一种基于混合微调策略的虚拟机异常检测器增强方法

An Enhanced Method for Virtual Machine Anomaly Detectors Based on Hybrid Fine-Tuning Strategy

虚拟机异常检测器在现实场景中面临训练数据样本稀疏的问题,为了实现稀疏样本条件下的虚拟机异常精准检测,提出了一种基于混合微调策略的虚拟机检测增强方法。首先,利用大语言模型,基于提示工程,对收集的虚拟机逃逸样本进行提升工程,得到增强的样本。其次,采用LoRA和PreFix混合微调策略对收集的虚拟机逃逸样本进行提升工程,得到增强的样本。再次,利用增强样本对预训练大模型ChatGLM进行微调,生成一种专用于生成虚拟机逃逸数据的模型。最后,利用专用模型生成的样本扩充数据集,增强基于学习的虚拟机异常检测器。通过实验验证,此方法显著提升了虚拟机逃逸检测的准确性,并降低了误报率。

Virtual machine anomaly detectors are faced with the problem of sparse training data samples in realistic scenarios.To address the issue of accurate detection of virtual machine anomalies under such sparse sample conditions,a virtual machine detection enhancement method based on a hybrid fine-tuning strategy is proposed in this article.Firstly,by using a large language model and based on prompt engineering,the collected virtual machine(VM)escape samples are upgraded,and the enhanced samples are obtained..Secondly,a hybrid fine-tuning strategy combining LoRA and PreFix is are used to enhance the collected VM escape samples and obtain enhanced samples.Subsequently,the enhanced samples are utilized to fine-tune the pre-trained large model,ChatGLM,thereby creating a dedicated model for generating VM escape data.Finally,the generated samples from the dedicated model are leveraged to augment the dataset and improve the performance of the learning-based VM anomaly detector.Experimental validation demonstrates that this method achieves significant improvements in VM escape detection accuracy while effectively reducing the false alarm rate.