Network security alarm processing method, device, equipment, medium and program product

Abstract

The embodiment of the invention discloses a network security alarm processing method and device, electronic equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring a network security alarm; retrieving a target text vector associated with the network security alarm in a network security domain knowledge base; the network security domain knowledge base is a knowledge base constructed after vectorization processing is carried out on network security corpora; based on the target text vector, an alarm vector corresponding to the network security alarm, a preset tool library and a large language model, obtaining a research and judgment processing flow of the network security alarm; executing a research and judgment processing flow; and obtaining a research and judgment result of the network security alarm based on an execution result of the research and judgment processing flow.

Description

Technical Field

[0001] The present invention relates to the technical field of network security alarm processing, and in particular to a network security alarm processing method, device, equipment, medium and program product. Background Art

[0002] In the related technology, the processing of network security alarms depends on manual judgment and analysis. Specifically, network security engineers need to obtain the judgment process of network security alarms based on their personal experience, and then manually find the data source related to network security alarms according to the judgment process. Finally, they conduct manual analysis on network security alarms and the found data sources to obtain the judgment results of network security alarms, such as whether the network security alarm is a false alarm, or whether the network security alarm is a malicious attack.

[0003] However, with the increasing complexity of network environments and the diversification of attack methods, the number of network security alarms has increased dramatically, and a more efficient network security alarm processing solution is needed. Summary of the invention

[0004] The embodiments of this specification provide a network security alarm processing method, apparatus, device, medium, and program product, which can improve the efficiency of network security alarm processing.

[0005] In a first aspect, an embodiment of the present specification provides a network security alarm processing method, including:

[0006] Get network security alerts;

[0007] Retrieving a target text vector associated with the network security alert in a network security domain knowledge base; the network security domain knowledge base is a knowledge base constructed after vectorization processing of network security corpus;

[0008] Based on the target text vector, the warning vector corresponding to the network security warning, the preset tool library and the large language model, the judgment and processing flow of the network security warning is obtained;

[0009] Execute the analysis and processing process;

[0010] Based on the execution results of the analysis and processing flow, the analysis results of the network security alarm are obtained.

[0011] In a possible implementation, based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model, the judgment and processing flow of the network security alarm is obtained, including:

[0012] The target text vector, warning vector, and tool description information corresponding to each network security assessment tool in the tool library are input into the large language model to obtain the analysis and processing flow of network security warnings.

[0013] In a possible implementation, the analysis and judgment process includes at least one analysis and judgment process step;

[0014] Execute the analysis and processing process, including:

[0015] Searching for network security data in the target data source configured in the research and judgment processing step through the target network security assessment tool configured in the research and judgment processing step;

[0016] Based on the execution results of the analysis and processing process, the analysis and judgment results of the network security alarm are obtained, including:

[0017] Input network security data into the large language model to obtain the analysis results of network security alerts.

[0018] In a possible implementation, the target network security assessment tool includes at least one of a threat intelligence query tool, a behavior log query tool, an asset query tool, a vulnerability scanning tool, and a network security domain knowledge base query tool.

[0019] In a possible implementation, the analysis result of the network security alarm includes at least one of verification information of the network security alarm, a level of the network security alarm, and recommended measures for the network security alarm.

[0020] In a possible implementation, the method further includes:

[0021] Perform vectorized word segmentation on the cybersecurity corpus to obtain at least two text segments;

[0022] Performing text vectorization processing on at least two text segments to obtain text vectors corresponding to the at least two text segments;

[0023] A network security domain knowledge base is constructed according to text vectors corresponding to at least two text segments.

[0024] In a possible implementation, the similarity between the target text vector and the warning vector satisfies a preset condition.

[0025] In a second aspect, an embodiment of the present specification provides a network security alarm processing device, including:

[0026] A first acquisition module is used to obtain network security alarms;

[0027] A retrieval module is used to retrieve a target text vector associated with a network security alert in a network security domain knowledge base; the network security domain knowledge base is a knowledge base constructed after vectorization processing of network security corpus;

[0028] The second acquisition module is used to acquire the analysis and processing flow of the network security alarm based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model;

[0029] An execution module is used to execute the analysis and processing process;

[0030] The third acquisition module is used to obtain the analysis and judgment results of the network security alarm based on the execution results of the analysis and judgment processing flow.

[0031] In a third aspect, an embodiment of this specification provides an electronic device, comprising: a processor and a memory; the memory stores a computer program, and when the computer program is executed by the processor, the method steps provided in the first aspect of the embodiment of this specification are implemented.

[0032] In a fourth aspect, an embodiment of the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps provided in the first aspect of the embodiment of the present specification.

[0033] In a fifth aspect, an embodiment of this specification provides a computer program product, including a computer program; when the above-mentioned computer program is executed by a processor, the method steps provided in the first aspect of the embodiment of this specification are implemented.

[0034] The above-mentioned network security alarm processing method, device, electronic device and computer storage medium automatically process network security alarms based on network security domain knowledge base, large language model and preset tool library, which ensures the accuracy of network security alarm processing and improves the efficiency of network security alarm processing. Specifically, by constructing a network security domain knowledge base through vectorization processing of network security corpus, it is convenient to quickly retrieve and match the target text vector related to the network security alarm; by obtaining the network security alarm, the target text vector associated with the network security alarm is retrieved in the network security domain knowledge base, which helps to understand and analyze the network security alarm more accurately and efficiently in the future; by automatically obtaining the judgment and processing flow of network security alarm based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model, the judgment and processing flow of network security alarm is improved, while the efficiency of obtaining the judgment and processing flow is improved, and the rationality of the judgment and processing flow is guaranteed; by executing the judgment and processing flow, and based on the execution result of the judgment and processing flow, the judgment and processing result of the network security alarm is obtained, which not only avoids the mistakes that may be caused by manually executing the judgment and processing flow, ensures the accuracy of the judgment and processing result, but also improves the efficiency of obtaining the judgment and processing result through automatic processing. The entire network security alarm processing process does not need to rely on manual research and analysis, achieving efficient and accurate network security alarm processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 A schematic diagram of an application environment of a network security alarm processing method provided by an exemplary embodiment of this specification;

[0037] Figure 2 A flowchart of a network security alarm processing method provided by an exemplary embodiment of this specification;

[0038] Figure 3 A flowchart of another network security alarm processing method provided by an exemplary embodiment of this specification;

[0039] Figure 4 A schematic diagram of the architecture of a network security alarm processing process provided by an exemplary embodiment of this specification;

[0040] Figure 5 A schematic diagram of the structure of a network security alarm processing device provided as an exemplary embodiment of this specification;

[0041] Figure 6 The present invention is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of this specification more clear, the following is a further detailed description of this specification in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain this specification and are not used to limit this specification.

[0043] In the description of this specification, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in this specification can be understood according to specific circumstances. In addition, in the description of this specification, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previously associated objects are in an "or" relationship.

[0044] The network security alarm processing method provided in the embodiments of this specification can be applied to Figure 1In the application environment shown. Among them, the terminal 10 communicates with the server 20 through the network. The data storage system can store the data that the server 20 needs to process. The data storage system can be integrated on the server 20, or it can be placed on the cloud or other network servers. Specifically, the server 20 constructs a network security domain knowledge base by vectorizing the network security corpus in advance, obtains network security alarms, retrieves the target text vector associated with the network security alarm in the network security domain knowledge base, and obtains the analysis and processing flow of the network security alarm based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model, executes the analysis and processing flow, and obtains the analysis and judgment result of the network security alarm based on the execution result of the analysis and processing flow.

[0045] The terminal 10 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The server 20 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0046] In one embodiment, Figure 2 As shown, a network security alarm processing method is provided, which is applied to Figure 1 The server 20 in the example is used as an example to illustrate, and the following steps are included:

[0047] S202: Obtain network security alerts.

[0048] The network security alarm includes information such as alarm time, alarm level, alarm type, alarm rule, alarm details, etc. The server 20 can process multiple network security alarms in parallel at the same time, for example, multiple network security alarms under the same subject can be processed in parallel, and the above-mentioned same subject can be but is not limited to the same IP (Internet Protocol) address, the same user account, etc.

[0049] Optionally, the server 20 obtains at least one network security alarm under the same IP address, treats each network security alarm as an independent processing task, and processes all the information contained in each network security alarm, such as the alarm time, alarm level, alarm type, alarm details, etc. It can be understood that the above-mentioned alarm time is the specific moment when the network security alarm occurs; the above-mentioned alarm level is used to characterize the severity or urgency of the network security alarm; the above-mentioned alarm type is the category of the network security alarm, which can be but is not limited to intrusion activities, virus activities, abnormal traffic, etc.; the above-mentioned alarm rule set triggers the specific rules or conditions of the alarm; the above-mentioned alarm details are the detailed information of the network security alarm, which includes but is not limited to the affected system, the IP address of the network security alarm, the port involved in the network security alarm, etc.

[0050] In this embodiment, the server obtains at least one network security alarm, treats each network security alarm as an independent processing task, and processes all information contained in each network security alarm, which can effectively improve the efficiency and comprehensiveness of network security alarm processing.

[0051] S204: Retrieve a target text vector associated with the network security alert in a network security domain knowledge base.

[0052] The network security domain knowledge base is a knowledge base constructed after vectorization processing of network security corpus. Network security corpus includes but is not limited to network security documents within an enterprise or organization, such as network security alarm processing specification documents, network security alarm response strategy documents, etc.

[0053] Optionally, the server 20 pre-acquires network security documents and other network security corpora within the enterprise, and then performs vectorized word segmentation, text vectorization, and vectorized storage on the network security corpora to build a network security domain knowledge base. After obtaining at least one network security alarm, the server 20 vectorizes each network security alarm to obtain an alarm vector corresponding to each network security alarm. Then the server 20 retrieves the target text vector with the highest similarity to the alarm vector corresponding to each network security alarm in the constructed network security domain knowledge base, that is, retrieves the target text vector associated with each network security alarm.

[0054] Specifically, the server 20 pre-acquires the enterprise's internal processing specification documents for network security alarms, as well as network security corpora such as response strategy documents for network security alarms, and then performs vectorized word segmentation, text vectorization and vectorized storage on the network security corpus to build a network security field knowledge base. After obtaining at least one network security alarm, the server 20 performs alarm text preprocessing and alarm text vectorization on each obtained network security alarm to obtain an alarm vector corresponding to each network security alarm. The server 20 then calculates the similarity between the alarm vector corresponding to each network security alarm and the text vector stored in the network security field knowledge base, and selects the text vector with the highest similarity to the alarm vector corresponding to each network security alarm as the target text vector.

[0055] In this embodiment, the server pre-builds a network security domain knowledge base and retrieves the target text vector with the highest similarity to the alarm vector corresponding to each network security alarm in the network security domain knowledge, so as to quickly obtain information such as alarm processing specifications and alarm response strategies associated with the network security alarm, thereby facilitating more efficient understanding and analysis of network security alarms in the future, thereby improving the accuracy and efficiency of network security alarm processing.

[0056] S206: Based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model, the analysis and processing flow of the network security alarm is obtained.

[0057] Among them, the pre-installed tool library includes a variety of network security assessment tools, including but not limited to threat intelligence query tools, behavior log query tools, asset query tools, vulnerability scanning tools, network security knowledge base query tools, etc.

[0058] Optionally, the server 20 synthesizes the retrieved target text vector, the alarm vector corresponding to the network security alarm, and the tool description information corresponding to each network security assessment tool in the tool library into prompts, and inputs them into the large language model, so that the large language model outputs the analysis and judgment processing flow corresponding to the network security alarm according to the above-mentioned input context information. It is worth noting that the analysis and judgment processing flow output by the large language model includes multiple analysis and judgment processing steps, and each analysis and judgment processing step is configured with a target network security assessment tool and a target data source for the target network security assessment tool to search, so that the server 20 can subsequently perform the analysis and judgment processing flow of the network security alarm according to the target network security assessment tool and the target data source configured in each analysis and judgment processing step. It can be understood that the target network security assessment tool configured in each analysis and judgment processing step can be at least one in the tool library, for example, it can be at least one of a threat intelligence query tool, a behavior log query tool, an asset query tool, a vulnerability scanning tool, and a network security domain knowledge base query tool. The vulnerability scanning tool can be, but is not limited to, a black box scanner, a white box scanner, etc.

[0059] In this embodiment, the server automatically obtains the analysis and processing flow of network security alarms based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model, which improves the efficiency of obtaining the analysis and judgment process while ensuring the rationality of the analysis and judgment process, thereby effectively improving the efficiency and accuracy of network security alarm processing.

[0060] S208: Execute the analysis and processing flow.

[0061] Optionally, the server 20 searches for network security data in the target data source configured in each analysis and judgment processing step through the target network security assessment tool configured in each analysis and judgment processing step, thereby executing the analysis and judgment processing flow corresponding to each network security alarm. Network security data refers to various information and data related to network security, which are used to verify and analyze network security alarms and provide a basis for subsequent acquisition of the analysis and judgment results of network security alarms. Network security data can be, but is not limited to, threat intelligence data, behavior log data, asset data, vulnerability data, alarm processing guide data, etc.

[0062] For example, assuming that the target network security assessment tool configured in a certain step in the analysis and judgment processing flow corresponding to a network security alarm is a behavior log query tool, and the target data source configured in this step is a system log file, then in the process of executing the analysis and judgment processing flow, the server 20 will call the behavior log query tool configured in this step, and search for behavior log data related to network security in the corresponding system log file, thereby completing the analysis and judgment processing of this step.

[0063] In this embodiment, the server automatically executes the analysis and judgment processing process, which not only avoids the errors that may be caused by manual execution of the analysis and judgment processing process, but also improves the execution efficiency of the analysis and judgment process by processing multiple network security alarms in parallel, thereby effectively improving the efficiency and accuracy of network security alarm processing.

[0064] S210: Based on the execution result of the analysis and processing flow, obtain the analysis result of the network security alarm.

[0065] Optionally, the server 20 inputs the network security data obtained by executing each analysis and judgment process into the large language model, so that the large language model outputs the analysis and judgment results of each network security alarm. The analysis and judgment results of the network security alarm include at least one of the verification information of the network security alarm, the level of the network security alarm and the recommended measures for the network security alarm.

[0066] It can be understood that the large language model is able to remember the contextual information input in the short term. Therefore, after the retrieved target text vector, the alarm vector corresponding to the network security alarm, and the tool description information corresponding to each network security assessment tool in the tool library are synthesized and input into the large language model, the present embodiment only needs to input the execution result of the analysis and judgment processing flow, that is, the network security data obtained after executing the analysis and judgment processing flow, into the large language model to obtain the analysis and judgment result of the network security alarm.

[0067] It is worth noting that this embodiment only describes a preferred implementation method. In actual application, the network security data obtained by executing the analysis and judgment processing flow, the retrieved target text vector, the alarm vector corresponding to the network security alarm, and the tool description information corresponding to each network security assessment tool in the tool library can also be synthesized and input into the large language model to obtain the analysis and judgment results of the network security alarm. This specification does not limit this in one or more embodiments.

[0068] In this embodiment, the server obtains the analysis and judgment results of the network security alarm based on the execution results of the analysis and judgment processing flow, which not only avoids the inaccurate analysis and judgment results that may be caused by personal subjective analysis, but also improves the efficiency of obtaining the analysis and judgment results through automated processing, thereby effectively improving the efficiency and accuracy of network security alarm processing.

[0069] The above network security alarm processing method obtains at least one network security alarm, regards each network security alarm as an independent processing task, and processes all the information contained in each network security alarm, thereby ensuring the comprehensiveness of network security alarm processing; by pre-building a network security domain knowledge base and retrieving the target text vector associated with each network security alarm in the network security domain knowledge, it is helpful to understand and analyze the network security alarm more accurately in the future; by automatically obtaining the analysis and judgment processing flow of the network security alarm based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model, while improving the efficiency of the analysis and judgment process, the rationality of the analysis and judgment process is guaranteed; by automatically executing the analysis and judgment processing flow, not only the errors that may be caused by manual execution of the analysis and judgment processing flow are avoided, but also the execution efficiency of the analysis and judgment process is improved by processing multiple network security alarms in parallel; by obtaining the analysis and judgment results of the network security alarm based on the execution results of the analysis and judgment processing flow, not only the inaccurate analysis and judgment results that may be caused by personal subjective analysis are avoided, but also the acquisition efficiency of the analysis and judgment results is improved through automated processing. The entire network security alarm processing process automatically processes network security alarms based on the network security domain knowledge base, large language model and preset tool library, achieving efficient, comprehensive and accurate network security alarm processing.

[0070] In one embodiment, Figure 3 As shown, another network security alarm processing method is provided, which is applied to Figure 1 The server 20 in the example is used as an example to illustrate, and the following steps are included:

[0071] S302: Perform vectorization processing on the network security corpus and build a knowledge base in the network security field.

[0072] The network security corpus includes but is not limited to network security documents within an enterprise or organization, such as network security alert processing specification documents, network security alert response strategy documents, etc. The network security domain knowledge base is a knowledge base constructed after vectorizing the network security corpus.

[0073] Optionally, the server 20 performs vectorized word segmentation on the network security corpus to obtain at least two text segments; performs text vectorization processing on the at least two text segments to obtain text vectors corresponding to the at least two text segments; and constructs a network security field knowledge base based on the text vectors corresponding to the at least two text segments.

[0074] Specifically, the server 20 pre-acquires network security documents within the enterprise or organization, such as network security alert processing specification documents, network security alert response strategy documents, etc., as network security corpus. After removing irrelevant characters, punctuation marks, stop words and other text preprocessing of the network security corpus, the server 20 vectorizes the network security corpus, divides it into multiple text segments, and then uses TF-IDF, Word2Vec and other text vectorization methods to convert the multiple text segments into multiple text vectors. After all text segments are converted into text vectors, a network security field knowledge base is constructed based on all the obtained text vectors.

[0075] In this embodiment, the server constructs a network security field knowledge base by vectorizing the network security corpus, which facilitates the subsequent rapid retrieval and matching of alarm processing specifications, alarm response strategies and other information associated with network security alarms, thereby facilitating the large language model to more efficiently understand and analyze network security alarms, thereby improving the accuracy and efficiency of network security alarm processing.

[0076] S304: Obtain network security alerts.

[0077] The network security alarm includes information such as alarm time, alarm level, alarm type, alarm rule, alarm details, etc. The server 20 can process multiple network security alarms in parallel at the same time, for example, multiple network security alarms under the same subject can be processed in parallel, and the above-mentioned same subject can be but is not limited to the same IP address, the same user account, etc.

[0078] Optionally, the server 20 obtains at least one network security alarm under the same user account, treats each network security alarm as an independent processing task, and processes all the information contained in each network security alarm, such as the alarm time, alarm level, alarm type, alarm details, etc. It can be understood that the above-mentioned alarm time is the specific moment when the network security alarm occurs; the above-mentioned alarm level is used to characterize the severity or urgency of the network security alarm; the above-mentioned alarm type is the category of the network security alarm, which can be but is not limited to intrusion activities, virus activities, abnormal traffic, etc.; the above-mentioned alarm rules are the specific rules or conditions for triggering the alarm; the above-mentioned alarm details are the detailed information of the network security alarm, which include but are not limited to the affected system, the IP address of the network security alarm, the port involved in the network security alarm, etc.

[0079] In this embodiment, the server obtains at least one network security alarm, treats each network security alarm as an independent processing task, and processes all information contained in each network security alarm, which can effectively improve the efficiency and comprehensiveness of network security alarm processing.

[0080] S306: Retrieve a target text vector associated with the network security alert in a network security domain knowledge base.

[0081] Among them, the similarity between the target text vector and the warning vector corresponding to the network security warning satisfies a preset condition. Specifically, the similarity between the target text vector and the warning vector corresponding to the network security warning satisfies the preset condition, which may be, but is not limited to, that the similarity between the target text vector and the warning vector reaches a preset similarity threshold, that the similarity between the target text vector and the warning vector is higher than the similarity between other text vectors and the warning vector stored in the network security domain knowledge base, etc.

[0082] Optionally, the server 20 calculates the cosine similarity between the warning vector corresponding to the network security warning and each text vector in the network security domain knowledge base, and selects the text vector with the highest cosine similarity with the warning vector as the target text vector.

[0083] It is worth noting that this embodiment only describes a preferred implementation, and the server 20 can also select a text vector whose cosine similarity with the alarm vector reaches a preset similarity threshold (such as 0.8) as the target text vector. In addition, the server 20 can also use other similarity calculation methods, such as Euclidean distance or Pearson correlation coefficient, to measure the similarity between the alarm vector corresponding to the network security alarm and each text vector in the network security field knowledge base. The embodiments of this specification do not limit the method of calculating similarity and the method of selecting the target text vector based on similarity.

[0084] In this embodiment, the server pre-builds a network security domain knowledge base and retrieves the target text vector associated with each network security alarm in the network security domain knowledge, so as to quickly obtain information such as alarm processing specifications and alarm response strategies associated with the network security alarm, thereby facilitating more efficient subsequent understanding and analysis of network security alarms, thereby improving the accuracy and efficiency of network security alarm processing.

[0085] S308: Input the target text vector, the warning vector, and the tool description information corresponding to each network security assessment tool in the tool library into the large language model to obtain the analysis and processing flow of the network security warning.

[0086] The tool description information corresponding to each network security assessment tool in the tool library is used to describe the function definition of the tool capability of each network security assessment tool, and the tool label used to identify each network security assessment tool.

[0087] Optionally, the server 20 synthesizes prompts including the target text vector retrieved from the network security field knowledge base, the alarm vector corresponding to the network security alarm, and the tool description information corresponding to each network security assessment tool in the tool library, and inputs them into the large language model, so that the large language model outputs the analysis and processing flow corresponding to the network security alarm based on the input context information.

[0088] It is worth noting that the analysis and judgment processing flow includes multiple analysis and judgment processing steps executed in a preset order, and each analysis and judgment processing step is configured with a target network security assessment tool and a target data source for the target network security assessment tool to search for network security data, so that the server 20 can subsequently call the target network security assessment tool to execute the analysis and judgment processing flow according to the analysis and judgment processing flow output by the large language model. It can be understood that the target network security assessment tool configured in each analysis and judgment processing step can be at least one in the tool library, for example, it can be at least one of a threat intelligence query tool, a behavior log query tool, an asset query tool, a vulnerability scanning tool, and a network security field knowledge base query tool. The vulnerability scanning tool can be, but is not limited to, a black box scanner, a white box scanner, etc.

[0089] In this embodiment, the server inputs the target text vector, the warning vector, and the tool description information corresponding to each network security assessment tool in the tool library into the large language model to obtain the judgment and processing flow of network security warnings. The entire process does not require manual judgment and analysis, which improves the efficiency of the judgment process acquisition while ensuring the rationality of the judgment process, thereby effectively improving the efficiency and accuracy of network security warning processing.

[0090] S310: Searching for network security data in the target data source configured in the analysis and judgment processing step through the target network security assessment tool configured in the analysis and judgment processing step.

[0091] Among them, the target network security assessment tool includes at least one of a threat intelligence query tool, a behavior log query tool, an asset query tool, a vulnerability scanning tool, and a network security domain knowledge base query tool. The vulnerability scanning tool may be, but is not limited to, a black box scanner, a white box scanner, etc. The target data source is a data source for the corresponding target network security assessment tool to search for network security data. Network security data refers to various information and data related to network security, which are used to verify and analyze network security alarms and provide a basis for subsequent acquisition of network security alarm research and judgment results. Network security data may be, but is not limited to, threat intelligence data, behavior log data, asset data, vulnerability data, alarm processing guide data, etc.

[0092] Exemplarily, assuming that the target network security assessment tool configured in a certain step in the analysis and judgment processing flow corresponding to a certain network security alarm is a network security domain knowledge base query tool, and the target data source configured in this step is a network security domain knowledge base, then in the process of executing the analysis and judgment processing flow, the server 20 will call the network security domain knowledge base query tool configured in this step, search for the alarm processing guide data in the network security domain knowledge base, and thus complete the analysis and judgment processing of this step.

[0093] In this embodiment, the server automatically searches for network security data in the target data source configured in the analysis and judgment processing step through the target network security assessment tool configured in the analysis and judgment processing step, and can provide valuable contextual information for the subsequent large language model to obtain the analysis and judgment results of the network security alarm, thereby effectively improving the efficiency and accuracy of network security alarm processing.

[0094] S312: Input the network security data into the large language model to obtain the analysis result of the network security alarm.

[0095] The analysis result of the network security alert includes at least one of the verification information of the network security alert, the level of the network security alert and the recommended measures for the network security alert.

[0096] Optionally, the server 20 inputs the threat intelligence data, behavior log data, asset data, vulnerability data, alarm processing guide data and other network security data searched after executing each analysis and processing step into the large language model, so that the large language model outputs the corresponding network security alarm analysis and judgment results, such as the verification information of the network security alarm, the level of the network security alarm, and the recommended measures for the network security alarm. It can be understood that the verification information of the network security alarm is used to determine whether each network security alarm is a real malicious attack or a false alarm; the level of the network security alarm is used to measure the severity or urgency of the network security alarm; the recommended measures for the network security alarm are used to provide specific response measures for the network security alarm, for example, it can be "update the code of the Web application, fix the SQL injection vulnerability", etc.

[0097] It is worth noting that if the large language model cannot determine that the network security alarm is a malicious attack based on the input network security data, that is, when the judgment result of the network security alarm cannot determine that the network security alarm is a malicious attack, the server 20 will further call the network security tool in the tool library to search for data in the target data source to update the network security data, and input the updated network security data into the large language model again to obtain the judgment result of the network security alarm, until the network security alarm judgment result output by the large language model can determine that the network security alarm is a malicious attack or reaches a preset number of iterations. It can be understood that when the preset number of iterations is reached, the judgment result of the network security alarm is determined to be a false alarm.

[0098] In this embodiment, the server inputs the network security data into the large language model to obtain the judgment result of the network security alarm. If the judgment result of the network security alarm cannot determine that the network security alarm is a malicious attack, the server will also call the network security tool in the tool library to further enrich the network security data until the judgment result output by the large language model can determine that the network security alarm is a malicious attack or reaches a preset number of iterations. The entire network security alarm judgment process avoids the situation where the judgment result may be inaccurate due to personal subjective analysis. Through the automated processing flow of repeated query verification, the efficiency and accuracy of obtaining the judgment result are improved, thereby effectively improving the efficiency and accuracy of network security alarm processing.

[0099] See also Figure 4, which is a schematic diagram of the architecture of the network security alarm processing process. After the server 20 obtains at least one network security alarm, it retrieves the target text vector associated with each network security alarm in the pre-built network security field knowledge base, and the similarity between the target text vector and the alarm vector corresponding to each network security alarm meets the preset conditions. Then the server 20 inputs the target text vector, the alarm vector, and the tool description information corresponding to each network security assessment tool in the tool library into the large language model to obtain the research and judgment processing flow of each network security alarm. And according to the configuration information of each research and judgment processing step in the research and judgment processing flow, the network security assessment tool in the tool library is called, such as the threat intelligence query tool, the behavior log query tool, the asset query tool, the vulnerability scanning tool, the network security field knowledge base query tool, etc., to obtain the execution results of each research and judgment processing flow (i.e., the searched network security data). Then the server 20 inputs the execution results of the research and judgment processing flow into the large language model to obtain the research and judgment results output by the large language model. If the judgment result cannot determine that the network security alarm is a malicious attack, the server 20 will further call the network security tool in the tool library to search for data in the target data source to update the network security data, and input the updated network security data into the large language model again to obtain the judgment result of the network security alarm, until the network security alarm judgment result output by the large language model can determine that the network security alarm is a malicious attack or reaches a preset number of iterations. If the preset number of iterations is reached, the judgment result of the network security alarm is determined to be a false alarm.

[0100] The above-mentioned network security alarm processing method constructs a network security field knowledge base by vectorizing the network security corpus, which is helpful for the subsequent rapid retrieval and matching of alarm processing specifications, alarm response strategies and other information associated with the network security alarm; by obtaining at least one network security alarm, each network security alarm is regarded as an independent processing task, and all the information contained in each network security alarm is processed, which can effectively improve the efficiency and comprehensiveness of network security alarm processing; by retrieving the target text vector associated with each network security alarm in the network security field knowledge, the alarm processing specifications, alarm response strategies and other information associated with the network security alarm can be quickly obtained, thereby facilitating more efficient understanding and analysis of network security alarms in the future; by inputting the target text vector, the alarm vector, and the tool description information corresponding to each network security assessment tool in the tool library into the large language model, the judgment and processing process of the network security alarm is obtained. The whole process does not require manual analysis, which improves the efficiency of the analysis process while ensuring the rationality of the analysis process; through the target network security assessment tool configured in the analysis and processing step, the network security data is automatically searched in the target data source configured in the analysis and processing step, which can provide valuable context information for the subsequent large language model to obtain the analysis results of the network security alarm; by inputting the network security data into the large language model, the analysis results of the network security alarm are obtained. When the analysis results of the network security alarm cannot determine that the network security alarm is a malicious attack, the network security tools in the tool library are called to further enrich the network security data until the analysis results output by the large language model can determine that the network security alarm is a malicious attack or the preset number of iterations is reached, avoiding the inaccurate analysis results that may be caused by personal subjective analysis, and improving the acquisition efficiency and accuracy of the analysis results. The entire network security alarm processing process, based on the network security field knowledge base, large language model and preset tool library to automatically process network security alarms, as well as the automatic processing process of repeated query and verification, realizes efficient, comprehensive and accurate network security alarm processing.

[0101] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0102] Based on the inventive concept of the above network security alarm processing method, Figure 5 As shown, the embodiment of this specification also provides a network security alarm processing device 500 for implementing the network security alarm processing method involved above. The network security alarm processing device 500 includes:

[0103] A first acquisition module 501 is used to acquire network security alarms;

[0104] A retrieval module 502 is used to retrieve a target text vector associated with a network security alert in a network security domain knowledge base; the network security domain knowledge base is a knowledge base constructed after vectorization processing of network security corpus;

[0105] The second acquisition module 503 is used to acquire the judgment and processing flow of the network security alarm based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model;

[0106] An execution module 504 is used to execute the analysis and judgment process;

[0107] The third acquisition module 505 is used to obtain the analysis result of the network security alarm based on the execution result of the analysis and processing flow.

[0108] In a possible implementation, the second acquisition module 503 is specifically used to input the target text vector, the warning vector, and the tool description information corresponding to each network security assessment tool in the tool library into the large language model to obtain the analysis and processing flow of the network security warning.

[0109] In one possible implementation, the analysis and judgment processing flow includes at least one analysis and judgment processing step; the execution module 504 is specifically used to search for network security data in the target data source configured in the analysis and judgment processing step through the target network security assessment tool configured in the analysis and judgment processing step; the third acquisition module 505 is specifically used to input the network security data into the large language model to obtain the analysis and judgment results of the network security alarm.

[0110] In a possible implementation, the target network security assessment tool includes at least one of a threat intelligence query tool, a behavior log query tool, an asset query tool, a vulnerability scanning tool, and a network security domain knowledge base query tool.

[0111] In a possible implementation, the analysis result of the network security alarm includes at least one of verification information of the network security alarm, a level of the network security alarm, and recommended measures for the network security alarm.

[0112] In one possible implementation, the network security alarm processing device 500 also includes a network security domain knowledge base construction module, which is used to perform vectorized word segmentation on the network security corpus to obtain at least two text fragments; perform text vectorization processing on the at least two text fragments to obtain text vectors corresponding to the at least two text fragments; and construct a network security domain knowledge base based on the text vectors corresponding to the at least two text fragments.

[0113] In a possible implementation, the similarity between the target text vector and the warning vector satisfies a preset condition.

[0114] Each module in the network security alarm processing device 500 can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0115] The embodiment of the present specification also provides an electronic device, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The electronic device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The application database of the electronic device is used to store network security alarm processing data. The input / output interface of the electronic device is used to exchange information between the processor and an external device. The communication interface of the electronic device is used to communicate with an external terminal through a network connection. The processor of the electronic device executes a computer program to implement a network security alarm processing method.

[0116] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of this specification, and does not constitute a limitation on the electronic device to which the scheme of this specification is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] In a possible implementation, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0118] Get network security alerts;

[0119] Retrieving a target text vector associated with the network security alert in a network security domain knowledge base; the network security domain knowledge base is a knowledge base constructed after vectorization processing of network security corpus;

[0120] Based on the target text vector, the warning vector corresponding to the network security warning, the preset tool library and the large language model, the judgment and processing flow of the network security warning is obtained;

[0121] Execute the analysis and processing process;

[0122] Based on the execution results of the analysis and processing flow, the analysis results of the network security alarm are obtained.

[0123] In one possible implementation, when the processor executes the computer program, it also implements the following steps: inputting the target text vector, the alarm vector, and the tool description information corresponding to each network security assessment tool in the tool library into the large language model to obtain the analysis and processing flow of the network security alarm.

[0124] In one possible implementation, the processor also implements the following steps when executing the computer program: searching for network security data in the target data source configured in the analysis and judgment processing step through the target network security assessment tool configured in the analysis and judgment processing step; inputting the network security data into the large language model to obtain the analysis and judgment results of the network security alarm.

[0125] In a possible implementation, the target network security assessment tool includes at least one of a threat intelligence query tool, a behavior log query tool, an asset query tool, a vulnerability scanning tool, and a network security domain knowledge base query tool.

[0126] In a possible implementation, the analysis result of the network security alarm includes at least one of verification information of the network security alarm, a level of the network security alarm, and recommended measures for the network security alarm.

[0127] In one possible implementation, the processor further implements the following steps when executing the computer program: performing vectorized word segmentation on the network security corpus to obtain at least two text segments; performing text vectorization processing on the at least two text segments to obtain text vectors corresponding to the at least two text segments; and constructing a network security field knowledge base based on the text vectors corresponding to the at least two text segments.

[0128] In a possible implementation, the similarity between the target text vector and the warning vector satisfies a preset condition.

[0129] The embodiments of this specification also provide a computer storage medium, in which instructions are stored, and when the instructions are executed on a computer or a processor, the computer or the processor executes one or more steps in the above embodiments. If the components of the above electronic device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer storage medium.

[0130] In a possible implementation, a computer storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0131] Get network security alerts;

[0132] Retrieve a target text vector associated with the network security alert in a network security domain knowledge base; the network security domain knowledge base is a knowledge base constructed after vectorization processing of network security corpus;

[0133] Based on the target text vector, the warning vector corresponding to the network security warning, the preset tool library and the large language model, the judgment and processing flow of the network security warning is obtained;

[0134] Execute the analysis and processing process;

[0135] Based on the execution results of the analysis and processing flow, the analysis results of the network security alarm are obtained.

[0136] In one possible implementation, when the computer program is executed by the processor, the following steps are also implemented: the target text vector, the alarm vector, and the tool description information corresponding to each network security assessment tool in the tool library are input into the large language model to obtain the analysis and processing flow of the network security alarm.

[0137] In one possible implementation, when the computer program is executed by the processor, the following steps are also implemented: searching for network security data in the target data source configured in the analysis and judgment processing step through the target network security assessment tool configured in the analysis and judgment processing step; inputting the network security data into the large language model to obtain the analysis and judgment results of the network security alarm.

[0138] In a possible implementation, the target network security assessment tool includes at least one of a threat intelligence query tool, a behavior log query tool, an asset query tool, a vulnerability scanning tool, and a network security domain knowledge base query tool.

[0139] In a possible implementation, the analysis result of the network security alarm includes at least one of verification information of the network security alarm, a level of the network security alarm, and recommended measures for the network security alarm.

[0140] In one possible implementation, when the computer program is executed by a processor, the following steps are also implemented: performing vectorized word segmentation on the network security corpus to obtain at least two text fragments; performing text vectorization processing on the at least two text fragments to obtain text vectors corresponding to the at least two text fragments; and constructing a network security field knowledge base based on the text vectors corresponding to the at least two text fragments.

[0141] In a possible implementation, the similarity between the target text vector and the warning vector satisfies a preset condition.

[0142] The embodiments of this specification also provide a computer program product, including a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0143] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of this specification is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0144] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0145] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Without departing from the design spirit of this specification, various modifications and improvements made to the technical solutions of this specification by ordinary technicians in this field should fall within the scope of protection determined by the claims.

[0146] The above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A network security alarm processing method, the method comprising: Get network security alerts; Retrieving a target text vector associated with the network security alert in a network security domain knowledge base; The network security domain knowledge base is a knowledge base constructed after vectorization processing of network security corpus; Based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model, the analysis and processing flow of the network security alarm is obtained; Execute the analysis and judgment processing flow; Based on the execution result of the analysis and judgment processing flow, the analysis and judgment result of the network security alarm is obtained.

2. The method according to claim 1, wherein the step of obtaining the analysis and processing flow of the network security alert based on the target text vector, the alert vector corresponding to the network security alert, a preset tool library and a large language model comprises: The target text vector, the warning vector, and the tool description information corresponding to each network security assessment tool in the tool library are input into the large language model to obtain the analysis and processing flow of the network security warning.

3. The method according to claim 1, wherein the analysis and judgment process comprises at least one analysis and judgment process step; The execution of the analysis and judgment process includes: Searching for network security data in the target data source configured in the analysis and judgment processing step through the target network security assessment tool configured in the analysis and judgment processing step; The obtaining the judgment result of the network security alarm based on the execution result of the judgment processing flow includes: The network security data is input into the large language model to obtain the analysis result of the network security alarm.

4. According to the method of claim 3, the target network security assessment tool includes at least one of a threat intelligence query tool, a behavior log query tool, an asset query tool, a vulnerability scanning tool, and a network security domain knowledge base query tool.

5. According to the method of claim 1, the analysis result of the network security alarm includes at least one of verification information of the network security alarm, the level of the network security alarm and recommended measures for the network security alarm.

6. The method of claim 1, further comprising: Performing vectorized word segmentation on the network security corpus to obtain at least two text segments; Performing text vectorization processing on the at least two text segments to obtain text vectors corresponding to the at least two text segments; A network security domain knowledge base is constructed according to the text vectors corresponding to the at least two text segments.

7. The method according to claim 1, wherein the similarity between the target text vector and the warning vector satisfies a preset condition.

8. A network security alarm processing device, the device comprising: A first acquisition module is used to obtain network security alarms; A retrieval module, used to retrieve a target text vector associated with the network security alert in a network security domain knowledge base; The network security domain knowledge base is a knowledge base constructed after vectorization processing of network security corpus; A second acquisition module is used to acquire the analysis and processing flow of the network security alarm based on the target text vector, the alarm vector corresponding to the network security alarm, the preset tool library and the large language model; An execution module, used to execute the analysis and judgment processing flow; The third acquisition module is used to obtain the analysis result of the network security alarm based on the execution result of the analysis and processing flow.

9. An electronic device, comprising: Processor and memory; The memory stores a computer program, and when the processor executes the computer program, the method steps of any one of claims 1 to 7 are implemented.

10. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images