Network security event processing method and device, electronic equipment and storage medium

Abstract

The invention provides a network security event processing method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: responding to a received monitoring instruction for a network security event, and instructing a large language model to monitor the network security event based on the monitoring instruction; when a monitoring result of the network security event monitored by the large language model is received, outputting alarm information for the monitoring result; in response to the received user interaction information input for the alarm information, indicating the large language model to output a response strategy for the network security event based on the user interaction information; inputting the response strategy into the cue word model, and obtaining a security response instruction for the network security event; and based on the security response instruction, indicating the large language model to process the network security event, and outputting a processing result of the network security event. And the processing efficiency of the network security event is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for processing network security events. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly serious. In traditional technologies, network security defense and emergency response methods usually use monitoring devices to monitor specific network security events and provide monitoring data to users for viewing. When a network security event is discovered, the user can use the corresponding processing method to deal with the network security event.

[0003] This approach not only requires users to observe network security incidents in real time, making it difficult to detect network security incidents in a timely manner, but also requires users to have certain professional knowledge to respond to network security incidents on their own. The efficiency of handling network security incidents depends on manpower, which makes it difficult to guarantee the efficiency of handling network security incidents. Summary of the invention

[0004] The present application provides a method, device, electronic device and storage medium for processing network security incidents.

[0005] Some embodiments of the present application provide a method for processing a network security incident, the method comprising:

[0006] In response to receiving a monitoring instruction for a network security event, instructing the large language model to monitor the network security event based on the monitoring instruction;

[0007] When receiving the monitoring result of the network security event detected by the large language model, outputting warning information for the monitoring result;

[0008] In response to receiving user interaction information input for the alarm information, instructing the large language model to generate and output a response strategy for the network security event based on the user interaction information;

[0009] Inputting the response strategy into a prompt word model to obtain a security response instruction for the network security incident;

[0010] Based on the security response instruction, the large language model is instructed to process the network security event and output a processing result of the network security event.

[0011] Some embodiments of the present application provide a device for processing a network security event, the device comprising:

[0012] A receiving module, configured to, in response to receiving a monitoring instruction for a network security event, instruct the large language model to monitor the network security event based on the monitoring instruction;

[0013] An alarm module, configured to output alarm information for the monitoring result when receiving the monitoring result of the network security event monitored by the large language model;

[0014] An interaction module, configured to, in response to receiving user interaction information input for the alarm information, instruct the large language model to generate and output a response strategy for the network security event based on the user interaction information;

[0015] A response module, used to input the response strategy into the prompt word model to obtain a security response instruction for the network security incident;

[0016] Based on the security response instruction, the large language model is instructed to process the network security event and output a processing result of the network security event.

[0017] Some embodiments of the present application provide a computing processing device, including:

[0018] a memory having computer readable code stored therein;

[0019] One or more processors. When the computer-readable code is executed by the one or more processors, the computing processing device executes the method for processing network security events as described above.

[0020] Some embodiments of the present application provide a computer program, including a computer-readable code, which, when executed on a computing and processing device, causes the computing and processing device to execute the method for processing network security events as described above.

[0021] Some embodiments of the present application provide a non-transitory computer-readable medium, in which the method for processing network security events as described above is stored.

[0022] The network security incident processing methods, devices, electronic devices and storage media provided in some embodiments of the present application can monitor network security incidents by using a large language model, and can promptly inform users through alarm information when a network security incident occurs, and then instruct the large language model to analyze the network security incident to obtain a response strategy by receiving user interaction information, and can further use a prompt word model to automatically instruct the large language model to process the network security incident based on the response strategy, so that the large language model can assist users in timely discovering network security incidents and efficiently perform emergency response processing on network security incidents.

[0023] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 A schematic diagram of a process of processing a network security incident provided by some embodiments of the present application is schematically shown;

[0026] Figure 2 A system diagram schematically illustrates a method for processing network security events provided by some embodiments of the present application;

[0027] Figure 3 One of the flowcharts of another method for handling network security incidents provided in some embodiments of the present application is schematically shown;

[0028] Figure 4 The second flowchart schematically shows another method for handling network security events provided in some embodiments of the present application;

[0029] Figure 5 The third flowchart schematically shows another method for handling network security incidents provided by some embodiments of the present application;

[0030] Figure 6 A fourth flowchart schematically illustrates another method for handling network security incidents provided in some embodiments of the present application;

[0031] Figure 7 A fifth flow chart of another method for handling network security incidents provided in some embodiments of the present application is schematically shown;

[0032] Figure 8 A system diagram schematically illustrates another method for handling network security events provided by some embodiments of the present application;

[0033] Fig. 9 The following schematically shows a schematic diagram of the structure of a network security event processing device provided by some embodiments of the present application;

[0034] Fig.10 The structural diagram of the exemplary device provided in some embodiments of the present application is schematically shown. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0036] Figure 1 A schematic diagram of a process flow of a method for handling a network security incident provided by the present application is schematically shown, and the method comprises:

[0037] Step 101: in response to receiving a monitoring instruction for a network security event, instruct a large language model to monitor the network security event based on the monitoring instruction.

[0038] It should be noted that the network security events in some embodiments of the present application refer to object events that may pose a threat to the hardware resources, software resources or data resources in the network system, such as causing damage to the network system, data tampering, data leakage, threatening the continuous and normal operation of the network system, causing network service interruption, etc.

[0039] Large Language Model (LLM) refers to a natural language processing model based on deep learning, which is characterized by being able to process massive text data through large-scale unsupervised or semi-supervised learning methods to understand and serve the understanding and generation of human language. The core of LLM is to use large-scale data training to imitate human language cognition and generation processes, so that they can simulate human language cognition and generation capabilities to a large extent. LLM models usually have billions to trillions of parameters, and can perform a variety of natural language processing tasks, including but not limited to natural language generation, text classification, text summarization, machine translation and speech recognition, etc. The large language model in some embodiments of the present application is obtained by training by collecting relevant data of network security incidents, which may include log files, intrusion monitoring system alarms, network traffic data, etc. The collected data needs to be pre-processed, including operations such as noise removal, data cleaning and standardization, to ensure the accuracy and consistency of subsequent steps, so that the large language model can perform monitoring and identification, analysis and evaluation, provide solutions, response processing, etc. to network security incidents.

[0040] Optionally, the above step 101 may include:

[0041] S1011. In response to receiving a monitoring instruction for a network security event, determine characteristic information of the network security event based on the monitoring instruction.

[0042] S1012: Input the feature information into the large language model, so that the large language model monitors the network security events represented by the feature information.

[0043] Specifically, in an embodiment of the present application, a user can specify a corresponding network security event by inputting characteristic information such as data characteristics and behavioral characteristics of the network security event to be monitored, or input identification information that has a mapping relationship with characteristic information such as data characteristics or behavioral characteristics of the network security event, such as a name, event number, etc., to indicate the corresponding network security event. Then, the embodiment of the present application can directly obtain the characteristic information carried by the monitoring instruction, or obtain the characteristic information of the network security event based on the identification information carried by the monitoring instruction, and then by inputting the characteristic information into the large language model, the large language model can be informed of the network security events that need to be monitored.

[0044] Furthermore, the large language model can monitor the network security events after determining the network security events that need to be monitored based on the characteristic information of the network security events carried by the monitoring instructions. Specifically, the large language model can collect the data transmission process and operation status of the monitoring object corresponding to the network security event, and then compare the collected operation data and operation status with the characteristic information of the network security event to realize the monitoring of the network security event.

[0045] Step 102: upon receiving the monitoring result of the network security event detected by the large language model, outputting warning information for the monitoring result.

[0046] In an embodiment of the present application, when the large language model monitors a network security incident, it can compare the collected operation data and operation status with the characteristic information of the network security incident. If the comparison is successful, it is determined that a network security incident has been monitored. The embodiment of the present application can use the monitored operation data and operation status and other information as monitoring results to send an alarm message to the client to remind the user to handle it immediately. Specifically, the characteristic information of the above-mentioned network security incident can include the corresponding operation data and operation status when the network security incident occurs. Then, the embodiment of the present invention can use the collected operation data and operation status to compare with the characteristic information of the network security incident. When the collected operation data and operation status are consistent with the characteristic information of the network security incident, the comparison is successful, and it is determined that a network security incident has been monitored. Correspondingly, when there is inconsistency, the comparison fails, it is determined that no network security incident has been monitored, and monitoring can continue.

[0047] The client can send warning information to users in the form of text, images, videos, voice, emails, text messages, etc. After knowing the warning information, users can log in to the client to perform subsequent processing operations.

[0048] Step 103: In response to receiving user interaction information input for the alarm information, instruct the large language model to generate and output a response strategy for the network security event based on the user interaction information.

[0049] In the embodiment of the present application, user interaction information refers to language information about the method of handling the network security incident described in the alarm information. The user can input the user interaction information to the client through the client by voice input or text input.

[0050] For example, when the network security event is a "remote network attack", the user interaction information may be "cut off the source of the network attack", "strengthen firewall protection", etc., so that the embodiment of the present application can instruct the large language model to handle security based on the user interaction information.

[0051] The embodiment of the present application can extract and identify the keyword information in the user interaction information, and then input the keyword information into the semantic recognition model to identify the real semantic information of the user interaction information. However, the user interaction information often only shows a relatively broad processing method. In order to generate a more specific response strategy, the embodiment of the present application can input the real semantic information into the large language model, so that the large language model can be based on the third-party threat intelligence data integrated during training (including but not limited to public vulnerability information, hacker organization actions, etc.), and the collected operation data and operation status are compared to evaluate the threat level of network security events, and then the assessed threat level and the user's real semantic information can be comprehensively analyzed to obtain the corresponding response strategy and send it to the client for the user to view.

[0052] Step 104: input the response strategy into a prompt word model to obtain a security response instruction for the network security incident.

[0053] Step 105: Based on the security response instruction, instruct the large language model to process the network security event and output a processing result of the network security event.

[0054] In an embodiment of the present application, a prompt word model (Prompt Template) is a replicable way of generating prompt words, which includes a text string and can receive a set of parameters from a terminal user to generate prompt words. The prompt word model can include instructions, quantity instances and questions raised by a language model. The prompt word model can be used to generate security response instructions that are more in line with natural language specifications and easier to be accurately recognized by a large language model, thereby instructing the large language model to perform natural language interaction and handle network security incidents according to the security response instructions.

[0055] Specifically, the embodiment of the present application can also automatically respond to network security incidents, that is, after the large language model outputs the response strategy, in order to respond to the network security incident immediately and avoid further deterioration of the network security incident, the response strategy can be automatically input into the prompt word model to generate a security response instruction, so as to instruct the large language model to use the response strategy to handle the network security incident through the security response instruction. Therefore, without user operation, the network security incident can be quickly responded to and processed, and the security threat caused by the network security incident to the network system can be eliminated in time.

[0056] Exemplarily, when the response strategy is to block the source IP of the network attack, the security response instruction "use the IP blocking tool to block the source IP of the network tool" can be input into the large language model, and then the large language model will call the available IP blocking tool to block the identified attack source IP. When the response strategy is to limit the number of terminal requests, the security response instruction "use the bandwidth control tool to limit the bandwidth of the service interface" can be input into the large language model, and then the large language model will call the bandwidth control tool to monitor the traffic of each interface connected to the terminal. When the interface traffic is greater than the limited bandwidth, the interface traffic is automatically limited to achieve the purpose of limiting the bandwidth of the service interface. Of course, this is only an exemplary description, and the specific response strategy can be set according to actual needs, and is not limited here.

[0057] In the process of handling network security incidents based on the response strategy, the large language model will continuously feed back the processing results to the client, so that the user can timely understand the processing progress of the network security incident through the client. After viewing the processing results, the user can also continue to input user interaction information through the client to instruct the large language model to adjust the response strategy, so that the large language model can assist users in flexibly handling network security incidents.

[0058] Specifically, refer to Figure 2 , where the input interface "Input Variables" inputs the user interaction information input by the user into the system application (Application), and the large language model and prompt word model can be integrated into the system application. First, after the user interaction information is processed by the prompt word model (Prompt Template), the instruction is input to the large language model (LLM), and then the large language model queries the corresponding response strategy and tool (search) in the database (Database), and then based on the response strategy, the prompt word model automatically controls the LLM to process the network security incident, and the processing result is output to the client through the output interface (Application Output) of the system application.

[0059] Exemplarily, after the user inputs the network security event that needs to be monitored by inputting user interaction information, the large language model will output a response strategy for the user interaction information. The response strategy may include the tools that need to be used, such as: sqlmap plug-in. Optionally, before the large language model calls the sqlmap plug-in to process the network security event based on the response strategy, it can also generate and display a task ID, wherein the task ID can be a unique identifier assigned to the network security event, and the task ID can be carried in the processing result to distinguish the processing results of different network security events. Finally, after the large language model completes the processing of the network security event, the large language model can output the processing result of the network security event based on the sqlmap plug-in, and the processing result can include the detected network security vulnerability.

[0060] The embodiment of the present application monitors network security events by utilizing a large language model, and can promptly inform users through alarm information when a network security event occurs, and then instruct the large language model to analyze the network security event to obtain a response strategy by receiving user interaction information, and can further utilize a prompt word model to automatically instruct the large language model to handle the network security event based on the response strategy, so that the large language model can assist users in promptly discovering network security events and efficiently perform emergency response processing on network security events.

[0061] Optionally, refer to Figure 3 , the step 103 comprises:

[0062] Step 1031: input the user interaction information into the prompt word model to obtain the prompt word corresponding to the user interaction information.

[0063] Step 1032: input the prompt word into the large language model to obtain a response strategy for the network security incident.

[0064] In the embodiment of the present application, the prompt word model includes a feature string template, so that the prompt word is generated by extracting the keywords in the user interaction information and then filling the keywords into the indication string template. The prompt words generated in this way are easier to be accurately recognized by the large language model. Compared with the irregularity of the format and content of the user interaction information, since the string template is set based on the recognition effect of the large language model, the obtained prompt words can make the large language model more accurately understand the actual semantics of the user interaction information, so that the response strategy that can meet the user interaction information can be more accurately output.

[0065] For example, if the user interaction information is "block all access information of Apple", if the user interaction information is directly input into the large language model, the large language model will find it difficult to determine whether "apple" refers to the fruit apple or the Apple brand. However, if the prompt word model is used, the user interaction information can be converted into a prompt word "block the access information of Apple brand terminal devices". In this way, the large language model can clearly know that the target object is the Apple brand terminal device.

[0066] Of course, this is only for easy understanding. The actual use of the prompt word model is to perform standardized conversion on user interaction information, so that the quality of the language information input into the large language model can be guaranteed, thereby improving the accuracy of the large language model's feedback on user interaction information.

[0067] Optionally, the prompt words include at least: question information, thinking information, action information, observation information, reference Figure 4 , the step 1032 comprises:

[0068] Step 10321: input the question information into the large language model to obtain semantic information corresponding to the user interaction information.

[0069] Step 10322: input the thinking information and the semantic information into the large language model to obtain a method for handling the network security incident.

[0070] Step 10323: Input the processing method, tool list and action information into the large language model to obtain the target tool identifier in the tool list for processing the network security incident.

[0071] Step 10324, input the processing method, target tool identification and the observation information into the large language model to obtain a response strategy.

[0072] In an embodiment of the present application, the execution process template of the prompt word model can be a standard ReAct process of "thinking -> action -> action input -> observation", where thinking refers to thinking about how to solve user problems, action refers to the tools needed to solve the problems, action input is the parameters needed by the tools, and observation is the result obtained after the tool is executed.

[0073] Specifically, first, question information is generated based on user interaction information, and then the question information is input into the large language model to enable the large language model to know what problem needs to be solved, and then the recognized semantic information and thinking information are input into the large language model to instruct the large language model to determine the processing method to be adopted to solve the problem, and then the processing method and the list of available tools and action information are input into the large language model, so that the large language model outputs the target tool identifier corresponding to the tool needed to solve the problem and the input parameters of the tool, and finally the processing method, target tool identifier and observation information are input into the large language model, so that the large language model analyzes and obtains the response strategy.

[0074] Exemplarily, the template may be, for example:

[0075] {tools}

[0076] Please follow the format below:

[0077] Question information: Input question you must answer;

[0078] Thinking about the information: You should always think about how to do it;

[0079] Action information: The action to be taken, which should be one of {tool_names};

[0080] Execution input: Use tools to solve problems;

[0081] Observation information: observe the processing results of tools;

[0082] ......(Thinking -> Action -> Action Input -> Observation can be repeated N times)

[0083] Thinking Information: Do I know the final answer now?

[0084] Final answer: The final answer to the original input user interaction information.

[0085] As you can see, the template has two variables, tools and tool_names. The tools variable is a tool list that contains all the tools. Each element in the tool list contains the name and description of the tool, while the tool_names variable is a list of tool names. After passing in a specific tool identifier, the corresponding tool list will be generated. For example, we have the following two tools, which are parsed as follows:

[0086] You can use the following open and possible answer questions:

[0087] Search: Tools for implementing online searches;

[0088] Sqlmap: sql injection scanning tool.

[0089] Of course, the tools here are only exemplary descriptions and can be set according to actual needs, which is not limited here.

[0090] The embodiment of the present application uses a process template of questions, thoughts, actions and observations to convert user interaction information to input prompt words into a large language model, thereby automatically guiding the large language model to feedback a response strategy to the user interaction information. There is no need for the user to continuously interact with the large language model, thereby improving the efficiency and accuracy of the large language model's output response strategy for network security incidents.

[0091] Optionally, refer to Figure 5 , the step 10324 comprises:

[0092] Step 103241, input the processing method, target tool identification and the observation information into the large language model to obtain the observation result.

[0093] Step 103242, when the observation result does not meet the expected requirements, enter the step of inputting the question information into the large language model to obtain semantic information corresponding to the user interaction information.

[0094] Step 103243, when the observation result meets the expected requirement, output a response strategy according to the target tool identification and the processing method.

[0095] In the embodiment of the present application, the process template of questions, thinking, actions and observations can be repeated multiple times until the observation results obtained meet the expected requirements. The template has two output variables, namely input and agent_scratchpad. Input refers to the user interaction information entered by the user. Agent_scratchpad is the previous thinking process based on the process template, including thinking, action, action input and observation, etc. Agent_scratchpad will be substituted with specific values ​​during the execution process and continuously updated based on the execution process.

[0096] For example,

[0097] Question information: Help me monitor whether http: / / testphp.com has SQL injection vulnerabilities;

[0098] Thinking information: We need to monitor through the sqlmap tool;

[0099] Action information: search;

[0100] Action input: http: / / testphp.com;

[0101] Observation information: Monitoring results of the sqlmap tool for http: / / testphp.com;

[0102] Thinking information: You should keep thinking about whether the tool can solve the problem. If not, what other methods can be used to solve it. If the problem is solved, output the monitoring results.

[0103] If the monitoring results can achieve the expected effect, the response strategy containing input and agent_scratchpad can be output. Of course, this is only an exemplary description. The specific setting methods of question information, thinking information, action information, action input and observation information can be set according to actual needs and are not limited here.

[0104] The embodiment of the present application loops through questioning, thinking, action, and observation until the observed information meets the expected effect, so that the large language model can independently think about the response strategy for handling network security incidents based on user interaction information, without the need for the user to continuously interact with the large language model, thereby improving the efficiency and accuracy of the large language model in outputting response strategies for network security incidents.

[0105] Optionally, refer to Figure 6 , said 103, including:

[0106] Step S1, splitting the user interaction information to obtain at least two task information.

[0107] Step S2: input the at least two task information into the large language model respectively to obtain a response strategy corresponding to each task information.

[0108] In the embodiment of the present application, the prompt word model can be input into the large language model for processing by splitting the user interaction information into multiple different task information. It can be understood that the user interaction information may contain multiple different task operations, and different tools are required to implement the corresponding processing operations. At this time, if the user interaction information is directly input into the large language model, the large language model needs to perform processing operations one by one, and the processing efficiency will be reduced. If the user interaction information is differentiated into multiple different task information and input into the large language model, the large language model can process different task information simultaneously, thereby improving the processing efficiency of the user interaction information.

[0109] Optionally, refer to Figure 7 , the step 105 comprises:

[0110] Step 1051: input the security response instruction corresponding to each task information into the large language model to obtain the processing result corresponding to each task information.

[0111] Step 1052: Combine the processing results of at least two task information to obtain a processing result for the network security event.

[0112] In an embodiment of the present application, for different task information, after using different tools to obtain processing results, in order to enable multiple processing results to provide feedback to one user interaction information, the embodiment of the present application can merge the processing results output by the large language model for different task information and feed them back to the user, so that the user can intuitively understand the processing results of the user interaction information input by him.

[0113] For example, refer to Figure 8 , wherein the user interaction information is input as "Prompt" into the system used in the embodiment of the present application, the system (Agent) will use the prompt word model to split the user interaction information into task information 1, task information 2 and task information 3, task information 1 can be executed by tool Tool1, task information 2 and task information 3 can be executed by tool Tool2, the system assigns different task information to the corresponding tools for execution, and obtains the corresponding processing results 1, processing results 2 and processing results 3 respectively, and then the system merges the three processing results and sends them to the client for the user to view. Of course, the description here is just an example, and it can be set according to actual needs, which is not limited here.

[0114] The embodiment of the present application divides the user interaction information into multiple task information and inputs them into the large language model for processing respectively, so that the large language model can process multiple task information in the same user interaction information in parallel and then output them after merging, thereby improving the efficiency of the large language model in providing feedback on user interaction information and processing network security incidents.

[0115] Optionally, after step 105, the method further includes: generating a network security report for the network security event based on the monitoring result, the user interaction information, and the processing result, and outputting the network security report.

[0116] In an embodiment of the present application, the large language model can analyze and summarize network security events that have occurred in the past, and generate a network security report based on monitoring results, user interaction information, processing results and other information generated during the network security event processing.

[0117] Specifically, the cybersecurity report may include but is not limited to: Introduction: A brief introduction to the purpose and background of the report, as well as the main content and conclusions of the report. Analysis of the current cybersecurity situation: Describe the current cybersecurity situation, possible security risks, and problems that need to be solved. Cybersecurity strategies and measures: Propose specific measures and methods to deal with cybersecurity threats, including but not limited to strengthening network management, improving security awareness, updating security facilities, and performing security reviews. These measures should be targeted and can be adjusted according to actual conditions. Cybersecurity education and training: Introduce how to improve employees' security awareness and skills through education and training so as to better cope with cybersecurity challenges. This may involve regular security training, online courses, actual combat exercises and other activities. Cybersecurity monitoring and early warning: Describe how to use existing technologies and means to monitor cybersecurity, and how to issue early warnings and respond when potential threats are discovered. Report conclusions and recommendations: Summarize the contents of the report and make recommendations and expectations for future cybersecurity work.

[0118] The embodiment of the present application generates a network security report based on past data of processed network security incidents and displays it to the user for viewing, so that the user can easily obtain reference cases of network security incidents.

[0119] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0120] Fig. 9 The structure diagram of a network security event processing device 20 provided by the present application is schematically shown, and the device includes:

[0121] A receiving module 201, configured to, in response to receiving a monitoring instruction for a network security event, instruct a large language model to monitor the network security event based on the monitoring instruction;

[0122] The alarm module 202 is used to output alarm information for the monitoring result when receiving the monitoring result of the network security event monitored by the large language model;

[0123] An interaction module 203, configured to, in response to receiving user interaction information input for the alarm information, instruct the large language model to generate and output a response strategy for the network security event based on the user interaction information;

[0124] A response module 204, configured to input the response strategy into a prompt word model to obtain a security response instruction for the network security incident;

[0125] Based on the security response instruction, the large language model is instructed to process the network security event and output a processing result of the network security event.

[0126] Optionally, the interaction module 203 is further configured to:

[0127] Inputting the user interaction information into the prompt word model to obtain the prompt word corresponding to the user interaction information;

[0128] The prompt word is input into the large language model to obtain a response strategy for the network security incident.

[0129] Optionally, the prompt words include at least: question information, thinking information, action information, and observation information;

[0130] The interaction module 203 is further used for:

[0131] Inputting the question information into the large language model to obtain semantic information corresponding to the user interaction information;

[0132] Inputting the thinking information and the semantic information into the large language model to obtain a processing method for the network security incident;

[0133] Inputting the processing method, the tool list and the action information into the large language model to obtain the target tool identifier in the tool list for processing the network security incident;

[0134] The processing method, the target tool identifier and the observation information are input into the large language model to obtain a response strategy.

[0135] Optionally, the interaction module 203 is further configured to:

[0136] Inputting the processing method, the target tool identifier and the observation information into the large language model to obtain an observation result;

[0137] When the observation result does not meet the expected requirement, entering the step of inputting the question information into the large language model to obtain semantic information corresponding to the user interaction information;

[0138] When the observation result meets the expected requirement, a response strategy is output according to the target tool identification and the processing method.

[0139] Optionally, the interaction module 203 is further configured to:

[0140] Splitting the user interaction information to obtain at least two pieces of task information;

[0141] The at least two task information are respectively input into the large language model to obtain a response strategy corresponding to each task information.

[0142] Optionally, the response module 204 is further configured to:

[0143] Inputting the security response instruction corresponding to each task information into the large language model to obtain the processing result corresponding to each task information;

[0144] The processing results of at least two task information are combined to obtain a processing result for the network security event.

[0145] Optionally, the response module 204 is further configured to:

[0146] A network security report for the network security event is generated based on the monitoring result, the user interaction information, and the processing result, and the network security report is output.

[0147] Optionally, the receiving module 201 is further configured to:

[0148] In response to receiving a monitoring instruction for a network security event, determining characteristic information of the network security event based on the monitoring instruction;

[0149] The feature information is input into the large language model so that the large language model monitors the network security events represented by the feature information.

[0150] The embodiment of the present application monitors network security events by utilizing a large language model, and can promptly inform users through alarm information when a network security event occurs, and then instruct the large language model to analyze the network security event to obtain a response strategy by receiving user interaction information, and can further utilize a prompt word model to automatically instruct the large language model to handle the network security event based on the response strategy, so that the large language model can assist users in promptly discovering network security events and efficiently perform emergency response processing on network security events.

[0151] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0152] The present application embodiment provides one or more machine-readable media, on which instructions are stored, and when executed by one or more processors, an electronic device executes one or more methods as described in the above embodiments. In the present application embodiment, the electronic device includes a server, a terminal device, and the like.

[0153] The embodiments of the present disclosure may be implemented as a device configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the device may include electronic devices such as a server (cluster), a terminal, etc. Fig.10 An exemplary apparatus 1000 that may be used to implement the embodiments described in this application is schematically illustrated.

[0154] For one embodiment, Fig.10 An exemplary apparatus 1000 is shown having one or more processors 1002, a control module (chip set) 1004 coupled to at least one of the processor(s) 1002, a memory 1006 coupled to the control module 1004, a non-volatile memory (NVM) / storage device 1008 coupled to the control module 1004, one or more input / output devices 1010 coupled to the control module 1004, and a network interface 1012 coupled to the control module 1004.

[0155] The processor 1002 may include one or more single-core or multi-core processors, and the processor 1002 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 1000 can be used as a server, terminal, or other device described in the embodiments of the present application.

[0156] In some embodiments, the apparatus 1000 may include one or more computer-readable media (e.g., memory 1006 or NVM / storage device 1008) having instructions 1014 and one or more processors 1002 combined with the one or more computer-readable media and configured to execute the instructions 1014 to implement a module to perform the actions described in the present disclosure.

[0157] For one embodiment, the control module 1004 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 1002 and / or any suitable device or component in communication with the control module 1004 .

[0158] The control module 1004 may include a memory controller module to provide an interface to the memory 1006. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0159] The memory 1006 may be used, for example, to load and store data and / or instructions 1014 for the device 1000. For one embodiment, the memory 1006 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 1006 may include double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

[0160] For one embodiment, control module 1004 may include one or more input / output controllers to provide an interface to NVM / storage device 1008 and input / output device(s) 1010 .

[0161] For example, NVM / storage 1008 may be used to store data and / or instructions 1014. NVM / storage 1008 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives).

[0162] NVM / storage device 1008 may include storage resources that are part of the device on which apparatus 1000 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 1008 may be accessed via (one or more) input / output devices 1010 over a network.

[0163] (One or more) input / output devices 1010 may provide an interface for the apparatus 1000 to communicate with any other appropriate device, and the input / output device 1010 may include a communication component, an audio component, a sensor component, etc. The network interface 1012 may provide an interface for the apparatus 1000 to communicate through one or more networks, and the apparatus 1000 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication.

[0164] For one embodiment, at least one of the processor(s) 1002 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 1004. For one embodiment, at least one of the processor(s) 1002 may be packaged together with the logic of one or more controllers of the control module 1004 to form a system-in-package (SiP). For one embodiment, at least one of the processor(s) 1002 may be integrated on the same die with the logic of one or more controllers of the control module 1004. For one embodiment, at least one of the processor(s) 1002 may be integrated on the same die with the logic of one or more controllers of the control module 1004 to form a system-on-chip (SoC).

[0165] In an embodiment, the device 1000 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In an embodiment, the device 1000 may have more or fewer components and / or a different architecture. For example, in some embodiments, the device 1000 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0166] Among them, the main control chip can be used as a processor or control module in the monitoring device, sensor data, location information, etc. are stored in a memory or NVM / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0167] An embodiment of the present application further provides an electronic device, comprising: a processor; and a memory, on which executable code is stored, and when the executable code is executed, the processor executes one or more methods described in the embodiments of the present application.

[0168] The embodiments of the present application also provide one or more machine-readable media on which executable codes are stored. When the executable codes are executed, the processor executes one or more methods described in the embodiments of the present application.

[0169] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0170] The embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referenced to each other.

[0171] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0172] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0173] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0174] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0175] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0176] The above is a detailed introduction to a method for processing a network security incident, a device for processing a network security incident, an electronic device and a storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for a general technician in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for handling network security incidents, characterized in that: include: In response to receiving a monitoring instruction for a network security event, instructing the large language model to monitor the network security event based on the monitoring instruction; When receiving the monitoring result of the network security event detected by the large language model, outputting warning information for the monitoring result; In response to receiving user interaction information input for the alarm information, instructing the large language model to generate and output a response strategy for the network security event based on the user interaction information; Inputting the response strategy into a prompt word model to obtain a security response instruction for the network security incident; Based on the security response instruction, the large language model is instructed to process the network security event and output a processing result of the network security event.

2. The method according to claim 1, characterized in that The instructing the large language model to generate and output a response strategy for the network security incident based on the user interaction information includes: Inputting the user interaction information into the prompt word model to obtain the prompt word corresponding to the user interaction information; The prompt word is input into the large language model to obtain a response strategy for the network security incident.

3. The method according to claim 2, characterized in that The prompt words at least include: question information, thinking information, action information, and observation information; The step of inputting the prompt word into the large language model to obtain a response strategy for the network security incident includes: Inputting the question information into the large language model to obtain semantic information corresponding to the user interaction information; Inputting the thinking information and the semantic information into the large language model to obtain a processing method for the network security incident; Inputting the processing method, the tool list and the action information into the large language model to obtain the target tool identifier in the tool list for processing the network security incident; The processing method, the target tool identifier and the observation information are input into the large language model to obtain a response strategy.

4. The method according to claim 3, characterized in that The step of inputting the processing method, the target tool identifier and the observation information into the large language model to obtain a response strategy includes: Inputting the processing method, the target tool identifier and the observation information into the large language model to obtain an observation result; When the observation result does not meet the expected requirement, entering the step of inputting the question information into the large language model to obtain semantic information corresponding to the user interaction information; When the observation result meets the expected requirement, a response strategy is output according to the target tool identification and the processing method.

5. The method according to claim 1, characterized in that The instructing the large language model to generate and output a response strategy for the network security incident based on the user interaction information includes: Splitting the user interaction information to obtain at least two pieces of task information; The at least two task information are respectively input into the large language model to obtain a response strategy corresponding to each task information.

6. The method according to claim 5, characterized in that The instructing the large language model to process the network security event based on the security response instruction and outputting a processing result of the network security event includes: Inputting the security response instruction corresponding to each task information into the large language model to obtain the processing result corresponding to each task information; The processing results of at least two task information are combined to obtain a processing result for the network security event.

7. The method according to claim 1, characterized in that After instructing the large language model to process the network security event based on the security response instruction and outputting a processing result for the network security event, the method further includes: A network security report for the network security event is generated based on the monitoring result, the user interaction information, and the processing result, and the network security report is output.

8. The method according to any one of claims 1 to 7, characterized in that: In response to receiving a monitoring instruction for a network security event, instructing a large language model to monitor the network security event based on the monitoring instruction, including: In response to receiving a monitoring instruction for a network security event, determining characteristic information of the network security event based on the monitoring instruction; The feature information is input into the large language model so that the large language model monitors the network security events represented by the feature information.

9. A network security incident processing device, characterized in that: The device comprises: A receiving module, configured to, in response to receiving a monitoring instruction for a network security event, instruct the large language model to monitor the network security event based on the monitoring instruction; An alarm module, configured to output alarm information for the monitoring result when receiving the monitoring result of the network security event monitored by the large language model; An interaction module, configured to, in response to receiving user interaction information input for the alarm information, instruct the large language model to generate and output a response strategy for the network security event based on the user interaction information; A response module, used to input the response strategy into the prompt word model to obtain a security response instruction for the network security incident; Based on the security response instruction, the large language model is instructed to process the network security event and output a processing result of the network security event.

10. A computing device, characterized in that: include: a memory having computer readable code stored therein; One or more processors, when the computer-readable code is executed by the one or more processors, the computing processing device executes the method for processing network security events as described in any one of claims 1-8.

11. A non-transitory computer readable medium, characterized in that A computer program for a method for processing a network security incident as described in any one of claims 1 to 8 is stored therein.

Images