Association analysis method and device, computer program product and electronic equipment

Abstract

The invention relates to a correlation analysis method and device, a computer program product and electronic equipment, and relates to the technical field of computers, and the method comprises the steps: determining network equipment related to security equipment according to an equipment capability coverage label of the security equipment, obtaining the network topology of the network equipment, determining a topological data structure according to the network topology; obtaining a security and protection log of the security and protection equipment, and performing semantic analysis and pre-impurity removal processing on the security and protection log to obtain a target security and protection log; according to the topological data structure and the target security and protection log, generating security and protection equipment feature data, and inputting the security and protection equipment feature data into a large language model to obtain an association relationship of threat information in the target security and protection log. The accuracy and efficiency of safety risk event analysis are improved.

Description

Background Art

[0002] Security risk event correlation analysis aims to help identify and assess potential security threats and risks by exploring the connections between multiple security events. Its significance lies in improving the response speed of security events, reducing the cost of security event processing, and assisting in decision-making and risk assessment. Existing security event correlation analysis technology often first manually analyzes security logs or intelligence, and then performs correlation analysis through fusion algorithms. Although this algorithm is universal, it lacks efficiency and semantic analysis of security events, so it has high limitations.

[0003] Therefore, a new association analysis method needs to be provided.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present invention, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a correlation analysis method, a correlation analysis device, a computer program product, and an electronic device, thereby overcoming, at least to a certain extent, the problem of low efficiency in security risk event analysis in related technologies caused by limitations and defects of related technologies.

[0006] According to one aspect of the present disclosure, there is provided an association analysis method, comprising:

[0007] Determine, according to the device capability coverage tag of the security device, a network device associated with the security device, obtain a network topology of the network device, and determine a topology data structure according to the network topology;

[0008] Obtaining a security log of the security device, performing semantic analysis and pre-de-cluttering processing on the security log, and obtaining a target security log;

[0009] Security equipment feature data is generated according to the topological data structure and the target security log, and the security equipment feature data is input into a large language model to obtain an association relationship of threat information in the target security log.

[0010] In an exemplary embodiment of the present disclosure, the determining of a network device associated with the security device according to a device capability overlay tag of the security device, acquiring a network topology of the network device, and determining a topology data structure according to the network topology includes:

[0011] According to the device capability coverage tag of the security device, determine the network devices covered by the security device according to the device capability coverage tag;

[0012] The network devices are layered according to the positions of the network devices in the network to obtain the levels of the network devices;

[0013] According to the network topology of the network devices at each level, a single-layer network topology data structure is obtained.

[0014] In an exemplary embodiment of the present disclosure, after obtaining the single-layer network topology data structure, the method further includes:

[0015] The single-layer network topology data structure is spliced ​​to obtain a multi-layer network topology data structure.

[0016] In an exemplary embodiment of the present disclosure, the step of obtaining the security log of the security device, performing semantic analysis and pre-de-cluttering processing on the security log, and obtaining the target security log includes:

[0017] Using a large language model to perform semantic analysis on the security log table of the security device, and normalizing the field names and table names included in each of the security log tables;

[0018] The table names of all the security log tables are normalized, and the normalized security log tables are pre-cleaned to obtain the target security log table.

[0019] In an exemplary embodiment of the present disclosure, the pre-removing the normalized security log table to obtain the target security log table includes:

[0020] Obtain security devices corresponding to each layer of network devices, and determine the threat authenticity of each security log in the security log table of the security devices at each layer;

[0021] The security logs in the security log table that do not meet the threat authenticity are deleted to obtain the target security log table.

[0022] In an exemplary embodiment of the present disclosure, after obtaining the target security log table, the method further includes:

[0023] Inputting the target security log table into a large language model to obtain a set of threat trigger points in the target security log table;

[0024] The threat trigger point set of the target security log table of each layer of the security equipment is feature classified, and when the threat trigger point set is exhausted, the security log table is pre-processed again.

[0025] In an exemplary embodiment of the present disclosure, generating security device feature data according to the topological data structure and the target security log includes:

[0026] Determining a security relationship between the network devices according to a network topology of the network devices;

[0027] The security device characteristic data is generated according to the device type of the security device, the device capability coverage tag, the security relationship, and the target security log of the security device.

[0028] In an exemplary embodiment of the present disclosure, inputting the security device feature data into a large language model to obtain the association relationship of the threat information in the target security log includes:

[0029] Determining the level of the security device characteristic data corresponding to the security device according to the hierarchical relationship of the security device;

[0030] Inputting the first-level security device feature data and the second-level security device feature data into the first large language model to obtain a first output; wherein the first output is a correlation relationship between threat information in a target security log of the first-level security device and a target security log of the second-level security device;

[0031] The first output, the second-level security device feature and the third-level security device feature data are input into a second large language model to obtain a second output; wherein the second output is a correlation relationship between threat information in all target security logs.

[0032] According to one aspect of the present disclosure, there is provided a correlation analysis device, comprising:

[0033] A topology structure determination module, used to determine the network device associated with the security device according to the device capability coverage tag of the security device, obtain the network topology of the network device, and determine the topology data structure according to the network topology;

[0034] A security log processing module, used to obtain the security log of the security device, perform semantic analysis and pre-de-cluttering processing on the security log, and obtain a target security log;

[0035] The association relationship identification module is used to generate security device feature data according to the topological data structure and the target security log, input the security device feature data into the large language model, and obtain the association relationship of the threat information in the target security log.

[0036] According to one aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the association analysis method described in any one of the above exemplary embodiments is implemented.

[0037] According to one aspect of the present disclosure, there is provided an electronic device, including:

[0038] Processor; and

[0039] A memory, configured to store executable instructions of the processor;

[0040] The processor is configured to execute the association analysis method described in any of the above exemplary embodiments by executing the executable instructions.

[0041] An association analysis method provided by an embodiment of the present disclosure determines network devices associated with the security device according to device capability coverage tags of the security device, obtains the network topology of the network device, and determines a topology data structure according to the network topology; obtains a security log of the security device, performs semantic analysis and pre-de-cluttering processing on the security log to obtain a target security log; generates security device feature data according to the topology data structure and the target security log, inputs the security device feature data into a large language model, and obtains an association relationship of threat information in the target security log. On the one hand, according to the device capability coverage label of the security device, the network device associated with the security device is determined, the topological data structure is determined according to the network topology of the network device, the security log of the security device is obtained, and the security log is processed to obtain the target security log. The characteristic data of the security device is determined according to the topological data structure of the network device and the target security log. Since different security devices have different defense attributes in network protection, the defense characteristics of the security device are classified through the topological data structure and the target security log. In addition, the topological data structure is used to provide accurate prompt words for the large language model, which reduces the noise output by the large language model and improves the output accuracy. On the other hand, the characteristic data of the security device is input into the large language model, and the correlation between the threat information included in the target security log is found through the large language model, and light to moderate load confusion such as load deformation is solved.

[0042] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present invention, and together with the specification are used to explain the principles of the present invention. Obviously, the accompanying drawings described below are only some embodiments of the present invention, and for those of ordinary skill in the art, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0044] Figure 1 The following schematically shows a flowchart of a correlation analysis method according to an exemplary embodiment of the present disclosure.

[0045] Figure 2 A schematic diagram schematically shows a correlation analysis system according to an exemplary embodiment of the present disclosure.

[0046] Figure 3 A flowchart of a method for determining network devices associated with security devices, obtaining network topology of the network devices, and determining a topology data structure based on the network topology according to an exemplary embodiment of the present disclosure is schematically shown.

[0047] Figure 4 A flowchart of a method for obtaining a security log of a security device, performing semantic analysis and pre-de-cluttering processing on the security log, and obtaining a target security log according to an exemplary embodiment of the present disclosure is schematically shown.

[0048] Figure 5 A flowchart of a method for performing pre-removal processing on a normalized security log table to obtain a target security log table according to an exemplary embodiment of the present disclosure is schematically shown.

[0049] Figure 6 A flowchart of a correlation analysis method after obtaining a target security log table according to an exemplary embodiment of the present disclosure is schematically shown.

[0050] Figure 7 A flowchart of a method for generating security device feature data according to a topological data structure and a target security log according to an exemplary embodiment of the present disclosure is schematically shown.

[0051] Figure 8 A flowchart schematically illustrates a method for inputting security device feature data into a large language model to obtain an association relationship of threat information in a target security log according to an exemplary embodiment of the present disclosure.

[0052] Fig. 9 A block diagram schematically shows a correlation analysis device according to an exemplary embodiment of the present disclosure.

[0053] Fig.10 An electronic device for implementing a correlation analysis method according to an exemplary embodiment of the present invention is schematically shown. DETAILED DESCRIPTION

[0054] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present invention will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present invention. However, those skilled in the art will appreciate that the technical solutions of the present invention may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present invention.

[0055] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0056] Security risk event correlation analysis aims to help identify and assess potential security threats and risks by exploring the connections between multiple security events. Its significance lies in improving the response speed of security events, reducing the cost of security event processing, and assisting in decision-making and risk assessment. Existing security event correlation analysis technology often first manually analyzes security logs or intelligence, and then performs correlation analysis through fusion algorithms. Although this algorithm is universal, it lacks efficiency and semantic analysis of security events, so it has high limitations.

[0057] Nowadays, pre-trained large language models are on the rise, and many studies have shown that they have great potential in analyzing and understanding text. Currently, the large models released for commercial use are mainly general large models, which have limitations in understanding security events, so the generated results often contain noise information.

[0058] This example embodiment first provides a correlation analysis method, referring to Figure 1 As shown, the association analysis method may include the following steps:

[0059] Step S110. Determine the network device associated with the security device according to the device capability coverage tag of the security device, obtain the network topology of the network device, and determine the topology data structure according to the network topology;

[0060] Step S120: Obtain the security log of the security device, perform semantic analysis and pre-de-cluttering processing on the security log, and obtain the target security log;

[0061] Step S130: Generate security equipment feature data according to the topological data structure and the target security log, input the security equipment feature data into a large language model, and obtain the association relationship of threat information in the target security log.

[0062] The above-mentioned association analysis method determines the network devices associated with the security device according to the device capability coverage label of the security device, obtains the network topology of the network device, and determines the topology data structure according to the network topology; obtains the security log of the security device, performs semantic analysis and pre-de-cluttering processing on the security log to obtain the target security log; generates security device feature data according to the topology data structure and the target security log, inputs the security device feature data into the large language model, and obtains the association relationship of the threat information in the target security log. On the one hand, according to the device capability coverage label of the security device, the network device associated with the security device is determined, the topological data structure is determined according to the network topology of the network device, the security log of the security device is obtained, and the security log is processed to obtain the target security log. The characteristic data of the security device is determined according to the topological data structure of the network device and the target security log. Since different security devices have different defense attributes in network protection, the defense characteristics of the security device are classified through the topological data structure and the target security log. In addition, the topological data structure is used to provide accurate prompt words for the large language model, which reduces the noise output by the large language model and improves the output accuracy. On the other hand, the characteristic data of the security device is input into the large language model, and the correlation between the threat information included in the target security log is found through the large language model, and light to moderate load confusion such as load deformation is solved.

[0063] The following is a detailed explanation and description of the association analysis system of the present disclosure.

[0064] refer to Figure 2As shown, the association analysis system includes a data collection module 210 , a topology analysis module 220 , a log structure analysis module 230 , a feature classification module 240 , an association discovery module 250 , and a correlation representation module 260 . Among them, the data collected in the data collection module 210 includes network device topology data and security logs of security equipment; the topology analysis module 220 analyzes the topology data of the network equipment collected in the data collection module 210 to obtain the topology data structure of the network equipment; the log structure analysis module 230 is used to process and analyze the security logs of the security equipment collected in the data collection module 210 to obtain the target security log; the feature classification module 230 is used to connect the data of network security equipment, pre-removed logs, and multi-layer relational data structures, and form semantically understandable security equipment feature data according to the network security equipment classification; the association discovery module 250 is used to connect the security equipment feature data through certain factors using a large model to deduce the attack chain, and finally output the association relationship between the threat information included in the security log; the association representation module 260 is used to perform graph data calculation on the association relationship between threat information and display the calculation results.

[0065] Hereinafter, each step involved in the association analysis method according to the exemplary embodiment of the present disclosure is explained and illustrated in detail.

[0066] In step S110, according to the device capability coverage tag of the security device, the network device associated with the security device is determined, the network topology of the network device is obtained, and the topology data structure is determined according to the network topology.

[0067] Among them, the security equipment can be an intrusion detection system, a honeynet system, a firewall, or a host security, container security, or other security protection equipment. In this example embodiment, the security equipment is not specifically limited. The device capability coverage label is the network device resources covered by the security equipment. After the network equipment associated with the security equipment is obtained, the level of the network equipment can be determined, and the topology data structure can be determined according to the level of the network equipment.

[0068] In this example embodiment, reference Figure 3 As shown, the method of determining the network device associated with the security device according to the device capability coverage tag of the security device, obtaining the network topology of the network device, and determining the topology data structure according to the network topology includes:

[0069] Step S310. According to the device capability coverage tag of the security device, determine the network devices covered by the security device according to the device capability coverage tag;

[0070] Step S320. Layering the network devices according to the positions of the network devices in the network to obtain the levels of the network devices;

[0071] Step S330: Obtain a single-layer network topology data structure according to the network topology of each layer of network devices.

[0072] Below, step S310-step S330 will be further explained and illustrated. Specifically, the network topology structure in the actual production environment is highly complex, and it is extremely difficult to directly input the complex network structure into the large language model for analysis. Therefore, it is necessary to first convert the network topology of the load into a single-layer network data structure. During the conversion, first, the device capability coverage label of the security device is obtained. The device capability coverage label is the network device resource covered by the security device, and the network device covered by the security device is obtained according to the device capability coverage label of each security device. Then, the network device is layered according to the position of the network device in the network device, and the network level of the network device in the production network is determined. The network level can be divided into three layers, namely, the inner layer, the middle layer, and the outer layer. For example, the inner layer can be a container in actual operation, the middle layer can be a network device with a low degree of virtualization, and the outer layer can be an external network device, etc. In this example embodiment, the network devices at each level are not specifically limited. After determining the network level of the network device in the production network, the network topology of the network device at each level can be obtained, and the network topology data structure of the level can be generated according to the network topology of each level.

[0073] Furthermore, after generating the network topology data structure at each level, it also includes:

[0074] The single-layer network topology data structure is spliced ​​to obtain a multi-layer network topology data structure.

[0075] Specifically, in order to improve the recognition accuracy of large language models, it is necessary not only to decompose the complex network structure into a single-layer network topology data structure, but also to describe the relationship between multiple single-layer network topology data structures. Therefore, after generating the network topology data structure of each level, the network topology data structure of each level can be spliced ​​to obtain a multi-layer network topology data structure.

[0076] In step S120, the security log of the security device is obtained, and semantic analysis and pre-de-cluttering processing are performed on the security log to obtain a target security log.

[0077] In the actual production environment, there are many kinds of security equipment, and each security equipment has a corresponding security log. Since the fields and table names of the logs stored in each security log are inconsistent, the security logs need to be unified.

[0078] refer to Figure 4As shown, the step of obtaining the security log of the security device, performing semantic analysis and pre-de-cluttering processing on the security log to obtain the target security log includes:

[0079] Step S410. Perform semantic analysis on the security log table of the security device using a large language model, and normalize the field names and table names included in each of the security log tables;

[0080] Step S420: normalize the table names of all the security log tables, perform pre-cleaning processing on the normalized security log tables, and obtain the target security log table.

[0081] In the following, step S410 and step S420 will be further explained and illustrated. Specifically, after the security log table of each security device is obtained, the security log table can be input into the large language model, and the security log table of each security device can be semantically analyzed by the large language model, and the table name of each security log table and the field names included therein can be normalized. After processing each security log table, since the content corresponding to each security log table is different, and the table name of each security log table is defined by itself, it may not reflect the problem handled by the security device. Therefore, it is necessary to normalize the table names of all security log tables to obtain table names that can reflect the functions of the security device. After the security log table is normalized, the security log table can be pre-processed to obtain the target security log table of each security device.

[0082] For example, when the security device is an intrusion detection system, the name of its security log table is log. When the first semantic analysis is performed, the name of the security log table is changed to alarm log. When the second normalization processing is performed, the name of the security log table is changed from alarm log to network-side alarm log query table.

[0083] After the security log table is normalized, you can perform pre-cleaning on the security log table. Figure 5 As shown, the normalized security log table is pre-processed to obtain the target security log table, including:

[0084] Step S510. Obtain the security devices corresponding to each layer of network devices, and determine the threat authenticity of each security log in the security log table of the security devices at each layer;

[0085] Step S520: Delete the security logs in the security log table that do not meet the threat authenticity, and obtain the target security log table.

[0086] In the following, step S510 and step S520 will be further explained and illustrated. Specifically, the security equipment corresponding to each layer of network equipment is determined, and the level of the security equipment is determined according to the level of the network equipment. When the level of the network equipment is the inner layer, the security equipment is the inner layer security equipment, when the level of the network equipment is the middle layer, the security equipment is the middle layer security equipment, and when the level of the network equipment is the outer layer, the security equipment is the outer layer security equipment. After the security equipment is layered, the security log table of the security equipment at each level is subjected to threat authenticity judgment, wherein the threat authenticity judgment can be to judge whether the log content of each security log in the security log table poses a threat to the network equipment, or the threat information contained in the security log is also in other security log tables. Among them, when the log content of any security log does not pose a threat to the network equipment or the security log does not exist in the security log table of the security equipment at the same level, it can be considered that the security log does not meet the threat authenticity. When any security log does not meet the threat authenticity, the security log can be deleted to obtain the target security log table.

[0087] In this example embodiment, reference Figure 6 As shown, after obtaining the target security log table, the method further includes:

[0088] Step S610: Input the target security log table into the large language model to obtain a set of threat trigger points in the target security log table;

[0089] Step S620: feature classification is performed on the threat trigger point set of the target security log table of each layer of the security equipment. When the threat trigger point set is exhausted, the security log table is pre-processed again.

[0090] In the following, step S610 and step S620 will be further explained and illustrated. Specifically, all target security log tables are input into the large language model, and the target security logs are analyzed by the fine-tuning technology of the large language model, and the threat trigger point set of all target security logs is output. When the starting threat point set is exhausted by the feature classifier, that is, when the feature classifier reclassifies the features, it cannot determine the security device feature data corresponding to the threat points in the threat point set, it can be considered that the threat points extracted by the large language model are incorrect. At this time, the security log table of the security device needs to be pre-processed and the threat point set needs to be extracted again.

[0091] In step S130, security device feature data is generated according to the topological data structure and the target security log, and the security device feature data is input into a large language model to obtain an association relationship of threat information in the target security log.

[0092] After obtaining the target security log and the topological data structure of the network device, the target security log, the topological data structure and the data of the security device can be connected, and the characteristic data of the security device can be formed according to the classification of the network security device. The characteristic data of the security device can be block data generated according to the topological data structure and the target security log. The block data is determined by the network security device in the actual production environment, and is the data-based expression of the log, capability coverage, and security relationship of the network security device in the production environment. Different network security devices have different defense attributes in network protection, that is, different defense characteristics, and the block data is the concrete data of this characteristic.

[0093] In this example embodiment, reference Figure 7 As shown, the generating of security equipment characteristic data according to the topological data structure and the target security log includes:

[0094] Step S710. Determine the security relationship between the network devices according to the network topology of the network devices;

[0095] Step S720: Generate the security device characteristic data according to the device type of the security device, the device capability coverage tag, the security relationship, and the target security log of the security device.

[0096] In the following, step S710 and step S720 will be further explained and illustrated. Specifically, first, the security relationship between network devices is determined according to the network topology of the network devices, wherein the security relationship between network devices includes not only the topological structure between network devices, but also the security devices between network devices. After obtaining the security relationship between network devices, the security relationship of network devices covered by the security device, the target security log of the security device, the device type of the security device, and the network devices covered by the security device are input into the large language model to generate security device feature data.

[0097] After generating the security device feature data, the security device feature data of each security device can be input into the large language model. Based on the analysis of the large language model, the correlation between the threat information included in the target security log is obtained, that is, the attack chain is deduced.

[0098] refer to Figure 8 As shown, the security equipment feature data is input into the large language model to obtain the correlation relationship of the threat information in the target security log, including:

[0099] Step S810. Determine the level of the security device characteristic data corresponding to the security device according to the hierarchical relationship of the security device;

[0100] Step S820. Input the first-level security device feature data and the second-level security device feature data into the first language model to obtain a first output; wherein the first output is an association relationship between threat information in the target security log of the first-level security device and the target security log of the second-level security device;

[0101] Step S830. Input the first output, the second-level security device characteristics and the third-level security device characteristic data into a second language model to obtain a second output; wherein the second output is the correlation relationship of the threat information in all target security logs.

[0102] In the following, step S810 to step S830 will be further explained and illustrated. Specifically, first, the security device feature data is classified according to the level of the security device. When the security device is an inner-layer security device, the security device feature data of the security device is the inner-layer feature data. When the security device is a middle-layer security device, the security device feature data of the security device is the middle-layer feature data. When the security device is an outer-layer security device, the security device feature data of the security device is the outer-layer feature data. After determining the level of the security device feature data, the inner-layer security device feature data and the middle-layer security device feature data are input into the first large language model to obtain the output of the first large language model, wherein the output of the first large language model is the correlation between the threat information in the target security log of the inner-layer security device and the target security log of the middle-layer security device determined according to the inner-layer security device feature data and the middle-layer security device feature data. After obtaining the output of the first language model, the output of the first language model, the feature data of the middle-layer security equipment and the feature data of the outer-layer security equipment are input into the first language model to obtain a second output, which is the correlation relationship between the threat information in all target security logs.

[0103] In this example embodiment, threat correlation analysis is performed from the inside out. Since inner-layer alarms are often more accurate and authentic, more accurate threat trigger points can be obtained when calling for pre-de-cluttering processing, and the interference and noise to the large model are lower when performing correlation discovery through the large language model. Prompt words such as "attack payload", "victim assets", and "attack source" that are highly associated with attack behavior and attack characteristics can be added to the first and second largest language models to solve mild load confusion situations such as load deformation and weak load encryption. Among them, the load is a manifestation of the attack behavior and can be a code for malicious attacks. Security equipment generally matches through regular rules, and load deformation can bypass the detection of security equipment. Load obfuscation makes attack behavior difficult to detect through encryption.

[0104] Furthermore, after obtaining the output of the second largest language model, the security device feature data of the security device and the pre-de-cluttering processing of the security log can be optimized according to the output results. When optimizing the feature data of the security device, the main thing is to optimize the association discovery ability of the large language model, and adjust the middle-level parameters of the large language model that generates the security device feature data of the security device. When optimizing the pre-de-cluttering processing of the security log, the main thing is to adjust the numerical value of the feature weight matrix of the large language model that processes the security log. In addition, in the process of training the large language model, in order to quantify the residual in the feedback mechanism, by constraining the output and performing graph data calculations, the loss function is calculated based on the graph edge comparison between the graph data calculation results and the results of the correct samples to form a quantifiable fit.

[0105] The commodity category maintenance method provided by the example embodiments of the present disclosure has at least the following advantages: on the one hand, according to the device capability coverage label of the security device, the network device associated with the security device is determined, the topology data structure is determined according to the network topology of the network device, the security log of the security device is obtained, the security log is processed to obtain the target security log, and the security device feature data is determined according to the topology data structure of the network device and the target security log. Since different security devices have different defense attributes in network protection, the defense features of the security devices are classified through the topology data structure and the target security log. In addition, accurate prompt words are provided for the large language model through the topology data structure, which reduces the noise of the large language model output and improves the accuracy of the output. On the other hand, the feature data of the security device is input into the large language model, and the correlation between the threat information included in the target security log is found through the large language model, and light to moderate load confusion such as load deformation is solved.

[0106] The exemplary embodiment of the present disclosure also provides a correlation analysis device, referring to Fig. 9 As shown, it may include: a topology structure determination module 910, a security log processing module 920 and an association relationship identification module 930. Among them:

[0107] A topology structure determination module 910 is used to determine the network device associated with the security device according to the device capability coverage tag of the security device, obtain the network topology of the network device, and determine the topology data structure according to the network topology;

[0108] The security log processing module 920 is used to obtain the security log of the security device, perform semantic analysis and pre-de-cluttering processing on the security log, and obtain a target security log;

[0109] The association relationship identification module 930 is used to generate security device feature data according to the topological data structure and the target security log, input the security device feature data into the large language model, and obtain the association relationship of the threat information in the target security log.

[0110] The specific details of each module in the above-mentioned association analysis device have been described in detail in the corresponding association analysis method, so they will not be repeated here.

[0111] In an exemplary embodiment of the present disclosure, the determining of a network device associated with the security device according to a device capability overlay tag of the security device, acquiring a network topology of the network device, and determining a topology data structure according to the network topology includes:

[0112] According to the device capability coverage tag of the security device, determine the network devices covered by the security device according to the device capability coverage tag;

[0113] The network devices are layered according to the positions of the network devices in the network to obtain the levels of the network devices;

[0114] According to the network topology of the network devices at each level, a single-layer network topology data structure is obtained.

[0115] In an exemplary embodiment of the present disclosure, after obtaining the single-layer network topology data structure, the method further includes:

[0116] The single-layer network topology data structure is spliced ​​to obtain a multi-layer network topology data structure.

[0117] In an exemplary embodiment of the present disclosure, the step of obtaining the security log of the security device, performing semantic analysis and pre-de-cluttering processing on the security log, and obtaining the target security log includes:

[0118] Using a large language model to perform semantic analysis on the security log table of the security device, and normalizing the field names and table names included in each of the security log tables;

[0119] The table names of all the security log tables are normalized, and the normalized security log tables are pre-cleaned to obtain the target security log table.

[0120] In an exemplary embodiment of the present disclosure, the pre-removing the normalized security log table to obtain the target security log table includes:

[0121] Obtain security devices corresponding to each layer of network devices, and determine the threat authenticity of each security log in the security log table of the security devices at each layer;

[0122] The security logs in the security log table that do not meet the threat authenticity are deleted to obtain the target security log table.

[0123] In an exemplary embodiment of the present disclosure, after obtaining the target security log table, the method further includes:

[0124] Inputting the target security log table into a large language model to obtain a set of threat trigger points in the target security log table;

[0125] The threat trigger point set of the target security log table of each layer of the security equipment is feature classified, and when the threat trigger point set is exhausted, the security log table is pre-processed again.

[0126] In an exemplary embodiment of the present disclosure, generating security device feature data according to the topological data structure and the target security log includes:

[0127] Determining a security relationship between the network devices according to a network topology of the network devices;

[0128] The security device characteristic data is generated according to the device type of the security device, the device capability coverage tag, the security relationship, and the target security log of the security device.

[0129] In an exemplary embodiment of the present disclosure, inputting the security device feature data into a large language model to obtain the association relationship of the threat information in the target security log includes:

[0130] Determining the level of the security device characteristic data corresponding to the security device according to the hierarchical relationship of the security device;

[0131] Inputting the first-level security device feature data and the second-level security device feature data into the first large language model to obtain a first output; wherein the first output is a correlation relationship between threat information in a target security log of the first-level security device and a target security log of the second-level security device;

[0132] The first output, the second-level security device feature and the third-level security device feature data are input into a second large language model to obtain a second output; wherein the second output is a correlation relationship between threat information in all target security logs.

[0133] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0134] In addition, although the steps of the method of the present invention are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0135] In an exemplary embodiment of the present invention, an electronic device capable of implementing the above method is also provided.

[0136] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0137] Refer to the following Fig.10 The electronic device 1000 according to this embodiment of the present invention will be described. Fig.10 The electronic device 1000 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0138] like Fig.10 As shown, the electronic device 1000 is in the form of a general computing device. The components of the electronic device 1000 may include, but are not limited to: the at least one processing unit 1010, the at least one storage unit 1020, a bus 1030 connecting different system components (including the storage unit 1020 and the processing unit 1010), and a display unit 1040.

[0139] The storage unit stores program codes, which can be executed by the processing unit 1010, so that the processing unit 1010 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 1010 can perform the following steps: Figure 1Step S110 shown in: determining the network device associated with the security device according to the device capability coverage label of the security device, obtaining the network topology of the network device, and determining the topology data structure according to the network topology; S120: obtaining the security log of the security device, performing semantic analysis and pre-de-cluttering processing on the security log to obtain the target security log; S130: generating security device feature data according to the topology data structure and the target security log, inputting the security device feature data into the large language model, and obtaining the association relationship of the threat information in the target security log.

[0140] The storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 10201 and / or a cache storage unit 10202 , and may further include a read-only storage unit (ROM) 10203 .

[0141] The storage unit 1020 may also include a program / utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0142] Bus 1030 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0143] The electronic device 1000 may also communicate with one or more external devices 1100 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1000, and / or communicate with any device that enables the electronic device 1000 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1050. In addition, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1060. As shown, the network adapter 1060 communicates with other modules of the electronic device 1000 via a bus 1030. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID (Redundant Arrays of Independent Disks, independent redundant disk array) systems, tape drives, and data backup storage systems.

[0144] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present invention.

[0145] In an exemplary embodiment of the present invention, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of this specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of this specification.

[0146] The program product for implementing the above method according to an embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0147] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0148] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0149] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF (Radio Frequency), etc., or any suitable combination of the above.

[0150] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0151] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0152] Other embodiments of the invention will readily occur to those skilled in the art after considering the specification and practicing the invention invented herein. This application is intended to cover any variations, uses or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art that are not invented by the present invention. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.

Claims

1. A method for association analysis, characterized in that: include: Determine, according to the device capability coverage tag of the security device, a network device associated with the security device, obtain a network topology of the network device, and determine a topology data structure according to the network topology; Obtaining a security log of the security device, performing semantic analysis and pre-de-cluttering processing on the security log, and obtaining a target security log; Security equipment feature data is generated according to the topological data structure and the target security log, and the security equipment feature data is input into a large language model to obtain an association relationship of threat information in the target security log.

2. The method according to claim 1, characterized in that The method of determining a network device associated with the security device according to the device capability coverage tag of the security device, acquiring a network topology of the network device, and determining a topology data structure according to the network topology includes: According to the device capability coverage tag of the security device, determine the network devices covered by the security device according to the device capability coverage tag; The network devices are layered according to the positions of the network devices in the network to obtain the levels of the network devices; According to the network topology of the network devices at each level, a single-layer network topology data structure is obtained.

3. The method according to claim 2, characterized in that After obtaining the single-layer network topology data structure, the method further includes: The single-layer network topology data structure is spliced ​​to obtain a multi-layer network topology data structure.

4. The method according to claim 2, characterized in that: The obtaining of the security log of the security device, performing semantic analysis and pre-de-cluttering processing on the security log to obtain the target security log includes: Using a large language model to perform semantic analysis on the security log table of the security device, and normalizing the field names and table names included in each of the security log tables; The table names of all the security log tables are normalized, and the normalized security log tables are pre-cleaned to obtain the target security log table.

5. The method according to claim 4, characterized in that The pre-removing of the normalized security log table to obtain the target security log table includes: Obtain security devices corresponding to each layer of network devices, and determine the threat authenticity of each security log in the security log table of the security devices at each layer; The security logs in the security log table that do not meet the threat authenticity are deleted to obtain the target security log table.

6. The method according to claim 5, characterized in that After obtaining the target security log table, the method further includes: Inputting the target security log table into a large language model to obtain a set of threat trigger points in the target security log table; The threat trigger point set of the target security log table of each layer of the security equipment is feature classified, and when the threat trigger point set is exhausted, the security log table is pre-processed again.

7. The method according to claim 6, characterized in that The generating of security equipment characteristic data according to the topological data structure and the target security log includes: Determining a security relationship between the network devices according to a network topology of the network devices; The security device characteristic data is generated according to the device type of the security device, the device capability coverage tag, the security relationship, and the target security log of the security device.

8. The method according to claim 7, characterized in that The step of inputting the security device feature data into a large language model to obtain a correlation relationship of threat information in the target security log includes: Determining the level of the security device characteristic data corresponding to the security device according to the hierarchical relationship of the security device; Inputting the first-level security device feature data and the second-level security device feature data into the first large language model to obtain a first output; wherein the first output is a correlation relationship between threat information in a target security log of the first-level security device and a target security log of the second-level security device; The first output, the second-level security device feature and the third-level security device feature data are input into a second large language model to obtain a second output; wherein the second output is a correlation relationship between threat information in all target security logs.

9. A correlation analysis device, characterized in that: include: A topology structure determination module, used to determine the network device associated with the security device according to the device capability coverage tag of the security device, obtain the network topology of the network device, and determine the topology data structure according to the network topology; A security log processing module, used to obtain the security log of the security device, perform semantic analysis and pre-de-cluttering processing on the security log, and obtain a target security log; The association relationship identification module is used to generate security device feature data according to the topological data structure and the target security log, input the security device feature data into the large language model, and obtain the association relationship of the threat information in the target security log.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

11. An electronic device, characterized in that: include: Processing unit; as well as A storage unit, used to store executable instructions of the processing unit; Wherein, the processing unit is configured to perform the method of any one of claims 1-8 by executing the executable instructions.

Images