Data processing and model training method and device, electronic equipment and storage medium

Abstract

The invention discloses a data processing and model training method and device, electronic equipment and a storage medium, and the data processing method comprises the steps: obtaining log data related to an attack event in an attacked host in response to a tracing instruction for the attack event; obtaining evidence obtaining data of the attack event according to the log data; the evidence obtaining data is used for tracing an attack chain of the attack event; and under the condition of detecting that the evidence obtaining data is incomplete, generating suggestion information for supplementing the evidence obtaining data of the attack event by utilizing a large language model.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a data processing and model training method, device, electronic device and storage medium. Background Art

[0002] Attack events in the network will cause network security risks. Tracing the attack events in the network to obtain the attack chain of the attack events and using the attack chain to counter the attack events is an important means to ensure network security. How to accurately and comprehensively obtain forensic data for tracing the attack events and then obtain the attack chain of the attack events has become an important topic that needs to be studied. Summary of the invention

[0003] In order to solve the above technical problems, the embodiments of the present application provide a data processing and model training method, device, electronic device and storage medium.

[0004] In a first aspect, an embodiment of the present application provides a data processing method, the method comprising:

[0005] In response to a source tracing instruction for an attack event, obtaining log data related to the attack event in the attacked host;

[0006] Acquire forensic data of the attack event according to the log data; the forensic data is used to trace the attack chain of the attack event;

[0007] When it is detected that the forensic data is incomplete, a large language model is used to generate suggestion information for supplementing the forensic data of the attack event.

[0008] In a second aspect, an embodiment of the present application provides a model training method, the method comprising:

[0009] Access the knowledge base in the field of computer forensics;

[0010] The knowledge base is used to train the initial large language model to obtain a large language model; wherein the large language model is used to generate suggestion information to supplement the forensic data of the attack event when the forensic data of the attack event is incomplete.

[0011] In a third aspect, an embodiment of the present application provides a data processing device, the device comprising:

[0012] A first acquisition unit, configured to acquire log data related to the attack event in the attacked host in response to a source tracing instruction for the attack event;

[0013] A second acquisition unit is used to acquire forensic data of the attack event according to the log data; the forensic data is used to trace the attack chain of the attack event;

[0014] The first generating unit is used to generate suggestion information for supplementing the forensic data of the attack event by using a large language model when detecting that the forensic data is incomplete.

[0015] In a fourth aspect, an embodiment of the present application provides a model training device, the device comprising:

[0016] A third acquisition unit is used to acquire a knowledge base in the field of computer forensics;

[0017] A training unit is used to train an initial large language model using the knowledge base to obtain a large language model; wherein the large language model is used to generate suggestion information to supplement the forensic data of the attack event when the forensic data of the attack event is incomplete.

[0018] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory stores computer executable instructions, and when the processor runs the computer executable instructions on the memory, it can implement the data processing method described in the embodiment of the first aspect above, or the model training method described in the embodiment of the second aspect above.

[0019] In a sixth aspect, an embodiment of the present application provides a computer storage medium, on which executable instructions are stored, and when the executable instructions are executed by a processor, the data processing method described in the first aspect of the embodiment above, or the model training method described in the second aspect of the embodiment above, is implemented.

[0020] The technical solution of the embodiment of the present application obtains log data related to the attack event in the attacked host; when obtaining forensic data for tracing the attack chain of the attack event based on the log data, when detecting that the forensic data is incomplete, it can use a large language model to generate suggestion information for supplementing the forensic data of the attack event, so that the user can provide more complete forensic data of the attack event according to the generated suggestion information, which is conducive to the subsequent use of the supplementary data provided by the user according to the suggestion information to supplement the forensic data to trace the attack chain of the attack event. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 Schematic diagram of the data processing method provided in the embodiment of the present application Figure 1 ;

[0022] Figure 2Schematic diagram of the data processing method provided in the embodiment of the present application Figure 2 ;

[0023] Figure 3 Schematic diagram of the data processing method provided in the embodiment of the present application Figure 3 ;

[0024] Figure 4 A schematic diagram of a clue expansion method provided in an embodiment of the present application;

[0025] Figure 5 Schematic diagram of the data processing method provided in the embodiment of the present application Figure 4 ;

[0026] Figure 6 A flowchart of a model training method provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0028] Figure 8 A schematic diagram of the structural composition of the model training device provided in an embodiment of the present application;

[0029] Fig. 9 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0031] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not necessarily need to be defined or explained in the subsequent drawings.

[0032] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0033] Below, the following relevant technical terms involved in the embodiments of the present application are explained.

[0034] APT: Advanced Persistent Threat, is a hidden and persistent computer intrusion process, usually carefully planned by certain personnel, targeting specific targets. It is usually motivated by business or politics, targeting specific organizations or countries, and requires high concealment for a long time. Advanced persistent threats contain three elements: advanced, long-term, and threat. Advanced emphasizes the use of complex and sophisticated malware and technology to exploit vulnerabilities in the system. Long-term implies that an external force will continue to monitor specific targets and obtain data from them, and threat refers to attacks planned by humans.

[0035] Cybercrime: Often aimed at obtaining illegal economic benefits, attacks are carried out through technical means such as abusing resources (such as BlackhatSEO), disrupting business (such as DDoS), and large-scale theft of sensitive information or digital assets.

[0036] IoC: Indicator Of Compromise, a special term in the field of computer attack forensics, is often a high-confidence information that can be used to indicate that a computer has been invaded, such as the Uniform Resource Locator (URL), Domain, Filehash, IP address, host registry value, etc. that are highly related to the attacker and appear in the attacked network.

[0037] C2: Command And Control Server, the attacker's command and control server, also referred to as "control server" or C2, is a server used by attackers to issue control instructions and obtain information on compromised hosts. It is also an infrastructure that attackers must deploy before launching an attack mission.

[0038] DNS: Domain Name System, is a basic service of the Internet. As a distributed database that maps domain names and IP addresses, it enables people to access the Internet more conveniently. DNS uses TCP and UDP port 53. Currently, the length of each level of domain name is limited to 63 characters, and the total length of the domain name cannot exceed 253 characters. The DNS protocol consists of DNS requests and DNS responses.

[0039] Beacon: A concept introduced by the famous post-penetration attack simulation tool in the field of penetration testing. It refers to the communication between malware deployed by attackers on the compromised host and the C2 server through various delivery methods.

[0040] Digital forensics timeline analysis: Timeline analysis is an important part of digital forensics. Its main function is to reconstruct the time sequence of events or cyber attack activities by correlating digital evidence at different time points to facilitate the investigation of cyber attack incidents. Its key steps include: evidence collection, time extraction, time standardization, time correlation, timeline construction, and detailed timeline analysis.

[0041] The attack event in the embodiment of the present application includes a series of attack behaviors launched by the attacker against the attacked host.

[0042] For example, an attack behavior can be an APT attack behavior. APT attacks specifically refer to targeted attacks that are intended to steal / destroy high-value data or assets. Such attacks may come from attack organizations with national backgrounds or from cybercrime gangs. The following uses a comparison of several specific scenarios to illustrate the differences between APT attacks and other attacks.

[0043] 1. The difference between "targeted ransomware" (belongs to APT) and "common ransomware" (not APT):

[0044] Common ransomware: It is automated and immediately encrypted after execution. It has no incubation period and lacks directionality, so it is not APT.

[0045] Targeted ransomware: After lurking for a long time, fully roaming the intranet, and finding high-value data in a targeted manner, encrypted ransomware is launched. This is considered to have strong APT-like characteristics.

[0046] 2. The difference between APT attacks and targeted attack drills:

[0047] Targeted attack drills are directional, but are often short-lived (e.g., a few weeks). Because of the nature of the drills, they cannot use highly concealed or persistent attack techniques, so they are not considered APTs.

[0048] APT is not only targeted, lasts longer, and places more emphasis on hiding, but also has clear motives, with data theft, espionage, or covert sabotage as its main motivation.

[0049] 3. Differences between APT and common malware families:

[0050] Common malware families often have malware, and their motivation is mainly economic: abusing computing resources to obtain CRN; and they often run quickly after being dropped onto the disk, automatically completing the attack and killing a target, which can be easily detected based on features.

[0051] APT (like espionage or targeted kidnapping): The motivation is usually intelligence theft, data theft, destruction, etc.; the techniques focus on hiding (legitimate credentials + off-land technology) and persistence, deliberately hiding in normal business actions or traffic, good at bypassing various defenses, highly confrontational, and difficult to detect based on traditional terminal antivirus, network intrusion detection, low-interaction honeypot technology, etc.; often involves the use of malware free tools, translation techniques for legitimate credentials, anti-killing code execution, rich privilege escalation methods, highly hidden C2 channels, etc.

[0052] The attack event in the embodiment of the present application may be an APT attack event or other types of non-APT attack events.

[0053] The data processing method provided in the embodiment of the present application is described in detail below:

[0054] Figure 1 Schematic diagram of the data processing method provided in the embodiment of the present application Figure 1 ,like Figure 1 As shown, the data processing method comprises the following steps:

[0055] S101: In response to an instruction to trace the source of an attack event, obtaining log data related to the attack event in the attacked host;

[0056] S102: Acquire forensic data of the attack event according to the log data;

[0057] S103: When it is detected that the forensic data is incomplete, using a large language model to generate suggestion information for supplementing the forensic data of the attack event.

[0058] In the embodiment of the present application, the attacked host is the device that the attacker wants to attack. The data processing method in the embodiment of the present application can be executed by the attacked host itself, or it can be implemented by other computer devices, such as other servers. For example, it can be executed by a cloud server.

[0059] In the embodiment of the present application, the attack event tracing instruction may be generated by one or more of the following methods:

[0060] Mode a1, determining the attack event according to the hit intrusion indicator, and generating a tracing instruction for the attack event;

[0061] Mode a2, determining the attack event according to the hit intrusion rule, and generating a tracing instruction for the attack event;

[0062] Mode a3, determining the attack event corresponding to the specific alarm event selected by the user, and generating a tracing instruction for the attack event;

[0063] Mode a4, receiving an event hunting condition input by a user, and generating a tracing instruction for the attack event when an attack event corresponding to the event hunting condition exists in the log data of the attacked host.

[0064] For method a1, after the attack event hits the IoC (such as hitting a malicious IP address), the corresponding attack event can be determined based on the hit IoC, and a tracing instruction for the attack event can be generated to trigger a tracing task.

[0065] For method a2, after the attack event hits the intrusion rule set by the user (such as the detection rule for malicious header file flags), the corresponding attack event can be determined according to the hit intrusion rule, and the tracing instruction of the attack event can be generated to trigger a tracing task.

[0066] For method a3, specifically, when the security protection system of the attacked host generates specific alarm information (such as APT's IoC hit alarm, a rule alarm corresponding to a vulnerability exploit, a host behavior IoA rule alarm, etc.), the user selects the specific alarm information in the search box, determines the corresponding attack event based on the specific alarm information selected by the user, and generates a tracing instruction for the attack event, triggering a tracing task.

[0067] For method a4, the user can enter an event hunting condition in the search box (such as APT-IoC hit alarm, APT technique-related IoA hit alarm, baseline deviation alarm, etc.), and the security protection system will build an automatic search statement based on the context records of the attack traces in the host log data to carry out an event hunting. When there is an event that meets the corresponding search condition, it can also trigger a tracing task.

[0068] In the embodiment of the present application, the forensic data is used to trace the attack chain of the attack event.

[0069] For a complete cyber attack event, there is at least one cyber attack behavior. It can be understood that cyber attack behavior is a malicious network behavior that will bring security risks to the network system and needs to be identified and prevented.

[0070] When the attacked host is working, it will generate a series of log data to record the operating status of the attacking host. The log data includes, for example, hardware status logs (such as the usage status of the central processing unit and memory, etc.) and application system logs (such as log data generated when the operating system and application are running).

[0071] By extracting the log data of the attacked host, it is possible to extract attack traces related to the attack event, such as malicious file names, malicious IP addresses, malicious domain names, etc.

[0072] In the embodiments of the present application, the forensic data of the attack event can be understood as attack clues, which are information related to the attack event and can be used to track and trace the attack event. It can reflect data related to the source of the attack, such as the attack behavior data generated by the attack behavior of the malicious attacker and the basic information of the attack source.

[0073] In an embodiment of the present application, the log data includes context records related to the attack trace data of the attack event and timestamp information corresponding to the context records (such as the time when the attack source logged into the device, the time when the server was connected, the time when the weapon was built, and the time when the C2 was connected).

[0074] In one implementation, the above step S102 may be implemented in the following manner:

[0075] The forensic data of the attack event is obtained according to the context records related to the attack trace data of the attack event and the timestamp information corresponding to the context records related to each attack trace data.

[0076] Specifically, digital forensic timeline analysis can be used to obtain forensic data of attack events based on the context records and timestamp information of log data related to the attack events. For example, digital evidence at different time points in the log data can be associated to reconstruct the time series of network attack events to facilitate network attack event investigations. The key steps of digital forensic timeline analysis include: evidence collection, time extraction, time standardization, time association, timeline construction, and detailed timeline analysis.

[0077] In the embodiment of the present application, when extracting forensic data from the log data of an attack event, the forensic data from the log data may be extracted using a forensic rule set corresponding to the attack scenario of the attack event.

[0078] In one implementation, for different attack scenarios, different forensic rule sets may be used to extract log data corresponding to the attack scenarios.

[0079] In one embodiment, a forensic rule set corresponding to each attack scenario in at least one attack scenario can be generated by utilizing a forensic analysis model, and different forensic rules can be adopted for different attack scenarios; then, a target attack scenario of the attack event is determined, and a target forensic rule set corresponding to the target attack scenario is selected from the forensic rule set; the forensic rules corresponding to the attack scenario corresponding to the attack event can be adopted, and then the target forensic rule set is used to customize the forensic tool of the attack event (the forensic tool can be obtained by utilizing the forensic rule set and the forensic plug-ins corresponding to each forensic rule in the forensic rule set), the forensic tool is also customized according to the attack scenario of the attack event, which can improve the efficiency of batch forensics and batch analysis of forensic operations on log data of attack events, and further improve the efficiency of tracing the attack events.

[0080] Due to deficiencies in telemetry technology, protocol analysis technology, etc. of the attacked host, or due to insufficient storage or processing performance of the attacked host, the log data of the attacked host may not be able to fully record data related to the attack. Therefore, the forensic data of the attack event obtained based on the log data may not be complete. It is difficult to form a closed loop by tracing the attack chain of the attack event using only the forensic data obtained from the log data.

[0081] In some implementations, one or more of the following methods may be used to detect whether the forensic data obtained based on the log data is complete:

[0082] Method b1, using a preset forensic data model and predefined rules to detect whether each data in the log data is missing;

[0083] Mode b2, comparing each data in the log data with historical statistical data to detect whether each data in the log data is abnormal;

[0084] Mode b3, analyzing the forensic data in the log data in association with each other, and querying the forensic data for abnormalities of associated breakpoints;

[0085] Method b4, determining whether there is any missing data in the forensic data based on user feedback and annotations.

[0086] For method b1, predefined rules can be used for detection. According to the preset forensic data model, rules can be used to detect whether the actual data meets the requirements, such as missing timestamps in logs and incomplete network traffic.

[0087] For method b2, a statistical comparison detection method can be used to compare the forensic data with historical statistical data to check for abnormal omissions, such as abnormal DNS log volume.

[0088] For method b3, the correlation analysis detection method can be used to detect possible deficiencies in correlation breakpoints through cross-domain correlation analysis of forensic data, such as inconsistent time periods between network logs and process logs.

[0089] For method b4, manual annotation feedback can be used, and the forensic personnel can provide feedback and mark the deficiencies identified by the model.

[0090] In an embodiment of the present application, when obtaining forensic data based on log data related to an attack event, the forensic data of the attack event may be incomplete due to the missing log data. When the forensic data is detected to be incomplete using a preset method (including but not limited to any one or more of the above methods b1 to b4), a large language model can be used to further generate suggestion information to supplement the forensic data of the attack event.

[0091] In an embodiment of the present application, professional knowledge in the field of computer forensics may be used to train an initial large language model to obtain a large language model for generating suggestion information to supplement the forensic data of the attack event.

[0092] The embodiments of the present application can provide users with forensic solution suggestions for supplementing forensic data by utilizing the suggestion information generated by the large language model to supplement the forensic data of the attack incident. For example, the suggestion information generated by the large language model may specifically include which data needs to be supplemented, the channels for supplementing the data, etc.

[0093] Exemplarily, when detecting forensic data in the log data of a certain attack event, if the context of the log of a specific entity in the log data is missing, the specific entity can be a process, such as svchost.exe, a log type such as security.evtx, an IP address, a file, etc.; the specific entity can be input into the large language model, and the large language model outputs a supplementary forensic solution suggestion for the log context of the specific entity; for example, in the case where the process log of svchost.exe is missing, the process name of svchost.exe is input into the large language model, and the large language model will generate a suggestion information suggesting to re-acquire the process log of the target host; for another example, if security.evtx is missing, the log type of security.evtx is input into the large language model, and the large language model will generate a prompt message that the evidence of the suspected target host has been deliberately destroyed, and generate a suggestion information for extracting the network traffic log of the network segment where the host is located to determine other hosts that have direct network communication with the host.

[0094] The technical solution of the embodiment of the present application obtains log data related to the attack event (such as APT attack behavior) in the attacked host; obtains forensic data for tracing the attack chain of the attack event based on the log data, and when it is detected that the forensic data is incomplete, it can use a large language model to generate suggestion information to supplement the forensic data of the attack event, so that the user can provide more complete forensic data of the attack event according to the generated suggestion information, which is conducive to the subsequent use of the supplementary data provided by the user according to the suggestion information to supplement the forensic data to trace the attack chain of the attack event, so as to obtain a more accurate and complete tracing path of the attack event.

[0095] Figure 2 Schematic diagram of the data processing method provided in the embodiment of the present application Figure 2 ,like Figure 2 As shown, the data processing method comprises the following steps:

[0096] S201: Obtaining forensic data of an attack event and suggestion information for supplementing the forensic data;

[0097] S202: upon receiving a feedback instruction from the user indicating that the suggested information is not feasible, generating a threat hunting hypothesis and an intelligence line expansion strategy for the threat hunting hypothesis;

[0098] S203: Query additional intelligence data related to the attack event using an intelligence query tool based on the threat hunting condition and the intelligence line expansion strategy;

[0099] S204: Generate at least one tracing path of the attack event by combining the forensic data and the additional intelligence data;

[0100] S205: Analyze the at least one tracing path using a traceability analysis model to determine a traceability success probability of each tracing path in the at least one tracing path.

[0101] In the embodiment of the present application, the execution of the above step S201 can be specifically implemented by referring to steps S101 to S103 in the above embodiment, which will not be repeated here.

[0102] In an embodiment of the present application, when using a large language model to generate suggestion information to supplement the forensic data of the attack event, the user can confirm whether the generated suggestion information is feasible. If the user believes that the generated suggestion information is not feasible, a feedback instruction indicating that the suggestion information is not feasible is generated.

[0103] If the user believes that the generated suggested information is not feasible, the user can be further provided with threat hunting assumptions that can be considered, such as the source of intrusion, attack target, adopted attack TTPs, adopted protocol type, used attack account, etc.; then, a corresponding intelligence outsourcing strategy is further generated based on the threat hunting assumptions, such as querying intelligence related to IOC, attack methods, etc., or establishing corresponding log retrieval statements, etc.

[0104] In an optional implementation of the present application, after providing the user with threat hunting conditions that can be considered for setting and the intelligence line expansion strategy corresponding to the threat hunting conditions, the threat hunting conditions and the corresponding intelligence line expansion strategy can be provided to the user for confirmation. If the user confirms that the intelligence query tool is allowed to be used to query additional intelligence data related to the attack event based on the threat hunting conditions and the intelligence line expansion strategy, the intelligence query tool can be used to query additional intelligence data related to the attack event based on the threat hunting conditions and the intelligence line expansion strategy.

[0105] The embodiments of the present application can utilize the intelligence query API to request permission from the user to conduct associated intelligence queries to expand network threat intelligence (i.e., additional intelligence data, such as intelligence information related to specific IoCs or attack organizations retrieved by security industry media, information on historical attack events of related attack organizations, information related to objects that have been attacked corresponding to related attack techniques / vulnerabilities, etc.); and when the user confirms that the relevant intelligence expansion strategy can be adopted, the intelligence query API is automatically called to complete the phased intelligence expansion.

[0106] In an embodiment of the present application, the intelligence query API can specifically use a large language model to generate the threat hunting conditions and the intelligence line expansion strategy to query additional intelligence data related to the attack event.

[0107] For example, when the context data of a certain DNS is missing in the forensic data, a threat hunting hypothesis condition related to the DNS will be generated, such as retrieving logs with a query length exceeding 50 under the DNS protocol, and giving priority to displaying the id, query, and answers fields of the DNS protocol log.

[0108] Afterwards, based on the generated threat hunting assumptions related to the DNS, the corresponding intelligence line expansion strategy is generated. Here, the intelligence line expansion strategy refers to the process of expanding from network threat intelligence clue A to intelligence clues B, C, and D. Take a line expansion path as an example:

[0109] By retrieving the "external IP" information in the log data under the DNS protocol, the corresponding historical "associated Domain" / "geographic location" / site "digital certificate" information, etc. are obtained through PDNS query; and based on the "associated Domain", the IP address information of the "intranet associated assets" that have communicated with the domain name is found; and the "associated asset historical alarm" information of the relevant time period of the "intranet associated assets" is obtained; and based on the aforementioned "associated Domain", the relevant "malicious file information" and so on are found.

[0110] Based on the above intelligence expansion strategy, other potential attack intelligence related to this attack event (such as associated IP, registration events, etc.) can be collected, and based on the intelligence obtained by these intelligence expansion strategies, other potential alarms in the log (including but not limited to network IoC alarms, attack feature matching alarms, etc.) can be further recursively queried.

[0111] In an embodiment of the present application, after obtaining the forensic data and additional intelligence data of the attack event, these two types of data can be combined to obtain at least one tracing path of the attack event.

[0112] Specifically, the forensic data and the additional intelligence data may be processed by using a model for establishing a traceability path obtained through pre-training to obtain a possible traceability path for the attack event.

[0113] In an embodiment of the present application, for at least one tracing path of the obtained attack event, the at least one tracing path is further analyzed using a tracing analysis model, and the tracing success probability of each tracing path in the at least one tracing path can be obtained; in an optional implementation, in addition to obtaining the tracing success probability of each tracing path using the tracing analysis model, key forensic evidence of each tracing path can also be obtained at the same time.

[0114] The above information output by the traceability analysis model (including the traceability success probability of each traceability path and / or the key forensic evidence of each traceability path) can be used as a reference for users to determine the traceability path of the attack event and achieve the purpose of accurately tracking and tracing the attack event.

[0115] It can be understood that after obtaining the attack chain for tracing the attack event, the attack intention can be determined based on the basic information of the attack organization to which the attack source in the tracing attack chain belongs, and the current attack stage can be determined based on the attack intention and the network attack clues that have been obtained. Based on the attack intention and the current attack stage, predicted network attack events that may occur in the future can be predicted, and then the countermeasures corresponding to the attack events can be determined based on the predicted network attack events.

[0116] The technical solution of the embodiment of the present application obtains log data related to the attack event in the attacked host; when obtaining forensic data for tracing the attack chain of the attack event based on the log data, it further detects whether the forensic data in the log data is complete; when the forensic data is incomplete, it can use the large language model to generate suggestion information to supplement the forensic data, and when the user believes that the suggestion information generated by the large language model is not feasible, the large prediction model is used to generate threat hunting conditions and the intelligence line expansion strategy to query additional intelligence data related to the attack event, thereby querying more additional intelligence related to the attack event, which is conducive to the subsequent use of additional intelligence data to trace the attack chain of the attack event.

[0117] Next, combine Figure 3 as well as Figure 4 This section introduces the attack chain tracing process of attack events.

[0118] Figure 3 The initial clues are the hit intrusion indicators, including Figure 3 The IP, domain and other indicators listed for the initial clues; then the attack intention is guessed based on the hit intrusion indicators, such as Figure 3 Several intentions are listed for intention guessing; based on the guessed intention, it is determined whether the intrusion indicator is a known white event (i.e., a legal event), a known black event (i.e., a malicious event), or an unknown event (i.e., a time when it is impossible to determine whether it is legal or malicious).

[0119] For unknown events, the attack clues (i.e. forensic data) are expanded by retrieving the log context records of the attack events, expanding the intelligence and querying key information.

[0120] In the embodiment of the present application, additional intelligence data of the attack event can be further queried through the expansion of attack clues. The use of forensic data and additional intelligence data can provide more complete forensic data for the attack event, which is convenient for subsequent more accurate determination of the backtracking path of the attack event.

[0121] Figure 5 Schematic diagram of the data processing method provided in the embodiment of the present application Figure 4 ,like Figure 5 As shown, the data processing method comprises the following steps:

[0122] S501: Obtaining forensic data of an attack event and suggestion information for supplementing the forensic data;

[0123] S502: receiving supplementary data provided by the user according to the suggestion information to supplement the forensic data;

[0124] S503: Generate at least one tracing path of the attack event by combining the forensic data and the supplementary data;

[0125] S504: Analyze the at least one tracing path using a traceability analysis model to determine a traceability success probability of each tracing path in the at least one tracing path.

[0126] In the embodiment of the present application, the execution of the above step S501 can be specifically implemented by referring to steps S101 to S103 in the above embodiment, which will not be repeated here.

[0127] The embodiments of the present application can provide users with forensic solution suggestions for supplementing forensic data by utilizing the suggestion information generated by the large language model to supplement the forensic data of the attack incident. For example, the suggestion information generated by the large language model may specifically include which data needs to be supplemented, the channels for supplementing the data, etc.

[0128] In an embodiment of the present application, after using a large language model to generate suggestion information to supplement the forensic data of the attack event, the user can further confirm whether the generated suggestion information is feasible. If the user believes that the generated suggestion information is feasible, the user provides supplementary data for the forensic data based on the suggestion information generated by the large language model, such as providing supplementary data for the forensic data based on the supplementary data suggested to be provided in the suggestion information, the path of the data that needs to be supplemented, etc.

[0129] At least one tracing path of the attack event can be obtained by combining the forensic data obtained based on the log data and the supplementary data of the forensic data provided by the user according to the suggestion information generated by the large model.

[0130] Specifically, the possible tracing path of the attack event can be obtained by processing the forensic data and the supplementary data of the forensic data through the model of the tracing path obtained by pre-training.

[0131] In an embodiment of the present application, for at least one tracing path of the obtained attack event, the at least one tracing path is further analyzed using a tracing analysis model, and the tracing success probability of each tracing path in the at least one tracing path can be obtained. In an optional implementation, in addition to obtaining the tracing success probability of each tracing path using the tracing analysis model, key forensic evidence of each tracing path can also be obtained at the same time.

[0132] The above information output by the traceability analysis model can be used as a reference for users to determine the traceability path of the attack event and achieve the purpose of accurately tracking and tracing the attack event.

[0133] The technical solution of the embodiment of the present application obtains log data related to the attack event in the attacked host; when obtaining forensic data for tracing the attack chain of the attack event based on the log data, if it is detected that the forensic data is incomplete, it can further use the large language model to generate suggestion information for supplementing the forensic data, so that the user can provide more complete forensic data of the attack event according to the generated suggestion information, which is conducive to the subsequent use of the supplementary data provided by the user according to the suggestion information to supplement the forensic data to trace the attack chain of the attack event, so as to obtain a more accurate and complete tracing path of the attack event.

[0134] Figure 6 A flow chart of the model training method provided in the embodiment of the present application is as follows: Figure 6 As shown, the model training method includes the following steps:

[0135] S601: Acquire a knowledge base in the field of computer forensics;

[0136] S602: Using the knowledge base to train an initial large language model to obtain a large language model.

[0137] In the embodiment of the present application, the training data for training the large language model may specifically be the following professional knowledge in the field of computer forensics:

[0138] 1. Collect papers, books, and documents in the field of digital forensics as training texts; these teaching materials can cover the basic concepts, principles, processes, tools, and other professional knowledge of digital forensics;

[0139] 2. Collect actual digital forensic analysis reports as cases and application examples to let the model learn analytical ideas;

[0140] 3. Build a Q&A dataset on forensics topics, covering the use of forensic tools, evidence extraction and processing, timeline analysis, etc., and use this dataset to refine the Q&A;

[0141] 4. Create situational dialogue data based on specific evidence collection scenarios, so that the model can master case analysis and response processes through dialogue learning;

[0142] 5. Use retrieval chat to supplement knowledge and conduct reinforcement learning for model knowledge gaps during interaction;

[0143] 6. Apply reinforcement learning to allow the model to continuously learn through forensic problem solving exercises.

[0144] 7. Introduce case analysis tests in the later stages of training to evaluate the model’s ability to conduct digital forensic analysis and provide additional knowledge where deficiencies exist.

[0145] In an embodiment of the present application, the large language model is used to generate suggestion information to supplement the forensic data of the attack event when the forensic data of the attack event is incomplete.

[0146] The large language model obtained by training the initial large language model with the above training data can provide suggestion information for supplementing the forensic data of the attack incident. The suggestion information is specifically a suggestion for a forensic solution for supplementing the forensic data. For example, the suggestion information generated by the large language model may specifically include which data needs to be supplemented, the channels for supplementing the data, etc.

[0147] The technical solution of the embodiment of the present application, by using the knowledge base in the field of computer forensics to train the initial large language model, obtains suggestion information for supplementing the forensic data of the attack event when the forensic data of the attack event is incomplete, so that the user can provide more complete forensic data of the attack event according to the generated suggestion information, which is conducive to tracing the attack chain of the attack event by using the supplementary data provided by the user according to the suggestion information to supplement the forensic data, so as to obtain a more accurate and complete tracing path of the attack event.

[0148] Figure 7 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application is shown in FIG. Figure 7 As shown, the data processing device includes:

[0149] The first acquisition unit 701 is used to obtain log data related to the attack event in the attacked host in response to the tracing instruction of the attack event;

[0150] The second acquisition unit 702 is used to acquire forensic data of the attack event according to the log data; the forensic data is used to trace the attack chain of the attack event;

[0151] The first generating unit 703 is used to generate suggestion information for supplementing the forensic data of the attack event by using a large language model when detecting that the forensic data is incomplete.

[0152] In one embodiment, the device further comprises:

[0153] A second generating unit, when receiving a feedback instruction from a user indicating that the suggestion information is not feasible, generates a threat hunting hypothesis condition and an intelligence line expansion strategy for the threat hunting hypothesis condition;

[0154] The query unit is used to query additional intelligence data related to the attack event based on the threat hunting condition and the intelligence line expansion strategy using an intelligence query tool.

[0155] In some embodiments, the device further comprises:

[0156] The third generating unit is used to generate at least one tracing path of the attack event by combining the forensic data and the additional intelligence data.

[0157] In some embodiments, the device further comprises:

[0158] A receiving unit, configured to receive supplementary data provided by a user according to the suggestion information to supplement the forensic data;

[0159] A fourth generating unit is used to generate at least one tracing path of the attack event in combination with the forensic data and the supplementary data.

[0160] In some embodiments, the device further comprises:

[0161] The analysis unit is used to analyze the at least one tracing path by using a tracing analysis model to determine the tracing success probability of each tracing path in the at least one tracing path.

[0162] Those skilled in the art should understand that Figure 7 The implementation functions of each unit in the data processing device shown can be understood by referring to the relevant description of the aforementioned data processing method. Figure 7 The functions of each unit in the data processing device shown may be implemented by a program running on a processor, or may be implemented by a specific logic circuit.

[0163] Figure 8 A schematic diagram of the structure of the model training device provided in the embodiment of the present application is shown in FIG. Figure 8 As shown, the model training device includes:

[0164] The third acquisition unit 801 is used to acquire a knowledge base in the field of computer forensics;

[0165] The training unit 802 is used to train the initial large language model using the knowledge base to obtain a large language model; wherein the large language model is used to generate suggestion information to supplement the forensic data of the attack event when the forensic data of the attack event is incomplete.

[0166] Those skilled in the art should understand that Figure 8 The implementation functions of each unit in the model training device shown can be understood by referring to the relevant description of the aforementioned model training method. Figure 8 The functions of each unit in the model training device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0167] An embodiment of the present application also provides an electronic device. Fig. 9 Schematic diagram of the hardware structure of the electronic device of the embodiment of the present application, such as Fig. 9 As shown, the electronic device includes: a communication component 903 for data transmission, at least one processor 901 and a memory 902 for storing a computer program that can be run on the processor 901. The various components in the terminal are coupled together through a bus system 904. It can be understood that the bus system 904 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 904 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Fig. 9 Various buses are labeled as bus system 904.

[0168] When the processor 901 executes the computer program, at least Figure 1 , Figure 2 , Figure 5 or Figure 6 The steps of the method are shown.

[0169] It can be understood that the memory 902 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 902 described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memories.

[0170] The method disclosed in the above embodiment of the present application can be applied to the processor 901, or implemented by the processor 901. The processor 901 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 901 or an instruction in the form of software. The above processor 901 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 901 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 902, and the processor 901 reads the information in the memory 902 and completes the steps of the above method in combination with its hardware.

[0171] In an exemplary embodiment, the electronic device may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0172] The present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the program is at least used to execute when executed by a processor Figure 1 , Figure 2 , Figure 5 or Figure 6 The computer readable storage medium may be a memory. The memory may be Fig. 9 Memory 902 is shown.

[0173] The technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0174] In the several embodiments provided in the present application, it should be understood that the disclosed methods and intelligent devices can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0175] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0176] In addition, all functional units in the embodiments of the present application may be integrated into a second processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0177] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A data processing method, characterized in that: The method comprises: In response to a source tracing instruction for an attack event, obtaining log data related to the attack event in the attacked host; Acquire forensic data of the attack event according to the log data; the forensic data is used to trace the attack chain of the attack event; When it is detected that the forensic data is incomplete, a large language model is used to generate suggestion information for supplementing the forensic data of the attack event.

2. The method according to claim 1, characterized in that: The method further comprises: In the case of receiving a feedback instruction from the user indicating that the suggested information is not feasible, generating a threat hunting hypothesis and an intelligence line expansion strategy for the threat hunting hypothesis; An intelligence query tool is used to query additional intelligence data related to the attack event based on the threat hunting conditions and the intelligence line expansion strategy.

3. The method according to claim 2, characterized in that The method further comprises: At least one tracing path of the attack event is generated by combining the forensic data and the additional intelligence data.

4. The method according to claim 1, characterized in that The method further comprises: receiving supplementary data provided by the user based on the suggestion information to supplement the forensic data; At least one tracing path of the attack event is generated by combining the forensic data and the supplementary data.

5. The method according to claim 3 or 4, characterized in that: The method further comprises: The at least one tracing path is analyzed using a traceability analysis model to determine a traceability success probability of each tracing path in the at least one tracing path.

6. A model training method, characterized in that: The method comprises: Access the knowledge base in the field of computer forensics; The knowledge base is used to train the initial large language model to obtain a large language model; wherein the large language model is used to generate suggestion information to supplement the forensic data of the attack event when the forensic data of the attack event is incomplete.

7. A data processing device, characterized in that: The device comprises: A first acquisition unit, configured to acquire log data related to the attack event in the attacked host in response to a source tracing instruction for the attack event; A second acquisition unit is used to acquire forensic data of the attack event according to the log data; the forensic data is used to trace the attack chain of the attack event; The first generating unit is used to generate suggestion information for supplementing the forensic data of the attack event by using a large language model when detecting that the forensic data is incomplete.

8. A model training device, characterized in that: The device comprises: A third acquisition unit is used to acquire a knowledge base in the field of computer forensics; A training unit is used to train an initial large language model using the knowledge base to obtain a large language model; wherein the large language model is used to generate suggestion information to supplement the forensic data of the attack event when the forensic data of the attack event is incomplete.

9. An electronic device, characterized in that: The electronic device comprises: a memory and a processor, wherein the memory stores computer executable instructions, and the processor can implement any one of claims 1 to 5 or claim 6 when executing the computer executable instructions on the memory.

10. A computer storage medium, characterized in that: The storage medium stores executable instructions, which, when executed by a processor, implement the method of any one of claims 1 to 5 or claim 6.

Images