信息网络安全

信息网络安全 ›› 2025, Vol. 25 ›› Issue (10): 1570-1578.doi: 10.3969/j.issn.1671-1122.2025.10.008

• 理论研究 • 上一篇    下一篇

大语言模型在安全托管服务误报处理中的应用研究

胡隆辉1, 宋虹1(), 王伟平1, 易佳2, 张智雄2   

  1. 1.中南大学计算机学院，长沙 410083
    2.深信服科技股份有限公司，深圳 518052
  • 收稿日期:2025-03-03 出版日期:2025-10-10 发布日期:2025-11-07
  • 通讯作者: 宋虹 E-mail:songhong@csu.edu.cn
  • 作者简介:胡隆辉（2001—），男，湖南，硕士研究生，主要研究方向为网络安全、大语言模型|宋虹（1975—），女，江西，副教授，博士，CCF会员，主要研究方向为操作系统安全、信息安全|王伟平（1969—），女，江苏，教授，博士，CCF会员，主要研究方向为网络安全态势感知、互联网应用安全|易佳（1992—），男，湖南，硕士，主要研究方向为大语言模型、AI智能体|张智雄（1993—），男，湖南，硕士，主要研究方向为大语言模型、网络安全
  • 基金资助:
    国家重点研发计划(2023YFB3106903)

Research on the Application of Large Language Model in False Positive Handling for Managed Security Services

HU Longhui1, SONG Hong1(), WANG Weiping1, YI Jia2, ZHANG Zhixiong2   

  1. 1. School of Computer Science and Engineering, Central South University, Changsha 410083, China
    2. Sangfor Technologies Co., Ltd., Shenzhen 518052, China
  • Received:2025-03-03 Online:2025-10-10 Published:2025-11-07
  • Contact: SONG Hong E-mail:songhong@csu.edu.cn

RichHTML

11

PDF (PC)

29

摘要：

当安全托管服务由第三方提供时，由于企业用户环境的差异，部署统一的安全检测规则容易导致误报，通常需要依据用户反馈人工调整安全规则或对告警进行过滤。针对该应用场景，文章提出一种自动化处理用户反馈语句的方法，从用户反馈语句中自动提取与告警过滤相关的语句，并将其转化为安全设备的告警过滤规则。该方法基于大语言模型，结合思维链和少样本提示两种提示工程技术，从用户反馈中提取告警过滤语句。为进一步提升提取效果，该方法使用GPT-4生成的安全语料对表现最优的ChatGLM4和Qwen1.5大语言模型进行指令微调。实验结果表明，该方法在告警过滤相关语句的提取任务中，Rouge-L指标达92.208%，可有效减少人工审核用户反馈的工作量。

关键词: 安全托管服务, 告警过滤, 大语言模型, 提示工程, 指令微调

Abstract:

When the managed security services are provided by a third party, the deployment of unified security detection rules frequently results in false positive alerts due to the difference of enterprise user networks. This typically requires manual adaption to security rules or alert filtering based on user’s feedback. The article proposed an automated method for processing user feedback for this application scenario. The method automatically extracted statements related to false positive alert filtering from user’s feedback and converted them into alert filtering rules for security devices. This method was based on a large language model, combined with two prompt engineering techniques of chain-of-thought and few-shot prompting, to extract alarm filtering statements from user feedback. To further enhanced the extraction performance, the secure corpus generated by GPT-4 was used to fine tune the instructions of the ChatGLM4 and Qwen1.5 language models with the best performance. The experimental results show that this method achieves a Rouge-L index of 92.208% in the task of extracting false alarm filtering related statements, which can effectively reduce the workload of manually reviewing user feedback.

Key words: managed security service, alarm filtering, large language model, prompt engineering, instruction fine-tuning

中图分类号: