Log file-based security vulnerability AI positioning method and system

Abstract

The invention relates to the technical field of network security, and discloses a security vulnerability AI positioning method and system based on log files. The method comprises the following steps: firstly, analyzing user feedback describing open source component security vulnerabilities to extract fault key entity information, screening related log entries based on the fault key entity information, and constructing a vulnerability propagation graph; identifying a vulnerability triggering initial point set by using a graph traversal algorithm and a graph neural network, calling a component vulnerability case library to deduce a vulnerability utilization propagation chain and calculating a matching degree with a known open source component vulnerability utilization chain feature, and obtaining a maximum probability vulnerability utilization propagation chain and an associated vulnerability triggering initial point set; and generating a root cause positioning report, and updating the knowledge base or model training data according to a user verification result. According to the method, the initial vulnerability point and the complete vulnerability propagation chain of the security vulnerability of the open source component can be accurately and efficiently positioned, and the positioning accuracy and timeliness are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for AI-based security vulnerability localization based on log files. Background Technology

[0002] Against the backdrop of rapid digital and intelligent development, third-party open-source components are widely used in various systems. The risks posed by their security vulnerabilities are becoming increasingly prominent. The exploitation methods for these vulnerabilities are becoming increasingly complex and covert, involving more diverse system components, interaction nodes, and operational behaviors, posing a serious threat to system security. Log files, as the core data carrier recording various operational behaviors, abnormal events, and interaction trajectories of systems and components, play an irreplaceable role in the detection, tracing, and root cause localization of third-party open-source component security vulnerabilities. However, current methods for localizing third-party open-source component security vulnerabilities based on log data still face many challenges: log entries related to third-party open-source component security vulnerabilities are often mixed in with massive amounts of normal system logs, and the vulnerability triggering and exploitation process may manifest as disguised normal operations. Relying solely on manual retrieval or simple rule matching makes it difficult to accurately filter out effective log clues directly related to the vulnerability, leading to the initial key trigger traces of the vulnerability being easily submerged or ignored. Furthermore, the impact of third-party open-source component security vulnerabilities exhibits clear stages and causal relationships, from the initial triggering of the vulnerability to its horizontal spread through component interactions. From initial logs to the eventual system anomaly, log information from each stage is scattered across different devices and time periods. Existing log analysis methods have limited ability to uncover the logical connections between these discrete logs, making it difficult to construct a complete vulnerability propagation chain map and hindering efficient localization of vulnerability sources and root causes. Furthermore, the rapid version iteration of third-party open-source components leads to the continuous emergence of new security vulnerabilities. The triggering conditions, exploitation methods, and impact scope of vulnerabilities are constantly evolving, and there is a lag between historical vulnerability case experience and the characteristics of new vulnerabilities. Existing mechanisms struggle to intelligently correlate and match real-time log information with dynamically updated vulnerability patterns, resulting in significantly reduced accuracy and timeliness in identifying unknown or mutated third-party open-source component vulnerabilities, making it difficult to quickly formulate targeted response and remediation strategies. Therefore, to address these issues, this invention proposes a security vulnerability AI localization method and system based on log files. Summary of the Invention

[0003] This invention aims to provide a security vulnerability AI-based method and system for locating vulnerabilities based on log files. Its core process is as follows: First, it parses the description information of security vulnerabilities in third-party open-source components reported by users, extracting key fault entity information. Based on this, it constructs the initial link from user feedback to accurate identification of key vulnerability information, providing support for subsequent security vulnerability location analysis and facilitating efficient location and handling of open-source component security vulnerabilities. Then, based on the extracted key fault entity information, it filters relevant log entries and constructs a vulnerability propagation graph. Subsequently, it uses graph traversal algorithms and graph neural networks to identify the initial trigger point set of vulnerabilities, and combines this with a component vulnerability case library to deduce and filter the propagation chain with the highest probability of vulnerability exploitation. Finally, it generates a root cause location report and updates the knowledge base or model training data based on user verification results. Through the above methods, this invention can accurately and efficiently locate the initial trigger point and complete vulnerability propagation chain of security vulnerabilities in third-party open-source components, improving the accuracy and timeliness of locating security vulnerabilities in third-party open-source components. This solves the problems of low location efficiency caused by insufficient accuracy in log filtering, incomplete vulnerability propagation chain construction, and delayed adaptation to new vulnerabilities in existing technologies.

[0004] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0005] AI-based security vulnerability localization methods based on log files include:

[0006] Analyze user feedback describing security vulnerabilities in open-source components and extract key entity information about the faults;

[0007] Based on the information of critical entities in the fault, time-series filtering technology is used to filter log entries related to security vulnerabilities of open-source components from the raw logs;

[0008] Log entries are parsed to generate basic event nodes, and a vulnerability propagation graph is constructed based on the vulnerability propagation rule base;

[0009] A graph traversal algorithm is used to identify abnormal source nodes in the vulnerability propagation graph to generate a candidate node set. A graph neural network is used to evaluate the vulnerability trigger confidence of the candidate nodes, and candidate nodes exceeding the preset threshold are selected to generate an initial set of vulnerability trigger points.

[0010] Based on the initial set of vulnerability trigger points, the vulnerability exploitation propagation chain is deduced by calling the component vulnerability case library. The matching degree between each vulnerability exploitation propagation chain and the characteristics of known open-source component vulnerability exploitation chains is calculated to obtain the vulnerability exploitation propagation chain with the highest probability and its associated vulnerability trigger initial set.

[0011] Based on the highest probability vulnerability exploit propagation chain and the initial set of vulnerability triggers, a root cause analysis report is generated and executed:

[0012] (a) When the user verifies that the initial vulnerability point is correct, mark the verified solution in the component vulnerability case library;

[0013] (b) When a user verifies that the initial vulnerability point is incorrect, the correct initial vulnerability point and evidence chain provided by the user are used as positive samples, and the incorrect initial vulnerability point is used as a negative sample to update the training data of the graph neural network model.

[0014] Specifically, the critical entity information for the failure includes vulnerability characteristic keywords, the time period of the failure, and the affected dependent components.

[0015] Specifically, extracting information about key fault entities includes:

[0016] A multimodal large model is used to parse the vulnerability descriptions submitted by users, and preliminary entity information is extracted through text semantic understanding. The preliminary entity information includes vulnerability feature keywords, the time period of failure, and affected dependent components.

[0017] The initial entity information is subjected to consistency verification, and the pre-trained language model fine-tuned by open-source component vulnerability domain corpus is used to correct the single-modal parsing error.

[0018] When ambiguous information exists, a targeted supplementary request is generated through an adaptive questioning strategy trained by reinforcement learning until the completeness of the key entity information meets a preset threshold, and then the faulty key entity information is output.

[0019] Specifically, using time-series filtering techniques to extract log entries related to security vulnerabilities in open-source components from raw logs includes:

[0020] Based on the time period of failure, the abnormal time period of the component is set by combining the component interaction and vulnerability lifecycle framework and relevant open source component vulnerability threat intelligence.

[0021] Based on the affected dependent components, generate a list of component tags with vulnerability context attributes;

[0022] Based on vulnerability feature keywords, and combined with historical vulnerability case library and open source component vulnerability threat intelligence, a vulnerability feature knowledge base is constructed.

[0023] The system captures raw logs during abnormal periods of component operation, and then filters and retrieves the captured logs using the component tag list and vulnerability feature knowledge base, outputting log entries related to the vulnerability propagation chain.

[0024] Specifically, the abnormal component periods include the pre-buffering time, the core burst time, and the post-tracking time.

[0025] Specifically, constructing a vulnerability propagation map includes:

[0026] The log entries related to security vulnerabilities of open-source components are structured and parsed to extract inherent log attributes, generate basic event nodes, parse the operation behavior description text of the basic event nodes, and extract standardized behavioral features; the inherent log attributes include timestamp, component identifier, and operation behavior;

[0027] Based on the entity of the vulnerability behavior knowledge framework, construct an open-source component security vulnerability causal relationship rule base;

[0028] The standardized behavioral characteristics are matched with the baseline behavioral characteristics of technical entities in the open-source component security vulnerability causal relationship rule base, and the basic event nodes are assigned technical identifiers and tactical phase labels to generate enhanced event nodes.

[0029] Based on an open-source component security vulnerability causal relationship rule library, we perform time continuity verification, component interaction topology verification, and causal strength calculation on enhanced event node sequences to filter out valid node association pairs.

[0030] An enhanced event node in a valid node association pair is connected by directed edges labeled with causal type to generate a structured vulnerability causal network graph.

[0031] Specifically, potential anomaly source nodes are identified in the vulnerability propagation graph to form a candidate node set. A graph neural network model is used to evaluate the vulnerability trigger confidence of the candidate nodes. Candidate nodes exceeding a preset threshold are selected to generate an initial set of vulnerability trigger points, including:

[0032] Starting from the terminal alarm node that is ultimately triggered in the causal network graph of open source component security vulnerabilities, a depth-first search strategy is used to perform reverse traversal. During the traversal, the process behavior logs of each component running node are parsed, and the component running nodes that meet the key behavioral characteristics of the vulnerability propagation chain are marked as candidate root nodes.

[0033] For each candidate root node in the candidate root node set, a multi-dimensional feature vector of the candidate root node is extracted from the vulnerability propagation graph. The multi-dimensional feature vector includes ontology features, behavioral evidence features, graph structure features, and temporal features.

[0034] The multidimensional feature vector is input into the graph attention temporal network model for evaluation, the vulnerability confidence probability value of each candidate root node is obtained, and the candidate root nodes with vulnerability confidence probability values ​​exceeding a preset threshold are selected to form a candidate node set.

[0035] If the candidate node set contains multiple candidate nodes that belong to the same vulnerability causal chain and exceed the preset threshold, then the candidate node with the earliest time and the highest vulnerability confidence probability value is retained; if the candidate node set contains candidate nodes that belong to independent vulnerability causal chains and exceed the preset threshold, then all such candidate nodes are retained, and the initial set of vulnerability triggering points is generated after this filtering.

[0036] Specifically, the component vulnerability case library is used to deduce the vulnerability exploitation propagation chain using a bidirectional traversal strategy, including:

[0037] Starting from each initial vulnerability point in the vulnerability triggering initial point set, a forward extension deduction is performed along the vulnerability causal direction in the vulnerability causal network graph, and node verification and path generation are performed according to the rules of the component vulnerability case library.

[0038] Starting from the terminal alarm node, reverse backtracking is performed along the causal direction of the vulnerability in the vulnerability causal network graph, and node verification, timing constraint checks and logical integrity detection are performed according to the rules of the component vulnerability case library.

[0039] Extract the set of nodes at the intersection of the vulnerability propagation chain generated by forward expansion deduction and the backtracking path generated by reverse backtracking deduction;

[0040] Sort all nodes in the intersection node set in ascending order of their timestamps to generate a candidate vulnerability exploit propagation chain set.

[0041] Specifically, the confidence level of candidate nodes in triggering vulnerabilities is evaluated using a graph neural network model, and candidate nodes exceeding a preset threshold are selected to generate an initial set of vulnerability trigger points, including:

[0042] Extract the technical IDs corresponding to all nodes on the propagation chain set of candidate vulnerabilities to form a technical ID sequence;

[0043] The technology ID sequence is compared item by item with the component vulnerability exploit chain feature sequence of the archived vulnerability propagation chain in the component vulnerability case library;

[0044] By combining the order of appearance of technical entities, the strength of contextual dependencies, and the uniqueness of technical combinations, a weighted similarity algorithm is used to calculate the path matching score of the candidate vulnerability exploitation propagation chain.

[0045] The path matching score is comprehensively calibrated by combining the topological interaction rationality of the components involved in the nodes of the candidate vulnerability exploitation propagation chain, the time consistency of the vulnerability phase transition, and the cumulative value of the behavioral evidence strength.

[0046] The candidate vulnerability propagation chain with the highest path matching score and its associated vulnerability trigger initial point set are selected, and the vulnerability propagation chain is reconstructed.

[0047] A security vulnerability location system based on log files using AI includes:

[0048] The information extraction module is configured to parse user feedback and extract key entity information related to the fault.

[0049] The log filtering module is configured to filter log entries related to security vulnerabilities of open-source components from the raw logs based on information about critical entities with faults, using time-series filtering technology.

[0050] The vulnerability propagation graph construction module is configured to parse log entries to generate basic event nodes and build a vulnerability propagation graph based on the vulnerability propagation rule base.

[0051] The intrusion point identification module is configured to identify abnormal source nodes in the vulnerability propagation graph based on a graph traversal algorithm to generate a candidate node set, and to use a graph neural network to evaluate the vulnerability trigger confidence of the candidate nodes, and filter candidate nodes that exceed a preset threshold to generate an initial vulnerability trigger point set.

[0052] The vulnerability exploitation propagation chain deduction module is configured to, based on the vulnerability triggering initial point set, call the component vulnerability case library to deduce the vulnerability exploitation propagation chain, calculate the matching degree of each path with the known open source component vulnerability exploitation chain characteristics, and obtain the vulnerability exploitation propagation chain with the highest probability and its associated vulnerability triggering initial point set;

[0053] The report generation and feedback module is configured to generate a root cause localization report based on the highest probability vulnerability exploitation propagation chain and the initial set of vulnerability triggers, and update the component vulnerability case library or graph neural network model training data according to the user verification results.

[0054] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0055] This invention precisely extracts key entity information about faults by analyzing user feedback, and efficiently filters core logs related to security vulnerabilities in open-source components from massive logs using time-series filtering technology. This solves the problems of low accuracy and overwhelmed effective information in traditional log filtering. By constructing a vulnerability propagation graph, discrete logs are transformed into a structured graph with causal relationships, clearly presenting the vulnerability propagation logic and overcoming the shortcomings of fragmented and difficult-to-trace vulnerability propagation chains. By combining graph traversal algorithms with graph neural networks to identify the initial set of vulnerability trigger points, and combining bidirectional inference with a component vulnerability case library to match the highest probability propagation chain, the accuracy of vulnerability source location and propagation path reconstruction is improved. At the same time, the case library and model training data are dynamically updated through a user verification feedback mechanism, realizing continuous system optimization and enhancing the adaptability to new and mutated vulnerabilities. Ultimately, this significantly improves the overall efficiency and accuracy of locating security vulnerabilities in open-source components, providing strong support for rapid response and vulnerability remediation. Attached Figure Description

[0056] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the specification, serve to illustrate the technical solutions of this disclosure.

[0057] Figure 1 This is a flowchart of the log file-based problem localization method provided in Embodiment 1 of the present invention;

[0058] Figure 2 This is a flowchart of constructing a vulnerability propagation graph provided in Embodiment 1 of the present invention;

[0059] Figure 3 This is a schematic diagram of obtaining the initial set of vulnerability trigger points provided in Embodiment 1 of the present invention;

[0060] Figure 4 This is a block diagram of a log file-based problem location system provided in Embodiment 2 of the present invention. Detailed Implementation

[0061] Example 1

[0062] This embodiment describes a security vulnerability AI-based method for locating vulnerabilities based on log files. The specific steps include:

[0063] S1. Utilizing a pre-trained language model fine-tuned from an open-source component security vulnerability corpus, combined with multimodal semantic understanding technology, deep analysis is performed on user-reported descriptions of open-source component security vulnerabilities. Through text semantic extraction, key entity information of the fault is accurately obtained. This key entity information includes vulnerability characteristic keywords, the time period of the fault occurrence, and the affected dependent components, used to accurately define the target scope of log analysis and avoid processing irrelevant massive amounts of data. Specifically, the affected dependent components, as indicated by the vulnerability characteristic keywords, include specific third-party open-source components, associated calling modules, and system components that depend on them for operation.

[0064] S2. Based on the critical entity information of the fault, time series filtering technology is applied to filter log entries related to the security vulnerabilities of open source components from the raw log data. This is used to focus on log fragments related to the security vulnerabilities of open source components from the raw logs, which greatly reduces the amount of data for subsequent analysis. Specifically, this includes: setting abnormal time periods for components based on the fault occurrence time combined with component interaction and vulnerability lifecycle framework, including pre-buffering time, core outbreak time, and post-tracking time; generating a list of component tags with vulnerability context attributes using the affected dependent components; constructing a vulnerability feature knowledge base by combining vulnerability feature keywords; and achieving accurate log filtering through abnormal time periods for components, the component tag list, and the vulnerability feature knowledge base in sequence.

[0065] S3. Structured parsing of log entries related to open-source component security vulnerabilities is performed to extract inherent log attributes and generate basic event nodes. Using a rule base for causal relationships of open-source component security vulnerabilities, these basic event nodes are linked to generate a vulnerability propagation graph. This transforms unstructured logs into a graph structure with explicit dependencies, providing a logical framework for root cause analysis of open-source component security vulnerabilities. The inherent log attributes encompass key information describing open-source component security vulnerability events, including timestamps, involved component identifiers, names and versions of third-party open-source components, operation type, call, parameter passing, permission verification, resource path, operation result status (success, failure, exception), and the identity of the operation subject. After standardized behavioral feature extraction and matching with the rule base, basic event nodes are assigned technical identifiers and tactical stage labels to generate enhanced event nodes. Finally, a structured vulnerability causal network graph is formed through directed edge connections.

[0066] S4. Using a graph traversal algorithm, potential abnormal source nodes are identified from the vulnerability propagation graph, forming a candidate node set. A graph attention temporal network model is then used to evaluate the vulnerability trigger confidence of each node in the candidate node set, selecting candidate root nodes whose probability scores exceed a preset threshold to form a vulnerability trigger initial point set. Specifically, this includes: performing a reverse depth-first traversal starting from the terminal alarm node, marking component running nodes that satisfy the key behavioral characteristics of the open-source component vulnerability propagation chain as candidate root nodes; extracting multi-dimensional feature vectors from the candidate root nodes, including ontology features, behavioral evidence features, graph structure features, and temporal features, and inputting them into the model for evaluation; and filtering and generating a vulnerability trigger initial point set based on confidence probability and causal chain relationships, used to accurately locate the most likely vulnerability initial trigger node in a complex causal network.

[0067] S5. Based on the set of vulnerability triggering initial points, the component vulnerability case library is called to deduce the open-source component vulnerability exploitation propagation chain using a bidirectional traversal strategy. The matching degree of each vulnerability exploitation propagation chain with the known open-source component vulnerability exploitation chain characteristics is calculated to generate the vulnerability exploitation propagation chain with the highest probability and its associated vulnerability triggering initial point set. Specifically, this includes: forward expansion deduction from the initial vulnerability point and backward backtracking deduction from the terminal alarm node. The intersection node set is extracted and sorted by timestamp to generate candidate propagation chains. The optimal chain is selected by comparing the technical ID sequence and calibrating the path matching score. This is used to reconstruct the complete path of the vulnerability from triggering to spreading, and to clarify the impact scope and dependent components of each link.

[0068] S6. Based on the most probable vulnerability propagation chain and its associated vulnerability triggering initial point set, a large model is used to automatically generate a structured root cause localization report, including root cause diagnosis, such as function implementation defects in a specific version of a specific open-source component, evidence chain, key log entries and node relationships, remediation suggestions, component version upgrades, patch adaptation, and interface verification strengthening. Simultaneously, the following operations are performed:

[0069] (a) When the user marks the initial vulnerability point correctly, a verified tag is created for the solution in the component vulnerability case library. When a new vulnerability is detected with a similarity to the current vulnerability exploitation propagation chain encoding vector exceeding the threshold, the verified solution is automatically recommended first.

[0070] (b) When a user marks an initial vulnerability point incorrectly, the correct initial vulnerability point and associated evidence chain provided by the user are extracted. The incorrect initial vulnerability point is used as a negative sample and the correct initial vulnerability point is used as a positive sample. These are added to the training dataset of the graph attention temporal network model to trigger incremental training of the model to dynamically adjust the node confidence evaluation weights. This is used to improve the accuracy of initial point identification of security vulnerabilities in new open source components, enhance the accuracy of vulnerability propagation chain tracing and root cause localization, and form a continuously iterative defense closed loop.

[0071] Furthermore, the specific steps of S1 include: First, collecting user-submitted descriptions of security vulnerabilities in open-source components, covering multimodal inputs such as text reports, conversation logs, vulnerability screenshots, and log fragment images. The AI ​​multimodal processing module converts non-textual information into parsable content, then uniformly converts it to plain text format for data cleaning, removing irrelevant small talk, repetitive expressions, and other redundant information, and correcting typos or ambiguous content to ensure semantic clarity. Next, it calls upon open-source component security vulnerability corpora, such as CVE libraries and component security announcements, and fine-tunes a pre-trained language model. Through dynamic prompt word engineering, it guides the model to focus on the task: automatically adjusting the prompt word template based on the length and style of the input text, such as strengthening the extraction of core features for short descriptions and adding concise key information guidance for lengthy descriptions, clearly defining requirements. The process begins by identifying and extracting key entity information about the fault from preprocessed text. A pre-trained language model, based on deep semantic understanding, then locates and extracts target information. This includes matching vulnerability feature keywords to preset vulnerability feature keywords or identifying equivalent expressions; extracting specific time points or intervals of the fault occurrence and standardizing them into timestamp format; and identifying the specific names of third-party open-source components, associated calling modules, and system components that depend on them, all explicitly mentioned in the text. Finally, the extracted entity information is validated, checking whether keywords match preset categories, whether time periods are complete, and whether dependent components are clearly defined. If ambiguity exists, an AI adaptive follow-up questioning strategy is triggered, generating targeted questions based on historical interaction data and dynamically adjusting the questioning direction based on user feedback until the key information is complete. Ultimately, based on the validated entity information, AI automatically generates a structured log analysis target scope list, precisely defining the boundaries of subsequent analysis.

[0072] This invention utilizes a pre-trained language model to perform deep semantic understanding of security vulnerability descriptions of open-source components. On the one hand, it can accurately capture implicit information in user expressions, regardless of whether the expression format is standardized, ensuring the complete extraction of key content. On the other hand, it can flexibly adapt to keyword expressions in diverse vulnerability scenarios, and at the same time, it can clearly distinguish components with the same name by combining asset rules, thereby ensuring that the identification of various vulnerability keywords and affected dependent components is both comprehensive and accurate.

[0073] Optionally, the specific steps of S2 include:

[0074] S21, based on the fault occurrence time period reported by users, combined with the component interaction and vulnerability lifecycle framework and related open source component vulnerability threat intelligence, sets the abnormal period of the component, defines the time boundary of core vulnerability activities and potentially related activities for log filtering, so as to accurately capture logs of key stages of the vulnerability propagation chain and eliminate redundant data.

[0075] S22 generates a list of component tags with vulnerability context attributes based on the affected dependent components and their roles in the vulnerability exploitation propagation chain. This list is used to provide component correlation criteria for log filtering, identify components that need to be monitored and abnormal access relationships, and avoid missing critical vulnerability springboard logs.

[0076] S23 utilizes vulnerability feature keywords, combined with typical vulnerability behavior patterns expanded from historical vulnerability case libraries and open-source component vulnerability threat intelligence, to construct a vulnerability feature knowledge base, providing high-precision behavior matching basis for log filtering and improving the identification coverage of vulnerability-related logs;

[0077] S24 captures raw logs during the abnormal period of the component in real time, performs component tag filtering and deep search of the vulnerability feature knowledge base in sequence, and outputs log entries that simultaneously meet the time range, component association or vulnerability feature matching, and generates core evidence chain log entries related to the vulnerability propagation chain, which is used to significantly compress the amount of data and provide accurate input for subsequent vulnerability behavior analysis, path reconstruction and root cause analysis.

[0078] For example, the component interaction and vulnerability lifecycle framework in step S21 can adopt the Lockheed Martin kill chain model. This model decomposes the interaction and vulnerability exploitation process of third-party open-source components into seven linearly progressive stages, including vulnerability reconnaissance, exploit tool construction, trigger payload delivery, vulnerability exploitation, malicious code injection, command transmission between components, and achievement of target impact. Based on the fault occurrence time period reported by users, combined with the standardized time parameters provided by this model and relevant open-source component vulnerability threat intelligence, the abnormal component time period is set. The expansion of this time period needs to cover the entire chain of third-party open-source component security vulnerabilities and dynamically divide it into pre-buffering time, core outbreak time, and post-tracking time. The pre-explosion buffer time covers the initial stage of the lifecycle, including vulnerability reconnaissance, exploit tool construction, and payload delivery. It aims to capture the initial probing of vulnerabilities and the fulfillment of triggering conditions. Its setting is based on the latency parameters of similar vulnerabilities in open-source component vulnerability threat intelligence. For example, the reconnaissance phase of common open-source component vulnerabilities can be traced back to the corresponding time period, while the reconnaissance phase of advanced customized component vulnerabilities may last longer. The core outbreak time directly locks into the time period of the user-reported failure, usually corresponding to the target impact achievement stage of the lifecycle. The post-explosion tracking time covers the malicious code injection, inter-component command transmission, and critical diffusion stages of the lifecycle. This stage can be considered as the vulnerability impact... The continuation or expansion of the impact depends on the key time parameters for similar vulnerabilities in the vulnerability threat intelligence of open-source components. Specifically, firstly, the end point of the fault occurrence period reported by users is used as the starting point for calculating the post-tracking time. Secondly, based on the longest duration of lateral spread of this type of vulnerability through component interaction after being triggered in the intelligence, the minimum duration for covering the spread activity is set. At the same time, based on the typical window for the vulnerability to maintain subsequent impact after achieving initial impact in the intelligence, the minimum duration for covering residual impact is set. Finally, the maximum value of the two is taken as the time increment for the extension from the end point of the fault period. That is, the end point of the post-tracking time is the sum of the end point of the core outbreak time and the time increment.

[0079] After identifying the period of abnormal component activity, step S22 generates a list of component tags with vulnerability context attributes based on the affected dependent components and their roles in the vulnerability exploitation propagation chain. Specifically, affected dependent components may include vulnerable server components, database components targeted for vulnerability propagation, and user terminal components used as propagation springboards. These components play different roles in the vulnerability exploitation propagation chain, such as initial trigger point, target asset, and intermediate propagation node. The corresponding component tags incorporate vulnerability context attributes such as initial trigger point, propagation target, and lateral springboard. When filtering logs, these tags can directly serve as the basis for judging component relevance, clearly defining the components that need to be analyzed in the log localization process. Simultaneously, based on the vulnerability context reflected by the tags, abnormal access relationships between components can be identified.

[0080] After obtaining the list of component tags with vulnerability context attributes, step S23 utilizes vulnerability feature keywords, combined with typical vulnerability behavior patterns from historical vulnerability case libraries and open-source component vulnerability threat intelligence, to construct a vulnerability feature knowledge base. Specifically, this invention uses vulnerability feature keywords as a foundation, integrating similar vulnerability patterns from historical vulnerability case libraries with the latest vulnerability behavior characteristics provided by open-source component vulnerability threat intelligence to form a structured vulnerability feature knowledge base. This knowledge base, based on the vulnerability stage and the component's role in the vulnerability exploitation and propagation chain, identifies corresponding typical vulnerability behavior characteristics, transforming vulnerability feature keywords into specific behavioral descriptions that can be directly used for log matching. Simultaneously, it combines the vulnerability context implied by component tags to clarify the characteristic behaviors that different components may exhibit during the vulnerability process. When performing log localization, this knowledge base provides clear feature basis for log filtering, enabling users to accurately identify vulnerability-related records from component logs with vulnerability context attributes based on the features in the knowledge base. This ensures that log localization focuses on information directly related to vulnerability behavior, effectively improving the accuracy and efficiency of capturing vulnerability traces from logs and avoiding wasting resources on irrelevant logs.

[0081] Step S24 obtains log entries related to the vulnerability propagation chain based on the original logs during the component's abnormal period, the component tag list with vulnerability context attributes, and the vulnerability feature knowledge base. Specifically, firstly, the scope of the original logs to be processed is defined using the component's abnormal period as the time boundary, ensuring that the analysis focuses on log data within the time interval where the vulnerability may occur. Secondly, using the component tag list with vulnerability context attributes, log content related to the affected dependent components is filtered from the original logs. The vulnerability context attributes contained in the component tags can clearly define the correlation between the logs and the component roles in the vulnerability exploitation propagation chain, thereby narrowing the scope of log analysis. Subsequently, the logs filtered by component tags are further matched with typical behavioral characteristics related to security vulnerabilities of third-party open-source components compiled in the vulnerability feature knowledge base to identify log entries that meet the vulnerability characteristics. These characteristics are constructed based on vulnerability feature keywords, historical vulnerability patterns, and open-source component vulnerability threat intelligence, which can accurately correspond to various behaviors in the vulnerability propagation chain. Through the above three layers of filtering and association, the log entries finally obtained are related to each link in the vulnerability propagation chain, providing accurate and focused log evidence for subsequent in-depth analysis of the vulnerability exploitation propagation chain and locating the root cause of the vulnerability.

[0082] Optional, such as Figure 3 As shown, the specific steps of S3 include:

[0083] The core evidence chain log entries related to open-source component security vulnerabilities are structured and parsed to extract inherent attributes such as timestamps, component identifiers, and operation behavior types from the logs. Basic event nodes representing open-source component security vulnerability events are generated to transform unstructured vulnerability-related logs into structured nodes, providing standardized input data for subsequent node association and graph generation based on the open-source component security vulnerability causal relationship rule base.

[0084] A causal relationship rule base for open-source component security vulnerabilities is constructed based on tactical and technical entities and their hierarchical dependencies. This provides a standardized and practical logical basis for the association of vulnerability behaviors, eliminating experience-based dependencies and semantic ambiguities in security analysis. Specifically, firstly, the tactics and technologies related to open-source component security vulnerabilities are logically modeled to clarify the preconditions, triggering actions, and consequences of different vulnerability technologies in the process, forming basic causal relationship rules. Secondly, based on global real-world vulnerability cases, vulnerability behavior patterns and characteristics are extracted, mapped to corresponding technical entities, and the inter-technical relationship logic is supplemented to improve the rule details, making the rule base more relevant to actual vulnerability scenarios.

[0085] By using semantic parsing techniques fine-tuned with a BERT pre-trained language model and behavioral feature extraction tools based on a regular expression library, the text describing the operational behavior of basic event nodes is parsed to extract standardized behavioral semantic and structural features. These features are then compared with the baseline behavioral features of technical entities in the open-source component security vulnerability causal relationship rule base using cosine similarity calculation and rule matching. Based on the results, basic event nodes are assigned corresponding technical IDs and tactical stage labels to generate enhanced event nodes. These nodes are used to achieve standardized classification of vulnerability behaviors and location of propagation chain links, ensuring that the behaviors of logs from different sources can be aligned within a unified framework.

[0086] Based on the dependency relationships between vulnerability phase transition logic and technology in the rule base, enhanced event node sequences are validated in multiple dimensions: First, temporal continuity is validated by calculating the time difference between adjacent nodes based on node timestamps and referring to typical time windows for similar vulnerability phase transitions in the rule base to determine whether the node sequence time order conforms to the vulnerability behavior logic, thus eliminating node pairs with contradictory time orders. Second, component interaction topology is validated by combining the component identifiers associated with nodes and component tags with vulnerability context attributes, and referring to component interaction relationships in the rule base to verify whether the components involved in the node have reasonable interaction paths, thus eliminating node pairs without reasonable paths. Finally, causal strength is calculated and filtered by using a weighted algorithm to calculate the causal strength score between nodes based on the pre-set association confidence weights in the rule base and the node attribute fit, retaining candidate node pairs with scores exceeding the threshold defined in the rule base as valid association pairs. Through multi-dimensional validation, valid node association pairs that conform to vulnerability logic, have reasonable paths, and meet the causal strength standard are selected, laying the foundation for generating an accurate vulnerability network graph.

[0087] The system connects verified pairs of enhanced event nodes with directed edges, and labels the edge attributes with the causal types defined in the open-source component security vulnerability causal relationship rule library. Finally, it generates a structured vulnerability causal network graph that starts from the initial intrusion event, extends through key vulnerability action nodes to the final impact event, and is used to transform discrete log entries into a graph structure with explicit dependencies, providing a clear logical framework for tracing the root causes and reconstructing the propagation chain of open-source component security vulnerabilities.

[0088] Optional, such as Figure 4 As shown, the specific steps of S4 include:

[0089] Starting from the terminal alert node that ultimately triggers the vulnerability in the causal network graph of open-source component security vulnerabilities, a depth-first search strategy is used for reverse traversal. During the traversal, the process behavior logs of each node are analyzed in real time. When a node is detected that meets the key behavioral characteristics of the open-source component vulnerability propagation chain, it is marked as a candidate root node. The key behavioral characteristics are: the earliest operation record on the vulnerability exploitation propagation chain timeline where illegal parameter input triggers a buffer overflow, the earliest behavior of unauthorized calls to sensitive interfaces or access to unauthorized resources, and the existence of a process entity where function calls return abnormally due to component version adaptation defects. The backtracking process continues to advance upstream in the vulnerability propagation chain until one of the following termination conditions representing the starting point of the vulnerability propagation chain is met: reaching the initial process node that has no prior dependent behavior in tactical logic, or discovering a single node that simultaneously triggers composite vulnerability behavior across multiple tactical stages. The final generated candidate root node set is accompanied by an encrypted vulnerability exploitation propagation chain fingerprint. This fingerprint is generated by extracting the tactical stage identifier sequence corresponding to all nodes on the path from the candidate node to the terminal alert node, and generating an irreversible digest through a cryptographic hash function. This digest is used to completely trace and verify the full-chain vulnerability logic from the potential initial vulnerability point to the abnormal terminal behavior.

[0090] Secondly, for each node in the candidate root node set, four types of multi-dimensional feature vectors are extracted from the causal network graph of open-source component security vulnerabilities, including ontology features, behavioral evidence features, graph structure features, and temporal features. The ontology features capture abnormal behavior patterns of open-source component vulnerabilities, quantifying the degree of input anomalies by calculating the compliance deviation of component function call parameters, identifying version risks by combining the matching status of the component version with known vulnerability databases, and analyzing permission verification logs to identify unauthorized operation traces. The behavioral evidence features focus on core activities in the vulnerability propagation chain, integrating the frequency of parameter verification failures in the node's interface calls, the strength of memory access violations during component runtime, and the permission abuse coefficient calculated based on the frequency of access to sensitive configuration files. The graph structure features analyze the strategic position of the node in the global vulnerability topology, quantifying its tactical depth distance to the terminal alert node, the number of outgoing edges from directly downstream vulnerability nodes, and the proportion of abnormal nodes in its K-order neighbor subnet. The temporal features track vulnerability rhythm anomalies, measuring the time deviation between the node's behavior timestamp and the expected vulnerability stage transition model, and calculating the total vulnerability time from the node's trigger to the terminal alert. The extracted feature vectors of the above four types are input into the graph attention temporal network model for vulnerability trigger confidence assessment. Specifically, ontology features and behavioral evidence features are nonlinearly transformed through a fully connected neural network to learn the implicit expression of the inherent behavioral pattern of the vulnerability. Graph structure features are processed through a graph attention mechanism, which calculates dynamic attention weights for each node and each neighbor node in its K-order neighborhood. The weight distribution is generated based on the features of neighbor nodes and the attributes of connecting edges, and then the states of neighbor nodes are weighted and aggregated to capture the structural influence of local vulnerability subnets. Temporal features are processed by a temporal convolution module, which uses a one-dimensional convolution kernel with adjustable dilation rate to slide along the time axis and extracts the temporal dependency pattern of vulnerability phase switching through multi-layer dilated convolution. The processed feature streams are input into the tactical awareness attention fusion layer. This layer automatically learns the weight allocation strategy between feature streams based on the tactical category involved in the current node, and performs weighted fusion of the fully connected network output, graph attention aggregation result, and temporal convolution features. Finally, it outputs a confidence probability value representing the node as an initial vulnerability point or core vulnerability module.

[0091] All nodes with confidence probabilities exceeding a preset threshold are selected to generate a candidate node set. This threshold is obtained through experimental fitting using historical data and real-time scenarios. The candidate node set is then refined based on the correlation of the vulnerability causal chain to generate a set of initial vulnerability trigger points. Specifically, when multiple nodes exceeding the preset threshold exist in the same vulnerability causal chain, the temporal progression characteristics and the principle of source uniqueness of the vulnerability propagation chain are strictly followed. Only the earliest node with the highest confidence is retained to accurately pinpoint the true starting point of the vulnerability propagation chain—the critical node where the vulnerability is first triggered or the component first exhibits an anomaly. This prevents subsequent derived nodes on the same vulnerability propagation chain from interfering with the determination of the initial vulnerability point, ensuring that the source analysis focuses on the vulnerability's origin. For nodes in the candidate node set belonging to independent vulnerability causal chains that exceed the preset threshold, all are retained to fully cover potential multi-source concurrent vulnerability scenarios, avoiding omission of any initial trigger traces in the vulnerability propagation chain and ensuring a comprehensive presentation of the complex situation of open-source component security vulnerabilities.

[0092] Optionally, the specific steps for S5 are as follows:

[0093] The system invokes known vulnerability propagation chain patterns, tactical techniques, and associated context rules stored in the component vulnerability case library to deduce the vulnerability exploitation propagation chain for the vulnerability triggering initial point set. This deduction employs a bidirectional traversal strategy: forward expansion starts from each initial vulnerability point in the vulnerability triggering initial point set and proceeds layer by layer using a breadth-first strategy. Specifically, a single-node initial path is first created for each initial vulnerability point, stored in a path queue in the order of generation, and marked as unexpanded. Then, unexpanded paths are extracted from the head of the queue, their end nodes are located, and all direct downstream nodes are queried based on the vulnerability causal network graph. Subsequently, downstream nodes are verified for stage transitions according to the tactical-level deduction rules of the component vulnerability case library, retaining only nodes that meet the subsequent dependencies of the current end node's tactical stage. Next, nodes that pass tactical verification are verified for technical feasibility, checking whether the prerequisite technical conditions are met by existing technical nodes in the current path. For nodes that pass dual verification, a timestamp later than the current end node is assigned and added to the end of the path to form a new chain, marked as unexpanded and stored at the tail of the queue. This process is repeated until no downstream node meets the conditions for the end node, at which point the forward traversal terminates.

[0094] The reverse backtracking process starts with the terminal alarm node and proceeds in a breadth-first, reverse manner. Specifically, the terminal alarm node is first stored in a queue as the initial backtracking path and marked as incomplete. Then, incomplete paths are extracted from the head of the queue, their starting nodes are located, and all direct upstream nodes are queried. Subsequently, the causal necessity of upstream nodes is verified, and it is determined whether they are reasonable preliminary operations based on the causal relationship rules of the component vulnerability case library. At the same time, it is verified whether the timestamp of the upstream node is earlier than the current starting node. For upstream nodes that pass the verification, they are added to the beginning of the path to form a new backtracking path, marked as incomplete, and stored at the tail of the queue. If a key causal node is found to be missing, causing a logical break, the backtracking of that path is terminated. The above process is repeated until no upstream node that meets the conditions can be found for any path or the process terminates due to a logical break, at which point the reverse traversal ends.

[0095] Extract the intersection set of candidate paths generated by forward expansion and reverse backtracking, sort them in ascending order by timestamp, obtain the candidate vulnerability exploitation propagation chain set, and at the same time ensure the legitimacy of the stage technology starting from the initial vulnerability point and the causal coherence to the terminal alarm node.

[0096] Calculate the matching degree between each candidate vulnerability propagation chain and the features of known open-source component vulnerability propagation chains in the component vulnerability case library. Specifically, extract the technology ID sequence corresponding to all nodes on the candidate path, compare it item by item with the feature sequence of archived vulnerability propagation chains in the knowledge base, and calculate the path matching score using a weighted similarity algorithm, combining the order of appearance of technical entities, the strength of contextual dependencies, and the uniqueness of technology combinations. Simultaneously, comprehensively calibrate the matching score by combining the topological interaction rationality of the components involved in the nodes, the consistency of vulnerability phase transition time, and the cumulative value of behavioral evidence strength. Finally, select the vulnerability propagation chain with the highest matching score and its associated vulnerability triggering initial point set to reconstruct the most likely vulnerability propagation chain, clarify the vulnerability step sequence, the lateral movement impact range, and the final goal, providing core logical evidence chain support for identifying the real vulnerability entry point. Optionally, the specific steps of S6 include:

[0097] Based on the most probable vulnerability propagation chain and the set of associated vulnerability triggering initial points, a pre-trained language model is used to automatically generate a structured root cause localization report. The report must include three core modules: root cause diagnosis, evidence chain, and remediation recommendations. Root cause diagnosis focuses on the key causal link from the initial vulnerability point to the final vulnerability target, clarifying the logical connections between the core weaknesses and key steps leading to the vulnerability. The evidence chain integrates verification information from each node in the vulnerability propagation chain, matching criteria from the component vulnerability case library, and behavioral consistency proof under time constraints, forming a traceable evidence system. Remediation recommendations address identified vulnerability points, technical weaknesses, and tactical defense gaps, proposing targeted defense strategies and remediation measures based on the characteristics of the vulnerability propagation chain, ensuring direct correspondence with key links in the vulnerability propagation chain.

[0098] When a user correctly identifies an initial vulnerability, the system creates a verified solution tag for that vulnerability propagation chain and the corresponding initial vulnerability in the component vulnerability case library. The tag includes characteristics of the correct initial vulnerability, verification criteria, and key node association information in the vulnerability propagation chain, making it a confirmed and valid reference case in the knowledge base. Subsequently, when a new vulnerability event is detected, the system automatically calculates the similarity of the encoded vectors between the new vulnerability propagation chain and historical propagation chains. If the similarity exceeds a preset threshold, the system determines that the new vulnerability is highly similar to the historical scenario and will automatically retrieve and prioritize verified solutions to accelerate the response and processing speed for similar vulnerabilities and improve defense efficiency.

[0099] When a user incorrectly identifies an initial vulnerability, the system extracts the correct initial vulnerability and its associated complete evidence chain provided by the user. The incorrect initial vulnerability is treated as a negative sample, and the correct initial vulnerability as a positive sample, and these are added to the training dataset of the graph attention temporal network model, triggering incremental model training. During training, the model relearns the feature distribution and discrimination rules of the initial vulnerability based on the new samples, dynamically adjusting the confidence evaluation weights of each node to enhance the sensitivity to the identification of correct initial vulnerability features and reduce the probability of misclassification of similar incorrect nodes. Through continuous sample input and model iteration, the graph attention temporal network model more accurately locates the initial vulnerability of new open-source component security vulnerabilities, thereby improving the accuracy and reliability of vulnerability exploitation propagation chain tracing and root cause localization. Ultimately, this forms a continuous iterative defense closed loop of "user feedback driving model optimization—model optimization improving detection capabilities—new detection results obtaining more feedback," continuously enhancing the dynamic defense capabilities against various open-source component security vulnerabilities.

[0100] Those skilled in the art will understand that, in the above-described method of the specific implementation, the writing order of each step does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0101] Example 2

[0102] In this embodiment, as Figure 4 This provides a security vulnerability AI localization system based on log files, used to implement a security vulnerability AI localization method based on log files, including:

[0103] The information extraction module is configured to analyze user feedback, including text, screenshots, log fragments, etc., through a multimodal AI model, accurately extract key entity information of the fault, and supplement fuzzy information based on intelligent interaction strategies to improve the completeness and accuracy of entity extraction.

[0104] The log filtering module is configured to filter log entries related to security vulnerabilities of open-source components from the raw logs based on information about critical entities with faults, using time-series filtering technology.

[0105] The vulnerability propagation graph construction module is configured to parse log entries to generate basic event nodes and build a vulnerability propagation graph based on the vulnerability propagation rule base.

[0106] The intrusion point identification module is configured to identify abnormal source nodes in the vulnerability propagation graph based on a graph traversal algorithm to generate a candidate node set, and to use a graph neural network to evaluate the vulnerability trigger confidence of the candidate nodes, and filter candidate nodes that exceed a preset threshold to generate an initial vulnerability trigger point set.

[0107] The vulnerability exploitation propagation chain deduction module is configured to, based on the vulnerability triggering initial point set, call the component vulnerability case library to deduce the vulnerability exploitation propagation chain, calculate the matching degree of each path with the known open source component vulnerability exploitation chain characteristics, and obtain the vulnerability exploitation propagation chain with the highest probability and its associated vulnerability triggering initial point set;

[0108] The report generation and feedback module is configured to generate a root cause localization report based on the highest probability vulnerability exploitation propagation chain and the initial set of vulnerability triggers, and update the component vulnerability case library or graph neural network model training data according to the user verification results.

[0109] In this embodiment, the log file-based problem localization system forms a complete closed loop for locating security vulnerabilities in open-source components through the collaborative operation of various modules. The information extraction module first parses the descriptions of open-source component security vulnerabilities reported by users, accurately extracting key entity information about the faults to provide targeted guidance for subsequent processing. The log filtering module, based on this key information, uses time-series filtering technology to efficiently filter log entries related to open-source component security vulnerabilities from massive amounts of raw logs, reducing interference from irrelevant data. The graph construction module performs structured parsing on the filtered log entries, generating basic event nodes, and constructs a vulnerability propagation graph that clearly presents the association of vulnerability events based on a vulnerability propagation rule base. The intrusion point identification module uses a graph traversal algorithm to identify abnormal source nodes in the graph to form candidate nodes. The system first sets a set of nodes, then uses a graph neural network to evaluate the confidence level of node vulnerability triggers, and selects candidate nodes that exceed a preset threshold to form an initial set of vulnerability trigger points. The vulnerability exploitation propagation chain deduction module takes the initial set of vulnerability trigger points as the starting point, calls the component vulnerability case library to deduce possible vulnerability exploitation propagation chains, and determines the most probable vulnerability exploitation propagation chain and its associated initial set of vulnerability trigger points by calculating the matching degree with the features of known vulnerability exploitation chains. The report generation and feedback module finally generates a root cause localization report based on the above results, and dynamically updates the component vulnerability case library or graph neural network model training data according to user verification results to continuously optimize the system's localization capabilities.

[0110] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A security vulnerability location method based on log files using AI, characterized in that, include: Analyze user feedback describing security vulnerabilities in open-source components and extract key entity information about the faults; Based on the information of the critical entities involved in the failure, time-series filtering technology is used to filter log entries related to security vulnerabilities of open-source components from the original logs. The log entries are parsed to generate basic event nodes, and a vulnerability propagation graph is constructed based on the vulnerability propagation rule base. A graph traversal algorithm is used to identify abnormal source nodes in the vulnerability propagation graph to generate a candidate node set. A graph neural network is used to evaluate the vulnerability trigger confidence of the candidate nodes, and candidate nodes exceeding a preset threshold are selected to generate an initial vulnerability trigger point set. Based on the aforementioned vulnerability triggering initial point set, the vulnerability exploitation propagation chain is deduced by calling the component vulnerability case library, and the matching degree between each vulnerability exploitation propagation chain and the known open-source component vulnerability exploitation chain characteristics is calculated to obtain the vulnerability exploitation propagation chain with the highest probability and its associated vulnerability triggering initial point set. Based on the maximum probability vulnerability exploit propagation chain and the initial set of vulnerability triggers, a root cause localization report is generated and executed: (a) When the user verifies that the initial vulnerability point is correct, mark the verified solution in the component vulnerability case library; (b) When a user verifies that the initial vulnerability point is incorrect, the correct initial vulnerability point and evidence chain provided by the user are used as positive samples, and the incorrect initial vulnerability point is used as a negative sample to update the training data of the graph neural network model.

2. The AI-based security vulnerability location method based on log files according to claim 1, characterized in that, The critical entity information of the fault includes vulnerability characteristic keywords, the time period of the fault, and the affected dependent components.

3. The AI-based security vulnerability location method based on log files according to claim 1, characterized in that, The extraction of key fault entity information includes: A multimodal large model is used to parse the vulnerability descriptions submitted by users, and preliminary entity information is extracted through text semantic understanding. The preliminary entity information includes vulnerability feature keywords, the time period of failure, and the affected dependent components. The initial entity information is subjected to consistency verification, and the pre-trained language model fine-tuned by open-source component vulnerability domain corpus is used to correct the single-modal parsing error. When ambiguous information exists, a targeted supplementary request is generated through an adaptive questioning strategy trained by reinforcement learning until the completeness of the key entity information meets a preset threshold, and then the faulty key entity information is output.

4. The AI-based security vulnerability location method based on log files according to claim 3, characterized in that, The method of using time-series filtering technology to filter log entries related to security vulnerabilities in open-source components from raw logs includes: Based on the time period of the failure, the abnormal time period of the component is set by combining the component interaction and vulnerability lifecycle framework and relevant open source component vulnerability threat intelligence. Based on the affected dependent components, generate a list of component tags with vulnerability context attributes; Based on the aforementioned vulnerability characteristic keywords, and combined with historical vulnerability case libraries and open-source component vulnerability threat intelligence, a vulnerability characteristic knowledge base is constructed. The original logs are captured during abnormal periods using the component, and the captured logs are filtered and retrieved using the component tag list and the vulnerability feature knowledge base in sequence, outputting log entries related to the vulnerability propagation chain.

5. The security vulnerability AI localization method based on log files according to claim 4, characterized in that, The abnormal period of the component includes the pre-buffering time, the core burst time, and the post-tracking time.

6. The security vulnerability AI localization method based on log files according to claim 1, characterized in that, The constructed vulnerability propagation map includes: The log entries related to the security vulnerabilities of the open-source components are structured and parsed to extract inherent log attributes, generate basic event nodes, parse the operation behavior description text of the basic event nodes, and extract standardized behavior features; the inherent log attributes include timestamp, component identifier, and operation behavior; Based on the entity of the vulnerability behavior knowledge framework, construct an open-source component security vulnerability causal relationship rule base; The standardized behavioral characteristics are matched with the baseline behavioral characteristics of technical entities in the open-source component security vulnerability causal relationship rule base, and the basic event nodes are assigned technical identifiers and tactical phase labels to generate enhanced event nodes. Based on the open-source component security vulnerability causal relationship rule library, the enhanced event node sequence is subjected to time continuity verification, component interaction topology verification, and causal strength calculation to filter out valid node association pairs; An enhanced event node in the effective node association pair is connected by directed edges labeled with causal type to generate a structured vulnerability causal network graph.

7. The AI-based security vulnerability location method based on log files according to claim 1, characterized in that, The step of identifying potential abnormal source nodes in the vulnerability propagation graph to form a candidate node set, evaluating the vulnerability triggering confidence of the candidate nodes using a graph neural network model, and filtering candidate nodes exceeding a preset threshold to generate an initial set of vulnerability triggering points includes: Starting from the terminal alarm node that is finally triggered in the causal network graph of the security vulnerability of the open source component, a depth-first search strategy is used to perform reverse traversal. During the traversal, the process behavior logs of each component running node are parsed, and the component running nodes that meet the key behavioral characteristics of the vulnerability propagation chain are marked as candidate root nodes. For each candidate root node in the candidate root node set, a multi-dimensional feature vector of the candidate root node is extracted from the vulnerability propagation graph. The multi-dimensional feature vector includes ontology features, behavioral evidence features, graph structure features, and temporal features. The multidimensional feature vector is input into the graph attention temporal network model for evaluation to obtain the vulnerability confidence probability value of each candidate root node, and candidate root nodes whose vulnerability confidence probability value exceeds a preset threshold are selected to form the candidate node set. If the candidate node set contains multiple candidate nodes that belong to the same vulnerability causal chain and exceed a preset threshold, then the candidate node with the earliest time and the highest vulnerability confidence probability value is retained; if the candidate node set contains candidate nodes that belong to independent vulnerability causal chains and exceed a preset threshold, then all such candidate nodes are retained, and the vulnerability triggering initial point set is generated after this filtering.

8. The AI-based security vulnerability location method based on log files according to claim 1, characterized in that, The vulnerability case library for the called components uses a bidirectional traversal strategy to deduce the vulnerability exploitation propagation chain, including: Starting from each initial vulnerability point in the vulnerability triggering initial point set, a forward extension deduction is performed along the vulnerability causal direction in the vulnerability causal network graph, and node verification and path generation are performed according to the rules of the component vulnerability case library. Starting from the terminal alarm node, reverse backtracking is performed along the causal direction of the vulnerability in the vulnerability causal network graph, and node verification, timing constraint checks and logical integrity detection are performed according to the rules of the component vulnerability case library. Extract the set of nodes at the intersection of the vulnerability exploitation propagation chain generated by the forward expansion deduction and the backtracking path generated by the reverse backtracking deduction; Arrange all nodes in the intersection node set in ascending order of their timestamps to generate a candidate vulnerability exploit propagation chain set.

9. The AI-based security vulnerability location method based on log files according to claim 1, characterized in that, The step of using a graph neural network model to evaluate the vulnerability trigger confidence of candidate nodes and selecting candidate nodes exceeding a preset threshold to generate an initial set of vulnerability trigger points includes: Extract the technical IDs corresponding to all nodes on the propagation chain set of the candidate vulnerabilities to form a technical ID sequence; The technology ID sequence is compared item by item with the component vulnerability exploitation chain feature sequence of the archived vulnerability propagation chain in the component vulnerability case library; The path matching score of the candidate vulnerability exploitation propagation chain is calculated by combining the order of appearance of technical entities, the strength of contextual dependency, and the uniqueness of the technical combination. The path matching score is comprehensively calibrated by combining the topological interaction rationality of the components involved in the nodes of the candidate vulnerability exploitation propagation chain, the time consistency of the vulnerability phase transition, and the cumulative value of the behavioral evidence strength. The candidate vulnerability propagation chain with the highest path matching score and its associated vulnerability triggering initial point set are selected, and the vulnerability propagation chain is reconstructed.

10. A security vulnerability location system based on log files, characterized in that, To implement the AI-based security vulnerability localization method based on log files as described in any one of claims 1 to 9, the method includes: The information extraction module is configured to parse user feedback and extract key entity information related to the fault. The log filtering module is configured to filter log entries related to security vulnerabilities of open-source components from the original logs based on the fault key entity information and using time-series filtering technology. The vulnerability propagation graph construction module is configured to parse the log entries to generate basic event nodes and construct a vulnerability propagation graph based on the vulnerability propagation rule base. The intrusion point identification module is configured to identify abnormal source nodes in the vulnerability propagation graph based on a graph traversal algorithm to generate a candidate node set, and to use a graph neural network to evaluate the vulnerability trigger confidence of the candidate nodes, and to filter candidate nodes that exceed a preset threshold to generate an initial vulnerability trigger point set. The vulnerability exploitation propagation chain deduction module is configured to, based on the vulnerability triggering initial point set, call the component vulnerability case library to deduce the vulnerability exploitation propagation chain, calculate the matching degree of each path with the known open source component vulnerability exploitation chain characteristics, and obtain the vulnerability exploitation propagation chain with the highest probability and its associated vulnerability triggering initial point set; The report generation and feedback module is configured to generate a root cause localization report based on the highest probability vulnerability exploitation propagation chain and vulnerability triggering initial point set, and update the component vulnerability case library or graph neural network model training data according to the user verification results.

Images