WAAD: A Web Vulnerability Attack Behavior Identification Method Based on Large Language Model

With the increasing complexity of network threats and the continuous evolution of Web attacks, accurate identification of Web vulnerabilities becomes more and more important in network security protection. Although the existing research has made some progress in this field, however, there are still many challenges in the current complex environment: (1) Limited number of sample instances leads to insufficient understanding of the underlying features of the samples by the model; (2) The ability to identify unknown and complex attacks can not meet the task requirements in the increasingly complex network environment. For this reason, this paper proposes an attack behavior identification method WAAD for four types of vulnerabilities: SQL injection, XSS, path traversal and remote code execution. The method includes three parts: The first part is to build a multi-task prompt response template library, enrich the number of instances of fine-tuning data sets, and share the underlying features through multi-task learning. In the second part, a SGL fine-tuning method is proposed, which introduces a low-rank matrix initialization strategy based on singular value decomposition and combines the gradient update mechanism to improve the fine-tuning effect of the large language model (LLM) without significantly increasing the computational cost. The third part designs an agent-guided approach to enable the fine-tuned large language model to perform hierarchical reasoning, improving the identification capability for tasks that are challenging for greedy decoding strategies by constructing a chain-of-thought framework. The experimental results show that, compared with the existing identification methods, the accuracy of WAAD is improved to 97.9%, and when dealing with the latest unknown attacks, the accuracy is still maintained at 81.4%, showing a strong generalization ability.