Network security event analysis method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to a network security event analysis method and device, electronic equipment and a storage medium, which are used for improving the accuracy and comprehensiveness of analysis and reducing the operation and maintenance cost. The method comprises the steps that N feature analysis agents are adopted to analyze a network security event, N intermediate analysis results of the network security event are obtained, the analysis dimensions of the feature analysis agents are different, and N is an integer larger than 1; and analyzing the network security event and each intermediate analysis result by adopting a result analysis agent to obtain a target analysis result of the network security event.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security event analysis method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of the Internet and information technology, network security issues are becoming increasingly serious, and network security incidents are growing explosively.

[0003] In the prior art, a single analysis model is often used to analyze network security incidents.

[0004] However, since cybersecurity incidents contain a huge amount of information, when analyzing based on a single model, there will be information loss, resulting in inaccurate analysis results and difficulty in perceiving the analysis process. In addition, when adding a new analysis dimension to a single model, the single model needs to be reconstructed, which is complex in construction and has high operation and maintenance costs. Summary of the invention

[0005] The embodiments of the present application provide a network security event analysis method, device, electronic device and storage medium to improve the accuracy and comprehensiveness of the analysis and reduce operation and maintenance costs.

[0006] The specific technical solutions provided by the embodiments of this application are as follows:

[0007] In a first aspect, a network security incident analysis method is provided, the method comprising:

[0008] Using N feature analysis agents to analyze the network security event, and obtaining N intermediate analysis results of the network security event, wherein the analysis dimension of each feature analysis agent is different, and N is an integer greater than 1;

[0009] A result analysis agent is used to analyze network security events and intermediate analysis results to obtain the target analysis results of network security events.

[0010] In a possible embodiment, before using N feature analysis agents to analyze network security events and obtaining N intermediate analysis results of network security events, the method further includes:

[0011] Obtain network security events and perform data cleansing and formatting on them.

[0012] Through the above method, the quality of data can be improved, thereby improving the accuracy of analysis.

[0013] In a possible embodiment, N feature analysis agents are used to analyze network security events to obtain N intermediate analysis results of network security events, including:

[0014] For each of the N feature analysis agents, the following operations are performed respectively: based on the input requirements corresponding to the feature analysis agent, the network security incident is processed to obtain the input data of the feature analysis agent, and the input data is input into the large language model of the feature analysis agent to obtain the intermediate analysis results of the network security incident.

[0015] Through the above method, accurate intermediate analysis results in each analysis dimension can be obtained. The intermediate analysis results obtained can not only reflect the analysis results of network security incidents in specific analysis dimensions, but also reflect the process of analyzing network security incidents by the entire system. The analysis is more comprehensive and more explanatory.

[0016] In a possible embodiment, based on the input requirements corresponding to the feature analysis agent, the network security event is processed to obtain the input data of the feature analysis agent, including:

[0017] According to the data form corresponding to the feature analysis agent, the network security incident is processed in data form;

[0018] Obtain, from the knowledge base corresponding to the feature analysis agent, each associated event whose correlation with the network security event meets a preset correlation condition under the analysis dimension of the feature analysis agent, and the analysis result of each associated event;

[0019] The network security events, the associated events, and the analysis results of the associated events are filled into the prompt words corresponding to the feature analysis agent to obtain the input data of the feature analysis agent.

[0020] By using the above method, each associated event and the analysis results of each associated event are obtained for knowledge enhancement, which can improve the accuracy of the analysis.

[0021] In a possible embodiment, a result analysis agent is used to analyze the network security event and each intermediate analysis result to obtain a target analysis result of the network security event, including:

[0022] Fill the network security events and N intermediate analysis results into the prompt words corresponding to the result analysis agent to obtain input data of the result analysis agent, wherein the prompt words corresponding to the result analysis agent are constructed based on the result requirements of the analysis task;

[0023] Input data is fed into the large language model of the result analysis agent to obtain the target analysis results of the network security incident.

[0024] Through the above method, the result analysis agent combines the intermediate analysis results to obtain accurate target analysis results of network security incidents.

[0025] In a possible embodiment, after adopting a result analysis agent to analyze the network security event and each intermediate analysis result to obtain the target analysis result of the network security event, the following further comprises:

[0026] Based on the business requirements of the downstream system, the target analysis result and / or N intermediate analysis results are sent to the downstream system.

[0027] Through the above method, the business requirements of the downstream system are taken into consideration, thereby improving the effectiveness of the business and the user experience.

[0028] In a second aspect, a network security event analysis device is provided, the device comprising:

[0029] A first analysis module is used to use N feature analysis agents to analyze the network security event and obtain N intermediate analysis results of the network security event, wherein the analysis dimension of each feature analysis agent is different, and N is an integer greater than 1;

[0030] The second analysis module is used to use a result analysis agent to analyze network security events and various intermediate analysis results to obtain target analysis results of network security events.

[0031] In a possible embodiment, N feature analysis agents are used to analyze network security events. Before obtaining N intermediate analysis results of network security events, a data preprocessing module is also included. The data preprocessing module is used to:

[0032] Obtain network security events and perform data cleansing and formatting on them.

[0033] In a possible embodiment, when N feature analysis agents are used to analyze a network security event and N intermediate analysis results of the network security event are obtained, the first analysis module is further used to:

[0034] For each of the N feature analysis agents, the following operations are performed respectively: based on the input requirements corresponding to the feature analysis agent, the network security incident is processed to obtain the input data of the feature analysis agent, and the input data is input into the large language model of the feature analysis agent to obtain the intermediate analysis results of the network security incident.

[0035] In a possible embodiment, based on the input requirements corresponding to the feature analysis agent, when processing the network security event and obtaining the input data of the feature analysis agent, the first analysis module is further used to:

[0036] According to the data form corresponding to the feature analysis agent, the network security incident is processed in data form;

[0037] Obtain, from the knowledge base corresponding to the feature analysis agent, each associated event whose correlation with the network security event meets a preset correlation condition under the analysis dimension of the feature analysis agent, and the analysis result of each associated event;

[0038] The network security events, the associated events, and the analysis results of the associated events are filled into the prompt words corresponding to the feature analysis agent to obtain the input data of the feature analysis agent.

[0039] In a possible embodiment, when a result analysis agent is used to analyze the network security event and each intermediate analysis result to obtain a target analysis result of the network security event, the second analysis module is further used to:

[0040] Fill the network security events and N intermediate analysis results into the prompt words corresponding to the result analysis agent to obtain input data of the result analysis agent, wherein the prompt words corresponding to the result analysis agent are constructed based on the result requirements of the analysis task;

[0041] Input data is fed into the large language model of the result analysis agent to obtain the target analysis results of the network security incident.

[0042] In a possible embodiment, a result analysis agent is used to analyze network security events and intermediate analysis results. After obtaining the target analysis results of network security events, a result processing module is also included. The result processing module is used to:

[0043] Based on the business requirements of the downstream system, the target analysis result and / or N intermediate analysis results are sent to the downstream system.

[0044] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any one of the methods described in the first aspect are implemented.

[0045] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect above.

[0046] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0047] In the embodiment of the present application, N feature analysis agents are used to analyze network security events and obtain N intermediate analysis results of network security events, wherein the analysis dimensions of each feature analysis agent are different, and N is an integer greater than 1. Then, a result analysis agent is used to analyze the network security event and each intermediate analysis result to obtain the target analysis result of the network security event. In this way, by analyzing and interpreting network security events from multiple analysis dimensions through multiple feature analysis agents, combined with result analysis agents, more comprehensive and detailed analysis results can be obtained, effectively improving the accuracy of the analysis, and the analysis results are more interpretable. In addition, the analysis task of the agent is an atomic task or a local atomic task. When more analysis dimensions need to be added, it is only necessary to add a feature analysis agent with new capabilities to the system, which is more scalable and effectively reduces the operation and maintenance costs. In addition, when responding to different analysis result requirements, the result analysis agent can be adjusted to complete the change of analysis direction at a lower cost, to meet the needs of more scenarios, and effectively reduce the operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of possible application scenarios in the embodiments of the present application;

[0049] Figure 2 This is a flowchart of an implementation of a network security incident analysis method provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of the composition of each intelligent agent in the embodiment of the present application;

[0051] Figure 4 This is an example diagram of obtaining intermediate analysis results in the embodiments of the present application;

[0052] Figure 5 This is a schematic diagram of the structure of a network security event analysis device in an embodiment of the present application;

[0053] Figure 6 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0055] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0056] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0057] To facilitate understanding of the technical solutions provided in the embodiments of the present application, some key terms used in the embodiments of the present application are explained here:

[0058] Agent: An autonomous entity in the field of computer science and artificial intelligence, usually designed in a modular form to enable it to perform specific tasks in different application areas. It obtains information from the environment through sensors or data input sources, and uses the information obtained to analyze and reason through rules, algorithms or machine learning models to complete specific tasks.

[0059] Multi-agent: A system consisting of multiple agents that collaborate or compete with each other, aiming to solve complex problems through collective behavior. In the system, each agent will play different roles to achieve some goals or tasks.

[0060] Large Language Model (LLM): It is an important model in the field of artificial intelligence, with powerful language generation and understanding capabilities. When LLM is used to process specific tasks, fine-tuning can further improve the processing effect.

[0061] Retrieval-augmented Generation (RAG): is a natural language processing technology that combines information retrieval and generation technologies. By constructing a RAG knowledge base, relevant information under different feature dimensions can be quickly retrieved from a large amount of data and applied to specific tasks.

[0062] Prompt: refers to a piece of text or question input to the language model to guide the model to generate a response. It plays a key role in natural language processing (NLP) tasks, especially in generative models and question-answering systems. The design of prompts directly affects the quality and relevance of model output.

[0063] The following is a brief introduction to the design concept of the embodiment of the present application:

[0064] At present, with the rapid development of the Internet and information technology, network security issues are becoming increasingly serious, and network security incidents are showing explosive growth.

[0065] In the prior art, the following two methods are usually used to analyze network security incidents.

[0066] Method 1: Rely on static rules and manual experience to analyze network security incidents.

[0067] When using method one, it is not only inefficient, but also difficult to ensure the effectiveness of the rules when facing unknown types of network security incidents, and it is difficult to cope with complex and changeable new attacks.

[0068] Method 2: Use a single analysis model to analyze network security incidents.

[0069] When using method 2, since cybersecurity incidents have a huge amount of information, when analyzing based on a single model, there will be information loss, resulting in inaccurate analysis results and difficulty in perceiving the analysis process. Secondly, when adding a new analysis dimension to a single model, the single model needs to be reconstructed, which is complex in construction and has high operation and maintenance costs. In addition, a single model focuses on a single analysis task. When the target result of the cybersecurity incident analysis task needs to be adjusted, the entire system needs to be adjusted significantly.

[0070] In view of this, in the embodiment of the present application, a network security event analysis method, device, electronic device and storage medium are provided, N feature analysis agents are used to analyze network security events, and N intermediate analysis results of network security events are obtained, wherein the analysis dimensions of each feature analysis agent are different, and N is an integer greater than 1, and then a result analysis agent is used to analyze the network security event and each intermediate analysis result to obtain the target analysis result of the network security event. In this way, by analyzing and interpreting network security events from multiple analysis dimensions through multiple feature analysis agents, combined with the result analysis agent, a more comprehensive and detailed analysis result can be obtained, which effectively improves the accuracy of the analysis and makes the analysis result more explanatory. In addition, the analysis task of the agent is an atomic task or a local atomic task. When more analysis dimensions need to be added, it is only necessary to add a feature analysis agent with new capabilities to the system, which is more scalable. In addition, when responding to different analysis result requirements, the result analysis agent can be adjusted to complete the change of analysis direction at a lower cost, meet the needs of more scenarios, and effectively reduce the operation and maintenance costs.

[0071] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments of the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0072] See also Figure 1 , which is a schematic diagram of a possible application scenario in an embodiment of the present application, includes a physical terminal 110 , an analysis system 120 (including various feature analysis agents and result analysis agents) and a downstream system 130 .

[0073] The physical device 110 is a device used to collect network security events, such as a network security firewall or other terminals, and must have the ability to collect network security events and report network security events to the analysis system.

[0074] After receiving the analysis results of the network security incident, the downstream system 130 processes and packages the data according to business requirements, forms a security report, and pushes it to the user.

[0075] The following describes the network security incident analysis method provided by the exemplary embodiment of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation methods of the present application are not limited in this regard.

[0076] See also Figure 2 As shown, it is an implementation flow chart of a network security event analysis method provided by an embodiment of the present application. The specific implementation process of the method is as follows:

[0077] Step 20: Use N feature analysis agents to analyze the network security incident and obtain N intermediate analysis results of the network security incident.

[0078] Among them, the analysis dimensions of each feature analysis agent are different, N is an integer greater than 1, and the analysis dimensions of the N feature analysis agents include but are not limited to: event type, event entity, event details and other analysis dimensions.

[0079] In addition, it is worth noting that the embodiment of the present application does not limit the number of feature analysis agents. When it is necessary to analyze complex network security events, in order to add more analysis dimensions, it is only necessary to add feature analysis agents under the new analysis dimensions.

[0080] Optionally, in the embodiment of the present application, N feature analysis agents are used to analyze the network security event, and before obtaining N intermediate analysis results of the network security event, the network security event may be preprocessed. Specifically, in the embodiment of the present application, the network security event is obtained, and the network security event is cleaned and formatted.

[0081] In an embodiment of the present application, the physical terminal monitors the network environment in which the customer is located, and when a network security event is obtained, it is pushed to the analysis system. The analysis system obtains the network security event sent by the physical terminal, performs data cleansing on the network security event, and formats the network security event according to a preset data format.

[0082] Among them, the source data of network security events includes but is not limited to the following information: event ID, event occurrence time, entity information of the event, event type, event description, source IP, destination IP, event detailed description, etc.

[0083] In this way, the quality of the data can be improved, thereby improving the accuracy of the analysis.

[0084] In addition, it is worth mentioning that Figure 3As shown, it is a schematic diagram of the composition of each agent in the implementation of this application. Each feature analysis agent and result analysis agent uses a large language model as a base. Based on the task direction of each feature analysis agent and result analysis agent, the large language model is fine-tuned in the corresponding direction in advance. The large language model includes but is not limited to GPT4, Llama, Qwen and other models, and the fine-tuning methods include but are not limited to P-tuning, Lora and other methods.

[0085] Optionally, in the embodiment of the present application, a possible embodiment is provided for using N feature analysis agents to analyze network security events and obtain N intermediate analysis results of network security events, and the following operations are specifically performed:

[0086] For each of the N feature analysis agents, the following operations are performed respectively: based on the input requirements corresponding to the feature analysis agent, the network security incident is processed to obtain the input data of the feature analysis agent, and the input data is input into the large language model of the feature analysis agent to obtain the intermediate analysis results of the network security incident.

[0087] In an embodiment of the present application, input data is input into a large language model of a feature analysis agent to obtain an output result of the large language model as an intermediate analysis result of a network security incident.

[0088] Optionally, in an embodiment of the present application, a possible embodiment is provided to process network security events based on input requirements corresponding to the feature analysis agent and obtain input data of the feature analysis agent, and the following operations are specifically performed:

[0089] Step 200: Process the network security incident in data format according to the data format corresponding to the feature analysis agent.

[0090] For example, the data format corresponding to the feature analysis agent under the event type analysis dimension is: S'=[T,S], where S is the network security event and T is the event type.

[0091] For example, the data format corresponding to the feature analysis agent under the event entity analysis dimension is: S”=[D,S], where S is the network security event and D is the entity information associated with the network security event.

[0092] For example, the data format corresponding to the feature analysis agent under the event details analysis dimension is: S''=[S], where S is a network security event.

[0093] Step 201: From the knowledge base corresponding to the feature analysis agent, obtain, under the analysis dimension of the feature analysis agent, each associated event whose correlation with the network security event meets a preset correlation condition, as well as the analysis results of each associated event.

[0094] Among them, Figure 3 As shown, the knowledge base corresponding to the feature analysis agent combines the characteristics of the analysis dimensions of the feature analysis agent, and pre-constructs the corresponding dimension-event knowledge base according to the corresponding dimension. The knowledge base can be a RAG knowledge base, which is not limited in the embodiments of the present application.

[0095] The associated events that meet the preset relevance condition are the K associated events with the highest relevance, where K is an integer greater than 0.

[0096] Exemplarily, for the feature analysis agent under the event type analysis dimension, first, from the pre-constructed knowledge base of event types and event associations, screen out candidate events whose event type is the same as the event type T of the network security event S, and then from each candidate event, screen out the K associated events with the highest correlation with the network security event S, as well as the analysis results of the K associated events.

[0097] Exemplarily, for the feature analysis agent under the event entity analysis dimension, first, from the pre-constructed knowledge base of entity domain and event association, select the candidate events whose entity association domain is the same as the entity association domain of the network security event S, and then select the K first associated events with the highest correlation with the network security event S from each candidate event, and the analysis results of the K first associated events as the first type of entity data. In addition, the K second associated events that occurred in the entity of the network security event S in the past historical time period, and the analysis results of the K second associated events, can also be obtained as the second type of entity data.

[0098] Among them, the field associated with the entity is the corresponding industry type of the enterprise where the entity terminal is located, such as the financial industry and the education industry.

[0099] Exemplarily, for the feature analysis agent under the event detail analysis dimension, K related events with the highest correlation with the network security event S and the analysis results of the K related events are screened out from a pre-built event knowledge base.

[0100] In this way, obtaining each related event and the analysis results of each related event for knowledge enhancement can improve the accuracy of the analysis.

[0101] Step 202: Fill the network security event, each related event, and the analysis results of each related event into the prompt word corresponding to the feature analysis agent to obtain the input data of the feature analysis agent.

[0102] Exemplarily, the input data of the feature analysis agent under the event type analysis dimension is: 1 =Prompt(S',S'1 ,S' 2 ,…,S' k ), where S k ' represents the kth associated event of network security event S under the event type analysis dimension, S k '=[T k ,S k ,R k ], R k represents the analysis result of the kth associated event, T k Indicates the event type of the kth associated event, I 1 It is the input data after the Prompt corresponding to the feature analysis agent is constructed.

[0103] In addition, it is worth noting that in the embodiment of the present application, the prompt of the agent is not a general template, but a prompt designed for a specific task, for example, a prompt for an event type analysis task, that is, a prompt of a feature analysis agent under the event type analysis dimension, and its main structure example is as follows:

[0104] [{“Input1”:S 1 , "Type1": T 1 , "Output1": R 1},{“Input2”:S 2 ,“Type2”:T 2 , "Output2": R 2},{“Input3”:S 3 , "Type3": T 3 , "Output3": R 3},......,{“Inputk”:S k , "Typek": T k , "Outputk": R k},{"Input":S,"Type":T,"Output":}]

[0105] The Input position is filled with event information, the Type position is filled with event type, and the Output is the analysis result of the event. It should be noted that the Prompt in the example is a structure filled with input data. When filling it in practice, more detailed adjustments can be made according to the requirements of the analysis task.

[0106] Exemplarily, the input data of the feature analysis agent under the event entity analysis dimension is: 21 =Prompt(S”,S’ 1 ' 1 ,S' 2' 1 ,…,S” k1 ), I 22 =Prompt(S”,S’ 1 ' 2 ,S' 2 ' 2 ,…,S” k2 ). Among them, S k1 " represents the kth first associated event of network security event S under the first type of entity data in the event entity analysis dimension, S k2 " represents the kth second associated event of network security event S under the second type of entity data in the event entity analysis dimension, I 21 is the input data corresponding to the first type of entity data after the Prompt corresponding to the feature analysis agent is constructed, I 21 It is the input data corresponding to the second type of entity data after the Prompt corresponding to the feature analysis agent is constructed.

[0107] For example, the input data of the feature analysis agent under the event details analysis dimension is: 3 =Prompt(S””,S’ 1 ”',S' 2 ”',…,S” k ”). Among them, S k ”' represents the kth associated event of network security event S under the event details analysis dimension.

[0108] In an embodiment of the present application, after obtaining the input data of the feature analysis agent, the input data is input into the large language model of the corresponding feature analysis agent to obtain the output result of the large language model as the intermediate analysis result of the network security incident.

[0109] For example, the intermediate analysis result of the feature analysis agent under the event type analysis dimension is: 1 =LLM(I 1 ), input data I 1 By inputting into LLM and obtaining the output result of LLM, we can get the intermediate analysis result of analyzing the network security event S according to the event type dimension.

[0110] In this way, after preliminary analysis of network security incidents from different analysis dimensions, the intermediate analysis results obtained can not only reflect the analysis results of network security incidents under specific analysis dimensions, but also reflect the process of the entire system analyzing network security incidents, making the analysis more comprehensive and explanatory.

[0111] Based on the above embodiment, the method for obtaining the intermediate analysis result in the embodiment of the present application is described in detail using a specific example below, specifically including:

[0112] See also Figure 4 As shown, it is an example diagram of obtaining intermediate analysis results in the embodiment of the present application. The analysis system includes: 3 feature analysis agents (event type analysis agent, event entity analysis agent, event detail analysis agent) and 1 result analysis agent. The 3 feature analysis agents analyze the network security event respectively to obtain 3 intermediate analysis results of the network security event. The result analysis agent analyzes the network security event and each intermediate analysis result to obtain the target analysis result of the network security event.

[0113] (1) The event type analysis dimension is used for analysis.

[0114] In network security events, event type is a preliminary classification of network security events. For example, in network security events, IP attack events, TCP attack events, DNS attack events and other types can all be classified into the DDOS attack category. By taking event type as a feature, analyzing the common features and severity features between similar events of the same type, we can obtain the analysis results of the current network security events from the perspective of type association.

[0115] Specifically, the data format of the event type analysis dimension is constructed as: S'=[T,S], where S is a network security event and T is an event type.

[0116] Then, through the constructed data form, the k related events with the highest correlation with the network security event S under the event type T and their analysis results are obtained from the event type knowledge base constructed in advance through the RAG technology.

[0117] Since the current event type analysis agent's analysis task is to analyze network security events based on event type as the analysis dimension, the prompt is designed to construct input data in the following form: 1 =Prompt(S',S' 1 ,S' 2 ,…,S' k ), where S k ' represents the kth associated event of network security event S under the event type analysis dimension, S k '=[T k ,S k ,R k ], R k represents the analysis result of the kth associated event, T k Indicates the event type of the k-th associated event.

[0118] After the above processing, the input data I 1Input the LLM of the event type analysis agent and obtain the intermediate analysis result a of the event type analysis agent 1 =LLM(I 1 ).

[0119] (2) Use event entity analysis agent for analysis.

[0120] The occurrence of network security incidents is inseparable from entities. The network security incidents that occur on the corresponding entities are closely related to the information attached to the entities themselves. For example, for the physical terminals of Internet companies, network security incidents such as DDOS attacks, vulnerability attacks, and virus attacks are more likely to occur, while physical terminals in the financial field are more likely to have backdoor attacks and other incidents. In addition, in the same entity or the same network entity, analyzing the network security incidents that have occurred in the time dimension can combine the threat level of the network security incidents that have occurred, the characteristics of the incidents, and other information to conduct a more comprehensive analysis of the current network security incidents. The event analysis is completed separately from the two aspects of related events of entities in the same field and the time dimension of the current entity.

[0121] Specifically, the data format of the event entity analysis dimension is constructed as: S”=[D,S], where S is a network security event and D is entity information associated with the network security event.

[0122] Then, through the constructed data form, with entity information as the dimension, combined with RAG technology, from the pre-constructed knowledge base of entity domain and event association, the k first associated events with the highest correlation with network security event S in the current entity association field are obtained. Then, with entity information as the dimension, the k second associated events that occurred in the entity of network security event S in the past historical time period are obtained. Events can be analyzed from the perspective of the correlation between consecutive events and more related information can be mined.

[0123] Through the above processing, two types of event data are obtained respectively. The two types of event data are constructed through the Prompt of the event entity analysis agent to obtain two input data, as shown below:

[0124] I 21 =Prompt(S”,S’ 1 ' 1 ,S' 2 ' 1 ,…,S” k1 )

[0125] I 22 =Prompt(S”,S’ 1 ' 2 ,S' 2 ' 2 ,…,S” k2 )

[0126] Among them, S k1 " represents the kth first associated event of network security event S, S k2 " represents the kth second associated event of network security event S.

[0127] After the above processing, the data I 21 and I 22 Input the LLM of the event entity analysis agent respectively, and obtain the intermediate analysis result a of the event type analysis agent 2 .

[0128] (3) Use event detail analysis agent for analysis.

[0129] The event detail analysis agent analyzes events based on their global information rather than a specific feature. The intermediate analysis results obtained can be used to improve the accuracy of network security event analysis and enrich the information in the analysis process.

[0130] Specifically, the data format of the event details analysis dimension is constructed as: S''=[S], where S is a network security event.

[0131] Then, from the pre-built event knowledge base, the k associated events with the highest correlation with the network security event S are obtained.

[0132] The obtained data is passed through the prompt structure of the event detail analysis agent to obtain the input data, as shown below: 3 =Prompt(S””,S’ 1 ”',S' 2 ”',…,S” k ”).

[0133] Among them, S k ”' represents the kth associated event of network security event S.

[0134] After the above processing, the data I 3 Input the LLM of the event detail analysis agent and obtain the intermediate analysis result a of the event detail analysis agent 3 .

[0135] Step 21: Use a result analysis agent to analyze the network security incident and each intermediate analysis result to obtain the target analysis result of the network security incident.

[0136] In the embodiment of the present application, the result analysis agent can be adjusted according to the direction of the analysis task.

[0137] For example, if the direction of the analysis task is situation awareness, the analysis direction of the result analysis agent is adjusted to analyze the current situation of the network where the physical terminal is located.

[0138] Optionally, in the embodiment of the present application, a possible embodiment is provided for obtaining a target analysis result of a network security event, and the following operations are specifically performed:

[0139] Step 210: Fill the network security event and N intermediate analysis results into the prompt words corresponding to the result analysis agent to obtain input data of the result analysis agent.

[0140] Among them, the prompt words corresponding to the result analysis agent are constructed based on the result requirements of the analysis task.

[0141] For example, in the current analysis task, the required analysis result is to judge the threat level of the event. When designing the prompt of the current result analysis agent, the output result needs to be controlled to judge the threat level of the event. The analysis result can be adjusted accordingly according to the type of analysis task. For example, the analysis task can be to analyze the threat level of the event, event solution, entity situation awareness, etc.

[0142] Exemplarily, each feature analysis agent includes: an event type analysis agent, an event entity analysis agent, and an event detail analysis agent, and the input data of the result analysis agent is: 4 =Prompt(S,a 1 ,a 2 ,a 3 ), where S represents a network security incident, a 1 represents the intermediate analysis result of the event type analysis agent analyzing the network security event S, a 2 represents the intermediate analysis result of the event entity analysis agent analyzing the network security event S, a 3 Represents the intermediate analysis results corresponding to the network security event S analyzed by the event details analysis agent.

[0143] Step 211: Input the input data into the large language model of the result analysis agent to obtain the target analysis results of the network security incident.

[0144] In an embodiment of the present application, after obtaining the input data of the result analysis agent, the input data is input into the large language model of the result analysis agent to obtain the output result of the large language model as the target analysis result of the network security incident.

[0145] For example, the target analysis results are: a 4 =LLM(I 4 ), input data I 4Input into LLM, obtain the output of LLM, and you can get the target analysis result.

[0146] Furthermore, after obtaining the target analysis result of the network security incident, in an embodiment of the present application, the target analysis result and / or N intermediate analysis results are sent to the downstream system based on the business requirements of the downstream system.

[0147] For example, if the business requirement of the downstream system requires retaining N intermediate analysis results, then the target analysis result and / or the N intermediate analysis results are sent to the downstream system.

[0148] In this way, the N intermediate analysis results reflect the analysis results of the network security incident under a specific analysis dimension, and can also reflect the process of the entire system analyzing the network security incident. The target analysis result reflects the comprehensive result of the network security incident. The N intermediate analysis results and the target analysis result are summarized to make a more comprehensive interpretation of the incident, and finally form complete incident analysis and interpretation information.

[0149] For another example, if the business requirements of the downstream system do not require retaining N intermediate analysis results, the target analysis result is sent to the downstream system.

[0150] Furthermore, after the downstream system receives the analysis results of the network security incident, it processes and packages the data according to business requirements, forms a security report, and pushes it to the customer.

[0151] Based on the same inventive concept, a network security event analysis device is also provided in the embodiment of the present application, see Figure 5 As shown, it is a schematic diagram of the structure of the network security event analysis device in the embodiment of the present application, which specifically includes:

[0152] The first analysis module 501 is used to use N feature analysis agents to analyze the network security event and obtain N intermediate analysis results of the network security event, wherein the analysis dimension of each feature analysis agent is different, and N is an integer greater than 1;

[0153] The second analysis module 502 is used to use a result analysis agent to analyze the network security event and each intermediate analysis result to obtain a target analysis result of the network security event.

[0154] In a possible embodiment, N feature analysis agents are used to analyze network security events. Before obtaining N intermediate analysis results of network security events, a data preprocessing module 503 is also included. The data preprocessing module 503 is used to:

[0155] Obtain network security events and perform data cleansing and formatting on them.

[0156] In a possible embodiment, when N feature analysis agents are used to analyze a network security event and N intermediate analysis results of the network security event are obtained, the first analysis module 501 is further used to:

[0157] For each of the N feature analysis agents, the following operations are performed respectively: based on the input requirements corresponding to the feature analysis agent, the network security incident is processed to obtain the input data of the feature analysis agent, and the input data is input into the large language model of the feature analysis agent to obtain the intermediate analysis results of the network security incident.

[0158] In a possible embodiment, based on the input requirements corresponding to the feature analysis agent, when processing the network security event and obtaining the input data of the feature analysis agent, the first analysis module 501 is further used to:

[0159] According to the data form corresponding to the feature analysis agent, the network security incident is processed in data form;

[0160] Obtain, from the knowledge base corresponding to the feature analysis agent, each associated event whose correlation with the network security event meets a preset correlation condition under the analysis dimension of the feature analysis agent, and the analysis result of each associated event;

[0161] The network security events, the associated events, and the analysis results of the associated events are filled into the prompt words corresponding to the feature analysis agent to obtain the input data of the feature analysis agent.

[0162] In a possible embodiment, when a result analysis agent is used to analyze the network security event and each intermediate analysis result to obtain a target analysis result of the network security event, the second analysis module 502 is further used to:

[0163] Fill the network security events and N intermediate analysis results into the prompt words corresponding to the result analysis agent to obtain input data of the result analysis agent, wherein the prompt words corresponding to the result analysis agent are constructed based on the result requirements of the analysis task;

[0164] Input data is fed into the large language model of the result analysis agent to obtain the target analysis results of the network security incident.

[0165] In a possible embodiment, a result analysis agent is used to analyze the network security event and each intermediate analysis result, and after obtaining the target analysis result of the network security event, a result processing module 504 is also included. The result processing module 504 is used to:

[0166] Based on the business requirements of the downstream system, the target analysis result and / or N intermediate analysis results are sent to the downstream system.

[0167] Based on the above embodiments, see Figure 6 Shown is a schematic diagram of the structure of an electronic device in an embodiment of the present application.

[0168] An embodiment of the present application provides an electronic device, which may include a processor 610 (Center Processing Unit, CPU), a memory 620, an input device 630 and an output device 640, etc. The input device 630 may include a keyboard, a mouse, a touch screen, etc., and the output device 640 may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), a cathode ray tube (Cathode Ray Tube, CRT), etc.

[0169] The memory 620 may include a read-only memory (ROM) and a random access memory (RAM), and provides the processor 610 with program instructions and data stored in the memory 620. In an embodiment of the present application, the memory 620 may be used to store the program of any network security event analysis method in the embodiment of the present application.

[0170] The processor 610 calls the program instructions stored in the memory 620, and the processor 610 is used to execute any network security event analysis method in the embodiments of the present application according to the obtained program instructions.

[0171] Based on the above embodiments, in an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the network security incident analysis method in any of the above method embodiments is implemented.

[0172] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0173] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0174] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0175] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0176] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network security incident analysis method, characterized in that: include: Using N feature analysis agents to analyze the network security event and obtain N intermediate analysis results of the network security event, wherein the analysis dimensions of each feature analysis agent are different, and N is an integer greater than 1; A result analysis agent is used to analyze the network security event and the intermediate analysis results to obtain a target analysis result of the network security event.

2. The method according to claim 1, characterized in that Before the method adopts N feature analysis agents to analyze the network security event and obtains N intermediate analysis results of the network security event, it also includes: Acquire network security events, and perform data cleaning and formatting on the network security events.

3. The method according to claim 2, characterized in that The adopting of N feature analysis agents to analyze the network security event and obtaining N intermediate analysis results of the network security event includes: For each of the N feature analysis agents, the following operations are performed respectively: based on the input requirements corresponding to the feature analysis agent, the network security event is processed to obtain the input data of the feature analysis agent, and the input data is input into the large language model of the feature analysis agent to obtain the intermediate analysis result of the network security event.

4. The method according to claim 3, characterized in that The processing of the network security event based on the input requirement corresponding to the feature analysis agent to obtain the input data of the feature analysis agent includes: According to the data form corresponding to the feature analysis agent, the network security event is processed in data form; Acquire, from the knowledge base corresponding to the feature analysis agent, each associated event whose correlation with the network security event satisfies a preset correlation condition under the analysis dimension of the feature analysis agent, and the analysis results of each associated event; The network security event, the associated events, and the analysis results of the associated events are filled into the prompt words corresponding to the feature analysis agent to obtain input data of the feature analysis agent.

5. The method according to claim 1, characterized in that The adopting result analysis agent to analyze the network security event and the intermediate analysis results to obtain the target analysis result of the network security event includes: Filling the network security event and the N intermediate analysis results into the prompt words corresponding to the result analysis agent to obtain input data of the result analysis agent, wherein the prompt words corresponding to the result analysis agent are constructed based on the result requirements of the analysis task; The input data is input into the large language model of the result analysis agent to obtain the target analysis result of the network security event.

6. The method according to claim 1, characterized in that After adopting the result analysis agent to analyze the network security event and the intermediate analysis results to obtain the target analysis result of the network security event, the method further includes: Based on the business requirements of the downstream system, the target analysis result and / or the N intermediate analysis results are sent to the downstream system.

7. A network security event analysis device, characterized in that: include: A first analysis module is used to use N feature analysis agents to analyze the network security event and obtain N intermediate analysis results of the network security event, wherein the analysis dimensions of each feature analysis agent are different, and N is an integer greater than 1; The second analysis module is used to use a result analysis agent to analyze the network security event and the intermediate analysis results to obtain a target analysis result of the network security event.

8. The device according to claim 7, characterized in that When the N feature analysis agents are used to analyze the network security event and N intermediate analysis results of the network security event are obtained, the first analysis module is further used to: For each of the N feature analysis agents, the following operations are performed respectively: based on the input requirements corresponding to the feature analysis agent, the network security event is processed to obtain the input data of the feature analysis agent, and the input data is input into the large language model of the feature analysis agent to obtain the intermediate analysis result of the network security event.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images