Network security data analysis method and system based on large model, and medium

Abstract

The invention relates to the technical field of network security, in particular to a network security data analysis method and system based on a large model and a medium. According to the technical scheme, the network security data analysis method based on the large model comprises the following steps: acquiring a multi-source heterogeneous log in real time from a firewall, an intrusion detection system or an intrusion prevention system, a Web application firewall, a server operating system and a service application through a distributed acquisition agent; performing data cleaning on the original log: removing repeated entries, filling missing fields, unifying a timestamp format, and extracting key structured fields including a source IP address, a target IP address, an operation type and a user ID; and performing deep semantic analysis on the cleaned log by using a pre-training large model based on a Transform architecture, and generating vectorized feature representation fused with context semantics. The semantic understanding accuracy of security terminologies is remarkably improved, and the misjudgment defect caused by domain knowledge deficiency of a traditional model is thoroughly overcome.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security data analysis method, system, and medium based on a large model. Background Technology

[0002] Currently, the cybersecurity field commonly employs rule-based signature (such as Snort and YARA) and traditional machine learning models (such as LSTM sequence analysis) analysis methods. These technologies process log data generated by firewalls, IDS / IPS, and other devices through predefined rule bases or simple pattern recognition for anomaly detection and threat classification. Domestic and international research progress includes the application of the CyberTransformer model from MIT Lincoln Lab to network traffic analysis, the LogBERT from Nanyang Technological University in Singapore for log pre-training based on the BERT architecture, and the optimization of Chinese log encoding by LogBERT-CN from Tsinghua University in China, as well as the integration of security knowledge graphs into Huawei's Pangu Security Big Data Model. The overall direction focuses on pre-training + fine-tuning paradigms, unsupervised learning, and multimodal data fusion to improve the ability to identify known threats.

[0003] However, these existing technologies still have fundamental bottlenecks, specifically: the difficulty in intelligent standardization of multi-source heterogeneous logs, such as system audit logs and network device logs, makes it impossible for traditional regular expressions to efficiently parse unstructured content; semantic understanding biases in unstructured security data make it difficult for general large models to accurately identify technical terms such as APT attack chains; insufficient correlation analysis capabilities for threat clues, making it impossible to reconstruct cross-device attack paths from scattered events; at the same time, it is difficult to balance the requirements of low false positive rate and real-time performance, and resource constraints in the intranet environment further limit the analysis efficiency, urgently requiring innovative technological breakthroughs. Summary of the Invention

[0004] This invention proposes a network security data analysis method, system, and medium based on a large model, which solves the problem that existing technologies cannot meet the high-precision threat detection requirements due to the limitations of traditional methods in semantic understanding and real-time processing of multi-source heterogeneous network security logs.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0006] A network security data analysis method based on a large model includes the following steps:

[0007] The distributed acquisition agent obtains multi-source heterogeneous logs in real time from firewalls, intrusion detection systems or intrusion prevention systems, web application firewalls, server operating systems and business applications.

[0008] Perform data cleaning on the raw logs: remove duplicate entries, fill in missing fields, standardize timestamp format, and extract key structured fields including source IP address, destination IP address, operation type, and user ID;

[0009] We use a pre-trained large model based on the Transformer architecture to perform deep semantic parsing on the cleaned logs and generate vectorized feature representations that integrate contextual semantics.

[0010] By combining time-series sliding window analysis to identify periodic patterns in log event sequences, and by constructing the association topology between devices, users, and network areas through graph neural networks, abnormal behavior chains can be identified.

[0011] Deploy a multi-agent collaborative framework: The parsing agent, detection agent, and judgment agent work together to perform threat classification, advanced persistent threat attack chain reconstruction, and automated response actions.

[0012] Furthermore, the data cleaning and standardization process specifically includes:

[0013] It adopts an intelligent classification engine based on a large model to map unstructured log content, such as error descriptions or operation instructions, to preset standardized field templates, replacing traditional regular expression matching;

[0014] Log types are classified into multiple levels: the first level is classified by source as network device logs, security device logs, or host logs; the second level is classified by event type as access control events, permission change events, or data transmission events.

[0015] Furthermore, the domain adaptation of the pre-trained large model includes:

[0016] In the pre-training stage of the general corpus, a masked language modeling task is used to learn basic semantic representations;

[0017] During the network security fine-tuning phase, labeled high-persistent threat attack chain log sequences are used to optimize the model's ability to extract features of attack patterns through comparative learning.

[0018] Furthermore, the spatiotemporal feature modeling further includes:

[0019] Temporal modeling: Extract the frequency of log events, interval variance, and burst index, and learn long-term dependencies through a long short-term memory network;

[0020] Spatial modeling: A bipartite graph is constructed based on the communication relationships between devices, and node embedding vectors are generated using a node-to-vector algorithm to quantify the deviation of device behavior.

[0021] Furthermore, the threat classification and attribution steps include:

[0022] The feature vectors output by the large model are input into the isolated forest algorithm to detect outliers that deviate from the normal behavior distribution;

[0023] By using dynamic prompt word templates, such as parsing lateral movement behavior in logs, the large model is guided to generate an attack chain report, marking the attack stage as the initial intrusion stage, privilege escalation stage, or goal achievement stage.

[0024] A network security analysis system, based on the aforementioned large-model-based network security data analysis method, includes:

[0025] Data Acquisition Layer: A log collector that integrates system log protocol interfaces or Kafka interfaces, supporting real-time streaming data transmission;

[0026] Analysis and processing layer: includes a lightweight inference engine for real-time detection and a large model base for deep analysis, with built-in retrieval enhancement and generation enhancement retrieval modules and a multi-agent collaboration engine;

[0027] Business Function Layer: Provides a visual dashboard that dynamically displays threat heatmaps, attack path topology, and automated handling logs.

[0028] Furthermore, the implementation method of the enhanced retrieval module is as follows:

[0029] Construct a security knowledge vector library: embed historical alerts, expert handling plans, and vulnerability database entries into a 768-dimensional vector using a large-scale bidirectional coding model;

[0030] A hybrid retrieval strategy is adopted: combining the best-match 25 keyword retrieval with cosine similarity calculation to recall highly relevant contexts;

[0031] The search results are injected into the prompt template, driving the large model to generate interpretable threat analysis conclusions.

[0032] Furthermore, the multi-agent cooperative engine employs:

[0033] Model Context Protocol: Defines the metadata format for communication between agents, including event ID, confidence level, and action recommendations;

[0034] Dynamic task routing mechanism: Based on the complexity of events, tasks are assigned to parsing agents to process data standardization or to judgment agents to perform advanced persistent threat attack chain inference.

[0035] Furthermore, the optimizations to the lightweight inference engine include:

[0036] Transfer the capabilities of large models to small BERT architectures through knowledge distillation;

[0037] We use integer 8-bit quantization to compress the model volume and combine it with the Apache Flink framework to achieve millisecond-level real-time stream processing.

[0038] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a terminal processor, implements a network security data analysis method based on a large model as described in any one of claims 1 to 5;

[0039] Perform the following operations:

[0040] Load the pre-trained large model weights and lightweight inference engine configuration parameters;

[0041] Dynamically construct a behavioral baseline model based on device topology;

[0042] Based on the enhanced search results, a visual attack path report is generated, and an automated response script is triggered.

[0043] The positive effects of this invention are as follows: by integrating spatiotemporal modeling technology that combines device topology relationships with behavioral temporal characteristics, it achieves full lifecycle semantic reconstruction of advanced persistent threat attack chains and accurately identifies attack stages; by combining a retrieval enhancement generation mechanism with vulnerability databases and expert experience, it significantly improves the accuracy of semantic understanding of security terminology and completely solves the misjudgment defects caused by the lack of domain knowledge in traditional models.

[0044] Based on a lightweight inference architecture using knowledge distillation and quantization compression, it breaks through the computing power constraints of the intranet environment, enabling real-time processing of massive logs and minute-level response closed loops. Relying on dynamic behavior baseline modeling technology, it builds millisecond-level streaming processing capabilities, simultaneously supporting the collaborative execution of threat detection and automated handling actions, and reshaping the standard for security operation timeliness.

[0045] With a layered architecture design, data collection → analysis and processing → business functions are integrated at the business layer. Dynamic prompt word engineering and visual tracing capabilities are integrated to empower non-professionals to accurately locate complex threats through natural language interaction. The multi-agent collaboration framework reconstructs the handling process with standardized protocols, transforming the experience of security experts into reusable response actions and promoting the evolution of the industry's defense model towards proactive immunity.

[0046] A layered architecture enables collaborative operation of the data acquisition layer, analysis and processing layer, and business function layer: real-time access to multi-source device logs via a distributed agent, supporting protocols such as Syslog and Kafka, and unified processing of heterogeneous data through a standardization engine; integration of a lightweight inference engine and a large model base, embedding signature matching, statistical analysis, and threat intelligence modules to balance detection accuracy and real-time requirements; and provision of asset topology management, interactive reports, and AI decision assistants to achieve one-click tracing and handling verification of security incidents. Detailed Implementation

[0047] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0048] Example

[0049] A network security data analysis method based on a large model includes the following steps:

[0050] The distributed acquisition agent obtains multi-source heterogeneous logs in real time from firewalls, intrusion detection systems or intrusion prevention systems, web application firewalls, server operating systems and business applications.

[0051] Perform data cleaning on the raw logs: remove duplicate entries, fill in missing fields, standardize timestamp format, and extract key structured fields including source IP address, destination IP address, operation type, and user ID;

[0052] We use a pre-trained large model based on the Transformer architecture to perform deep semantic parsing on the cleaned logs and generate vectorized feature representations that integrate contextual semantics.

[0053] By combining time-series sliding window analysis to identify periodic patterns in log event sequences, and by constructing the association topology between devices, users, and network areas through graph neural networks, abnormal behavior chains can be identified.

[0054] Deploy a multi-agent collaborative framework: The parsing agent, detection agent, and judgment agent work together to perform threat classification, advanced persistent threat attack chain reconstruction, and automated response actions.

[0055] Specifically:

[0056] Multi-source log collection utilizes a distributed collection agent to acquire heterogeneous logs from firewalls, intrusion detection systems (IDS / IPS), web application firewalls (WAF), server operating systems, and business applications in real time. Log formats include Syslog, JSON, and text, and protocols support core network protocols such as HTTP, DNS, and TCP / IP. Streaming data ingestion is achieved using ELK (Elasticsearch, Logstash, Kibana) or Splunk tools to ensure the real-time performance and integrity of log data.

[0057] Data cleaning and standardization involve deep cleaning of raw logs: removing duplicate entries based on timestamps and source IP hashes; filling missing fields (such as empty target IPs) using adjacent record interpolation algorithms; and extracting key structured fields (source IP, target IP, operation type, user ID). A large-scale intelligent classification engine maps unstructured log content (such as error description text and operation instructions) to pre-defined standardized field templates, replacing traditional regular expression parsing. Log types are classified in a two-layer structure: the first layer categorizes logs by source (network device logs, security device logs, or host logs); the second layer categorizes them by event type (access control events, permission change events, or data transmission events).

[0058] Large-scale feature extraction utilizes pre-trained models with Transformer architectures (such as BERT or RoBERTa) for semantic parsing. Model training is divided into two phases: pre-training and fine-tuning. In the pre-training phase, a masked language modeling (MLM) task is performed on the Wikipedia general corpus to learn basic semantic representations. In the fine-tuning phase, labeled APT attack chain log sequences are used to optimize the model's feature extraction capability for attack patterns through comparative learning. The final output is a 768-dimensional semantic vector (based on [CLS] token representation), incorporating contextual semantic information from the logs.

[0059] Spatiotemporal feature modeling includes temporal modeling and spatial modeling. In temporal modeling, the frequency of log events (number of times per unit time), interval variance (standard deviation of event interval), and burst index (calculated based on Poisson distribution) are extracted and input into a Long Short-Term Memory (LSTM) network to learn long-term dependencies within a 60-second time window. In spatial modeling, a bipartite graph network is constructed based on the communication relationships between devices, and a 128-dimensional node embedding vector is generated using the Node2Vec algorithm to quantify the spatial deviation of device behavior.

[0060] Multi-agent collaborative response, deploying parsing agents, detection agents, and judgment agents to form a collaborative framework: the parsing agent executes logs and stores them in a structured manner; the detection agent identifies behavioral anomalies based on the isolated forest algorithm (anomaly detection threshold contamination = 0.01); the judgment agent guides the large model to generate an APT attack chain report through dynamic prompt word templates (such as "parse the lateral movement behavior in the following logs"), marking the attack stages (initial intrusion → privilege escalation → data theft → target achievement).

[0061] Data cleaning and standardization specifically include:

[0062] It adopts an intelligent classification engine based on a large model to map unstructured log content, such as error descriptions or operation instructions, to preset standardized field templates, replacing traditional regular expression matching;

[0063] Log types are classified into multiple levels: the first level is classified by source as network device logs, security device logs, or host logs; the second level is classified by event type as access control events, permission change events, or data transmission events.

[0064] The intelligent classification engine uses a finely tuned large model to parse unstructured log content (such as the text "Invalid user access attempt") and map it to preset standardized field templates (field name: event type; field value: illegal access). The engine has a built-in multi-layer classifier: the first layer automatically classifies logs based on their source (network device logs are characterized by high-frequency short packets; host logs contain process IDs); the second layer matches event types based on semantic similarity (e.g., "Permission denied" is classified as a permission change event). Dynamic template adaptation is designed for logs from new business systems, dynamically expanding field templates through small-sample learning (e.g., adding an "API call failed" field), avoiding the limitations of traditional regular expressions that require manually written rules.

[0065] Domain adaptation of the pre-trained large model includes: in the general corpus pre-training stage, learning basic semantic representations using masked language modeling tasks; and in the network security fine-tuning stage, using labeled high-level persistent threat attack chain log sequences, optimizing the model's feature extraction capability for attack patterns through comparative learning.

[0066] In the network security fine-tuning phase, labeled APT attack chain log sequences (including stage labels such as initial penetration, lateral movement, and data outflow) are input into the model. Through a comparative learning task, the model distinguishes between normal operational and maintenance activities and attack behaviors. The fine-tuning data ratio is 70% normal logs and 30% attack logs. For lightweight adaptation, knowledge distillation technology is used to migrate the capabilities of the large model to the TinyBERT architecture for real-time scenarios, compressing model parameters to 30% of their original size and reducing inference latency to less than 50ms.

[0067] Spatiotemporal feature modeling further includes:

[0068] Temporal modeling: Extract the frequency of log events, interval variance, and burst index, and learn long-term dependencies through a long short-term memory network;

[0069] Spatial modeling: A bipartite graph is constructed based on the communication relationships between devices, and node embedding vectors are generated using a node-to-vector algorithm to quantify the deviation of device behavior.

[0070] The specific implementation method is as follows: First, time series analysis is performed, and core indicators are calculated by sliding the log event stream with a 60-second window. The core indicators include:

[0071] Occurrence frequency (times / second): An anomaly is triggered if the frequency exceeds 3 times the baseline value;

[0072] Interval variance: reflects the suddenness of an event (such as short-term, high-frequency login attempts);

[0073] Suddenness index: calculated based on Poisson distribution (λ>5 is considered a sudden flow).

[0074] Next, topological relationship embedding is performed to extract the device communication matrix (device A → device B: average daily access count), construct an unweighted bipartite graph, generate device embedding vectors (dimension 128) using the Node2Vec algorithm, and calculate cosine similarity to identify abnormal device groups (similarity < 0.2 is judged as isolated attack nodes).

[0075] Threat classification and attribution steps include:

[0076] The feature vectors output by the large model are input into the isolated forest algorithm to detect outliers that deviate from the normal behavior distribution;

[0077] By using dynamic prompt word templates, such as parsing lateral movement behavior in logs, the large model is guided to generate an attack chain report, marking the attack stage as the initial intrusion stage, privilege escalation stage, or goal achievement stage.

[0078] First, anomaly detection is performed. The feature vector output from the large model is input into the Isolation Forest algorithm, with an anomaly score threshold of 0.65 (scores > 0.65 are considered anomalies). Detected anomalies are correlated with the original logs to generate a detailed report containing the source IP, target port, and operation commands. Next, attack chain analysis is performed, guiding the large model to perform semantic reasoning through predefined dynamic prompt templates. For example, if the prompt "Analyze the privilege escalation behavior in the following logs: {log fragment}" is input, the model outputs an attack stage marker (stage type: privilege escalation; technique: sudo privilege escalation attempt; confidence level: 92%), which is automatically associated with the APT attack chain timeline.

[0079] Network security analysis systems include:

[0080] Data Acquisition Layer: This layer integrates a log collector with a system log protocol interface or a Kafka interface, supporting real-time streaming data transmission. Specifically, it collects logs from devices such as firewalls and IDS in real time via the Syslog interface and Kafka message queue. Raw logs are processed by a normalization engine (using a unified timestamp in ISO 8601 format), a filtering engine (discarding heartbeat packets), and a merging engine (merging duplicate alarms with the same event ID) before being output to the analysis layer.

[0081] Analysis and Processing Layer: Includes a lightweight inference engine for real-time detection and a large model base for deep analysis, with built-in retrieval enhancement and generation enhancement modules and a multi-agent collaboration engine; specifically, the lightweight inference engine runs the TinyBERT model to perform real-time anomaly detection (response time <100ms); the large model base deploys a full-parameter BERT model for deep attack chain analysis; built-in modules include a signature library (YARA rule matching for known threats), a statistical analysis module (calculating behavioral baselines), and a threat intelligence module (integrating external APT organization indicators).

[0082] Business Function Layer: Provides a visual dashboard that dynamically displays threat heatmaps, attack path topologies, and automated response logs. Specifically, this includes: asset management (maintaining a mapping table between device IPs and asset types); report management (automatically generating daily reports, including statistics on the top 10 threats); and an AI assistant (parsing user natural language queries, such as "What abnormal logins occurred last week?") and outputting visual analysis results.

[0083] The implementation method of the enhanced retrieval module is as follows:

[0084] Construct a security knowledge vector library: embed historical alerts, expert handling plans, and vulnerability database entries into a 768-dimensional vector using a large-scale bidirectional coding model;

[0085] The data sources include historical alert records (including handling results), APT case manuals annotated by experts, and vulnerability database entries (CVE number + impact description); text processing involves dividing the document into blocks (512 characters per block), extracting key summaries (such as "Attackers use CVE-2023-1234 to perform RCE"), and de-identifying sensitive fields (replacing the real IP with [IP_MASKED]).

[0086] A hybrid retrieval strategy is employed: combining best-match 25 keyword retrieval with cosine similarity calculation to recall highly relevant context; the retrieval results are injected into a prompt template to drive the large model to generate interpretable threat analysis conclusions. The bge-large-zh model is used to embed text blocks into 768-dimensional vectors; these are stored in the Milvus vector database (index type: IVF_FLAT); a hybrid retrieval strategy is used: the BM25 algorithm matches keywords (such as "SQL injection"), cosine similarity is used to calculate semantic association (threshold > 0.75), and the top 5 relevant contexts are retrieved.

[0087] Example of prompt word generation:

[0088] [Retrieved log fragments]

[0089] Based on the above context, please analyze the nature of the current event: {User Query}

[0090] The large model is input to generate natural language conclusions (such as "It has been determined to be an SQL injection attack, and it is recommended to block the source IP").

[0091] The multi-agent collaboration engine adopts:

[0092] Model Context Protocol: Defines the metadata format for communication between agents, including event ID, confidence level, and action recommendations;

[0093] Dynamic task routing mechanism: Based on the complexity of events, tasks are assigned to parsing agents to process data standardization or to judgment agents to perform advanced persistent threat attack chain inference.

[0094] Model Context Protocol (MCP) defines the metadata format for agent communication:

[0095] {

[0096] "event_id":"APT-2025-001",

[0097] "confidence":0.93,

[0098] "action":"block_source_ip"

[0099] }

[0100] The task routing mechanism includes simple events and complex events. Simple events (such as a single login failure) are assigned to the parsing agent, which performs log standardization and storage. Complex events (such as lateral movement across devices) are assigned to the judgment agent, which calls the large model to reconstruct the APT attack chain and outputs handling suggestions.

[0101] Optimizations to the lightweight inference engine include:

[0102] Transfer the capabilities of large models to small BERT architectures through knowledge distillation;

[0103] We use integer 8-bit quantization to compress the model volume and combine it with the Apache Flink framework to achieve millisecond-level real-time stream processing.

[0104] Specifically, the process includes: model compression and knowledge distillation, transferring knowledge from the BERT model to the TinyBERT architecture (student model layers: 4; hidden layer dimension: 512); INT8 quantization, converting model weights from FP32 to INT8 format, compressing the size to 25% of the original. Real-time stream processing integrates the Apache Flink engine, using a sliding window (60 seconds) to calculate log feature statistics (such as request success rate) in real time, combined with a lightweight model to achieve millisecond-level threat assessment.

[0105] A computer-readable storage medium having a computer program stored thereon, which, when executed by a terminal processor, implements a network security data analysis method based on a large model;

[0106] Perform the following operations:

[0107] Load the pre-trained large model weights and lightweight inference engine configuration parameters;

[0108] Dynamically construct a behavioral baseline model based on device topology;

[0109] Based on the enhanced search results, a visual attack path report is generated and an automated response script is triggered.

[0110] Initialization loading: Loads the pre-trained large model weight file (.bin format) and lightweight inference engine configuration file (including INT8 quantization parameters) from local storage. Dynamic behavior modeling: Constructs a behavioral baseline model based on device topology (e.g., database servers are only allowed to be accessed by application servers). Real-time alerts are triggered for behaviors deviating from the baseline (e.g., unfamiliar IPs directly connecting to the database). Automated handling: Based on the conclusions generated by the RAG module (e.g., "high-risk SQL injection"), calls pre-built scripts to execute automated responses (calling the firewall API to block the source IP).

[0111] The above-described embodiments are detailed and specific, illustrating preferred embodiments of the present invention. They are only used to illustrate the technical ideas and features of the present invention, with the aim of enabling those skilled in the art to understand the content of the present invention and implement it accordingly. However, they are not limited to the present invention, and the patent scope of the present invention cannot be limited by this embodiment alone. That is, any equivalent changes or modifications made to the spirit disclosed in the present invention, without departing from the structure of the present invention, such as local improvements within the system and modifications or transformations between subsystems, are still within the patent scope of the present invention.

Claims

1. A large model-based network security data analysis method, characterized by, The method comprises the following steps: Real-time acquisition of multi-source heterogeneous logs from firewalls, intrusion detection systems or intrusion prevention systems, web application firewalls, server operating systems and business applications through distributed collection agents; Data cleaning is performed on the original logs: removing duplicate entries, filling in missing fields, unifying timestamp formats, and extracting key structured fields including source IP address, target IP address, operation type and user ID; Deep semantic analysis of the cleaned logs is performed using a pre-trained large model based on the Transformer architecture to generate vectorized feature representations that integrate context semantics; Periodic patterns of log event sequences are analyzed using a time series sliding window, and a related topology of devices, users and network regions is constructed using a graph neural network to identify abnormal behavior chains; A multi-agent collaborative framework is deployed: the analysis agent, the detection agent and the research and judgment agent work together to perform threat classification, advanced persistent threat attack chain restoration and automated response actions.

2. The network security data analysis method based on a large model according to claim 1, characterized in that, The data cleaning and standardization process specifically includes: An intelligent classification engine based on a large model is used to map unstructured log content error descriptions or operation instructions to a pre-set standardized field template, replacing traditional regular expression matching; The logs are classified at multiple levels: the first level divides them into network device logs or security device logs or host logs, and the second level divides them into access control events or permission change events or data transmission events.

3. The network security data analysis method based on a large model according to claim 1, characterized in that, The domain adaptation of the pre-trained large model includes: In the general corpus pre-training phase, a mask language modeling task is used to learn the basic semantic representation; In the network security fine-tuning phase, labeled advanced persistent threat attack chain log sequences are used to optimize the model's feature extraction ability for attack patterns through contrastive learning.

4. The network security data analysis method based on a large model according to claim 1, characterized in that, The spatiotemporal feature modeling further includes: Temporal modeling: extract the log event occurrence frequency, interval variance and burstiness index, and learn the long-term dependencies through a long short-term memory network; Spatial modeling: construct a bipartite graph based on device communication relationships, generate node embedding vectors using a node2vec algorithm, and quantify the degree of deviation of device behavior.

5. The network security data analysis method based on a large model according to claim 1, characterized in that, The threat classification and tracing steps include: Input the feature vectors output by the large model into an isolation forest algorithm to detect abnormal points that deviate from normal behavior distribution; Use a dynamic prompt word template to analyze the horizontal movement stage behavior in the logs to guide the large model to generate an attack chain report, and mark the attack stages including the initial intrusion stage, the privilege escalation stage or the target achievement stage.

6. A network security analysis system based on the large model-based network security data analysis method of any one of claims 1 to 5, characterized in that, It includes: Data collection layer: log collector integrated with system log protocol interface or Kafka interface, supporting real-time streaming data transmission; Analysis and processing layer: contains a lightweight inference engine for real-time detection and a large model base for deep analysis, with built-in search enhancement to generate an enhanced search module and a multi-agent collaboration engine; Business function layer: provides a visual dashboard to dynamically display threat heat maps, attack path topology and automated handling logs.

7. The network security analysis system of claim 6, wherein, The implementation of the search enhancement generation enhanced search module is: Construct a security knowledge vector library: embed historical alerts, expert handling schemes and vulnerability library entries into 768-dimensional vectors through a large bidirectional encoding model; Adopting a hybrid retrieval strategy: combining the best match of 25 keywords retrieval and cosine similarity calculation to recall high-relevance context; Injecting the retrieval results into the prompt template to drive the large model to generate interpretable threat analysis conclusions.

8. The network security analysis system of claim 6, wherein, The multi-agent collaboration engine adopts: Model context protocol: defines the metadata format of inter-agent communication, including event ID, confidence, and treatment suggestion; Dynamic task routing mechanism: assigns events to resolution agents for data standardization or analysis agents for advanced persistent threat attack chain reasoning according to event complexity.

9. The network security analysis system of claim 6, wherein, The optimization of the lightweight inference engine includes: Migrating large model capabilities to small BERT architecture through knowledge distillation; Using integer 8-bit quantization to compress model size and combining Apache Fl ink framework to achieve millisecond-level real-time stream processing.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a terminal processor to realize a network security data analysis method based on a large model as claimed in any one of claims 1 to 5.