A method, apparatus, device and medium for network security incident analysis

Abstract

This application discloses a method, apparatus, device, and medium for network security incident assessment, relating to the field of computer technology. It is applied to a network security incident assessment system. The system deploys a large language model within an analysis chain framework to perform progressive reasoning. The method includes: extracting target assessment features related to network security threats from multi-source heterogeneous data; determining at least one threat hypothesis scenario based on the target assessment features; assigning positive weights to supporting evidence for the scenario and negative weights to rebuttal evidence for the scenario; performing reasoning analysis on the evidence set to generate a target assessment report for the threat hypothesis scenario; the evidence set is obtained based on target evidence carrying the aforementioned weights. This application avoids interference from different contextual scenarios in the judgment; avoids the problem of lack of reasoning basis in the reasoning process; significantly reduces misjudgments and omissions; and solves the problem of insufficient understanding and adaptability of general large language models to network security expertise.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and medium for network security incident assessment. Background Technology

[0002] In the face of increasingly complex cybersecurity threats, Large Language Models (LLMs), as a next-generation artificial intelligence technology, have demonstrated enormous application potential in the field of cybersecurity analysis. However, current LLMs still face several serious challenges in handling cybersecurity threat assessment tasks: 1. Insufficient stability of judgment results; the same threat may lead to drastically different conclusions in different contexts; 2. Lack of transparency in the reasoning process; security analysts find it difficult to trace and understand the basis of the model's judgments; 3. The problem of misjudgment rate is particularly prominent when dealing with complex Advanced Persistent Threats (APTs) and novel unknown threats; 4. Insufficient depth and adaptability of general-purpose LLMs in understanding cybersecurity expertise. Summary of the Invention

[0003] The purpose of this application is to provide a method, device, equipment, and medium for network security incident analysis, which avoids interference from different contexts and scenarios in the judgment; avoids the problem of lack of reasoning basis in the reasoning process; significantly reduces misjudgment and omission; and solves the problem that the general large language model does not have a deep understanding of network security professional knowledge and has insufficient adaptability.

[0004] To address the aforementioned problems, this application provides a method for network security incident assessment, applied to a network security incident assessment system. The system deploys a large language model within an analysis chain framework to perform progressive reasoning. The method includes: Acquire multi-source heterogeneous data related to cybersecurity incidents, extract target assessment features related to cybersecurity threats from the multi-source heterogeneous data, and then determine at least one threat hypothesis scenario based on the target assessment features; Identify target evidence associated with each of the threat hypothesis scenarios, and assign positive weights to supporting evidence and negative weights to rebuttal evidence in the target evidence; wherein, supporting evidence is evidence that supports the threat hypothesis scenario, and rebuttal evidence is evidence that refutes the threat hypothesis scenario; The evidence set is subjected to inference and analysis to generate a target assessment report for the threat hypothesis scenario; wherein the evidence set is obtained based on the target evidence with positive weights and the target evidence with negative weights.

[0005] Optionally, determining the target evidence associated with each of the threat hypothetical scenarios includes: Collect internal evidence, external evidence, and historical evidence corresponding to each of the aforementioned threat hypotheses; wherein, the internal evidence is evidence related to the threat hypotheses obtained locally from the network system, and the external evidence is evidence related to the threat hypotheses obtained from outside the network system. The internal evidence, the external evidence, and the historical evidence are aggregated into the target evidence.

[0006] Optionally, the target assessment features include any one or a combination of several of the following: contextual features, behavioral features, temporal features, and statistical features; Accordingly, determining at least one threat hypothesis scenario based on the target assessment characteristics includes: The target assessment features are vectorized to obtain the target feature vector; Calculate the target anomaly score corresponding to the target feature vector; Based on the target anomaly score, at least one threat hypothesis scenario is matched from a preset threat hypothesis scenario library.

[0007] Optionally, the step of performing reasoning analysis on the evidence set to generate a target assessment report for the hypothetical threat scenario includes: Analyze the causal relationships between the pieces of evidence in the evidence set, and construct an attack causal chain from the initial attack point to the final attack point based on the causal relationships; Analyze the time information carried by each piece of evidence in the evidence set to reconstruct the attack timeline of the cybersecurity incident based on the time information; Based on Bayesian theory, the prior probability of the threat and the target weight carried by each piece of evidence are calculated to obtain the posterior probability of the threat; wherein, the target weight includes the positive weight and the negative weight; The simulation results are obtained by simulating the attack probability based on each piece of evidence in the evidence set. Based on the attack causal chain, the attack timeline, the threat posterior probability, and the simulation results, a target assessment report is generated for the threat hypothetical scenario.

[0008] Optionally, the target assessment report includes attack path analysis, threat assessment results, confidence scores, and response strategies; the threat assessment results include network security threat levels; the confidence scores are credibility evaluation values ​​for the threat assessment results, including any one or a combination of several of the following: a first-dimensional score corresponding to the credibility of expert verification, a second-dimensional score corresponding to the strength of the evidence chain, a third-dimensional score corresponding to the consistency of reasoning logic, a fourth-dimensional score corresponding to the matching degree of professional knowledge, and a fifth-dimensional score corresponding to the accuracy of historical assessments.

[0009] Optionally, after performing reasoning analysis on the evidence set to generate a target assessment report for the hypothetical threat scenario, the method further includes: The scores from each dimension are weighted and fused to obtain the total score. Determine the target confidence interval in which the total score falls; Execute the response strategy corresponding to the target confidence interval.

[0010] Optionally, the target confidence interval is one of a preset high confidence interval, a preset medium confidence interval, a preset low confidence interval, and a preset uncertainty interval; Accordingly, the response strategy corresponding to the preset high confidence interval is to automatically perform threat handling operations, the response strategy corresponding to the preset medium confidence interval is to perform threat handling operations after manual confirmation, the response strategy corresponding to the preset low confidence interval is to perform evidence supplementation and deep reasoning operations, and the response strategy corresponding to the preset uncertain interval is to wait for analysis and continuous monitoring operations.

[0011] Optionally, after acquiring multi-source heterogeneous data related to cybersecurity incidents, the process may also include: The time information corresponding to different data sources in the multi-source heterogeneous data is calibrated to obtain a unified timestamp benchmark; The data formats corresponding to different data sources in the multi-source heterogeneous data are calibrated to obtain a unified data format; The invalid data corresponding to each data source in the multi-source heterogeneous data is filtered to obtain the filtered valid data. The filtered valid data is then integrated from multiple sources to obtain a standardized unified dataset.

[0012] This application also provides a network security incident analysis device, applied to a network security incident analysis system. The system performs progressive reasoning by deploying a large language model within an analysis chain framework. The device includes: The scenario determination module is used to acquire multi-source heterogeneous data related to network security incidents, extract target judgment features related to network security threats from the multi-source heterogeneous data, and then determine at least one threat hypothesis scenario based on the target judgment features. The weight configuration module is used to determine the target evidence associated with each of the threat hypothesis scenarios, and to configure positive weights for supporting evidence and negative weights for rebuttal evidence in the target evidence; wherein, the supporting evidence is evidence that supports the threat hypothesis scenario, and the rebuttal evidence is evidence that refutes the threat hypothesis scenario; The reasoning and analysis module is used to perform reasoning analysis on the evidence set to generate a target analysis report for the threat hypothesis scenario; wherein, the evidence set is obtained based on the target evidence with positive weights and the target evidence with negative weights.

[0013] This application also provides a network security incident analysis device, including: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the network security incident assessment method as described above.

[0014] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network security incident assessment method described above.

[0015] This application provides a method for assessing cybersecurity incidents, applied to a cybersecurity incident assessment system. The system deploys a large language model within an analysis chain framework to perform progressive inference. The method includes: acquiring multi-source heterogeneous data related to cybersecurity incidents and extracting target assessment features related to cybersecurity threats from the multi-source heterogeneous data; then determining at least one threat hypothesis scenario based on the target assessment features; determining target evidence associated with each threat hypothesis scenario and configuring positive weights for supporting evidence and negative weights for rebuttal evidence in the target evidence; wherein the supporting evidence is evidence supporting the threat hypothesis scenario, and the rebuttal evidence is evidence of the threat hypothesis scenario; and performing inference analysis on the evidence set to generate a target assessment report for the threat hypothesis scenario; wherein the evidence set is obtained based on target evidence carrying positive weights and target evidence carrying negative weights.

[0016] In summary, this application first acquires multi-source heterogeneous data related to cybersecurity incidents, then extracts target assessment features related to cybersecurity threats from these data, and subsequently determines threat hypotheses and filters relevant target evidence based on these features. In this way, the reasoning process of this application revolves around specific features and specific evidence, avoiding interference from different contextual scenarios in the judgment. Furthermore, the progressive reasoning chain constructed in this application specifically includes steps of feature extraction, hypothesis generation, evidence matching, and reasoning analysis. Each step has clear inputs and outputs and logical connections, forming a traceable analysis chain and avoiding the problem of lacking reasoning basis in the reasoning process. In addition, through the comprehensive acquisition and feature extraction of multi-source heterogeneous data, this application can more completely capture attack information of complex attacks, significantly improving the accuracy of judgment on complex advanced persistent threats and novel unknown threats, and reducing misjudgments and omissions. Finally, this application assigns positive weights to supporting evidence and negative weights to rebuttal evidence, and the evidence set is obtained based on the target evidence carrying the weights. In this way, the professional judgment logic of the security field is embedded into the reasoning process, making the model's reasoning more in line with the professional knowledge of the domain, thereby solving the problem that the general large language model does not have a deep understanding of cybersecurity professional knowledge and has insufficient adaptability. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a network security incident assessment method provided in this application embodiment; Figure 2 A schematic diagram of a network security incident analysis device provided in an embodiment of this application; Figure 3 This is a schematic diagram of a network security incident analysis device provided in an embodiment of this application. Detailed Implementation

[0019] The core of this application is to provide a method, device, equipment, and medium for network security incident analysis, which avoids interference from different contexts and scenarios in the judgment; avoids the problem of lack of reasoning basis in the reasoning process; significantly reduces misjudgment and omission; and solves the problem that the general large language model does not have a deep understanding of network security professional knowledge and has insufficient adaptability.

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] In the face of increasingly complex cybersecurity threats, large language models, as a new generation of artificial intelligence technology, have demonstrated enormous application potential in the field of cybersecurity analysis. However, current large language models still face many serious challenges in handling cybersecurity threat assessment tasks: 1. Insufficient stability of judgment results; the same threat may lead to drastically different conclusions in different contexts; 2. Lack of transparency in the reasoning process; security analysts find it difficult to trace and understand the basis of the model's judgments; 3. The problem of misjudgment rate is particularly prominent when dealing with complex advanced persistent threats and novel unknown threats; 4. The depth of understanding and adaptability of general-purpose large language models to cybersecurity expertise is insufficient.

[0022] Traditional large language model applications not only fail to solve the aforementioned technical problems but also exacerbate these shortcomings: existing solutions often directly input security event descriptions into the large language model to obtain threat assessment results. This "black box" application model is fundamentally flawed in fields like cybersecurity, which demand extremely high levels of risk control and analytical precision. Cybersecurity assessment requires not only accurate conclusions but also clear reasoning logic, sufficient supporting evidence, and a verifiable analytical framework. Incorrect threat assessments can either lead to the omission of genuine attacks and subsequent security incidents, or the misjudgment of normal network behavior as a threat, resulting in wasted resources and business disruption—both with serious consequences.

[0023] Therefore, this application first acquires multi-source heterogeneous data related to cybersecurity incidents, then extracts target assessment features related to cybersecurity threats from these data, and subsequently determines threat hypotheses and filters relevant target evidence based on these features. In this way, the reasoning process of this application revolves around specific features and specific evidence, avoiding interference from different contextual scenarios. Furthermore, the progressive reasoning chain constructed in this application specifically includes steps of feature extraction, hypothesis generation, evidence matching, and reasoning analysis. Each step has clear inputs, outputs, and logical connections, forming a traceable analysis chain and avoiding the problem of lacking reasoning basis in the reasoning process. In addition, through the comprehensive acquisition and feature extraction of multi-source heterogeneous data, this application can more completely capture attack information of complex attacks, significantly improving the accuracy of assessment of complex advanced persistent threats and novel unknown threats, and reducing misjudgments and omissions. Finally, this application assigns positive weights to supporting evidence and negative weights to rebuttal evidence, and the evidence set is obtained based on the target evidence carrying the weights. In this way, the professional judgment logic of the security field is embedded into the reasoning process, making the model's reasoning more in line with the professional knowledge of the domain, thereby solving the problem that the general large language model does not have a deep understanding of cybersecurity professional knowledge and has insufficient adaptability.

[0024] The following example illustrates a network security incident assessment method provided in this application.

[0025] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a network security incident assessment method provided in an embodiment of this application.

[0026] In this embodiment, the method is applied to a network security incident analysis system. The system deploys a large language model within an analysis chain framework to perform progressive reasoning. The method includes: S101: Acquire multi-source heterogeneous data related to network security incidents, extract target assessment features related to network security threats from the multi-source heterogeneous data, and determine at least one threat hypothesis scenario based on the target assessment features.

[0027] In this embodiment, by deploying a Large Language Model (LLM) within the Chain of Analysis (CoA) framework, the language understanding and generation capabilities of the LLM are constrained within a hierarchical analysis chain of observation, hypothesis, evidence collection, reasoning verification, and conclusion generation. This enables a progressive and transparent assessment of cybersecurity threats, avoiding the problems of opaque reasoning processes, unstable judgment results, lack of domain knowledge support, and missing confidence assessments caused by the traditional "black box" approach.

[0028] In this embodiment, to ensure the accuracy of subsequent target assessment feature extraction, after obtaining multi-source heterogeneous data related to network security events, the time information corresponding to different data sources in the multi-source heterogeneous data is calibrated to obtain a unified timestamp benchmark; the data formats corresponding to different data sources in the multi-source heterogeneous data are calibrated to obtain a unified data format; invalid data corresponding to each data source in the multi-source heterogeneous data is filtered to obtain filtered valid data; and the filtered valid data is integrated through multi-source correlation to obtain a standardized unified dataset. This avoids assessment biases caused by problems such as heterogeneous data formats, inconsistent time benchmarks, and redundant noise interference.

[0029] In this embodiment, target assessment features related to network security threats are extracted from a unified dataset, and at least one threat hypothesis scenario is determined based on the target assessment features. In some embodiments, the target assessment features include any one or a combination of contextual features, behavioral features, temporal features, and statistical features; determining at least one threat hypothesis scenario based on the target assessment features includes: vectorizing the target assessment features to obtain a target feature vector; calculating the target anomaly score corresponding to the target feature vector; and matching at least one threat hypothesis scenario from a preset threat hypothesis scenario library based on the target anomaly score. For example, multi-source heterogeneous data includes enterprise server operation logs, network traffic data, system security alarms and external threat intelligence. After standardization, four types of target judgment features are extracted: (1) Context features, used to describe the background of the event, such as the access request pointing to the enterprise's core business server and the IP (Internet Protocol) having no historical legitimate interaction records; (2) Behavioral features, used to describe the specific actions of network access or system operation, such as attempting to call an unauthorized database sensitive query interface and perform batch data export; (3) Temporal features, used to reflect the time pattern and sequence of events, such as the operation behavior being concentrated in the early morning business off-peak period and the temporal sequence from login to data transmission being continuous and uninterrupted; (4) Statistical features, used to describe the numerical pattern and degree of abnormality of event data, such as the number of login failures in a single day far exceeding the historical average level and the data transmission traffic exceeding the daily peak. Furthermore, the target's features are vectorized to obtain a target feature vector. By comparing it with a pre-set normal behavior baseline model in multiple dimensions, the target anomaly score corresponding to the target feature vector is obtained. Assuming the target anomaly score is 90 points, a pre-set threat hypothesis scenario library is retrieved based on this anomaly score. This scenario library contains typical cybersecurity threat scenarios such as APT attacks, malicious data theft, internal violations, and external probing attacks. Through a feature matching degree algorithm, two highly correlated threat hypothesis scenarios, APT attacks and malicious data theft, are finally matched.

[0030] S102: Determine the target evidence associated with each of the threat hypothesis scenarios, and configure positive weights for supporting evidence and negative weights for rebuttal evidence in the target evidence; wherein, the supporting evidence is evidence that supports the threat hypothesis scenario, and the rebuttal evidence is evidence that refutes the threat hypothesis scenario.

[0031] In this embodiment, internal evidence, external evidence, and historical evidence corresponding to each threat hypothesis scenario are collected. Internal evidence refers to evidence related to the threat hypothesis scenario obtained locally from the network system, while external evidence refers to evidence related to the threat hypothesis scenario obtained from outside the network system. The internal evidence, external evidence, and historical evidence are aggregated into target evidence. Positive weights are assigned to supporting evidence in the target evidence, and negative weights are assigned to rebuttal evidence in the target evidence.

[0032] For example, for the two threat hypotheses of APT attack and malicious data theft matched above, three types of target evidence were collected respectively: (1) Internal evidence: obtained from the local enterprise network system, including login logs of the core business database, data export operation records, firewall interception records, and interface permission logs called during the access process of the overseas IP, etc., which directly reflect the execution trajectory of the attack behavior in the local system; (2) External evidence: obtained from outside the network system, including historical attack records of the hacker organization to which the overseas IP belongs and recent attack activity reports of the same source IP provided by a third-party threat intelligence platform, which provide external corroboration for the threat hypothesis; (3) Historical evidence: extracted from the enterprise's historical security data, including records of similar attacks that the enterprise has suffered in the past. After aggregating the above internal evidence, external evidence and historical evidence, complete target evidence is formed. Furthermore, for the threat scenario of APT attacks, positive weights are configured for supporting evidence in the target evidence (positive weight of 0.9 for "core business database login logs show: overseas IP successfully logged in during the early morning hours without compliance approval records"), and negative weights are configured for rebuttal evidence in the target evidence (negative weight of -0.3 for "firewall only blocked some non-critical port access requests from this IP and did not trigger high-risk behavior interception alarms"). The weight configuration logic is the same for the threat scenario of malicious data theft.

[0033] S103: Perform reasoning analysis on the evidence set to generate a target assessment report for the threat hypothesis scenario; wherein the evidence set is obtained based on the target evidence with positive weights and the target evidence with negative weights.

[0034] In this embodiment, an evidence set is constructed based on target evidence with positive and negative weights, and reasoning analysis is performed on the evidence set to generate a target assessment report for the threat hypothesis scenario. Specifically, the causal relationships between the evidence in the evidence set are analyzed to construct an attack causal chain from the initial attack point to the final attack point; the time information carried by each piece of evidence in the evidence set is analyzed to reconstruct the attack timeline of the network security event based on the time information; the prior probability of the threat and the target weights carried by each piece of evidence are calculated based on Bayesian theory to obtain the posterior probability of the threat; wherein the target weights include the positive weights and the negative weights; the attack probability is simulated based on each piece of evidence in the evidence set to obtain simulation results; and a target assessment report for the threat hypothesis scenario is generated based on the attack causal chain, the attack timeline, the posterior probability of the threat, and the simulation results.

[0035] Specifically, (1) Analyze the causal relationship of each piece of evidence in the evidence set: construct the attack causal chain of "overseas IP initiates login → successfully bypasses authentication → calls sensitive interface → executes data export" to restore the core logic of the attack; (2) sort out the time information carried by the evidence: construct the attack timeline of "01:20 overseas IP initiates login → 01:25 successfully logs in → 01:30 calls sensitive interface → 01:40 executes data export"; (3) calculate the threat posterior probability: assuming that the prior probability of APT attack in the domain knowledge base is 0.35, combine the positive and negative weights carried by each target evidence, The posterior probability is calculated using Bayesian theory to quantify the likelihood of a threat being established; (4) Simulate the probability of an attack: refer to the embedded MITREATT&CK attack pattern library, construct an attack path of "initial access (request initiated by overseas IP) → obtaining permissions (successful login without approval) → attack implementation (calling sensitive interfaces) → target achievement (execution data export)", compare the matching situation of each link of the path with the evidence set, and obtain the simulation results (e.g., the attack path and the evidence are completely consistent); based on the above attack causal chain, attack timeline, threat posterior probability and simulation results, generate a target assessment report.

[0036] This application provides a method for assessing cybersecurity incidents, applied to a cybersecurity incident assessment system. The system deploys a large language model within an analysis chain framework to perform progressive inference. The method includes: acquiring multi-source heterogeneous data related to cybersecurity incidents and extracting target assessment features related to cybersecurity threats from the multi-source heterogeneous data; then determining at least one threat hypothesis scenario based on the target assessment features; determining target evidence associated with each threat hypothesis scenario and configuring positive weights for supporting evidence and negative weights for rebuttal evidence in the target evidence; wherein the supporting evidence is evidence supporting the threat hypothesis scenario, and the rebuttal evidence is evidence of the threat hypothesis scenario; and performing inference analysis on the evidence set to generate a target assessment report for the threat hypothesis scenario; wherein the evidence set is obtained based on target evidence carrying positive weights and target evidence carrying negative weights.

[0037] In summary, this application first acquires multi-source heterogeneous data related to cybersecurity incidents, then extracts target assessment features related to cybersecurity threats from these data, and subsequently determines threat hypotheses and filters relevant target evidence based on these features. In this way, the reasoning process of this application revolves around specific features and specific evidence, avoiding interference from different contextual scenarios in the judgment. Furthermore, the progressive reasoning chain constructed in this application specifically includes steps of feature extraction, hypothesis generation, evidence matching, and reasoning analysis. Each step has clear inputs and outputs and logical connections, forming a traceable analysis chain and avoiding the problem of lacking reasoning basis in the reasoning process. In addition, through the comprehensive acquisition and feature extraction of multi-source heterogeneous data, this application can more completely capture attack information of complex attacks, significantly improving the accuracy of judgment on complex advanced persistent threats and novel unknown threats, and reducing misjudgments and omissions. Finally, this application assigns positive weights to supporting evidence and negative weights to rebuttal evidence, and the evidence set is obtained based on the target evidence carrying the weights. In this way, the professional judgment logic of the security field is embedded into the reasoning process, making the model's reasoning more in line with the professional knowledge of the domain, thereby solving the problem that the general large language model does not have a deep understanding of cybersecurity professional knowledge and has insufficient adaptability.

[0038] This application also provides a network security incident analysis device, a network security incident analysis equipment, and a computer-readable storage medium, which have the above-mentioned beneficial effects, and will not be elaborated here.

[0039] It should be noted that after completing the multi-dimensional reasoning and verification of cybersecurity incidents based on the CoA framework, further targeted measures need to be implemented. In this embodiment, the target assessment report includes attack path analysis, threat assessment results, confidence scores, and response strategies. Threat assessment results include cybersecurity threat levels. The confidence score is a credibility assessment value for the threat assessment results, including any one or a combination of the following: a first-dimensional score corresponding to the credibility of expert verification, a second-dimensional score corresponding to the strength of the evidence chain, a third-dimensional score corresponding to the consistency of reasoning logic, a fourth-dimensional score corresponding to the matching degree of professional knowledge, and a fifth-dimensional score corresponding to the accuracy of historical assessments.

[0040] Furthermore, the scores from each dimension are weighted and fused to obtain a total score; the target confidence interval of the total score is determined; and the response strategy corresponding to the target confidence interval is executed. The target confidence interval is one of the following: a preset high confidence interval, a preset medium confidence interval, a preset low confidence interval, and a preset uncertain interval. Correspondingly, the response strategy for the preset high confidence interval is automatic threat handling; the response strategy for the preset medium confidence interval is threat handling after manual confirmation; the response strategy for the preset low confidence interval is evidence supplementation and deep reasoning; and the response strategy for the preset uncertain interval is waiting for analysis and continuous monitoring. The analysis follows: I. The target analysis report includes attack paths, threat assessment results, confidence scores, and response strategies. 1. Attack Path Analysis: By combining the attack causal chain and attack timeline, the complete attack path is reconstructed; 2. Threat Assessment Results: APT attack is classified as a high threat level; malicious data theft is classified as a high threat level. 3. Confidence Score: First Dimension Score (Expert Verification Credibility): Score range 0-10 (weight 0.1), assumed to be 9 in this example; Second Dimension Score (Strength of Evidence Chain): Score range 0-30 (weight 0.3), assumed to be 28 in this example; Third Dimension Score (Consistency of Reasoning Logic): Score range 0-25 (weight 0.25), assumed to be 24 in this example; Fourth Dimension Score (Matching Degree of Professional Knowledge): Score range 0-20 (weight 0.2), assumed to be 18 in this example; Fifth Dimension Score (Accuracy of Historical Judgment): Score range 0-15 (weight 0.15), assumed to be 14 in this example.

[0041] 4. Response strategy execution: If the IP is in the high confidence range, threat handling will be executed automatically; if it is in the medium confidence range, a manual confirmation process will be triggered, and the analyst will review and issue a handling instruction; if it is in the low confidence range, evidence supplementation and in-depth reasoning will be initiated; if it is in the uncertain range, it will be marked as pending analysis, and the IP's behavior and system indicators will be continuously monitored.

[0042] II. Confidence Score Calculation and Response Strategy Implementation

[0043] The total score is calculated as follows: (First dimension score × 0.1) + (Second dimension score × 0.3) + (Third dimension score × 0.25) + (Fourth dimension score × 0.2) + (Fifth dimension score × 0.15). Substituting these values, we get: (9 × 0.1) + (28 × 0.3) + (24 × 0.25) + (18 × 0.2) + (14 × 0.15) = 21 points, which is equivalent to 90 points on a 0-100 scale. Furthermore, since the pre-set confidence intervals include a high confidence interval (80-100 points), a medium confidence interval (60-80 points), a low confidence interval (40-60 points), and an uncertain interval (<40 points), a score of 90 falls into the high confidence interval, triggering automatic threat handling.

[0044] This solution deploys a large language model in the CoA framework and constructs a five-layer architecture of "observation-hypothesis-evidence-reasoning-conclusion". (1) The observation layer realizes the processing of raw data and extraction of basic features. First, it collects multi-source heterogeneous data such as threat intelligence, security event logs, and network traffic data. Then, it completes standardized preprocessing through timestamp calibration, data format unification, invalid filtering, and multi-source association integration. Simultaneously, it performs feature extraction, anomaly detection, event aggregation, and preliminary classification. Finally, it extracts four types of target judgment features: context, behavior, time series, and statistics, to provide standardized basic information for subsequent analysis. (2) The hypothesis layer, based on the target judgment features output by the observation layer, performs vectorization processing and anomaly score calculation, and matches highly correlated scenarios from the preset threat hypothesis scenario library. (3) The evidence layer relies on evidence collection. The engine collects internal, external and historical evidence for each threat hypothesis scenario, and sets positive weights for supporting evidence and negative weights for rebuttal evidence; (4) The reasoning layer uses the LLM reasoning engine to complete logical verification, conflict detection and probabilistic reasoning under domain knowledge constraints. It constructs an attack causal chain by analyzing the causal relationship between evidence, sorts out time information to reconstruct the attack timeline, calculates the posterior probability of the threat by combining Bayesian theory, simulates the attack possibility by referring to the MITREATT&CK attack pattern library, and forms a reasoning result by integrating multi-dimensional information; (5) The conclusion layer completes the threat level assessment based on the reasoning result, and simultaneously constructs a complete attack chain, generates response suggestions and a target assessment report including attack path analysis, threat judgment results, confidence score and response strategy. (6) Based on the total score obtained by weighted fusion calculation of the confidence scores of each dimension, determine the high (80-100 points), medium (60-80 points), low (40-60 points) confidence interval or uncertain interval (<40 points) where it is located, and implement corresponding response strategies such as automatic threat handling, manual confirmation and handling, evidence supplementation and in-depth reasoning, and continuous monitoring and waiting analysis.

[0045] The core key points of this solution focus on five dimensions: First, it applies the CoA analysis chain framework to the field of cybersecurity, decomposing complex threat assessment into verifiable analysis steps, giving each step clear inputs, outputs, and verification mechanisms, achieving complete transparency in the reasoning process, and solving the traditional "black box" decision-making problem; Second, it constructs a five-layer architecture of "observation-hypothesis-evidence-reasoning-conclusion," relying on a progressive deepening analysis model and a backtracking correction mechanism to ensure the coherence and accuracy of the assessment logic; Third, it achieves deep integration of large language models and structured reasoning; Fourth, it establishes a multi-dimensional confidence quantification assessment system, not only outputting assessment conclusions but also comprehensively quantifying the credibility of conclusions from multiple dimensions, providing clear risk references for decision-making; Fifth, it creates an evidence-driven reasoning mechanism, requiring all conclusions to be supported by sufficient evidence, taking into account both positive and negative evidence and dynamically adjusting evidence weights, fundamentally improving the reliability of assessment results.

[0046] Table 1. Comparison of technical effectiveness between traditional network security assessment methods and the assessment scheme based on the CoA framework in this proposal.

[0047] To adapt to diverse needs in different scenarios, this solution also provides a wealth of modification design options and alternatives: Regarding the number of analysis chain layers, a simplified three-layer version merging "observation" and "hypothesis," and "reasoning" and "conclusion" can be adopted to suit scenarios with limited resources or high real-time requirements; an enhanced seven-layer version can also be added, consisting of a "preprocessing layer" (data cleaning and standardization), a "correlation layer" (multi-event correlation analysis), and a "verification layer" (conclusion verification and testing), to meet scenarios with high security requirements; Regarding inference strategies, it supports a rule-first mode (first executing rule matching for rapid judgment, then initiating CoA analysis in complex cases to improve processing efficiency), a parallel analysis mode (multiple hypotheses analyzed in parallel, with a final vote to improve accuracy), and a cascading analysis mode (deepening analysis step by step according to threat level, from low to high security). Alternative solutions include rapid threat detection and in-depth analysis of high-threat threats. For LLM model selection, flexible options are available: local small models (7B-13B parameters, data remains within the enterprise network, strongest privacy protection), cloud-based large models (100B+ parameters, stronger inference capabilities, suitable for non-sensitive data), or hybrid models (sensitive analysis completed locally, complex inference processed in the cloud, balancing security and performance). Regarding the knowledge base architecture, three options are provided: centralized (unified management of all knowledge, easy maintenance and updates, high query efficiency), distributed (distributed knowledge storage, strong fault tolerance, supports large-scale expansion), and federated (multi-organizational knowledge sharing, protecting the privacy of all parties, achieving collaborative defense). In terms of application scenarios, it can be extended to SOC (Security Operations). The Security Operations Center (SOC) is automated (intelligentizing the SOC, automatically classifying and responding to incidents, reducing the workload of analysts), threat hunting (proactively searching for potential threats, hypothesis-driven investigations, and discovering unknown attacks), incident tracing (reconstructing attack paths, root cause analysis, and rebuilding the chain of evidence), and compliance auditing (automatic compliance checks, identification of violations, and generation of audit reports), expanding the boundaries of technology application. In terms of deployment modes, it supports standalone deployment (serving externally as an independent analysis system through an application programming interface, facilitating integration), embedded deployment (embedding into existing security products, enhancing existing capabilities, and seamless upgrades), and SaaS (Software as a Service) service models (cloud services, on-demand use, and continuous updates).

[0048] The network security incident analysis device provided in the embodiments of this application is described below.

[0049] Please refer to Figure 2 , Figure 2This is a schematic diagram of the structure of a network security incident analysis device provided in an embodiment of this application.

[0050] In this embodiment, the device may include: The scenario determination module 100 is used to acquire multi-source heterogeneous data related to network security incidents, extract target judgment features related to network security threats from the multi-source heterogeneous data, and then determine at least one threat hypothesis scenario based on the target judgment features. The weight configuration module 200 is used to determine the target evidence associated with each of the threat hypothesis scenarios, and to configure positive weights for supporting evidence and negative weights for rebuttal evidence in the target evidence; wherein, the supporting evidence is evidence that supports the threat hypothesis scenario, and the rebuttal evidence is evidence that refutes the threat hypothesis scenario; The reasoning and analysis module 300 is used to perform reasoning analysis on the evidence set to generate a target analysis report for the threat hypothesis scenario; wherein the evidence set is obtained based on the target evidence with positive weights and the target evidence with negative weights.

[0051] Figure 3 This is a schematic diagram of the structure of a network security event analysis device provided in an embodiment of this application.

[0052] This application also provides a network security incident analysis device, which may include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the network security incident assessment method as described in the above embodiments.

[0053] like Figure 3 The diagram shows the structural composition of a network security incident analysis device. This device may include a processor 10, a memory 11, a communication interface 12, and a communication bus 13. The processor 10, memory 11, and communication interface 12 all communicate with each other via the communication bus 13.

[0054] In this embodiment, the processor 10 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic devices.

[0055] The processor 10 can call the program stored in the memory 11. Specifically, the processor 10 can execute the operations in the embodiments of the network security incident assessment method.

[0056] The memory 11 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment, the memory 11 stores at least a program for implementing the following functions: Acquire multi-source heterogeneous data related to cybersecurity incidents, extract target assessment features related to cybersecurity threats from the multi-source heterogeneous data, and then determine at least one threat hypothesis scenario based on the target assessment features; Identify target evidence associated with each of the threat hypothesis scenarios, and assign positive weights to supporting evidence and negative weights to rebuttal evidence in the target evidence; wherein, supporting evidence is evidence that supports the threat hypothesis scenario, and rebuttal evidence is evidence that refutes the threat hypothesis scenario; The evidence set is subjected to inference and analysis to generate a target assessment report for the threat hypothesis scenario; wherein the evidence set is obtained based on the target evidence with positive weights and the target evidence with negative weights.

[0057] In one possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0058] In addition, memory 11 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0059] Communication interface 12 can be an interface for the communication module, used to connect with other devices or systems.

[0060] Of course, it should be noted that, Figure 3 The structure shown does not constitute a limitation on the network security event analysis device in the embodiments of this application. In practical applications, the network security event analysis device may include more than Figure 3 More or fewer components as shown, or combinations of certain components.

[0061] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network security incident assessment method described in the above embodiments.

[0062] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0063] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0064] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0065] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0066] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0067] The foregoing has provided a detailed description of the network security incident assessment method, apparatus, device, and medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for assessing network security incidents, characterized in that, An application to a network security incident analysis system, wherein the system deploys a large language model within an analysis chain framework to perform progressive inference, the method comprising: Acquire multi-source heterogeneous data related to cybersecurity incidents, extract target assessment features related to cybersecurity threats from the multi-source heterogeneous data, and then determine at least one threat hypothesis scenario based on the target assessment features; Identify target evidence associated with each of the threat hypothesis scenarios, and assign positive weights to supporting evidence and negative weights to rebuttal evidence in the target evidence; wherein, supporting evidence is evidence that supports the threat hypothesis scenario, and rebuttal evidence is evidence that refutes the threat hypothesis scenario; The evidence set is subjected to inference and analysis to generate a target assessment report for the threat hypothesis scenario; wherein the evidence set is obtained based on the target evidence with positive weights and the target evidence with negative weights.

2. The network security incident assessment method according to claim 1, characterized in that, The determination of target evidence associated with each of the threat hypothetical scenarios includes: Collect internal evidence, external evidence, and historical evidence corresponding to each of the aforementioned threat hypotheses; wherein, the internal evidence is evidence related to the threat hypotheses obtained locally from the network system, and the external evidence is evidence related to the threat hypotheses obtained from outside the network system. The internal evidence, the external evidence, and the historical evidence are aggregated into the target evidence.

3. The network security incident assessment method according to claim 1, characterized in that, The target assessment features include any one or a combination of several of the following: contextual features, behavioral features, temporal features, and statistical features. Accordingly, determining at least one threat hypothesis scenario based on the target assessment characteristics includes: The target assessment features are vectorized to obtain the target feature vector; Calculate the target anomaly score corresponding to the target feature vector; Based on the target anomaly score, at least one threat hypothesis scenario is matched from a preset threat hypothesis scenario library.

4. The network security incident assessment method according to claim 1, characterized in that, The step of reasoning and analyzing the evidence set to generate a target assessment report for the hypothetical threat scenario includes: Analyze the causal relationships between the pieces of evidence in the evidence set, and construct an attack causal chain from the initial attack point to the final attack point based on the causal relationships; Analyze the time information carried by each piece of evidence in the evidence set to reconstruct the attack timeline of the cybersecurity incident based on the time information; Based on Bayesian theory, the prior probability of the threat and the target weight carried by each piece of evidence are calculated to obtain the posterior probability of the threat; wherein, the target weight includes the positive weight and the negative weight; The simulation results are obtained by simulating the attack probability based on each piece of evidence in the evidence set. Based on the attack causal chain, the attack timeline, the threat posterior probability, and the simulation results, a target assessment report is generated for the threat hypothetical scenario.

5. The network security incident assessment method according to claim 4, characterized in that, The target assessment report includes attack path analysis, threat assessment results, confidence scores, and response strategies. The threat assessment results include network security threat levels. The confidence scores are credibility evaluation values ​​for the threat assessment results, including any one or a combination of several of the following: a first-dimensional score corresponding to the credibility of expert verification, a second-dimensional score corresponding to the strength of the evidence chain, a third-dimensional score corresponding to the consistency of reasoning logic, a fourth-dimensional score corresponding to the matching degree of professional knowledge, and a fifth-dimensional score corresponding to the accuracy of historical assessments.

6. The network security incident assessment method according to claim 5, characterized in that, After performing reasoning analysis on the evidence set to generate a target assessment report for the hypothetical threat scenario, the method further includes: The scores from each dimension are weighted and fused to obtain the total score. Determine the target confidence interval in which the total score falls; Execute the response strategy corresponding to the target confidence interval.

7. The network security incident assessment method according to claim 6, characterized in that, The target confidence interval is one of the following: a preset high confidence interval, a preset medium confidence interval, a preset low confidence interval, and a preset uncertainty interval. Accordingly, the response strategy corresponding to the preset high confidence interval is to automatically perform threat handling operations, the response strategy corresponding to the preset medium confidence interval is to perform threat handling operations after manual confirmation, the response strategy corresponding to the preset low confidence interval is to perform evidence supplementation and deep reasoning operations, and the response strategy corresponding to the preset uncertain interval is to wait for analysis and continuous monitoring operations.

8. The network security incident assessment method according to any one of claims 1 to 7, characterized in that, After acquiring multi-source heterogeneous data related to cybersecurity incidents, the process also includes: The time information corresponding to different data sources in the multi-source heterogeneous data is calibrated to obtain a unified timestamp benchmark; The data formats corresponding to different data sources in the multi-source heterogeneous data are calibrated to obtain a unified data format; The invalid data corresponding to each data source in the multi-source heterogeneous data is filtered to obtain the filtered valid data. The filtered valid data is then integrated from multiple sources to obtain a standardized unified dataset.

9. A network security incident analysis device, characterized in that, An apparatus for use in a network security incident analysis system, wherein the system deploys a large language model within an analysis chain framework to perform progressive inference, the apparatus comprising: The scenario determination module is used to acquire multi-source heterogeneous data related to network security incidents, extract target judgment features related to network security threats from the multi-source heterogeneous data, and then determine at least one threat hypothesis scenario based on the target judgment features. The weight configuration module is used to determine the target evidence associated with each of the threat hypothesis scenarios, and to configure positive weights for supporting evidence and negative weights for rebuttal evidence in the target evidence; wherein, the supporting evidence is evidence that supports the threat hypothesis scenario, and the rebuttal evidence is evidence that refutes the threat hypothesis scenario; The reasoning and analysis module is used to perform reasoning analysis on the evidence set to generate a target analysis report for the threat hypothesis scenario; wherein, the evidence set is obtained based on the target evidence with positive weights and the target evidence with negative weights.

10. A network security incident analysis device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the network security incident assessment method as described in any one of claims 1 to 8 when executing the computer program.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the network security incident assessment method as described in any one of claims 1 to 8.

Images