Security event association analysis and question and answer method and system and medium

Abstract

The invention provides a security event association analysis and question answering method and system and a medium, and the method comprises the following steps: context-aware query completion: receiving an original query input by a user, obtaining a historical record of a current dialogue, and forming a context enhanced query according to the original query and the historical record of the current dialogue; dynamic task identification: outputting a prediction task model according to the context enhancement query in combination with a dynamic task identification strategy; multi-dimensional retrieval: performing multi-dimensional retrieval on the prediction task model to obtain a final knowledge context packet; and knowledge-driven response generation: generating a knowledge-driven response based on the knowledge context packet, and outputting a final security analysis report after the generated content passes verification. According to the method, efficient, accurate and explainable intelligent association analysis of the multi-source heterogeneous security data is realized by constructing a multi-dimensional knowledge base, designing a dynamic task recognition mechanism and realizing context-aware query completion.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security and artificial intelligence, and particularly relates to a security event correlation analysis and question answering method and system based on hybrid retrieval enhanced generation and a medium. BACKGROUND

[0002] Currently, large language models (LLMs) have shown great potential in the field of network security, especially in the automation and intelligentization of security operations centers (SOCs). In order to make up for the inherent knowledge limitations and "hallucination" problems of LLMs, retrieval-augmented generation (RAG) technology has become one of the mainstream solutions. RAG combines LLMs with external knowledge bases and dynamically retrieves relevant information during reasoning, thereby improving the accuracy, reliability and timeliness of answers. In the SOC scenario, RAG is widely used in tasks such as threat intelligence query, attack path analysis, log summary generation, etc. For example, existing research has constructed a RAG-based question answering system for network attack investigation and attribution, which has significantly improved the factual accuracy and provided evidence traceability. Other works attempt to combine RAG with network security knowledge graphs to enhance the understanding and reasoning ability of complex attack chains. In addition, some research explores the integration of RAG into SIEM platforms to realize the summary and response suggestion generation of multi-source alerts. These works collectively show that RAG is a key bridge connecting LLMs and massive security data, laying the foundation for AI-driven SOC automation.

[0003] Although RAG technology has achieved preliminary success in SOCs, existing solutions still have significant technical bottlenecks in dealing with complex and heterogeneous security data in the real world, making it difficult to meet the needs of efficient, accurate and explainable threat correlation analysis. The specific problems are as follows: Firstly, existing RAG frameworks rely heavily on static or semi-static external threat intelligence databases such as MITRE ATT&CK, CVE database, etc., and fail to effectively integrate and utilize structured operational data generated internally by SOCs, reflecting real-time security posture (such as IDS / EDR alerts, access logs, honeypot interaction records). This "information silo" phenomenon leads to a lack of contextual support in analysis, making it difficult to conduct in-depth correlation across sources and time, limiting the comprehensive judgment ability of advanced persistent threats (APTs).

[0004] Secondly, for the retrieval of internal structured alarm data, the existing method mainly adopts semantic retrieval based on vector similarity. However, this method faces three major challenges when processing security logs: (1) Insufficient real-time performance: The massive and high-concurrency alarm stream requires that the vector index must be updated in real time, but under the scale of millions or even tens of millions of records, this is almost impossible in terms of computing cost and engineering implementation; (2) Semantic dilution: There are a large number of repetitive patterns in security logs (such as failed login attempts by different IPs), which lead to high semantic similarity in vector space, but the actual meaning is quite different, and the retrieval results are easy to confuse the key differences; (3) Missing relationship semantics: Traditional vector embedding is "flattened" and cannot express complex logic such as foreign key association between database tables, multi-table JOIN, nested filtering conditions, etc., so it cannot support cross-table aggregation, statistical analysis and other advanced queries, greatly limiting the depth and flexibility of analysis.

[0005] Finally, the existing solutions generally lack a fine understanding and guidance of user query intent. Most systems treat all queries equally and directly perform a wide-area search, which is not only inefficient but also easily introduces irrelevant information, reducing the relevance of the final output. At the same time, although existing Text-to-SQL methods can handle structured queries, they usually require a large amount of labeled data for fine-tuning, which consumes a lot of resources, and are sensitive to database schema changes, making it difficult to adapt to the rapid evolution of data sources and attack patterns in the SOC environment.

[0006] In summary, the existing technology has obvious shortcomings in the fusion of internal and external data, the processing of complex relationships of structured logs, and the understanding of analyst intent. Therefore, the present application aims to propose a security event correlation analysis and question answering method based on hybrid retrieval enhancement generation for the SOC scenario, which effectively solves the above problems by constructing a multi-dimensional knowledge base, designing a dynamic task recognition mechanism, and implementing context-aware query completion, and realizes efficient, accurate, and interpretable intelligent correlation analysis of multi-source heterogeneous security data. SUMMARY

[0007] The main purpose of the present application is to provide a security event correlation analysis and question answering method based on hybrid retrieval enhancement generation, which comprises the following steps: Step S1, context-aware query completion: receiving a user's original query and obtaining the history record of the current dialogue, forming a context-enhanced query according to the original query and the history record of the current dialogue; Step S2, dynamic task recognition: outputting a predicted task model according to the context-enhanced query and combining a dynamic task recognition strategy; Step S3, multi-dimensional retrieval: performing multi-dimensional retrieval on the predicted task model to obtain a final knowledge context package; Step S4, Knowledge-driven response generation: Generate a knowledge-driven response based on the knowledge context package, and output the final security analysis report after the generated content passes verification.

[0008] A further technical solution of the present invention is that step S1 includes: Step S101: Receive the original query input by the user. And retrieve the history of the current conversation. , including the previous A complete "query-response" pair represents the entire dialogue history from the first round to the current round, used for context understanding and reference resolution; Indicates the first The query statement issued by the user, that is, the question or instruction that the user puts on the system; Indicates the system's response to the first... Round query The generated response content, namely the analysis results, suggestions, or explanations returned by the system, This indicates that the current number is the [number]. A round of dialogue, meaning that in the current message, the one being processed is the first round. Secondary user input; Step S102: Extract a set of key entities from the historical records, including IP addresses, domain names, file hashes, and usernames; Step S103: If the current query lacks a specific entity, the most relevant entity is matched from the key entity set and injected into the query to form a context-enhanced query.

[0009] A further technical solution of the present invention is that step S2 includes: Step S201, Build a task template library It is a set of problem templates and corresponding task types, formally represented as: ,in An abstract problem template. For the corresponding task type, A predefined set of task types; a template for each question. This is achieved by abstracting real analyst queries. Specifically, the method involves identifying and replacing specific entities in the original question with standardized placeholders. The predefined set of task types includes: honeypot events, threat intelligence matching, security alert analysis, access behavior auditing, and threat correlation and response. Step S202: Complete the query with context. Generate its vector representation using a lightweight embedding model. Its dimensions are predetermined by the embedded model architecture adopted; Step S203, Calculate With all templates Cosine similarity: ; S204: Before selection The most similar template And according to its corresponding task tag Constructing the prompt context This is used to guide large language models in task classification. S205: Query With the context of the prompt Input a large language model, perform a zero-shot classification task, and output the predicted task type. : .

[0010] A further technical solution of the present invention is that step S3 includes: Step S31, structured data retrieval, specifically includes: S311: Based on the task type output by the task identification module Identify the set of data sources associated with this task. It is a structured and secure database; S312: Enhance queries from context The key target entities were parsed out, including IP address, domain name, user account, file hash, and process name; S313: In the selected set of data sources Execute context-aware aggregate queries Extract multidimensional information related to the target entity and generate a structured summary. The content includes: attack timeline, list of related security events, and statistical metrics. The output format is as follows: ; in, This represents a structured evidence summary extracted and aggregated from the internal security database. This represents a context-aware aggregate function that supports cross-table joins, nested filtering, and time-series aggregation operations. Indicates based on task type A defined set of relevant data sources; This indicates a context-enhanced query.

[0011] A further technical solution of the present invention is that step S3 further includes: S32: Expert-guided retrieval, specifically including the following steps: S321: Establish an expert knowledge base A security analysis experience and operation specification storage device for storing unstructured security analysis experience and operation specification, including: security event research and judgment process, threat response strategy template, analysis guide of typical attack mode, SOC standard operation procedure; S322: based on the identified task type , through a predefined deterministic mapping function Retrieve the most relevant guidance documents: .

[0012] A further technical solution of the present application is that the step S3 further comprises: Step S33: term disambiguation retrieval, the step S33 specifically comprises: S331: constructing a field term library , denoted as , wherein each keyword contains the following attributes: standard term definition, synonym set , pre-trained embedding vector , generated using a lightweight embedding model; S332: performing word segmentation processing on the query , and filtering stop words and identified named entities to obtain a query word list to be disambiguated ; S333: for each word , calculate the cosine similarity between it and all term keywords : ; Wherein is the embedding vector of the word ; S334: for each , if the similarity between it and a certain keyword reaches the maximum and is not lower than a preset threshold , then is added to the term explanation set : ; S335: unify and integrate the three types of retrieval results to form the final knowledge context package: .

[0013] A further technical solution of the present application is that the step S4 comprises: S401: judge whether the input query belongs to the predefined task distribution category, i.e. whether the type output by the task identification module satisfies ; If it belongs to a known task distribution, a unified multi-slot prompt template is used for prompt construction, and the unified multi-slot prompt template includes the following core content: Dialogue history: preserve the context of multiple rounds of interaction to ensure semantic coherence; Search results : Inject multi-dimensional knowledge from structured search, expert-guided search, and term disambiguation search; Output format constraints: explicitly generate requirements such as "step-by-step instructions", "list evidence sources", "avoid speculative descriptions", etc. to improve the standardization and auditability of responses; If it does not belong to any predefined task type, enable a general reasoning prompt template that weakens the dependence on search results, utilizes the common sense and logical reasoning ability of the large language model itself to generate stable responses, and prevents system collapse or output out of control due to search failure; S402: input the constructed prompt into the large language model , execute the natural language generation task, and output an analysis response with clear structure and accurate semantics; S403: perform traceability verification on the generated content, and check whether the fact statements, threat judgments, and response suggestions involved in the response can be mapped to specific data entries in the search results ; S404: After verification, output the final security analysis report; the report content includes: threat event description, evidence chain, attack impact assessment, and actionable response suggestions.

[0014] To achieve the above purpose, the present application further provides a security event correlation analysis and question and answer system, characterized in that the system comprises a memory, a processor and a security event correlation analysis and question and answer program stored in the processor, and the security event correlation analysis and question and answer program executes the steps of the method as described above when run by the processor.

[0015] To achieve the above purpose, the present application further provides a computer readable storage medium, characterized in that the computer readable storage medium stores a security event correlation analysis and question and answer program, and the security event correlation analysis and question and answer program executes the steps of the method as described above when run by the processor.

[0016] The security event correlation analysis and question and answer method, system and medium of the present application have the following advantages: The application receives a user input original query, acquires a history record of a current dialogue, forms a context enhanced query according to the original query and the history record of the current dialogue, outputs a predicted task model according to the context enhanced query in combination with a dynamic task identification strategy, performs multi-dimensional retrieval on the predicted task model, obtains a final knowledge context package, generates a knowledge driven response based on the knowledge context package, and outputs a final security analysis report after the generated content is verified, thereby realizing efficient, accurate and interpretable intelligent correlation analysis on multi-source heterogeneous security data through construction of a multi-dimensional knowledge base, design of a dynamic task identification mechanism and implementation of context aware query completion. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is a flowchart of a preferred embodiment of the security event correlation analysis and question answering method of the application.

[0018] In order to make the objectives, technical solutions and advantages of the application clearer, further detailed description will be made to the application in combination with the drawings and embodiments. DETAILED DESCRIPTION

[0019] It should be understood that the specific embodiments described herein are only used to explain the application and do not limit the application.

[0020] The application proposes a security event correlation analysis and question answering method, which is suitable for real-time correlation, threat research and response suggestion generation of multi-source heterogeneous security alarm data in a security operation center (SOC), and is particularly suitable for intelligent auxiliary analysis in a high concurrency and dynamic evolution network attack scenario. The application aims to propose a security event correlation analysis and question answering method for SOC scenarios based on hybrid retrieval enhancement generation, effectively solves the above problems through construction of a multi-dimensional knowledge base, design of a dynamic task identification mechanism and implementation of context aware query completion, and realizes efficient, accurate and interpretable intelligent correlation analysis on multi-source heterogeneous security data.

[0021] As shown in Figure 1 The preferred embodiment of the security event correlation analysis and question answering method of the application includes the following steps: Step S1, context aware query completion: receiving a user input original query, acquiring a history record of a current dialogue, and forming a context enhanced query according to the original query and the history record of the current dialogue.

[0022] To solve the problem of ambiguous reference in multi-round dialogue (such as “How to handle this IP?”), the application designs a context aware query completion mechanism.

[0023] Step S10 as shown specifically includes the following steps: Step S101: Receive the original query input by the user. And retrieve the history of the current conversation. , including the previous A complete "query-response" pair represents the entire dialogue history from the first round to the current round, used for context understanding and reference resolution. Indicates the first The query statement issued by the user, that is, the question or instruction that the user puts on the system; Indicates the system's response to the first... Round query The generated response content refers to the analysis results, suggestions, or explanations returned by the system. This indicates that the current number is the [number]. A round of dialogue, meaning that in the current message, the one being processed is the first round. Secondary user input.

[0024] Step S102: Extract the set of key entities from the historical records This includes IP address, domain name, file hash, username, etc.

[0025] Step S103: If the current query If there is no clearly defined entity, then from The most relevant entities are matched and injected into the query to form a context-enhanced query. .

[0026] For example: If the previous output was "The attack source IP is 172.26.*.*", and the current query is "How to deal with this IP?", then it should be completed as "How to deal with the attack source IP 172.26.*.*?" Step S2, Dynamic Task Identification: Based on the context-enhanced query, a predictive task model is output using the dynamic task identification strategy.

[0027] To improve retrieval accuracy, this invention introduces a task recognition mechanism based on dynamic few-sample enhancement.

[0028] Step S2 specifically includes the following steps: S201: Building a Task Template Library It is a set of problem templates and corresponding task types, formally represented as: ,in An abstract problem template. For the corresponding task type, A predefined set of task types. Each question template. The real analyst query sentence is obtained by abstracting, and the specific method is: identifying and replacing specific entities (such as IP addresses, domain names, file hashes, user names, etc.) in the original problem with standardized placeholders (for example <ip> 、 <domain> 、 <filehash> 、 <user>This process preserves the semantic structure of the question and the query intent, while also making it general and reusable.

[0029] Predefined task type set This includes, but is not limited to, the following five categories: honeypot incidents, threat intelligence matching, security alert analysis, access behavior auditing, and threat correlation and response.

[0030] The following is a task template library Several example entries: Question Template 1: List all from <ip>Honeypot interaction logs, including attack payloads and timestamps.

[0031] Task Type 1: Honeypot event query Question Template 2: Check <ip>Is it present in the latest threat intelligence blacklists, if yes, please provide associated malicious family and confidence level.

[0032] Task Type 2: Threat Intelligence Matching Question Template 3: Analysis with threat organization <threatactor>All historical security alerts related, statistics on most commonly exploited CVEs and attack preferences.

[0033] Task Type 3: Security Alert Analysis Question Template 4: Rebuild User <user>All access behaviors in the past 24 hours, including login time, executed commands, and accessed resources.

[0034] Task type 4: access behavior audit The template library is dynamically extensible, and can be continuously expanded through manual annotation or combined with the pattern mining capabilities of large language models to cover more security analysis scenarios.

[0035] S202: complete the query after the context , generate its vector representation using a lightweight embedding model (such as BAAI / llm-embedder) , whose dimension is determined by the pre-selected embedding model architecture.

[0036] S203: calculation Cosine similarity with all templates : .

[0037] S204: select the top similar templates , and construct a prompt context according to their corresponding task labels , which is used to guide the large language model to perform task classification.

[0038] S205: input the query and the prompt context into the large language model, perform the zero-shot classification task, and output the predicted task type : .

[0039] This mechanism avoids the high computational complexity problem caused by traversing all database tables and fields in traditional Text-to-SQL methods. By decoupling task recognition into template retrieval and classification based on semantic matching, the computational complexity of the system is significantly reduced from (where is the number of tables, and is the average number of fields) to (where is the number of predefined task types), and is generally true in typical SOC scenarios, greatly improving the response efficiency and scalability of the system.

[0040] Step S3, multidimensional retrieval: multidimensional retrieval is performed on the predicted task model to obtain the final knowledge context package.

[0041] ​The step mainly innovatively constructs a three-channel mixed retrieval architecture, respectively processes structured security data, expert analysis rules and domain term disambiguation, realizes multi-dimensional knowledge collaborative injection, and improves the accuracy and interpretability of the large language model in security event analysis.

[0042] The step S3 specifically includes the following steps: Step S31, structured data retrieval. The step S31 specifically includes: S311: determining a data source set associated with the task according to the task type output by the task identification module , the structured security database, storing data such as honeypot logs, terminal detection and response alarms, firewall logs, access behavior logs, etc.

[0043] S312: parsing key target entities from the context-enhanced query , including but not limited to IP address, domain name, user account, file hash, process name, etc.

[0044] S313: performing context-aware aggregation query on the selected data source set , extracting multi-dimensional information related to the target entity, generating a structured summary , including: attack timeline, associated security event list, statistical indicators (such as attack frequency, duration, number of affected assets). The output form is:

[0045] Among them, represents the structured evidence summary extracted and aggregated from the internal security database; represents a context-aware aggregation function that supports cross-table association, nested filtering and time series aggregation operations; represents the relevant data source set determined according to the task type ; represents the context-enhanced query.

[0046] It should be noted that the structured security database in the present application is a logical data set, and its physical implementation can be based on relational databases, time series databases or search engines, etc. The specific data mode is determined by the security data acquisition system of the deployment environment. The present application realizes the decoupling of the underlying data storage structure through the logical mapping mechanism of task type and data source, ensuring the universality and deployability of the scheme in different security infrastructure environments, and not affecting the technical effects of the present application.

[0047] Step S32, expert guidance retrieval. The step S32 specifically includes:​​​ S321: Establishing an expert knowledge base for storing unstructured security analysis experience and operation specifications, including but not limited to: security incident judgment process, threat response strategy template, analysis guide of typical attack mode, SOC standard operation procedure.

[0048] S322: Based on the identified task type , retrieve the most relevant guidance documents through a predefined deterministic mapping function .

[0049] For example, when the task is "threat correlation and response", the system returns guidance materials such as "multi-source evidence fusion analysis process" and "emergency response plan template", guiding the large language model to follow the standardized analysis path.

[0050] Step S33, term disambiguation retrieval. The step S33 specifically includes the following steps: S331: Constructing a domain term library , denoted as , where each keyword contains the following attributes: (1) Standard term definition (2) Synonym set (such as "lateral movement" and "lateral movement") (3) Pre-trained embedding vector generated using a lightweight embedding model (such as \texttt{BAAI / llm-embedder}).

[0051] S332: Tokenization processing is performed on the query , and stop words and recognized named entities are filtered to obtain a list of query words to be disambiguated .

[0052] S333: For each word , calculate its cosine similarity with all term keywords : .

[0053] where is the embedding vector of the word .

[0054] S334: For each , if its similarity with a certain keyword reaches the maximum and is not lower than a preset threshold (e.g. 0.75), then​ Add a term explanation set : .

[0055] S335: unify and integrate the three types of retrieval results to form the final knowledge context package: .

[0056] The composite context will serve as the core input for the subsequent response generation stage, ensuring that the large language model generates accurate and reliable analysis conclusions based on a thorough understanding of semantics, context, and professional terminology.

[0057] Step S4, knowledge-driven response generation: generate a knowledge-driven response based on the knowledge context package, and output the final security analysis report after the generated content is verified.

[0058] The step S4 specifically includes: S401: determine whether the input query belongs to the predefined task distribution category, i.e., its type output by the task recognition module whether to meet : If it belongs to a known task distribution, use a unified multi-slot prompt template for prompt construction. This template includes the following core content: dialog history: preserve the context of multiple rounds of interaction to ensure semantic coherence; retrieval results : inject multi-dimensional knowledge from structured retrieval, expert-guided retrieval, and term disambiguation retrieval; output format constraints: explicitly generate requirements such as "step-by-step explanation", "list evidence sources", "avoid speculative descriptions", etc., to improve the standardization and auditability of the response.

[0059] If it does not belong to any predefined task type, for example, the query content is ambiguous, unrelated to security analysis, or cannot match the task template, enable the general reasoning prompt template. This template weakens the dependence on retrieval results and mainly utilizes the large language model's own common sense and logical reasoning ability to generate a stable response, preventing system collapse or output out of control due to retrieval failure.

[0060] S402: input the constructed prompt into the large language model , execute the natural language generation task, and output a clear structure and accurate semantic analysis response.

[0061] S403: perform traceability verification on the generated content, and check whether the fact statements, threat judgments, and response suggestions involved in the response can be mapped to the retrieval results Specific data entries in the report (such as log record ID, threat intelligence source, expert rule number, etc.), ensuring that all conclusions have evidence and eliminating "hallucination" output.

[0062] S404: After verification, output the final security analysis report. The report content includes but is not limited to: (1) Threat event description; (2) Evidence chain; (3) Attack impact assessment; (4) Actionable response recommendations.

[0063] This mechanism realizes controllable generation guided by domain knowledge, balances generation quality, explainability and security, and is suitable for high-reliability security operation scenarios.

[0064] The beneficial effects of the security event correlation analysis and question answering method are: The application forms a context-enhanced query according to the original query and the history record of the current dialogue; outputs a predicted task model according to the context-enhanced query in combination with a dynamic task identification strategy; performs multi-dimensional retrieval on the predicted task model to obtain a final knowledge context package; generates a knowledge-driven response based on the knowledge context package; and outputs a final security analysis report after the generated content is verified. Through the construction of a multi-dimensional knowledge base, the design of a dynamic task identification mechanism and the implementation of context-aware query completion, efficient, accurate and explainable intelligent correlation analysis of multi-source heterogeneous security data is realized.

[0065] To achieve the above object, the application further provides a security event correlation analysis and question answering system, which comprises a memory, a processor and a security event correlation analysis and question answering program stored in the processor. The security event correlation analysis and question answering program performs the steps of the method as described above when executed by the processor, which will not be repeated here.

[0066] To achieve the above object, the application further provides a computer readable storage medium, which stores a security event correlation analysis and question answering program. The security event correlation analysis and question answering program performs the steps of the method as described above when executed by the processor, which will not be repeated here.

[0067] The above description is only the preferred embodiments of the application, and does not limit the inventive scope of the application. Any equivalent structure or process transformation, or direct or indirect application in other related technical fields, is also included in the inventive protection scope of the application.< / user> < / threatactor> < / ip> < / ip> < / user> < / filehash> < / domain> < / ip>

Claims

1. A security incident correlation analysis and question answering method, characterized in that, The method comprises the following steps: Step S1, context-aware query completion: receiving a user-inputted original query, and obtaining a history record of a current dialogue, and forming a context-enhanced query according to the original query and the history record of the current dialogue; Step S2, dynamic task identification: outputting a predicted task model according to the context-enhanced query in combination with a dynamic task identification strategy; Step S3, multi-dimensional retrieval: performing multi-dimensional retrieval on the predicted task model to obtain a final knowledge context package; Step S4, knowledge-driven response generation: generating a knowledge-driven response based on the knowledge context package, and outputting a final security analysis report after the generated content is verified.

2. The security incident correlation analysis and Q&A method of claim 1, wherein, The step S1 comprises: Step S101: Receive the original query input by the user. And retrieve the history of the current conversation. , including the previous A complete "query-response" pair represents the entire dialogue history from the first round to the current round, used for context understanding and reference resolution; Indicates the first The query statement issued by the user, that is, the question or instruction that the user puts on the system; Indicates the system's response to the first... Round query The generated response content, namely the analysis results, suggestions, or explanations returned by the system, This indicates that the current number is the [number]. A round of dialogue, meaning that in the current message, the one being processed is the first round. Secondary user input; Step S102, extracting a key entity set from the history record, including an IP address, a domain name, a file hash, and a username; Step S103, if the current query lacks an explicit entity, matching the most relevant entity from the key entity set and injecting it into the query to form a context-enhanced query.

3. The security incident correlation analysis and Q&A method of claim 2, wherein, The step S2 comprises: Step S201, constructing a task template library which is a set of question templates and corresponding task types, and is formally represented as wherein is an abstract question template, is a corresponding task type, is a predefined set of task types; each question template is obtained by abstracting a real analyst query statement, and the specific method is: identifying and replacing specific entities in the original question with standardized placeholders; wherein the predefined set of task types includes: honeypot event, threat intelligence matching, security alert analysis, access behavior audit, threat correlation and response; Step S202, the query after context completion its vector representation is generated using a lightweight embedding model whose dimension is predetermined by the adopted embedding model architecture; Step S203, calculating Cosine similarity with all templates of the template ； S204: Selecting the top similar templates and constructing a prompt context according to the corresponding task label of each template to guide the large language model to perform task classification; S205: query with the prompt context input large language model, execute zero-shot classification task, output predicted task type : 。 4. The security incident correlation analysis and Q&A method of claim 3, wherein, The step S3 comprises: Step S31, structured data retrieval, which specifically comprises: S311: determining a set of data sources associated with the task according to the task type output by the task identification module , the structured security database is determined ; S312: Resolve key target entities from the context-enhanced query including IP addresses, domain names, user accounts, file hashes, process names; S313: In the selected data source set Performing context-aware aggregation query , extract multi-dimensional information related to the target entity, and generate structured summary , the content includes: attack timeline, associated security event list, statistical indicators, output form: ； wherein, represents structured evidence summaries extracted and aggregated from internal security databases; represents a context-aware aggregation function that supports cross-table joins, nested filters, and time-series aggregation operations; represents a set of relevant data sources determined according to the task type represents a context-enhanced query.​ 5. The security incident correlation analysis and Q&A method of claim 4, wherein, The step S3 further comprises: S32: expert guidance retrieval, which specifically comprises: S321: Establish expert knowledge base for storing unstructured security analysis experience and operation specifications, including: security event research and judgment process, threat response strategy template, analysis guide of typical attack mode, SOC standard operation procedure; S322: based on the identified task type by a predefined deterministic mapping function retrieve the most relevant guidance document: 。 6. The security incident correlation analysis and Q&A method of claim 5, wherein, The step S3 further comprises: Step S33: term disambiguation retrieval, which specifically comprises: S331: Constructing a domain terminology library , denoted as where each keyword contains the following attributes: standard terminology definition, synonym set , pre-trained embedding vector , generated using a lightweight embedding model; S332: query word segmentation, and filter stop words and recognized named entities to obtain a query word list to be disambiguated ; S333: For each word , compute its cosine similarity with all term keywords : ； wherein is the embedding vector for the word ; S334: for each , if the similarity between it and a certain keyword reaches the maximum and is not lower than a preset threshold , add to the term explanation set : ； S335: integrating the three types of retrieval results to form a final knowledge context package: 。 7. The security incident correlation analysis and Q&A method of claim 6, wherein, The step S4 comprises: S401: judge whether the input query belongs to a predefined task distribution category, i.e. its type output by the task identification module whether the condition is met ; If it belongs to a known task distribution, a unified multi-slot prompt template is used for prompt construction, and the unified multi-slot prompt template includes the following core content: Dialogue history: retaining the context of multiple rounds of interaction to ensure semantic coherence; Search results : Inject multi-dimensional knowledge from structured search, expert guided search, and term disambiguation search; Output format constraint: explicitly generating requirements such as "step-by-step explanation", "list of evidence sources", "avoid speculative description", etc., to improve the standardization and auditability of the response; If it does not belong to any predefined task type, a general reasoning prompt template is enabled, which weakens the dependence on retrieval results, utilizes the common sense and logical reasoning ability of the large language model itself to generate a stable response, and prevents system collapse or output out of control due to retrieval failure; S402: input the constructed prompt into the large language model , execute the natural language generation task, and output an analysis response with clear structure and accurate semantics; S403: Perform traceability check on the generated content, check each fact statement, threat judgment and response suggestion involved in the response whether they can be mapped to the specific data entry in the search result ; S404: After verification, output the final security analysis report; the report content includes threat event description, evidence chain, attack impact assessment, and actionable response suggestions.

8. A security event correlation analysis and question answering system, characterized by, The system comprises a memory, a processor, and a security event correlation analysis and question and answer program stored on the processor, and the security event correlation analysis and question and answer program performs the steps of the method of any one of claims 1 to 7 when executed by the processor.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a security event correlation analysis and question and answer program, and the security event correlation analysis and question and answer program performs the steps of the method of any one of claims 1 to 7 when executed by the processor.

Images