Abstract: With the continuous expansion of the scale of power distribution and transformation network infrastructure,the information and communication traffic data generated by various types of security secondary equipment,edge terminal nodes,and business systems show significant differences in terms of format,protocol,and semantic characteristics.The main issues are reflected in the lack of a data normalization processing algorithm for multi-source heterogeneous network anomaly traffic detection in existing mitigation frameworks,the reliance of network attack behavior analysis on rule engines based on manual feature extraction,and the difficulty in determining effective network attack mitigation measures.To address the above pain points,a network attack mitigation framework based on normalized processing and TrafficLLM(NAMF-NPTLLM) is proposed.This framework includes four stages:feature selection,normalization processing,model fine-tuning,and generation of attack mitigation plans.Firstly,in the feature selection stage,an integrated voting mechanism is used to combine the results of various feature selection methods to accurately extract key features that have a significant impact on classification results.Secondly,the selected key features are norma-lized to generate a unified natural language token sequence expression,providing standardized input for the TrafficLLM model for traffic anomaly analysis in this network attack mitigation framework.Then,the TrafficLLM model is fine-tuned to enable it to understand prompt template instructions and learn the traffic patterns of attack behaviors.Finally,the fine-tuned large model is used for inference to generate attack mitigation instructions,allowing the framework to dynamically adjust network attack mitigation strategies based on the characteristics of attack behaviors.

Key words: Attack behavior detection, Data parsing, Normalization process, Integrated learning models, Cyber attack mitigation, Parameter fine tuning