《计算机应用》唯一官方网站 ›› 2026, Vol. 46 ›› Issue (4): 1158-1170.DOI: 10.11772/j.issn.1001-9081.2025040474

• 网络空间安全 • 上一篇    

基于大语言模型的视频监控网络安全漏洞分类框架

王晓宇1, 李欣1,2,3(), 薛迪1, 蒋章涛1, 王威1, 肖岩军4   

  1. 1.中国人民公安大学 信息网络安全学院,北京 100038
    2.安全防范技术与风险评估公安部重点实验室(中国人民公安大学),北京 100026
    3.中国人民公安大学 公安大数据战略研究中心,北京 100038
    4.绿盟科技集团股份有限公司,北京 100048
  • 收稿日期:2025-04-29 修回日期:2025-06-26 接受日期:2025-06-27 发布日期:2025-07-07 出版日期:2026-04-10
  • 通讯作者: 李欣
  • 作者简介:王晓宇(2001—),女,湖北宜昌人,硕士研究生,CCF会员,主要研究方向:大语言模型、风险评估
    薛迪(2001—),男,山东临沂人,硕士研究生,主要研究方向:视觉问答、大语言模型
    蒋章涛(2000—),男,山东济南人,硕士研究生,主要研究方向:网络安全、威胁检测
    王威(1981—),女,黑龙江伊春人,讲师,博士,主要研究方向:网络安全、恶意代码分析
    肖岩军(1981—),男,河南平顶山人,主要研究方向:态势感知、知识图谱、人工智能决策指挥。
  • 基金资助:
    国家重点研发计划项目(2022YFC3301101);CCF-绿盟科技“鲲鹏”科研基金资助项目(CCF-NSFOCUS202216)

Vulnerability classification framework for video surveillance network security based on large language models

Xiaoyu WANG1, Xin LI1,2,3(), Di XUE1, Zhangtao JIANG1, Wei WANG1, Yanjun XIAO4   

  1. 1.School of Information Network Security,People’s Public Security University of China,Beijing 100038,China
    2.Key Laboratory of Security Prevention Technology and Risk Assessment,Ministry of Public Security (People’s Public Security University of China),Beijing 100026,China
    3.Public Security Big Data Strategy Research Center,People’s Public Security University of China,Beijing 100038,China
    4.NSFOCUS Technologies Group Company Limited,Beijing 100048,China
  • Received:2025-04-29 Revised:2025-06-26 Accepted:2025-06-27 Online:2025-07-07 Published:2026-04-10
  • Contact: Xin LI
  • About author:WANG Xiaoyu, born in 2001, M. S. candidate. Her research interests include large language models, risk assessment.
    XUE Di, born in 2001, M. S. candidate. His research interests include visual question answering, large language models.
    JIANG Zhangtao, born in 2000, M. S. candidate. His research interests include cybersecurity, threat detection.
    WANG Wei, born in 1981, Ph. D., lecturer. Her research interests include cybersecurity, malware analysis.
    XIAO Yanjun, born in 1981. His research interests include situational awareness, knowledge graph, AI-based decision-making and command.
  • Supported by:
    National Key Research and Development Program of China(2022YFC3301101);CCF-NSFOCUS “Kunpeng” Research Fund(CCF-NSFOCUS202216)

摘要:

视频监控网络中的安全漏洞危害公共安全乃至国家安全。面对安全威胁的持续演进,亟须增量学习方法。然而,现有方法面临少样本学习性能不足、语义模糊致分类偏差和动态扩展新类别能力受限这三大挑战,导致增量学习分类失准。因此,提出一种基于大语言模型(LLM)的增量漏洞分类框架(IVCF-LLM),该框架采用数据分层与动态阈值机制确保训练数据的均衡分布。在顶层分类阶段,首先,利用GPT-4o深层分析环节从少量样本中提取漏洞触发词,生成高质量分类提示词模板(即技能);其次,优化关键词提取机制,精准识别漏洞成因和攻击方式,匹配出最优技能指导GPT-3.5 Turbo实现准确分类;最后,引入知识蒸馏技术实现新旧技能的无缝融合,完成类别增量学习(CIL)。在子层分类阶段,通过构建常见弱点列举(CWE)知识图谱,结合静态知识注入与动态关系检索策略,实现细粒度精准分类。实验结果表明,在自建数据集上,IVCF-LLM在准确率和马修斯相关系数(MCC)上分别达到了75.0%和65.7%,均优于文本到弱点映射(Text2Weak)、语义常见弱点列举预测器(SCP)和提示词分类等模型;在通用网络安全数据集上,IVCF-LLM的准确率显著优于SCP模型15.9个百分点,验证了所提框架的有效性和跨场景稳定性。

关键词: 视频监控网络安全, 漏洞分类, 大语言模型, 常见弱点列举, 类别增量学习

Abstract:

Security vulnerabilities in video surveillance networks endanger public safety and even national security. Facing the continuous evolution of security threats, incremental learning methods are needed urgently. However, the existing methods suffer from classification inaccuracies in incremental learning due to three major challenges: insufficient few-shot learning performance, classification bias caused by semantic ambiguity, and limited capability to expand new categories dynamically. Therefore, an Incremental Vulnerability Classification Framework based on Large Language Model (LLM) (IVCF-LLM) was proposed. In the framework, data stratification and a dynamic threshold mechanism were employed to ensure balanced distribution of training data. In the top-level classification stage, firstly, GPT-4o was used for deep analysis to extract vulnerability trigger words from few samples, thereby generating high-quality classification prompt templates, termed as “skills”; then, the keyword extraction mechanism was optimized to identify vulnerability causes and attack methods precisely, thereby matching the optimal skill to guide GPT-3.5 Turbo for accurate classification; finally, the knowledge distillation technology was introduced to achieve seamless fusion of old and new skills, thereby realizing Class-Incremental Learning (CIL). In the sub-layer classification stage, a Common Weakness Enumeration (CWE) knowledge graph was constructed, and static knowledge injection and dynamic relationship retrieval strategies were combined, so as to achieve fine-grained and precise classification. Experimental results demonstrate that on the self-built dataset, IVCF-LLM achieves accuracy of 75.0% and Matthews Correlation Coefficient (MCC) of 65.7%, outperforming models such as Text-to-Weakness mapping (Text2Weak), Semantic Common weakness enumeration Predictor (SCP), and prompt-based classification; on the general network security dataset, the accuracy of IVCF-LLM is significantly higher than that of SCP model by 15.9 percentage points, validating the proposed framework’s effectiveness and cross-scenario stability.

Key words: video surveillance network security, vulnerability classification, Large Language Model (LLM), Common Weakness Enumeration (CWE), Class-Incremental Learning (CIL)

中图分类号: