An intelligent analysis system capable of analyzing cybersecurity incidents based on retrieved cybersecurity knowledge and information.

Abstract

A cybersecurity incident analysis method, implemented by an intelligent analysis system, includes the following steps: (A) determining whether to retrieve at least one target cybersecurity knowledge data based on an analysis request prompt and a knowledge base retrieval prompt; (B) when it is determined that retrieval is required, retrieving the at least one target cybersecurity knowledge data; (C) determining whether to invoke at least one target cybersecurity tool based on the analysis request prompt, a tool description, and a tool retrieval prompt; (D) when it is determined that invocation is required, invoking the cybersecurity tool for each target and obtaining a tool execution result; and (E) based on the analysis request prompt, the at least one target cybersecurity knowledge data, and the at least one tool execution result, using a large language model to obtain an analysis result related to the cybersecurity incident to be analyzed.

Images