A secret network malicious traffic intelligent detection system based on a large language model

Abstract

The application relates to the technical field of network security, and discloses a secret network malicious traffic intelligent detection system based on a large language model, which comprises the following steps: generating secret session records; calculating homologous communication baselines; generating directional rhythm sequences; calculating protocol rarity, time sequence deviation, protocol time sequence evidence tension values and evidence anchor point sets; generating evidence gating abnormality quantities and structured security contexts; generating large language model constraint reasoning results after evidence checking; and outputting secret malicious traffic detection alarm messages. Through the detection mode of multi-dimensional evidence coupling, in combination with the correlation analysis of protocol features and time sequence behavior features, the application can distinguish normal rare business from real malicious communication, balance false positive rates and false negative rates, map global abnormal results to specific message positions through an evidence anchor point positioning mechanism, support manual review and audit traceability of security operation and maintenance personnel, and reduce cross-scene misjudgment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to an intelligent detection system for malicious traffic in dense networks based on a large language model. Background Technology

[0002] With the widespread adoption of encrypted network communication, encryption mechanisms such as Secure Transport Layer Session (SLS) and Fast User Datagram Internet Connection (FHT) are extensively used in various network services, including web browsing, instant messaging, and file transfer. The proportion of encrypted traffic in overall network traffic continues to rise. Traditional malicious traffic detection schemes based on application-layer plaintext payload feature matching suffer from significantly reduced detection capabilities due to the difficulty in reading encrypted payload content, making them ill-suited for the malicious traffic detection needs of today's fully encrypted network environments.

[0003] Existing malicious traffic detection schemes for encrypted networks are mainly divided into three categories: one is based on single-dimensional matching of visible protocol fingerprints, which compares known malicious fingerprints by features such as encryption suites and extended fields in the handshake phase; another is based on ordinary time-series feature detection, which judges anomalies by statistical features of packet length and time interval or sequence distance; and the third introduces a large language model to perform semantic analysis of traffic features, and identifies unknown malicious traffic through the generalization ability of the model.

[0004] Existing solutions have several shortcomings. Single-dimensional protocol fingerprint detection can only identify malicious traffic with known fingerprints, and its ability to distinguish between unknown variants and normal rare services is insufficient, making it difficult to balance false positives and false negatives. Ordinary time-series detection is easily affected by network fluctuations and out-of-order retransmissions, and the detection results are only global anomaly values, making it difficult to locate specific anomalies and support manual review. The introduction of large language models lacks input and output constraints, and the models are prone to generating judgment results that are detached from actual traffic evidence, resulting in insufficient credibility of the conclusions. Most solutions use a globally unified baseline, which does not distinguish the communication characteristics of different business scenarios, and cross-scenario comparisons are prone to misjudgment. Summary of the Invention

[0005] This invention provides an intelligent detection system for malicious traffic in dense networks based on a large language model, which solves the technical problems mentioned in the background.

[0006] This invention provides an intelligent detection system for malicious traffic in dense networks based on a large language model, comprising: The encrypted session record generation module performs session merging, visible protocol field parsing, length direction time series construction, and same-source communication grouping on undecrypted network packets, and outputs encrypted session records. The same-source communication baseline mapping module reads the legally archived historical secret state session records based on the same-source communication group identifier, and outputs the same-source communication baseline, the probability distribution of visible protocol tokens, and the rhythm prototype set. The directional rhythm sequence generation module generates a directional rhythm sequence based on the message length sequence, message direction sequence, and message arrival time sequence. The protocol timing evidence generation module calculates protocol rarity, timing deviation, protocol timing evidence tension value, and evidence anchor set based on the visible protocol token sequence, visible protocol token probability distribution, directional rhythm sequence, and rhythm prototype set. The evidence gating context generation module generates evidence gating anomalies and structured security contexts based on protocol sparseness, timing deviation, protocol timing evidence tension value, and evidence anchor set. The large language model constraint reasoning module generates the large language model constraint reasoning results after evidence verification, based on the structured security context and the local attack sample feature library. The alarm message generation module generates a dense malicious traffic detection alarm message based on the large language model constraint reasoning results after evidence verification, dense session records, evidence anchor point set, and evidence gating anomaly quantity.

[0007] The beneficial effects of this invention are as follows: This invention addresses the need for malicious traffic detection in dense network environments, achieving malicious traffic identification without decrypting application-layer payloads. Through a multi-dimensional evidence coupling detection method, combined with correlation analysis of protocol features and temporal behavioral features, it can distinguish between normal, rare services and genuine malicious communication, balancing false positive and false negative rates. Through an evidence anchoring mechanism, global anomaly results are mapped to specific packet locations, supporting manual review and audit tracing by security operations personnel. Through fixed input / output constraints and evidence verification mechanisms, the reasoning of large language models is limited to the scope of visible evidence, reducing unfounded speculation and improving the credibility of detection conclusions. Through a tiered and graded baseline matching mechanism, it adapts to the communication characteristics of different business scenarios, covering new business scenarios not yet covered by the baseline, reducing cross-scenario misjudgments. Attached Figure Description

[0008] Figure 1 This is a schematic diagram of a module of an intelligent detection system for malicious traffic in dense networks based on a large language model, according to the present invention. Figure 2 This is a box plot of the distribution of evidence-gated anomalies in this invention; Figure 3 This is a scatter plot of evidence coupling between protocol rarity and timing deviation in this invention. Detailed Implementation

[0009] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, features described in some examples may be combined in other examples.

[0010] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of the present invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in one or more embodiments of the present invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" indicate that the element or object preceding the term encompasses the elements or objects listed following the term and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0011] like Figures 1-3 As shown, a dense-state network malicious traffic intelligent detection system based on a large language model includes: The encrypted session record generation module performs session merging, visible protocol field parsing, length direction time series construction, and same-source communication grouping on undecrypted network packets, and outputs encrypted session records. The same-source communication baseline mapping module reads the legally archived historical secret state session records based on the same-source communication group identifier, and outputs the same-source communication baseline, the probability distribution of visible protocol tokens, and the rhythm prototype set. The directional rhythm sequence generation module generates a directional rhythm sequence based on the message length sequence, message direction sequence, and message arrival time sequence. The protocol timing evidence generation module calculates protocol rarity, timing deviation, protocol timing evidence tension value, and evidence anchor set based on the visible protocol token sequence, visible protocol token probability distribution, directional rhythm sequence, and rhythm prototype set. The evidence gating context generation module generates evidence gating anomalies and structured security contexts based on protocol sparseness, timing deviation, protocol timing evidence tension value, and evidence anchor set. The large language model constraint reasoning module generates the large language model constraint reasoning results after evidence verification, based on the structured security context and the local attack sample feature library. The alarm message generation module generates a dense malicious traffic detection alarm message based on the large language model constraint reasoning results after evidence verification, dense session records, evidence anchor point set, and evidence gating anomaly quantity.

[0012] In one embodiment of the present invention, the encrypted session record generation module performs the following steps: Step S101: Read the network packet collection time, address port, transmission protocol, packet length, visible protocol field and connection status field, and output the packet field set; Message length refers to the number of effective payload bytes in a single message. It is obtained by directly reading the total length field of the Internet layer and subtracting the lengths of the Internet header and transport layer header after capturing the message from the data link layer using a network probe. Step S102: Generate a secret session based on the message field set and session boundary merging rules; The preset idle end duration refers to a fixed duration parameter written into the configuration before the detection begins. It does not change with the single session detection result and is used to determine the idle end boundary of the session. For the Transmission Control Protocol (TCP) carrying secure transport layer session scenario, 30 seconds is preferred, and for the Fast User Datagram Internet connection scenario, 15 seconds is preferred. The value is based on the average packet interval statistics of normal business in the corresponding scenario. Step S103: Generate a visible protocol token sequence, a message length sequence, a message direction sequence, and a message arrival time sequence according to the message arrival order within the encrypted session; The message direction refers to the transmission direction of a single message. The source address of the first handshake message is identified by the session merging unit as the client address. If the source address of subsequent messages matches the client address, they are marked as client to server; otherwise, they are marked as server to client. The message arrival time refers to the time when a single message arrives at the network interface card (NIC), which is recorded by the network probe using the NIC's hardware timestamp when the message arrives. The number of packets involved in the detection refers to the total number of valid packets merged into the same session, which is obtained by the session merging unit counting packets one by one after deduplication and filtering of invalid packets. The visible protocol token sequence refers to a fixed-length token string obtained by encoding multiple visible protocol fields in a fixed order. An empty token with a value of 0 is written at the corresponding position of the unobservable field. The empty token is only used as a placeholder for the unobservable field and does not represent that the corresponding protocol field actually takes a value of 0. Step S104: Generate a same-origin communication packet identifier based on the internal host role, peer network affiliation, destination port, and transport protocol family; The same-source communication packet identifier is a string used to identify the communication environment to which a session belongs. It is obtained by concatenating the internal host role label, the peer network affiliation label, the destination port value, and the transport protocol family label in a fixed order. Step S105: Combine the visible protocol token sequence, message length sequence, message direction sequence, message arrival time sequence, and same-source communication packet identifier into a secret session record.

[0013] A secret session record refers to a structured evidence set of a single session, which is encapsulated in a fixed structure by visible protocol token sequences, message length sequences, message direction sequences, message arrival time sequences, and same-source communication packet identifiers. The session boundary merging rules are as follows: For secure transport layer sessions carried by Transmission Control Protocol, the session boundary is determined by a 5-tuple, handshake start point, end message, reset message, or preset idle end length; for Fast User Datagram Internet connection sessions carried by User Datagram Protocol, the session boundary is determined by a 5-tuple, visible connection identifier, and preset idle end length.

[0014] The visible protocol token sequence is obtained by encoding the visible protocol version, visible cipher suite identifier, visible extension type, visible field of Fast User Datagram Internet Connection Long Header, visible frame type of connection establishment phase, visible certificate status, visible session recovery flag, and round-trip number of connection establishment phase in a fixed order; when a field is not observable, an empty token is written in the corresponding position.

[0015] Specifically, the formula for composing the encrypted session record is as follows: in, For closed session Secret session records, For closed session The visible protocol token sequence, The message length sequence for a closed session. For closed session The message direction sequence, For closed session The message arrival time sequence, For closed session The identifier of the same source communication group.

[0016] Specifically, the formulas for composing the message length sequence, message direction sequence, and message arrival time sequence are as follows: in, For closed session The Middle The length of each message participating in the detection. For closed session The Middle The message direction of each message involved in the detection. For closed session The Middle The arrival time of each message participating in the detection. For closed session The number of messages involved in the detection For closed session The sequence number of the detection message in the middle.

[0017] Specifically, the formula for determining the message direction is as follows: Indicates a secret session The Middle Each participating detection message travels from the client to the server; Indicates a secret session The Middle Each detection message travels from the server to the client; in, For closed session The Middle The message direction of each message involved in the detection. For closed session The sequence number of the detection message in the middle.

[0018] The identifier of the same-origin communication packet is determined by the internal host role, peer network affiliation, destination port, and transport protocol family.

[0019] Furthermore, the encoding order of the visible protocol token sequence is as follows: visible protocol version occupies 2 token bits, visible cipher suite identifier occupies 4 token bits, visible extension type occupies 8 token bits, visible field of Fast User Datagram Internet Connection Long Header occupies 3 token bits, visible frame type during connection establishment occupies 5 token bits, visible certificate status occupies 1 token bit, visible session recovery flag occupies 1 token bit, and round trip count during connection establishment occupies 1 token bit. Each field is mapped to a consecutive integer encoding in ascending order of protocol field values, and the length of all token bits is fixed. During the generation of same-source communication packet identifiers, internal host roles are determined based on the deployment location of collection points and asset ledger mapping. Collection points deployed at the server front end mark local hosts as servers, collection points deployed at the terminal egress mark local hosts as terminals, collection points deployed at proxy nodes mark local hosts as proxies, and collection points deployed at gateway locations mark local hosts as gateways. When it is difficult to determine the identity, the host is marked as unknown. The peer network affiliation is obtained by querying the routing table and the autonomous system number mapping library. The storage format is a string concatenated in a fixed order, and matching is performed by comparing the entire string. The idle threshold setting for session boundary merging can cover most normal business intervals, avoiding misjudging normal business waiting intervals as session termination. For example, in a certain instant messaging scenario, the maximum normal message sending interval is 12 seconds. Setting an idle threshold of 15 seconds can cover more than 99% of normal business intervals, preventing the waiting process for a reply from being mistakenly split into multiple sessions.

[0020] Understandably, without decrypting the application layer payload, only the directly observable protocol field codes from the transport layer and handshake phases are extracted, and unobservable fields are marked with null tokens. All detection calculations are based on the actual observable field values, ensuring that the detection evidence comes from observable network facts from the input source. The scope of subsequent baseline comparisons is limited by using same-source communication packet identifiers, avoiding comparing traffic from different scenarios on the same baseline and reducing false alarms caused by cross-scenario baseline mismatches.

[0021] In one embodiment of the present invention, the same-source communication baseline mapping module performs the following steps: Step S201: Based on the same-source communication group identifier, read the legally archived historical secret state session records from the baseline library and output the same-source communication baseline; The same-source communication baseline refers to the set of historical sessions used as a normal reference. It consists of historical secret session records that match the packet identifier and have been archived for legality. Secret session records are generated by collecting normal business traffic of the corresponding packet for more than 7 consecutive days. After manual review to confirm that there is no malicious traffic, the records are archived and stored in the baseline library. The records are automatically re-collected and updated every 30 days. Step S202: Count the number of times the visible protocol token sequence appears in the same source communication baseline, the total number of historical secret state sessions, and the number of different visible protocol token sequences, and generate the probability distribution of visible protocol tokens by combining the smoothing coefficient; The smoothing coefficient is a probability calculation parameter fixed before deployment, used to smooth the probability distribution of visible protocol tokens. The preferred value is 0.01, which is based on the general empirical value of Laplace smoothing. It can avoid the probability of a protocol token sequence that has never appeared being 0 without significantly changing the original probability distribution. The visible protocol token probability distribution refers to the probability of occurrence of each visible protocol token sequence within the baseline. It is calculated by counting the occurrence times of all visible protocol token sequences in the corresponding group within the baseline library and then smoothing the probability of occurrence of each sequence using a smoothing coefficient. Step S203: Process the historical dense-state session records within the same source communication baseline according to the directional rhythm sequence generation method, and output the historical directional rhythm sequence; Step S204: Perform the center sample extraction process on the historical directional rhythm sequence and output the rhythm prototype set; The rhythm prototype set refers to the set of sample sequences that represent normal rhythm patterns. After generating directional rhythm sequences from all historical sessions within the baseline, representative samples are selected through the central sample extraction process. The number of prototypes is preferably 3 to 5. For baseline sessions below 100,000, 3 prototypes are selected, and for sessions above 100,000, 5 prototypes are selected, which can cover the main normal rhythm patterns. Step S205: Output the visible protocol token probability distribution and rhythm prototype set.

[0022] The same-source communication baseline consists of historical secret session records that match the same-source communication packet identifier and have been legally archived. When there is no completely identical packet, the same-source communication baseline is matched in a fixed downgrading order. The first downgrading retains the transport protocol family, destination port, and peer network affiliation while relaxing the internal host role. The second downgrading retains the transport protocol family and destination port while relaxing the peer network affiliation. The third downgrading retains the transport protocol family while relaxing the destination port. If there is still no usable baseline after downgrading, the baseline is output as unavailable.

[0023] Specifically, the formula for calculating the probability distribution of the visible protocol token is as follows: in, Identifier for same-source communication packets The corresponding visible protocol token probability distribution, Identifier for same-source communication packets The corresponding protocol token sequence is visible in the same-source communication baseline. The number of times it appears, Identifier for same-source communication packets The total number of historical close-state sessions in the corresponding same-source communication baseline, Identifier for same-source communication packets The number of different visible protocol token sequences in the corresponding same-source communication baseline. For smoothing coefficients, This is a sequence of candidate visible protocol tokens.

[0024] The rhythm prototype set is obtained by generating historical directional rhythm sequences from historical dense-state session records in the same communication baseline using a directional rhythm sequence generation method, and then extracting them through a central sample extraction process; the central sample extraction process is a pre-fixed process within the same deployment instance.

[0025] Furthermore, baseline matching prioritizes finding baselines that are completely identical to the source communication packet identifier of the current session. If the matching result is empty, the first level of degradation is performed, retaining the three dimensions of transport protocol family, destination port, and peer network affiliation, while relaxing the internal host role dimension for matching. If there is still no matching result, the second level of degradation is performed, retaining the two dimensions of transport protocol family and destination port, while relaxing the peer network affiliation dimension for matching. If there is still no matching result, the third level of degradation is performed, retaining only the transport protocol family dimension for matching. If there is still no matching baseline after the three levels of degradation, a baseline unavailable status is output. This status is marked in the structured security context and passed to the corresponding module for calculation, without directly classifying the session as abnormal. The available methods for center sample extraction include cluster center nearest sample extraction, minimum average distance sample extraction, and manually verified center sample extraction. One extraction method is selected during initialization for the same deployment instance. All historical sessions entering the baseline database must undergo two layers of verification. The first layer is automatic verification, where the session detection result is normal and there are no corresponding alarm records. The second layer is manual sampling review, where 1% of the sessions are randomly selected for manual verification. Only after confirming that there are no hidden malicious communication characteristics can they be archived. For example, during the baseline construction process of port 443 of an office network, 120,000 alarm-free session records were automatically screened out. After manual sampling of 1,200 records for review and confirmation that they were all normal web page access and office business traffic, these sessions were archived into the baseline database.

[0026] Understandably, a three-level fixed-order descending matching mechanism is used to obtain the baseline. The matching dimensions are gradually broadened according to a preset order. This covers new services, new ports, and other scenarios not yet covered by the baseline, while ensuring the similarity of the baseline environment, thus avoiding interruptions in the detection process due to missing baselines. By adding smoothed probability statistics and extracting central samples, a stable set of rhythm prototypes is obtained, avoiding zero-probability problems and interference from discrete samples, thereby improving the stability of subsequent anomaly calculations.

[0027] In one embodiment of the present invention, the directional rhythm sequence generation module performs the following steps: Step S301: Read the message length sequence, message direction sequence, and message arrival time sequence; Step S302: Generate a direction switching indication based on the direction of adjacent messages; The direction switching indicator is a parameter that indicates whether the direction of adjacent packets has changed. The direction of the current packet is compared with that of the previous packet. If the directions are different, the value is 1; if the directions are the same, the value is 0. Step S303: According to the order of the second to the last message participating in the detection, combine the message direction, message length into a logarithmic term and the direction switching time into a logarithmic term, and output the directional rhythm single-point value. The length normalization adjustment coefficient refers to the length normalization parameter fixed before deployment, which is used to normalize the packet byte length to a dimensionless logarithmic term. The preferred value is 1500 for Internet egress scenarios and 9000 for data center giant frame scenarios. The value is based on the maximum effective payload length of a typical single packet in the corresponding scenario. The time normalization adjustment coefficient refers to the time normalization parameter fixed before deployment, which is used to normalize the arrival time interval of adjacent packets to a dimensionless logarithmic term. The preferred value is 1 for local area network scenarios and 2 for transoceanic long latency scenarios. The value is based on the typical network round-trip time order of the corresponding scenario. The direction switching time adjustment coefficient is a fixed time item weight parameter before deployment, used to control the contribution weight of the direction switching delay item to the rhythm value. It is preferred to be 0.5 for bidirectional interaction scenarios and 0.2 for scenarios with unidirectional transmission as the main mode. The value is based on the experience of balancing the weights of the direction switching time item and the length item. Directional rhythm single-point value refers to the dimensionless rhythm value corresponding to a single message, which is calculated by combining the message direction mark, the normalized message length term, and the normalized time term during direction switching. Step S304: Connect the directional rhythm single-point values ​​according to the message arrival order, and output the directional rhythm sequence.

[0028] Directed rhythm sequence refers to the rhythm value sequence of a single session, which is formed by arranging the directional rhythm single-point values ​​corresponding to all messages in the session starting from the second message in the order of message arrival. Specifically, the formula for determining the direction switching indicator is as follows: in, For closed session The Middle A direction switching indicator for each participating detection message. For closed session The Middle The message direction of each message involved in the detection. For closed session The Middle The message direction of each message involved in the detection. For closed session The number of messages involved in the detection For closed session The sequence numbers of the messages that participated in the detection, from the second to the last.

[0029] Specifically, the formula for calculating the single-point value of the directional rhythm is as follows: in, For closed session The Middle A single-point value of the directional rhythm involved in the detection message. For closed session The Middle The message direction of each message involved in the detection. For closed session The Middle The length of each message participating in the detection. This is the length normalization adjustment coefficient. This is the direction switching time adjustment coefficient. For closed session The Middle A direction switching indicator for each participating detection message. For closed session The Middle The arrival time of each message participating in the detection. For closed session The Middle The arrival time of each message participating in the detection. This is the time-normalized adjustment coefficient. For closed session The number of messages involved in the detection is for closed-state sessions. The sequence numbers of the messages that participated in the detection, from the second to the last.

[0030] Specifically, the formula for composing the directional rhythm sequence is as follows: in, For closed session Directed rhythmic sequences, For closed session The second single-point value of the directional rhythm in the detection message. For closed session The directional rhythm single-point value of the last message participating in the detection. For closed session The number of messages involved in the detection.

[0031] Furthermore, the three adjustment coefficients are tuned according to the network and service characteristics of the deployment scenario, adapting to the packet length, network latency, and interaction characteristics of different scenarios. For example, in a local area network (LAN) egress deployment scenario, the average round-trip time is 20 milliseconds. When the time normalization adjustment coefficient is set to 1, the normalized value corresponding to a 100-millisecond directional switching interval is approximately 0.095, preventing the dominant rhythm value from being too large. The directional rhythm sequence is generated starting from the second packet of the session. The first packet does not participate in the calculation of the single-point value of the directional rhythm. This processing method avoids the problem of difficulty in calculating the time interval when the first packet has no preceding packet. At the same time, the sequence starting position of all sessions is consistent, and there will be no fixed deviation in the comparison of subsequent sequences due to different processing methods of the first item.

[0032] Understandably, when constructing directional rhythmic sequences, introducing a message interval time term only at the location where the communication direction of adjacent messages switches can effectively filter out normal rate fluctuations in scenarios such as unidirectional large file transfers and video streaming, while retaining the rhythmic characteristics of direction switching that reflect the communication interaction logic. Mapping features of different physical dimensions to a unified dimensionless space eliminates the impact of dimensional differences on subsequent temporal distance calculations, enabling sessions of different lengths and intervals to be compared on the same scale.

[0033] In one embodiment of the present invention, the protocol timing evidence generation module performs the following steps: Step S401: Calculate the protocol rarity based on the currently visible protocol token probability and the probability lower bound stability term; The probability lower bound stability term refers to the computational stability parameter that is fixed before deployment. It is used to avoid computational anomalies when taking the logarithm with zero probability. The preferred value is 0.00001, and the value is based on the lower limit of the precision of floating-point calculation. Protocol rarity is a parameter that characterizes how rare a protocol combination is. It is obtained by taking the negative logarithm of the probability of the same source baseline corresponding to the visible protocol token sequence in the current session. The larger the value, the less common the protocol combination is in the same source environment. Step S402: Calculate the normalized dynamic time warping distance based on the directional rhythm sequence and the rhythm prototype set, take the minimum distance, and output the temporal deviation and the nearest rhythm prototype; Normalized dynamic time warping distance is a parameter that characterizes the degree of difference between two rhythm sequences. It is calculated through the optimal matching path and normalizes the difference of matching points to avoid a single point dominating the total distance. Temporal deviation is a parameter that characterizes the degree to which the current session rhythm deviates from the normal pattern. It is obtained by calculating the normalized dynamic time warping distance between the current session directional rhythm sequence and each prototype sequence in the rhythm prototype set, and taking the minimum value among them. The most recent rhythm prototype refers to the normal prototype sequence that is most similar to the current session rhythm. It is recorded during the calculation of the timing deviation, and the position of the prototype message corresponding to each current message on the optimal matching path is also recorded. Step S403: Count the direction switching indication and output the number of direction switching; The direction switching count refers to the total number of direction switchings within a session, which is obtained by accumulating the direction switching indications of all packets within the session packet by packet. Step S404: Calculate the protocol timing evidence tension value based on protocol rarity, timing deviation, number of direction switching, number of participating detection messages, and adjustment parameters; The tension stability term refers to the calculated stability parameter that is fixed before deployment. It is used to avoid the anomaly that the denominator is zero when calculating tension. The preferred value is 0.01, and the value is based on the numerical stability experience of anomaly degree calculation. The counting stability term refers to the calculation stability parameter fixed before deployment, which is used to avoid abnormal denominators when calculating the counting ratio. The preferred value is 1, and the value is based on the smoothing experience of counting ratio calculation. The direction switching tension adjustment coefficient refers to the tension weight parameter fixed before deployment, which controls the amplification of the tension value by the direction switching ratio. The preferred value is 0.3, and the value is based on the abnormal weight experience of the direction switching characteristics. The protocol timing evidence tension value refers to an intermediate anomaly parameter that couples multiple types of anomaly features. It is calculated by combining protocol rarity, timing deviation, evidence inconsistency degree, and direction switching ratio. Step S405: Obtain the set of evidence anchors by sorting the directional rhythm sequence according to the normalized deviation between the most recent rhythm prototype.

[0034] The number of anchor points refers to the number of evidence anchor points selected before deployment. For ordinary scenarios, 5 is preferred, and for core high-audit scenarios, 10 is preferred. The value is based on the typical evidence viewing requirements of security audit. The evidence anchor set refers to the set of message sequence numbers that contribute the most to the anomaly. The relative difference in amplitude between each message and the matching point corresponding to the most recent rhythm prototype is calculated, and the messages are sorted from largest to smallest. The first fixed number of message sequence numbers are selected to form the set. Specifically, the formula for calculating the protocol rarity is as follows: in, For closed session The rarity of the protocol, Identifier for same-source communication packets The visible protocol token sequence in the corresponding visible protocol token probability distribution The probability value, For closed session The visible protocol token sequence, This is a stable term with a lower probability bound.

[0035] Specifically, the formula for calculating the normalized dynamic time warp distance is as follows: in, Directed rhythmic sequences and directional rhythm sequence Normalized dynamic time-warped distance between them Directed rhythmic sequences The Middle Single-point value of directional rhythm Directed rhythmic sequences The Middle Single-point value of directional rhythm To find the regularization matching path that minimizes the cumulative regularization cost, To normalize the number of matching pairs in the matching path, This is a set of matching pairs in the regularized matching path.

[0036] Specifically, the formula for calculating the timing deviation is as follows: in, For closed session The time series deviation, For closed session Directed rhythmic sequences, Identifier for same-source communication packets The corresponding set of rhythm prototypes, For rhythm prototype set One of the rhythm prototypes; the most recent rhythm prototype is the rhythm prototype that obtains the minimum normalized dynamic time warp distance in the calculation of time deviation.

[0037] Specifically, the formula for calculating the number of direction switching times is as follows: in, For closed session Number of direction switching times For closed session The Middle A direction switching indicator for each participating detection message. For closed session The number of messages involved in the detection For closed session The sequence numbers of the messages that participated in the detection, from the second to the last.

[0038] The adjustment parameters consist of a tension stability term, a count stability term, and a direction switching tension adjustment coefficient.

[0039] Specifically, the formula for calculating the protocol timing evidence tension value is as follows: in, For closed session The temporal evidence tension value of the agreement. For closed session The rarity of the protocol, For closed session The time series deviation, For tension stability, For closed session Number of direction switching times For closed session The number of messages involved in the detection For counting stable terms, This is the tension adjustment coefficient for direction switching.

[0040] Specifically, the formula for calculating the set of evidence anchor points is as follows: in, For closed session The set of anchor points of evidence This indicates that a fixed number of samples are taken from largest to smallest based on the normalized deviation values ​​within the parentheses. Message sequence number, For closed session The sequence numbers of the messages that participated in the detection, from the second to the last. For closed session The number of messages involved in the detection For closed session The Middle A single-point value of the directional rhythm involved in the detection message. Identifier for same-source communication packets Corresponding to the most recent rhythm prototype and the first A single point value of the rhythm prototype involved in the detection message matching. To regulate the matching path and the dense session The The sequence number of the rhythm prototype that participates in the detection message matching. This represents the number of anchor points.

[0041] Furthermore, the matching path for the normalized dynamic time warping distance starts from the first point pair of the two sequences and ends at the last point pair. Each step of the path is only allowed to move in three directions: right, down, and down-right. Skipping any point in the sequence is not permitted. The path with the smallest cumulative difference is selected as the optimal matching path. When selecting evidence anchor points, all message deviation values ​​are calculated and sorted in descending order. If multiple messages have the same deviation value, they are selected by sorting them in ascending order of message sequence number. Anchor points correspond to the abnormal protocol fields or message length positions. The protocol-time evidence tension value calculation includes three coupling factors, reflecting the overall anomaly strength, the degree of inconsistency between the protocol and time-series evidence, and the frequency of anomaly interactions. The three factors are multiplied sequentially to obtain the final tension value, with each factor corresponding to a type of anomaly feature.

[0042] Understandably, constructing a multi-factor coupled protocol timing evidence tension value, while integrating multi-dimensional anomaly features, avoids inflated anomaly values ​​caused by misjudgments based on a single dimension, thus achieving coupled anomaly measurement of protocol features and timing behavior. By using a set of evidence anchor points, the global timing deviation results are located to specific message sequence numbers, transforming abstract anomaly values ​​into locatable and verifiable concrete evidence, supporting security auditing and tracing needs.

[0043] In one embodiment of the present invention, the evidence gating context generation module performs the following steps: Step S501: The protocol rarity, timing deviation, and protocol timing evidence tension value are combined to form an evidence vector; The evidence quantity vector is a three-dimensional vector containing three types of abnormal evidence values, which is obtained by arranging the three values ​​of protocol rarity, time series deviation, and protocol time series evidence tension value in a fixed order; Step S502: Calculate the evidence gating weight based on the evidence quantity vector and the gating temperature adjustment coefficient; The gating temperature adjustment coefficient refers to the gating weight parameter fixed before deployment, which is used to control the concentration of evidence gating weight. The preferred value is 1, and the value is based on experience regarding the concentration of gating weight. Evidence gating weight refers to the fusion weight corresponding to the three types of evidence. It is obtained by performing a temperature-adjusted exponential operation on each value in the evidence quantity vector, and then dividing each exponential value by the sum of all exponential values. The sum of the three weights is 1. Step S503: Sum the evidence quantity vector and the evidence gating weights by weighting them, and output the evidence gating anomaly quantity. Evidence gating anomaly refers to the unified anomaly value after fusion, which is obtained by multiplying the three evidence values ​​by their corresponding gating weights and then adding the three products together. Step S504: Generate a structured security context based on the evidence quantity vector, evidence gating weight, evidence gating anomaly quantity, evidence anchor set, and visible protocol field name.

[0044] Structured security context refers to the structured text input to the language model, which is strictly encapsulated by seven categories of content according to a fixed template: evidence quantity vector, gating weight, evidence gating anomaly quantity, evidence anchor set, visible protocol field name, matched rhythm prototype number, and anchor corresponding deviation value. Specifically, the formula for composing the evidence vector is as follows: in, For closed session The vector of evidence, For closed session The first evidence component in the evidence vector. For closed session The second evidence component in the evidence vector. For closed session The third evidence component in the evidence vector. For closed session The rarity of the protocol, For closed session The time series deviation, For closed session The tension value of the protocol's timing evidence.

[0045] Specifically, the formula for calculating the evidence gating weight is as follows: in, For closed session The Individual evidence gating weights, For closed session The first in the evidence vector Each piece of evidence constitutes a component. This is the gate temperature regulation coefficient. For closed session The first in the evidence vector Each piece of evidence constitutes a component. For the summation index, This is the serial number of the evidence component.

[0046] Specifically, the formula for calculating the evidence gating anomaly is as follows: in, For closed session Evidence gating anomalies For closed session The Individual evidence gating weights, For closed session The first in the evidence vector Each piece of evidence constitutes a component. This is the serial number of the evidence component.

[0047] The structured security context consists of an evidence quantity vector, evidence gating weights, evidence gating anomalies, a set of evidence anchors, visible protocol field names, the matched rhythm prototype number, and the normalized deviation value corresponding to the evidence anchor.

[0048] Furthermore, during the tuning of the gating temperature adjustment coefficient, the three evidence values ​​of all normal sessions within the corresponding group baseline are first collected. The distribution range of the three evidence values ​​is statistically analyzed, and the parameter values ​​are adjusted so that the highest dimension weight of normal sessions does not exceed 0.6, and the highest dimension weight of abnormal sessions is not lower than 0.4. For example, in an office network baseline, the three evidence values ​​of normal sessions are all between 0 and 1. When the gating temperature adjustment coefficient is set to 1, the weight distribution of the three dimensions of normal sessions is even, and the abnormal dimension of abnormal sessions can obtain a higher weight. All fields in the structured security context are arranged in a fixed key-value pair format, and the key name of each field is fixed. Fields are not arbitrarily added or removed, ensuring the consistency of the context structure of the input language model.

[0049] Understandably, an exponentially normalized gating mechanism is used to calculate the weights for multi-dimensional evidence fusion. The weight magnitude is positively correlated with the degree of anomaly in the corresponding dimension, achieving adaptive allocation of evidence weights without the need for manually setting fixed weights, thus adapting to the distribution of anomaly features in different scenarios. This fuses multi-dimensional heterogeneous evidence into a single, sortable anomaly quantity while preserving the complete structured evidence context, defining clear input boundaries for subsequent language model inference.

[0050] In one embodiment of the present invention, the large language model constrained inference module performs the following steps: Step S601: Construct a fixed set of input fields based on the structured security context; The fixed input field set refers to the fixed model input range configuration before deployment, which includes all field names that are allowed to be input into the language model. Fields not in the set must not be input into the model. Step S602: Retrieve the local attack sample feature library based on the visible protocol token sequence, evidence anchor set, protocol rarity, temporal deviation, and protocol temporal evidence tension value, and output structured entries; The local attack sample feature library is a structured library that stores known attack features. It collects confirmed malicious encrypted traffic samples, extracts the visible protocol token pattern, rhythm deviation pattern, common anchor point pattern, attack type, and handling suggestions for each sample, organizes them into structured entries and stores them in the local library, and updates the new attack samples every 15 days. Step S603: Input the fixed set of input fields, the structured entries and the fixed set of output keys into the large language model and output the constraint reasoning result of the large language model. A fixed set of output keys refers to a fixed configuration of the model's output range before deployment. It includes all key names that the model is allowed to output and the allowed value range for each key. The model must not output keys outside the set. Step S604: Perform evidence verification on the large language model constraint inference result and output the large language model constraint inference result after evidence verification.

[0051] The large language model constrained inference result refers to the verified structured output of the model. The structured security context and the retrieved attack sample features are input into the language model, and the model output is then corrected through evidence verification. The fixed input field set consists of the visible protocol token sequence, the desensitized group description of the same source communication group identifier, the protocol rarity, the timing deviation, the protocol timing evidence tension value, the evidence gating anomaly, the evidence anchor set, the matched rhythm prototype number, the normalized deviation value corresponding to the evidence anchor, the direction switching indication value corresponding to the evidence anchor, and the baseline unavailable state.

[0052] The structured entries in the local attack sample feature library consist of attack type, visible protocol token pattern, directional rhythm deviation pattern, evidence anchor morphology, and handling suggestions; the structured entries serve as input evidence for the large language model's constrained reasoning results.

[0053] The fixed output key set consists of detection category, anomaly cause, attack path summary, handling priority, and evidence anchor reference; the detection category can be normal encrypted session, suspicious encrypted session, or malicious encrypted session.

[0054] The evidence verification specifically involves: when the cause of the anomaly does not reference a visible protocol field name, protocol rarity, timing deviation, protocol timing evidence tension value, evidence gating anomaly amount, or evidence anchor set, replacing the cause of the anomaly with insufficient evidence; when the attack path summary contains a network entity outside the fixed input field set, deleting the network entity or replacing it with an unknown entity; and when the evidence anchor reference does not belong to the evidence anchor set and does not belong to a visible protocol field name, marking the evidence anchor reference as an invalid reference.

[0055] Furthermore, during the local attack sample feature library retrieval process, the protocol token matching degree is the proportion of identical token bits to the total number of token bits, the rhythm pattern matching degree is the normalized correlation coefficient of the rhythm sequence, and the comprehensive matching degree is the weighted sum of the two, each accounting for 0.5. The top 3 samples with a comprehensive matching degree higher than 0.7 are selected as the retrieval results, and only the attack type, typical characteristics, and handling suggestions of these samples are input into the model. Evidence verification includes three rules: checking whether the anomaly cause cites evidence existing in the context, replacing anomaly causes that do not cite any evidence with insufficient evidence; deleting network entities not mentioned in the context of the attack path summary; and checking whether the evidence anchor reference belongs to the evidence anchor set, marking invalid anchor references as invalid. During the generation of de-identified packet descriptions, the role, network affiliation, port, and protocol family in the same-source communication packet identifier are mapped to corresponding labels, and sensitive information such as specific Internet Protocol addresses, hostnames, and organization names are not output to avoid locating specific hosts.

[0056] Understandably, employing dual constraints of fixed input fields and fixed output keys, combined with a deterministic evidence verification mechanism, limits the inference range of large language models. The model can only perform anomalous attribution based on observable input evidence, reducing the risk of the model generating illusions or fabricating attack facts. Multi-layered evidence verification filters out out-of-range outputs and unfounded speculations, ensuring that inference results are based on observable communication evidence and improving the credibility of detection conclusions.

[0057] In one embodiment of the present invention, the alarm message generation module performs the following steps: Step S701: Bind the large language model constraint reasoning result after evidence verification and the session identifier field corresponding to the closed session; Step S702: Generate an evidence anchor summary and processing priority based on the detection category, evidence anchor set, visible protocol field name, direction switching indication corresponding to the evidence anchor, normalized deviation sorting, and evidence gating anomaly quantity. The handling priority refers to the handling level parameter of the alarm. First, the basic priority is determined according to the detection category. Then, the priority level is adjusted by combining the quantile interval of the evidence gated anomaly in the distribution of the anomaly in the same source baseline. The final level is selected from four fixed levels: low, medium, high, and emergency. An evidence anchor summary is a brief description of an evidence anchor, which is obtained by organizing the message sequence number, corresponding visible protocol field name, direction switching status, and normalized deviation value of each evidence anchor in a fixed format. Step S703: Generate a verification field based on the session identifier field, detection category, evidence anchor summary, and processing priority; The verification field refers to the digest value used for alarm integrity verification. It is obtained by concatenating the contents of the four parts: session identifier, detection category, evidence anchor digest, and handling priority, and then calculating a fixed-length digest value using a hash algorithm recognized by the State Cryptography Administration. Step S704: Encapsulate a secret malicious traffic detection alarm message.

[0058] The encrypted malicious traffic detection alarm message refers to the standardized detection result message finally output by the system, which is strictly encapsulated in a fixed format by four parts: detection category, evidence anchor point summary, handling priority, and verification fields. The encrypted malicious traffic detection alarm message consists of a detection category, evidence anchor point summary, processing priority, and verification fields; the detection category is derived from the large language model constraint reasoning result after evidence verification.

[0059] The evidence anchor summary consists of the message sequence number in the evidence anchor set, the corresponding visible protocol field name, the direction switching indication corresponding to the evidence anchor, and the normalized deviation sorting; the processing priority is taken from a fixed level set and is jointly determined by the detection category and the same source communication baseline quantile interval where the evidence gating anomaly is located.

[0060] The verification field is written after calculating the summary value from the session identifier field, detection category, evidence anchor summary, and handling priority; the encrypted malicious traffic detection alarm message is sent to the alarm queue or security audit interface.

[0061] Furthermore, the statistical sample for determining the quantile values ​​is the evidence-gated anomaly volume of normal sessions within the corresponding group baseline for 7 consecutive days. The anomalies are sorted in ascending order, and the corresponding quantile is used as the threshold. Anomalies below the 90th quantile correspond to low priority, those between the 90th and 99th quantiles to medium priority, those between the 99th and 99.9th quantiles to high priority, and those above the 99.9th quantile to emergency priority. Sessions with a normal detection category have a priority no higher than low, while sessions with a malicious detection category and an anomaly volume above the 99th quantile have a priority no lower than high. When auditors review alarms, they recalculate the hash values ​​of the four core fields and compare them with the verification fields in the message. If they match, the alarm content has not been tampered with; if they do not match, the alarm content is at risk of tampering, and the original traffic needs to be re-verified.

[0062] Understandably, adopting a priority determination mechanism that links detection categories with anomaly quantification intervals, and combining quantified anomalies to determine priorities, reduces the likelihood of models misjudging high-priority alarms. Alarm messages include verification fields, allowing for content integrity verification during the audit phase. The final alarm message contains only necessary detection results and verifiable evidence summaries, excluding the original payload content and sensitive information, reducing privacy risks and meeting compliance and security audit requirements.

[0063] like Figure 2 As shown, this figure compares the distribution differences in evidence-gated anomalies among normal, suspicious, and malicious dense sessions. The bins represent the central tendency and dispersion of each category of samples, while the overlaid scatter plots show the actual values ​​for individual sessions. Normal sessions are mainly concentrated in the low anomaly range, suspicious sessions are in the intermediate transition zone, and malicious sessions generally move towards the high anomaly region, with more high-priority and urgent samples appearing. This figure illustrates that evidence-gated anomalies can clearly distinguish dense network traffic of different risk levels.

[0064] like Figure 3 As shown, this figure illustrates the joint relationship between protocol sparseness and temporal deviation, and observes their contribution to detection category classification. Normal dense sessions are mostly distributed in regions with low protocol sparseness and low temporal deviation, suspicious sessions are located in the intermediate transition region, and malicious sessions are concentrated in high-risk areas where both indicators increase simultaneously. The size of the dots reflects the tension value of protocol temporal evidence; malicious samples typically have larger tension values, indicating that protocol anomalies and rhythm anomalies show a trend of enhanced coupling in high-risk traffic.

[0065] It should be noted that this system can be deployed in bypass mode at enterprise network egress points, data center boundaries, campus network gateways, etc. It obtains network packets through traffic mirroring without the need for link concatenation or traffic decryption, and will not affect existing network services. Before the system goes live, it first collects normal business traffic for the corresponding scenario for 7 consecutive days. After automatic verification and manual sampling review, a common-source communication baseline is generated. After going live, it continuously performs session merging, anomaly calculation, and constraint inference on the mirrored traffic. The normal baseline is automatically updated every 30 days, and the local attack sample feature library is updated synchronously every 15 days.

[0066] The system ultimately outputs standardized encrypted malicious traffic detection alarm messages, including detection category, evidence anchor summary, handling priority, and verification fields. For example, in an enterprise perimeter deployment scenario, the system detects protocol and timing anomalies in an encrypted session on port 443 initiated by a terminal. Through constraint reasoning, it determines that this is malicious tunnel communication, with an urgent handling priority. After the alarm is pushed to the security operations platform, operations personnel can quickly locate the abnormal packet location and view visible features through the evidence anchor to complete the verification. The verification fields can verify that the alarm content has not been tampered with.

[0067] The content of this embodiment has been described above, but this embodiment is not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms based on the guidance of this embodiment, all of which are within the protection scope of this embodiment.

Claims

1. A system for intelligent detection of malicious traffic in dense networks based on a large language model, characterized in that, The system includes: The encrypted session record generation module performs session merging, visible protocol field parsing, length direction time series construction, and same-source communication grouping on undecrypted network packets, and outputs encrypted session records. The same-source communication baseline mapping module reads the legally archived historical secret state session records based on the same-source communication group identifier, and outputs the same-source communication baseline, the probability distribution of visible protocol tokens, and the rhythm prototype set. The directional rhythm sequence generation module generates a directional rhythm sequence based on the message length sequence, message direction sequence, and message arrival time sequence. The protocol timing evidence generation module calculates protocol rarity, timing deviation, protocol timing evidence tension value, and evidence anchor set based on the visible protocol token sequence, visible protocol token probability distribution, directional rhythm sequence, and rhythm prototype set. The evidence gating context generation module generates evidence gating anomalies and structured security contexts based on protocol sparseness, timing deviation, protocol timing evidence tension value, and evidence anchor set. The large language model constraint reasoning module generates the large language model constraint reasoning results after evidence verification, based on the structured security context and the local attack sample feature library. The alarm message generation module generates a dense malicious traffic detection alarm message based on the large language model constraint reasoning results after evidence verification, dense session records, evidence anchor point set, and evidence gating anomaly quantity.

2. The intelligent detection system for malicious traffic in dense networks based on a large language model according to claim 1, characterized in that, The encrypted session record generation module performs the following steps: The system reads and collects network packets, including the collection time, address and port, transmission protocol, packet length, visible protocol field, and connection status field, and outputs a set of packet fields. Generate a secret session based on the message field set and session boundary merging rules; Generate a visible protocol token sequence, a message length sequence, a message direction sequence, and a message arrival time sequence according to the message arrival order within the encrypted session; Generate same-origin communication packet identifiers based on internal host roles, peer network affiliation, destination port, and transport protocol family; The visible protocol token sequence, message length sequence, message direction sequence, message arrival time sequence, and same-source communication packet identifier are combined into a secret session record.

3. The intelligent detection system for malicious traffic in dense networks based on a large language model according to claim 1, characterized in that, The same-source communication baseline mapping module performs the following steps: Based on the same-source communication packet identifier, retrieve the legally archived historical secret-state session records from the baseline library and output the same-source communication baseline; The probability distribution of visible protocol tokens is generated by statistically analyzing the number of occurrences of visible protocol token sequences, the total number of historical encrypted sessions, and the number of different visible protocol token sequences in the same source communication baseline, combined with a smoothing coefficient. The historical dense-state session records within the same source communication baseline are processed according to the directional rhythm sequence generation method, and the historical directional rhythm sequence is output. Perform a center sample extraction process on the historical directional rhythm sequence and output a set of rhythm prototypes.

4. The intelligent detection system for malicious traffic in dense networks based on a large language model according to claim 1, characterized in that, The directional rhythm sequence generation module performs the following steps: Read the message length sequence, message direction sequence, and message arrival time sequence; Generate a direction switching indicator based on the direction of adjacent messages; According to the order of the second to the last message participating in the detection, the message direction, message length and direction switching time are grouped into a logarithmic number and combined into a logarithmic number to output the directional rhythm single-point value; Connect the directional rhythm single-point values ​​according to the order of message arrival, and output the directional rhythm sequence.

5. The intelligent detection system for malicious traffic in dense networks based on a large language model according to claim 1, characterized in that, The protocol timing evidence generation module performs the following steps: The protocol rarity is calculated based on the currently visible protocol token probabilities and the probability lower bound stability term; Calculate the normalized dynamic time warping distance based on the directional rhythm sequence and the set of rhythm prototypes, take the minimum distance, and output the temporal deviation and the nearest rhythm prototype. Statistical analysis of direction switching indication, outputting the number of direction switching; The protocol timing evidence tension value is calculated based on protocol rarity, timing deviation, number of direction switching, number of participating detection messages, and adjustment parameters. The set of evidence anchors is obtained by sorting the directional rhythm sequence with the normalized deviation between it and the nearest rhythm prototype.

6. The intelligent detection system for malicious traffic in dense networks based on a large language model according to claim 1, characterized in that, The evidence gating context generation module performs the following steps: The protocol sparseness, timing deviation, and protocol timing evidence tension value are combined to form an evidence quantity vector; The evidence gating weights are calculated based on the evidence quantity vector and the gating temperature adjustment coefficient. The evidence quantity vector and the evidence gating weights are weighted and summed to output the evidence gating anomaly quantity. A structured security context is generated based on the evidence quantity vector, evidence gating weight, evidence gating anomaly quantity, evidence anchor set, and visible protocol field name.

7. The intelligent detection system for malicious traffic in dense networks based on a large language model according to claim 1, characterized in that, The large language model constraint inference module performs the following steps: Construct a fixed set of input fields based on the structured security context; Based on the visible protocol token sequence, evidence anchor set, protocol sparseness, temporal deviation, and protocol temporal evidence tension value, the local attack sample feature library is retrieved, and structured entries are output. The fixed set of input fields, structured entries, and fixed set of output keys are fed into the large language model, and the large language model's constrained inference results are output. Perform evidence verification on the constraint inference results of the large language model, and output the large language model constraint inference results after evidence verification.

8. The intelligent detection system for malicious traffic in dense networks based on a large language model according to claim 1, characterized in that, The alarm message generation module performs the following steps: Bind the large language model constraint inference results after evidence verification and the session identifier field corresponding to the closed session; Based on the detection category, evidence anchor set, visible protocol field name, direction switching indication corresponding to the evidence anchor, normalized deviation sorting, and evidence gating anomaly, generate evidence anchor summary and handling priority; Generate verification fields based on session identifier field, detection category, evidence anchor point summary and processing priority; encapsulate encrypted malicious traffic detection alarm message.

Images