Abnormal data processing method and device, equipment and medium

Abstract

The invention discloses an abnormal data processing method and device, equipment and a medium. The method comprises the following steps: acquiring abnormal data; analyzing and processing the abnormal data through a large language model, and determining a processing strategy; and based on the processing strategy, processing an operation corresponding to the abnormal data.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an abnormal data processing method, device, equipment and medium. Background Art

[0002] In the related art, security events captured during the operation of devices or networks are usually processed based on expert experience or abnormal features of historical security events. However, expert experience and abnormal features of historical security events cannot cope with the detection of rapidly changing security events. Summary of the invention

[0003] Based on the above problems, the embodiments of the present application provide a method, device, equipment and medium for processing abnormal data.

[0004] The technical solution provided by the embodiment of the present application is as follows:

[0005] The present invention provides a method for processing abnormal data, the method comprising:

[0006] Get exception data;

[0007] Analyze and process the abnormal data through a large language model to determine a processing strategy;

[0008] Based on the processing strategy, the operation corresponding to the abnormal data is processed.

[0009] In some embodiments, the large language model includes at least a disassembly module; the analyzing and processing the abnormal data by using the large language model to determine the processing strategy includes:

[0010] Decomposing the abnormal data by the decomposing module to obtain a first set including at least one decomposing data;

[0011] Analyze and process the disassembled data in the first set to determine the risk status of the abnormal data;

[0012] Based on the risk status, the treatment strategy is determined.

[0013] In some embodiments, the disassembling of the abnormal data by the disassembling module to obtain a first set including at least one disassembled data includes:

[0014] Performing semantic recognition on the abnormal data by the disassembling module to obtain a second set of at least one step included in the operation process represented by the abnormal data;

[0015] The at least one step in the second set is decomposed into operation object granularity to obtain the first set; wherein the operation object at least includes the data and / or device object targeted by the operation process.

[0016] In some embodiments, the at least one step includes a kth step and a k+1th step; the k+1th step is the next step of the kth step; k is an integer greater than or equal to 1; the at least one step in the second set is decomposed at an operation object granularity to obtain the first set, including:

[0017] The k-th step is disassembled at the granularity of the operation object by the disassembly module to obtain disassembly data of the k-th step; wherein the disassembly data of the k-th step includes problem data at the granularity of the operation object;

[0018] Determine the disassembly data of the k+1th step based on the answer data of the mth question data contained in the disassembly data of the kth step; wherein m is an integer greater than or equal to 1;

[0019] Determine that the disassembly data of the first step to the disassembly data of the Kth step are the first set; wherein K is the number of steps included in the second set; and K is an integer greater than or equal to 2.

[0020] In some embodiments, the disassembling of the abnormal data by the disassembling module to obtain a first set including at least one disassembled data includes:

[0021] Determine target prompt data;

[0022] Based on the target prompt data, the disassembly module is controlled to disassemble the abnormal data to obtain the first set.

[0023] In some embodiments, the determining target prompt data includes:

[0024] Get sample prompt data;

[0025] The target prompt data is determined from the sample prompt data based on a degree of matching between the prompt data in the sample prompt data and the category of the abnormal data.

[0026] In some embodiments, the method further comprises:

[0027] Acquire sample prompt data; wherein the sample prompt data includes prompt data corresponding to various types of abnormal events;

[0028] The initial disassembly module is trained using the sample prompt data to obtain the disassembly module.

[0029] In some embodiments, the first set includes disassembled data from the first step to the Kth step; the operation of characterizing the abnormal data includes the first step to the Kth step; K is an integer greater than or equal to 2; the large language model also includes a classification module; the processing strategy includes a decision logic tree; and determining the processing strategy based on the risk state includes:

[0030] Determining, by the classification module, an action to be performed at the k-th step based on the risk status of the k-th step; wherein k is an integer greater than or equal to 1 and less than or equal to K;

[0031] Determine a decision logic tree based on the actions respectively performed in the first step to the Kth step;

[0032] The operation corresponding to processing the abnormal data based on the processing strategy includes:

[0033] Based on the processing decisions respectively corresponding to the first step to the K-th step in the decision logic tree, the actions respectively executed in the first step to the K-th step are processed accordingly.

[0034] In some embodiments, the determining of the decision logic tree based on the actions respectively performed in the first step to the Kth step includes:

[0035] If the action performed in the k-th step is associated with text data analysis, the processing decision associated with the k-th step in the decision logic tree is determined to be: obtaining target text data from the k-th step and performing a thought chain analysis on the target text data.

[0036] In some embodiments, the determining of the decision logic tree based on the actions respectively performed in the first step to the Kth step includes:

[0037] If the action performed in the kth step is associated with abnormal access within the network, the processing decision associated with the kth step in the decision logic tree is determined as: determining and sending inquiry data to the target device, obtaining and determining the risk level of the abnormal access within the network based on the reply data sent by the target device; wherein the target device is at least associated with the abnormal access within the network.

[0038] In some embodiments, the determining of the decision logic tree based on the actions respectively performed in the first step to the Kth step includes:

[0039] If the action performed in the kth step is associated with the missing target information, the processing decision associated with the kth step in the decision logic tree is determined as follows: obtaining associated information associated with the action performed in the kth step, and determining the risk level of the action performed in the kth step at least based on the associated information; wherein the associated information is associated with the target information.

[0040] In some embodiments, the determining of the decision logic tree based on the actions respectively performed in the first step to the Kth step includes:

[0041] If the action performed in the k-th step is associated with a port risk, the processing decision associated with the k-th step is determined to be: calling at least one interface to block a target port; wherein the target port is associated with the port risk.

[0042] In some embodiments, the determining of the decision logic tree based on the actions respectively performed in the first step to the Kth step further includes:

[0043] If the action performed in the k-th step is associated with an attack action, the processing decision corresponding to the k-th step in the decision logic tree is determined to be:

[0044] Determine the association relationship between the attack action and the attack operations included in other abnormal data, and construct an abnormal association graph based on the association relationship.

[0045] In some embodiments, the method further comprises:

[0046] Acquire classified sample data; wherein the classified sample data includes abnormal data corresponding to security events of multiple abnormal types;

[0047] Based on the classification sample data and the abnormal type, an initial classification module is trained to obtain the classification module.

[0048] The embodiment of the present application also provides an abnormal data processing device, the device comprising:

[0049] Acquisition module, used to obtain abnormal data;

[0050] A determination module, used to analyze and process the abnormal data through a large language model to determine a processing strategy;

[0051] A processing module is used to process the operation corresponding to the abnormal data based on the processing strategy.

[0052] An embodiment of the present application also provides an electronic device, which includes a processor and a memory; wherein: a computer program is stored in the memory; when the computer program is executed by the processor, it can implement any of the above-mentioned abnormal data processing methods.

[0053] An embodiment of the present application further provides a computer-readable storage medium, characterized in that a computer program is stored in the storage medium; when the computer program is executed by a processor of an electronic device, the abnormal data processing method provided in any of the previous embodiments can be implemented.

[0054] The abnormal data processing method provided in the embodiment of the present application, after acquiring the abnormal data, analyzes and processes the abnormal data through a large language model (LLM) to determine the processing strategy. In this way, with the help of the powerful semantic understanding ability of LLM, it is possible to achieve accurate and complete identification of abnormal data, thereby improving the pertinence, comprehensiveness and accuracy of the processing strategy; and with the help of the powerful generalization ability of LLM, it is also possible to achieve flexible and targeted analysis and processing of diverse and frequently changing abnormal data, thereby getting rid of the dependence on preset rules, features and security protection experience of technical experts; on this basis, based on the processing strategy, the operations corresponding to the abnormal data are processed, and the operations corresponding to the abnormal data can be accurately processed, thereby meeting the processing requirements for the operations corresponding to the rapidly changing abnormal data.

[0055] In the case where the abnormal data corresponds to the log data corresponding to the security event, the abnormal data processing method provided in the embodiment of the present application can realize the accurate real-time processing of diverse and rapidly changing security events, thereby meeting the processing requirements of actual security events. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A flowchart of an abnormal data processing method provided in an embodiment of the present application;

[0057] Figure 2 A schematic diagram of a process for obtaining a first set provided in an embodiment of the present application;

[0058] Figure 3 A schematic diagram of a process for handling abnormal data provided in an embodiment of the present application;

[0059] Figure 4 A schematic diagram of the process of generating and executing a problem logic tree provided in an embodiment of the present application;

[0060] Figure 5 A schematic diagram of the structure of an abnormal data processing device provided in an embodiment of the present application;

[0061] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0063] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0064] In the process of network security protection, massive security incidents occur every day. In practical applications, it is usually necessary to rely on expert experience and abnormal characteristics of historical security incidents to process abnormal data such as alarms in security incidents.

[0065] Among them, dozens or even hundreds of security event detection rules can be pre-set through expert experience to cover detection of different types of security events.

[0066] In actual applications, in addition to using the above-mentioned security incident detection rules, operation and maintenance personnel may also need to combine detailed historical alarm information stored in multiple databases to analyze possible missed reports and false alarms in security incidents before confirming the authenticity and severity of the security incidents. On this basis, different processing tools are called based on the analysis results for corresponding disposal.

[0067] Therefore, in practical applications, the process of handling security incidents mainly relies on rich expert experience. However, in the face of the diversity of attack scenarios of network security attacks, the detection rules based on the above security incident handling process are prone to conflict; and with the rapid changes in the means of network security incident attacks, the lag of the rules in the above processing process makes it difficult to continue to evolve, and therefore cannot meet the rapidly changing security incident detection needs in diverse scenarios.

[0068] Based on the above problems, the embodiments of the present application provide a method, device, equipment and medium for processing abnormal data.

[0069] The abnormal data processing method provided in the embodiment of the present application can be implemented by a processor of an electronic device. The above-mentioned processor can be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller (MCU), and a microprocessor.

[0070] Exemplarily, the electronic device may be a physical device or a virtual machine device.

[0071] Exemplarily, the electronic device may be a computer device.

[0072] Figure 1 A flow chart of the abnormal data processing method provided in the embodiment of the present application is as follows: Figure 1 As shown, the process may include the following steps:

[0073] Step 101: Obtain abnormal data.

[0074] In one implementation, the abnormal data may include log data corresponding to the security event.

[0075] In one embodiment, abnormal data may include descriptive data of network security alerts (Security Alert) and / or network security incidents (Security Incident); wherein, network security alerts include alerts caused by abnormal situations such as attacks and intrusions on assets by malicious Internet Protocol (IP) addresses, and network security incidents include events composed of multiple related network security alerts.

[0076] In one embodiment, the abnormal data may include log data corresponding to the alarm data; exemplarily, a data flow when the data transmission and / or data processing process is different from the target state can be determined as alarm data; exemplarily, abnormal feature detection can be performed on the timing characteristics of network traffic and access behavior based on at least one of IP addresses, data packet characteristics, machine learning algorithms, and statistical algorithms to obtain abnormal data.

[0077] In one implementation, the risk level of the operation corresponding to the abnormal data may be greater than or equal to the level threshold, or may be less than the level threshold. That is, the operation corresponding to the abnormal data may be a threatening operation such as an attack operation, or may be a safe operation.

[0078] Step 102: Analyze and process the abnormal data through LLM to determine the processing strategy.

[0079] LLM is a natural language processing model based on deep learning, which can learn the grammar and semantics of natural language, so as to generate human-readable text. The language model in LLM includes an artificial intelligence (AI) model used to process language, text or symbol system, which is used to discover the rules contained in text or data, and automatically generate content that conforms to these rules in combination with prompts.

[0080] LLM can quickly and automatically process various natural language processing tasks, such as natural language generation, text classification, text summarization, machine translation, and speech recognition.

[0081] In one embodiment, the processing strategy may include a decision whether to process the operation represented by the abnormal data.

[0082] In one embodiment, the processing strategy may include methods and / or steps used to process the operation represented by the abnormal data.

[0083] In one implementation, the processing strategy may include the timing and / or conditions for processing the operation represented by the abnormal data.

[0084] In one embodiment, the processing strategy may be determined by any of the following methods:

[0085] The first result is obtained by performing semantic recognition and analysis processing of the abnormal data in the security detection dimension through LLM, and then a processing strategy is determined according to the operation steps included in the first result.

[0086] The abnormal data is analyzed and processed through LLM to determine the target data for the operation corresponding to the abnormal data, and the processing strategy is determined according to the type of the target data.

[0087] The abnormal data is analyzed and processed through LLM to determine the frequency and result of the operation corresponding to the abnormal data, and the processing strategy is determined based on the operation frequency and the operation result.

[0088] Step 103: Based on the processing strategy, process the operation corresponding to the abnormal data.

[0089] In one implementation, when the processing conditions included in the processing strategy are met, the operation corresponding to the abnormal data may be processed based on the processing method included in the processing strategy.

[0090] From the above, it can be seen that the abnormal data processing method provided in the embodiment of the present application, after obtaining the abnormal data, analyzes and processes the abnormal data through LLM to determine the processing strategy. In this way, with the help of the powerful semantic understanding ability of LLM, it is possible to achieve accurate and complete identification of abnormal data, thereby improving the pertinence, comprehensiveness and accuracy of the processing strategy; and, with the help of the powerful generalization ability of LLM, it is also possible to achieve flexible and targeted analysis and processing of diverse and frequently changing abnormal data, thereby getting rid of the dependence on preset rules, features and security protection experience of technical experts; on this basis, based on the processing strategy, the operations corresponding to the abnormal data can be processed accurately, thereby meeting the processing requirements for the operations corresponding to the rapidly changing abnormal data.

[0091] In the case where the abnormal data corresponds to the log data corresponding to the security event, the abnormal data processing method provided in the embodiment of the present application can realize the accurate real-time processing of diverse and rapidly changing security events, thereby meeting the processing requirements of actual security events.

[0092] Based on the foregoing embodiments, in the abnormal data processing method provided in the embodiments of the present application, the LLM at least includes a disassembly module.

[0093] In one implementation, the disassembly module may include an LLM having a disassembly function, or a submodule in the LLM having a disassembly function.

[0094] In one implementation, the disassembly module may disassemble the abnormal data based on the semantic recognition parameters in the LLM.

[0095] In one embodiment, the disassembly module can disassemble the abnormal data based on the semantic recognition parameters related to security event processing in the LLM and the semantic recognition parameters related to the steps and / or actions corresponding to the security event.

[0096] Accordingly, the abnormal data can be analyzed and processed by LLM to determine the processing strategy, which can be achieved through the following steps:

[0097] Step A1: disassemble the abnormal data through a disassembly module to obtain a first set including at least one disassembled data.

[0098] In one embodiment, the disassembly data may characterize at least one of at least one action included in the operation corresponding to the abnormal data, the operation object targeted by at least one action, and the execution result of at least one action; wherein the operation object may include a device object and / or a data object; and the execution result may include the success or failure of the execution of at least one action.

[0099] In one implementation, the disassembled data in the first set may be sorted according to the time corresponding to each data in the abnormal data.

[0100] In one implementation, the first set may be obtained by any of the following methods:

[0101] The abnormal data is evenly disassembled in the time dimension based on a preset time interval by a disassembly module to obtain a first set including at least one disassembled data.

[0102] The abnormal data is disassembled according to the data elements contained in the abnormal data by a disassembly module to obtain a first set including at least one disassembled data; wherein the data element may include at least one of an action, an operation object and an execution result.

[0103] Step A2: Analyze and process the disassembled data in the first set to determine the risk status of the abnormal data.

[0104] In one implementation, the risk status may represent whether the operation corresponding to the abnormal data is an attack operation, whether the operation is a potential threat operation, the risk level or risk probability of the operation, and the like.

[0105] In one embodiment, the risk status may be determined by any of the following methods:

[0106] At least part of the disassembled data in the first set is analyzed and processed by LLM. If an action corresponding to at least one disassembled data indicates that the abnormal data performs an attack operation, it can be determined that the risk state is an attack state.

[0107] The disassembled data in the first set are analyzed and processed. If the target data corresponding to at least one disassembled data indicates that the operation corresponding to the abnormal data attempts to access sensitive data, it can be determined that the risk status is a data theft status.

[0108] The disassembled data in the first set are analyzed and processed. If the disassembled data in the first set indicates that the actions, operation objects and execution results included in the abnormal data are all in a safe state, it can be determined that the risk state is a safe state.

[0109] Step A3: Determine the treatment strategy based on the risk status.

[0110] In one implementation, the processing strategy may be determined based on the level of the risk status, the frequency of execution of actions corresponding to the risk status, and the type of data associated with the risk status.

[0111] From the above, it can be seen that in the abnormal data processing method provided in the embodiment of the present application, the abnormal data is disassembled by a disassembly module to obtain a first set including at least one disassembled data, thereby reducing the data volume of each disassembled data in the first set, thereby reducing the computing resources for subsequently determining the risk status of the abnormal data, and improving the computing efficiency; and, by analyzing and processing the disassembled data in the first set, the risk status of the abnormal data is determined, so that the risk status can reflect the actual risk probability of the abnormal data from the dimensions of each disassembled data included in the first set, comprehensively and finely, thereby overcoming the shortcomings of the related art in determining the correlation only based on the edit distance of the attack operation; at the same time, a processing strategy is determined based on the risk status, so that the processing strategy can comprehensively respond to the risk processing needs represented by at least one disassembled data.

[0112] Based on the foregoing embodiment, in the abnormal data processing method provided in the embodiment of the present application, the abnormal data is disassembled by the disassembly module to obtain a first set including at least one disassembled data, which can be implemented by the following steps:

[0113] Step B1: perform semantic recognition on the abnormal data through a disassembly module to obtain a second set of at least one step included in the operation process represented by the abnormal data.

[0114] In one implementation, the operation process may include at least one step; illustratively, the above step may correspond to the actions in the aforementioned embodiments.

[0115] In one implementation, the second set may be obtained by any of the following methods:

[0116] The calling process of at least one of the methods, functions and interfaces represented by the abnormal data is semantically identified by the disassembly module to obtain a second set including at least one step; illustratively, a calling operation of a method, function or interface can correspond to one step.

[0117] The process scheduling flow represented by the abnormal data is identified by the disassembly module, thereby obtaining a second set including at least one step; illustratively, switching between processes may correspond to switching of steps.

[0118] Step B2: Decompose at least one step in the second set into operation object granularity to obtain a first set.

[0119] The operation object at least includes the data and / or device object targeted by the operation process.

[0120] In one implementation, the operation object may also include the operation performed during the operation and / or the operation result.

[0121] In one implementation, the device object may include a physical device object and / or a virtual device object.

[0122] In one implementation, the data object may include a file object.

[0123] In one implementation, the first set may be implemented in the following manner:

[0124] The operation objects included in each step in the second set are decomposed in association with each other in the time dimension, and the decomposition result is determined as the first set.

[0125] From the above, it can be seen that in the abnormal data processing method provided in the embodiment of the present application, semantic recognition is performed on the abnormal data through a disassembly module to obtain a second set of at least one step included in the operation process represented by the abnormal data. In this way, the second set can comprehensively present the step elements and the execution process included in the operation process represented by the abnormal data; and at least one step in the second set is disassembled at the granularity of the operation object to obtain the first set, and the operation object at least includes the data and / or device objects targeted by the operation process. In this way, through the above operations, fine-grained disassembly of the steps in the second set can be achieved, thereby improving the precision of the disassembled data in the first set.

[0126] Based on the foregoing embodiments, in the abnormal data processing method provided in the embodiments of the present application, at least one step includes the kth step and the k+1th step; the k+1th step is the next step of the kth step; and k is an integer greater than or equal to 1.

[0127] Accordingly, decomposing at least one step in the second set at the granularity of the operation object to obtain the first set can be achieved by the following steps:

[0128] Step C1: Decomposing the k-th step at the granularity of the operation object through a decomposition module to obtain decomposition data of the k-th step.

[0129] The disassembly data of the kth step includes problem data at the granularity of the operation object.

[0130] In one embodiment, the problem data contained in the disassembly data of the kth step can represent at least one result that may be obtained after the action represented by the disassembly data of the kth step is completed, the type of at least one returned data, the degree of influence of the frequency of execution of the above action on the above at least one result, etc.

[0131] In one implementation, the disassembly data in step k can be obtained in the following manner:

[0132] According to the statistical laws and / or detection methods in the field of security incident detection, at least one possible result that may be obtained after the execution of the action represented by the disassembly data of the kth step is completed, the type of at least one returned data, the degree of influence of the frequency of execution of the above action on the above at least one result, etc. are estimated, and the estimated result is determined as the action included in the kth step, the operation object associated with the above action, and the operation result and other problem data.

[0133] Step C2: Determine the disassembled data of the k+1th step based on the answer data of the mth question data contained in the disassembled data of the kth step.

[0134] Here, m is an integer greater than or equal to 1.

[0135] In one implementation, the answers that may be included in the mth question data may be counted according to the changing rules of security events, and the statistical results may be determined as the response data for the mth question data.

[0136] In one embodiment, the disassembly data of the k+1th step can be constructed based on the response data of each question data contained in the disassembly data of the kth step; exemplarily, after determining the disassembly data of the k+1th step, the disassembly data of the k+2th step can be constructed according to the question data corresponding to the disassembly data of the k+1th step.

[0137] Step C3: determine the disassembled data from the first step to the Kth step as the first set.

[0138] Wherein, K is the number of steps included in the second set; K is an integer greater than or equal to 2.

[0139] From the above, it can be seen that the abnormal data processing method provided in the embodiment of the present application decomposes the kth step at the granularity of the operation object through the disassembly module, and obtains the disassembled data of the kth step including the question data at the granularity of the operation object. In this way, the disassembled data of the kth step can not only reflect the action performed by the kth step, but also determine at least one possible result corresponding to the action performed by the kth step; and, based on the answer data of the mth question data contained in the disassembled data of the kth step, determine the disassembled data of the k+1th step, so as to strengthen the correlation between the kth step and the k+1th step; on this basis, by determining the disassembled data of the first step to the Kth step as the first set, the first set can not only display the action flow corresponding to the abnormal data in a refined manner from the granularity of the operation object, but also reflect the correlation degree of each action in the action flow corresponding to the abnormal data.

[0140] Based on the foregoing embodiment, in the abnormal data detection method provided in the embodiment of the present application, the abnormal data is disassembled by the disassembly module to obtain a first set including at least one disassembled data, which can be implemented in the following manner:

[0141] Determine target prompt data; based on the target prompt data, control the disassembly module to disassemble the abnormal data to obtain a first set.

[0142] In one embodiment, the target prompt data may include at least part of the abnormal data; exemplarily, the target prompt data may guide the disassembly degree and / or disassembly direction of the disassembly operation performed by the disassembly module; exemplarily, the disassembly degree may include whether the disassembly module performs associative disassembly on the abnormal data, for example, whether the LLM performs associative disassembly on the abnormal data based on historical disassembly results; exemplarily, the disassembly direction may include how the LLM selects and disassembles at least part of the abnormal data.

[0143] In one embodiment, the target prompt data may be a prompt word (Prompt) corresponding to the abnormal data, wherein in the LLM field, the prompt is usually text data, which is usually based on the original question and / or original data, by adding additional prompt data to guide the LLM to output the processing result in an expected manner.

[0144] In one implementation, at least part of the abnormal data, abnormal data disassembly requirements, and target format of disassembled data output may be integrated according to a preset prompt rule to obtain target prompt data.

[0145] In one implementation, the first set may be obtained in the following manner:

[0146] The degree of refinement is determined based on the target format and the disassembly requirements contained in the target prompt data, and the disassembly module is controlled to disassemble the abnormal data based on the degree of refinement to obtain a first set; wherein the disassembly requirements may include the knowledge background and specific disassembly requirements of the disassembly module for disassembling the abnormal data; exemplarily, the knowledge background may be reflected through SystemMessage; exemplarily, the disassembly requirements may include the number of steps for dividing the abnormal data, and whether to output the processing solutions corresponding to each step, etc.

[0147] From the above, it can be seen that the abnormal data processing method provided in the embodiment of the present application, after determining the target prompt data, controls the disassembly module to disassemble the abnormal data based on the target prompt data to obtain the first set. In this way, through the target prompt data, the disassembly module can flexibly handle the abnormal data disassembly process, so that the first set can meet the actual disassembly requirements; and by adjusting the target prompt data, the flexibility and diversity of abnormal data disassembly can be improved.

[0148] Based on the above embodiments, in the abnormal data processing method provided in the embodiments of the present application, determining the target prompt data can be achieved in the following ways:

[0149] Acquire sample prompt data; determine target prompt data from the sample prompt data based on the degree of matching between the prompt data in the sample prompt data and the category of the abnormal data.

[0150] In one embodiment, the category of abnormal data can be determined by analyzing the abnormal data through LLM; illustratively, the category of abnormal data can represent the category of operation corresponding to the abnormal data; illustratively, the above category can include attack category and / or non-attack category, etc.

[0151] In one implementation, the target prompt data may include prompt data in the sample prompt data that has the highest matching degree with the category of the abnormal data.

[0152] Figure 2 A schematic diagram of a process for obtaining a first set provided in an embodiment of the present application, such as Figure 2 As shown, the process may include the following steps:

[0153] Step 201: Obtain sample prompt data.

[0154] Exemplarily, the sample prompt data may be obtained from a database.

[0155] Step 202: Determine target prompt data.

[0156] Exemplarily, the target prompt data determined from the sample prompt data based on the above matching degree may be as follows:

[0157] System Message: You are a security expert....

[0158] Few-Shot Example: xxxx...... ...... ......

[0161] Info: basic alarm information

[0162] Instruction: How many steps are needed to analyze and deal with this abnormal data, and what problems need to be solved in sequence, and how should they be solved?

[0163] Among them, System Message can be used to guide the disassembly accuracy and method of the disassembly module; few-short is used for the disassembly module to refer to how to disassemble the abnormal data and how to output the first set; Info can include the data type of the abnormal data, Instruction can include the number of steps that the abnormal data needs to be divided into and the purpose of the operation in each step, and can also include how to handle the operation in each step.

[0164] Step 203: Decompose the abnormal data based on the target prompt data to obtain a first set.

[0165] Exemplarily, the abnormal data may be decomposed by the method provided in the aforementioned embodiment to obtain the first set.

[0166] Exemplarily, the first set obtained by the above method may be as follows:

[0167] According to the current alarm information, this is a network alarm, which is caused by an attack from the external network on the internal network assets. It needs to be analyzed in the following steps:

[0168] Step Z1: To confirm whether the attack is successful, the LLM data packet decoding application programming interface (API) needs to be called;

[0169] Step Z2: To obtain attack details, you need to query the database for relevant asset information and threat intelligence;

[0170] Step Z3: To confirm whether the IP is a malicious IP, you need to query the database blacklist and whitelist;

[0171] Step Z4: To block malicious IPs, you need to call the IP blocking API;

[0172] Step Z5: To detect and kill the compromised assets, you need to start the anti-virus software to detect and kill the API.

[0173] Among them, steps Z1 to Z4 include not only the steps in the aforementioned embodiments, but also the measures that should be taken to process each step, that is, the processing strategy. For example, for step Z1, the processing strategy that needs to be collected to process this step is: it is necessary to call the LLM data packet interpretation API; illustratively, the API can include the input and output data formats for interaction between programs, the conventions followed, etc.

[0174] Exemplarily, the first set may also be as follows:

[0175] Step Y1: Analyze whether the operation corresponding to the abnormal data is an attack operation;

[0176] Step Y2: Analyze whether the attack operation is an external network device attacking an internal network device, an internal network device attacking an internal network device, or an internal network device attacking an external network device;

[0177] Step Y3: Attack the internal network device against the external network device, obtain and interpret the data packet, confirm whether the attack is successful, and confirm whether the external network IP is on the blacklist or whitelist;

[0178] Step Y4: Based on the response data to the question data in step Y3, determine whether IP blocking may be necessary, and further proceed to the next disposal strategy based on whether the blocking is successful.

[0179] In one implementation, the above matching degree can be obtained by any of the following methods:

[0180] The character matching result between the category of the abnormal data and the type information contained in the prompt data in the sample prompt data is determined as the above-mentioned matching degree.

[0181] Clustering is performed on the prompt data in the sample prompt data, and the sample prompt data is classified into types according to the clustering results to obtain type classification results, and then target prompt data is determined from the sample prompt data according to the matching results between the categories of the abnormal data and the categories in the type classification results.

[0182] Exemplarily, the target prompt data may guide the methods and strategies in the disassembly process of the disassembly module. Therefore, the target prompt data may have an impact on the accuracy of the disassembly operation of the disassembly module.

[0183] Exemplarily, different abnormal data may correspond to different target prompt data; exemplarily, at least two prompt data with the highest matching degree may be selected from the sample prompt data based on the above matching degree, and these prompt data may be determined as target prompt data.

[0184] Exemplarily, the target prompt data may be a Few-Shot Learning Prompt.

[0185] As can be seen from the above, in the abnormal data processing method provided in the embodiment of the present application, after obtaining the sample prompt data, the target prompt data is determined from the sample prompt data based on the matching degree between the prompt data in the sample prompt data and the category of the abnormal data. In this way, the target prompt data contains the characteristics of the prompt data in the sample prompt data, and can also match the type of the abnormal data, thereby not only improving the relevance between the target prompt data and the sample prompt data, but also improving its consistency with the abnormal data.

[0186] Based on the above embodiments, the abnormal data processing method provided in the embodiments of the present application may further include the following steps:

[0187] Obtain sample prompt data; train the initial disassembly module through the sample prompt data to obtain the disassembly module.

[0188] The sample prompt data includes prompt data corresponding to various types of abnormal events.

[0189] In one embodiment, the disassembly module can be obtained by any of the following methods:

[0190] Professional data in the field of security incident technology is obtained to pre-train the initial disassembly module to obtain an intermediate state disassembly module, and then sample prompt data is determined based on the processing process of historical security incidents. Then, based on the sample prompt data, the intermediate state disassembly module is fine-tuned (Fine Tuning) or instruction fine-tuning (Instruction Fine Tuning) is processed to obtain a disassembly module; wherein, pre-training usually needs to rely on massive data to realize model training, and fine-tuning can adjust the model parameters based on a small amount of professional field data on the basis of the pre-training result model. Instruction fine-tuning includes fine-tuning based on instruction data. The instruction data is usually in the form of question and answer data, and only the content of the answer in the data is used to adjust the model parameters.

[0191] The initial disassembly module is trained by the Few-Shot Learning method to obtain the disassembly module; wherein, in the above training process, a small number of similar cases can be added to the sample prompt data (Prompt) to stimulate the initial disassembly module's reasoning ability on this type of problem, so that the trained disassembly module can have the ability to disassemble abnormal data corresponding to various types of security events. Among them, the large model can generate output text based on the input data during the reasoning process.

[0192] From the above, it can be seen that the abnormal data processing method provided in the embodiment of the present application, after obtaining the sample prompt data, trains the initial disassembly module through the prompt data corresponding to various types of abnormal events contained in the sample prompt data to obtain the disassembly module. In this way, through the above training process, the disassembly module can improve the disassembly accuracy of the prompt data corresponding to various types of abnormal events.

[0193] Based on the foregoing embodiments, in the abnormal data processing method provided in the embodiments of the present application, the first set includes the disassembly data of the first step to the Kth step; the operations represented by the abnormal data include the first step to the Kth step; K is an integer greater than or equal to 2; the LLM also includes a classification module; and the processing strategy includes a decision logic tree.

[0194] In one implementation, the classification module may include a submodule of the LLM, or may include an LLM with a classification function, which may exist as a submodule of the LLM in the embodiment of the present application, and is used to classify the risk status.

[0195] In one embodiment, the decision logic tree can display the first step to the Kth step included in the first set in the form of a tree network diagram; exemplarily, the kth branch in the tree network diagram can correspond to the kth step, and the next level branch of the kth branch, i.e., the k+1th branch, can correspond to the k+1th step.

[0196] In one implementation, each branch in the decision logic tree may also include a method or strategy for processing an operation corresponding to the k+1th step.

[0197] Accordingly, based on the risk status, the treatment strategy can be determined through the following steps:

[0198] Step D1: Determine the action to be performed at the kth step based on the risk status of the kth step through the classification module.

[0199] Here, k is an integer greater than or equal to 1 and less than or equal to K.

[0200] In one implementation, the action performed in step k can be obtained by:

[0201] Through the classification module, semantic recognition and judgment are performed on the risk description data corresponding to the risk status of the kth step, so as to determine the action performed in the kth step; wherein, the risk description data can comprehensively and finely characterize the operation objects associated with the risk status and the operations performed on the operation objects.

[0202] Step D2: Determine a decision logic tree based on the actions respectively performed in the first step to the Kth step.

[0203] In one implementation, the decision logic tree may be determined in the following manner:

[0204] Based on the operation object associated with the action performed in the kth step, a method for protecting the operation object is determined, and the above method is determined as a processing decision corresponding to the action performed in the kth step in the decision logic tree. Then, the processing decision corresponding to the action performed in the first step is integrated with the processing decision corresponding to the action performed in the Kth step, and the integration result is determined as a decision logic tree.

[0205] Accordingly, based on the processing strategy, abnormal data can be processed in the following ways:

[0206] Based on the processing strategies respectively corresponding to the first step to the Kth step in the decision logic tree, the actions respectively executed in the first step to the Kth step are processed accordingly.

[0207] In one implementation, after the action performed in the kth step is processed based on the processing strategy corresponding to the kth step in the decision logic tree, a processing result may be output.

[0208] From the above, it can be seen that in the abnormal data processing method provided in the embodiment of the present application, the classification module in the LLM determines the action performed in the kth step based on the risk status of the kth step, thereby realizing the refinement of the risk status of the kth step; and, based on the actions respectively performed in the first step to the Kth step, a decision logic tree is determined, so that the processing decisions in the decision logic tree can correspond to the actions respectively performed in each step, thereby improving the pertinence, accuracy and completeness of the decision logic tree; on this basis, based on the processing decisions corresponding to the first step to the Kth step in the decision logic tree, the actions respectively performed in the first step to the Kth step are processed accordingly, thereby realizing the precise and automated processing of each step.

[0209] Based on the above embodiments, in the abnormal data processing method provided in the embodiment of the present application, the decision logic tree is determined based on the actions respectively performed in the first step to the Kth step, which can be implemented in the following manner:

[0210] If the action performed in step k is associated with text data analysis, the processing decision associated with step k in the decision logic tree is determined as: obtaining target text data from step k and performing thought chain analysis on the target text data.

[0211] Exemplarily, if the action performed in step k is not associated with text data parsing, the operation of obtaining the target text data may not be performed.

[0212] In one implementation, the target text data may include text data sent, acquired, or assembled during the execution of the kth step.

[0213] In one embodiment, the target text data may be subjected to chain of thought analysis by LLM or a parsing module in LLM; illustratively, the chain of thought analysis may include Chain of Thought (COT) analysis of LLM; wherein COT is a process by which LLM performs multi-step logical reasoning on complex problems.

[0214] From the above, it can be seen that the abnormal data processing method provided in the embodiment of the present application, when the action performed in the kth step is associated with text data analysis, can obtain the target text data from the kth step and perform COT analysis on the target text data, thereby improving the analysis accuracy of the target text data.

[0215] Based on the above embodiments, in the abnormal data processing method provided in the embodiment of the present application, the decision logic tree is determined based on the actions respectively performed in the first step to the Kth step, which can be implemented in the following manner:

[0216] If the action performed in step k is associated with abnormal access to the network, the processing decision associated with step k in the decision logic tree is determined as follows: determine and send the query data to the target device, obtain and determine the risk level of abnormal access to the network based on the response data sent by the target device.

[0217] The target device is at least associated with abnormal access within the network.

[0218] Exemplarily, if the action performed in step k is not associated with abnormal access within the network, determining and sending the query data and subsequent operations may not be performed.

[0219] In one implementation, the network internal access anomaly may include an abnormal access operation occurring between devices within the same network.

[0220] In one implementation, the inquiry data may include text data capable of describing at least one of the time when the abnormal access occurs within the network, the duration, and the associated data volume.

[0221] In one implementation, the query data may be determined based on the time when the abnormal access occurs within the network, the duration, the associated data volume, the associated device, and the like.

[0222] In one embodiment, the response data may include data automatically generated by the target device or determined in response to user input; illustratively, the target device or a user of the target device may respond based on at least one question included in the inquiry data, and integrate the response results to obtain and send the response data to the LLM.

[0223] In one implementation, the risk level of abnormal access within the network may indicate whether the abnormal access within the network is an attack behavior, a potential threat behavior, or a safe behavior.

[0224] In one implementation, the LLM or an analysis module in the LLM may perform COT analysis on the inquiry data and the response data to determine the risk level.

[0225] In one implementation, the target device may include a device that triggers abnormal access within the network and / or a device associated with abnormal access within the network; illustratively, the number of devices in the target device may be at least one.

[0226] From the above, it can be seen that the abnormal data processing method provided in the embodiment of the present application, when the action executed in the kth step is associated with abnormal access within the network, can automatically determine and send the inquiry data to the target device, thereby improving the automation level of processing abnormal access within the network; and after obtaining the reply data, by determining the risk level of abnormal access within the network based on the reply data, further confirmation of abnormal access within the network is achieved, thereby being able to improve the accuracy of the above risk level.

[0227] Based on the above embodiment, based on the actions respectively performed in the first step to the Kth step, determining the decision logic tree can be implemented in the following manner:

[0228] If the action performed in step k is associated with the missing target information, the processing decision associated with step k in the decision logic tree is determined as follows: obtaining associated information associated with the action performed in step k, and determining the risk level of the action performed in step k at least based on the associated information.

[0229] The associated information is associated with the target information.

[0230] Exemplarily, if the action performed in step k is not associated with the missing target information, the operation of obtaining the associated information may not be performed.

[0231] In one implementation, the association information may include information whose association degree with the context data of the k-th step execution action is greater than an association threshold.

[0232] In one implementation, the associated information may be obtained from a database.

[0233] In one implementation, the target information may include key information or core information for describing the execution action of the k-th step.

[0234] In one implementation, the association information is associated with the target information, which may include matching the target information with key information or core information used to describe the k-th step execution action.

[0235] In one implementation, the LLM or a parsing module in the LLM may perform COT parsing on the context data and associated information of the action performed at the kth step to determine the risk level of the action performed at the kth step.

[0236] In one implementation, the risk level of the action performed in the kth step may be determined by at least one of an operation object associated with the kth step, an execution frequency of the kth step, and an execution result of the kth step.

[0237] From the above, it can be seen that the abnormal data processing method provided in the embodiment of the present application can obtain the associated information associated with the action performed in step k when the action performed in step k is associated with the missing target information. In this way, the detailed characteristics of the action performed in step k can be comprehensively and accurately reflected through the associated information and the action performed in step k; and by determining the risk level of the action performed in step k at least based on the associated information, the accuracy of the risk level of the action performed in step k can be improved.

[0238] Based on the above embodiment, based on the actions respectively performed in the first step to the Kth step, determining the decision logic tree can be implemented in the following manner:

[0239] If the action performed in the kth step is associated with the port risk, the processing decision associated with the kth step in the decision logic tree is determined to be: calling at least one interface to block the target port.

[0240] Among them, the target port is associated with the port risk.

[0241] Exemplarily, if the action performed in step k is not associated with the port risk, the operation of determining to block the target port may not be performed.

[0242] In one embodiment, the action performed in the kth step is associated with the port risk, and may include that the action performed in the kth step includes transmitting at least one or at least one sensitive data through the target port.

[0243] In one implementation, the port risk may include the data transmission risk faced by the IP port.

[0244] In one embodiment, at least one interface may include an API for performing port blocking.

[0245] In one implementation, the target port may include a port for performing data transmission corresponding to step k; illustratively, the number of ports in the target port may be at least one.

[0246] As can be seen from the above, the abnormal data processing method provided by the embodiment of the present application, when the action executed in the kth step is associated with the port risk, blocks the target port by calling at least one interface, and the target port is associated with the port risk. In this way, not only the targeted blocking control of the port risk is achieved, but also the real-time and accuracy of the above blocking control can be improved.

[0247] Based on the above embodiment, the decision logic tree is determined based on the actions respectively performed in the first step to the Kth step, which can also be implemented in the following manner:

[0248] If the action performed in step k is associated with the attack action, the processing decision associated with step k in the decision logic tree is determined as follows: determining the association relationship between the attack action and the attack operations contained in other abnormal data, and constructing an abnormal association graph based on the association relationship.

[0249] Exemplarily, if the action performed in the kth step is not associated with the attack action, the operation of determining the association relationship may not be performed.

[0250] In one implementation, the Payload in the data packet associated with step k can be interpreted by the basic network security knowledge contained in the LLM or a submodule in the LLM, thereby determining the above attack action. In the field of computer science and telecommunications, Payload is the actual information transmitted in data transmission, which is also usually referred to as actual data or data body.

[0251] In one implementation, the above-mentioned association relationship may be determined based on the degree of matching between the attack action and the attack operations included in other abnormal data; accordingly, the above-mentioned association relationship may include the similarity between the above-mentioned attack action and the attack operations included in other abnormal data, whether they are of the same type, etc.

[0252] In one implementation, the abnormal association diagram may display the association relationship between attack actions or operations included in different abnormal data by connecting legends.

[0253] In one embodiment, LLM or a submodule in LLM can perform semantic recognition on the above-mentioned attack actions and attack operations contained in other abnormal data to identify the association relationship between the attack operations contained in different abnormal data, and construct an abnormal association graph based on the existence and strength of the association relationship.

[0254] From the above, it can be seen that through the above operations, the attack actions or attack operations contained in different abnormal data can be correlated with each other, thereby laying the foundation for the merging and elimination of the same type of attack actions or attack operations contained in different abnormal data; and, by constructing an abnormal correlation diagram, the correlation between the alarm events or security events corresponding to different abnormal data in the device dimension and / or time dimension can be intuitively displayed, thereby providing conditions for comprehensive prevention of attack operations, and can also reduce the probability of underreporting or false reporting of attack actions or attack behaviors contained in security events.

[0255] Figure 3 A schematic diagram of a process for handling abnormal data provided in an embodiment of the present application, such as Figure 3 As shown, the process may include the following steps:

[0256] Step 301: Data packet interpretation.

[0257] Exemplarily, the LLM may be used to interpret the data packets contained in the abnormal data, thereby determining whether the abnormal data contains an attack operation, and further determining whether the attack operation is successful.

[0258] Step 302: Determine whether the attack is successful.

[0259] Exemplarily, if the attack is successful, steps 303 to 308 are executed; if the attack is not successful, steps 309 to 311 are executed.

[0260] Step 303: Obtain asset information.

[0261] Exemplarily, the attack address targeted by the attack operation may be determined, and the target substation targeted by the attack operation may also be determined based on the attack address by means of a database query.

[0262] Step 304: Obtain a blacklist.

[0263] Exemplarily, the blacklist may be obtained by a database query method; wherein the blacklist may include an IP or domain name blacklist.

[0264] Step 305: Determine whether it is a malicious IP.

[0265] Exemplarily, if the attack source address obtained from the data packet is an IP address, it can be determined whether the IP address is a malicious IP according to the blacklist.

[0266] Exemplarily, if it is a malicious IP, execute step 306; if it cannot be determined whether it is a malicious IP, execute step 307.

[0267] Step 306: Check and kill.

[0268] Exemplarily, the killing operation may be performed by a pre-deployed killing tool.

[0269] Step 307: Block the IP.

[0270] Exemplarily, the operation of blocking an IP address may be performed by the method provided in the aforementioned embodiment.

[0271] Step 308: Generate an answer description including the treatment process and treatment results through LLM.

[0272] Exemplarily, the above-mentioned handling process may include the processing strategy in the aforementioned embodiment.

[0273] Exemplarily, the handling result may include the execution result of the processing strategy.

[0274] For example, the solution description may include text data including processing strategies and treatment results.

[0275] Step 309: Obtain the blacklist.

[0276] Step 310: Determine whether it is a malicious IP.

[0277] Exemplarily, if it is impossible to determine whether it is a malicious IP or it is determined not to be a malicious IP, step 308 is executed; if it is determined to be a malicious IP, step 311 is executed.

[0278] Step 311: Block the IP.

[0279] Exemplarily, after step 311 is completed, step 308 may also be executed.

[0280] For example, Figure 3 The various steps shown in may include processing decisions in the decision logic tree in the aforementioned embodiment, and the above processing decisions may correspond one-to-one to the various steps in the abnormal data.

[0281] From the above, it can be seen that the embodiment of the present application realizes the automatic interpretation, analysis and disposal process of data packets in security events through LLM, thereby getting rid of the dependence of security incident processing on security experts in related technologies and greatly improving the processing efficiency of security incidents; and, on the basis of LLM, through interaction with security data management tools such as databases, the accuracy of security incident processing can also be improved.

[0282] Figure 4 A flowchart of the problem logic tree generation and execution provided in the embodiment of the present application is shown in FIG. Figure 4 As shown, the process may include the following steps:

[0283] Step 401: Obtain data corresponding to the security event.

[0284] Exemplarily, the data corresponding to the security event may include at least a portion of the data stream in the log data used to describe the security event.

[0285] Step 402: Detect data corresponding to the security event to obtain abnormal data.

[0286] Exemplarily, abnormal data may be obtained by detecting and screening data corresponding to security events.

[0287] Step 403: Analyze the abnormal data.

[0288] Exemplarily, the abnormal data may be parsed by a disassembly module in the LLM, thereby obtaining a first set including at least one step.

[0289] Step 404: Generate a problem logic tree.

[0290] Exemplarily, the problem logic tree may be the decision logic tree in the aforementioned embodiment.

[0291] Exemplarily, the problem logic tree includes not only the first set, but also processing decisions for handling K steps in the first set.

[0292] For example, the processing decision in the problem logic tree can be as follows Figure 3 shown.

[0293] Step 405: Execute the problem logic tree.

[0294] Exemplarily, the step flow process in the problem logic tree and the processing decisions corresponding to each step can be automatically executed, thereby realizing the analysis of operations corresponding to abnormal data and the determination of risk levels.

[0295] To sum up, the embodiment of the present application uses the LLM CoT function to automatically disassemble the data corresponding to the security incident, and automatically construct and execute the problem logic tree corresponding to the abnormal data, thereby not only improving the automation and intelligence level of normal data processing, but also improving the accuracy and pertinence of abnormal data processing.

[0296] Based on the above embodiments, the present application also provides an abnormal data processing device. Figure 5 A schematic diagram of the structure of an abnormal data processing device provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the device 5 may include:

[0297] The acquisition module 501 is used to acquire abnormal data.

[0298] The determination module 502 is used to analyze and process the abnormal data through LLM to determine a processing strategy.

[0299] The processing module 503 is used to process operations corresponding to abnormal data based on the processing strategy.

[0300] In some embodiments, the large language model includes at least a disassembly module;

[0301] The processing module 503 is used to disassemble the abnormal data through the disassembly module to obtain a first set including at least one disassembled data;

[0302] The determination module 502 is used to analyze and process the disassembled data in the first set to determine the risk status of the abnormal data; and determine a processing strategy based on the risk status.

[0303] In some embodiments, the processing module 503 is used to perform semantic recognition on the abnormal data through the disassembly module to obtain a second set of at least one step included in the operation process represented by the abnormal data; disassemble at least one step in the second set at the granularity of the operation object to obtain a first set; wherein the operation object includes at least the data and / or device object targeted by the operation process.

[0304] In some embodiments, at least one step includes a kth step and a k+1th step; the k+1th step is the next step of the kth step; k is an integer greater than or equal to 1;

[0305] The processing module 503 is used to disassemble the k-th step at the granularity of the operation object through the disassembly module to obtain the disassembly data of the k-th step; wherein the disassembly data of the k-th step includes the problem data at the granularity of the operation object;

[0306] A determination module 502 is used to determine the disassembly data of the k+1th step based on the answer data of the mth question data contained in the disassembly data of the kth step; wherein m is an integer greater than or equal to 1;

[0307] The determination module 502 is further used to determine that the disassembled data of the first step to the disassembled data of the Kth step are the first set; wherein K is the number of steps included in the second set; and K is an integer greater than or equal to 2.

[0308] In some embodiments, the determination module 502 is used to determine target prompt data;

[0309] The processing module 503 is used to control the disassembly module to disassemble the abnormal data based on the target prompt data to obtain a first set.

[0310] In some embodiments, the acquisition module 501 is used to acquire sample prompt data;

[0311] The determination module 502 is used to determine target prompt data from the sample prompt data based on the matching degree between the prompt data in the sample prompt data and the category of the abnormal data.

[0312] In some embodiments, the acquisition module 501 is used to acquire sample prompt data; wherein the sample prompt data includes prompt data corresponding to various types of abnormal events;

[0313] The processing module 503 is used to train the initial disassembly module through sample prompt data to obtain the disassembly module.

[0314] In some embodiments, the first set includes the disassembled data of the first step to the disassembled data of the Kth step; the operation of abnormal data characterization includes the first step to the Kth step; K is an integer greater than or equal to 2; the large language model also includes a classification module;

[0315] A determination module 502, configured to determine the action to be performed at the kth step based on the risk status of the kth step through the classification module; wherein k is an integer greater than or equal to 1 and less than or equal to K;

[0316] The determination module 502 is further used to determine a decision logic tree based on the actions respectively performed in the first step to the Kth step;

[0317] The processing module 503 is used to process the actions respectively performed in the first step to the Kth step based on the processing decisions respectively corresponding to the first step to the Kth step in the decision logic tree.

[0318] In some embodiments, the determination module 502 is used to determine that if the action performed in the kth step is associated with text data analysis, the processing decision associated with the kth step in the decision logic tree is: obtaining the target text data from the kth step and performing a thought chain analysis on the target text data.

[0319] In some embodiments, the determination module 502 is used to determine that if the action performed in the kth step is associated with abnormal access within the network, the processing decision associated with the kth step in the decision logic tree is: determining and sending the query data to the target device, obtaining and determining the risk level of abnormal access within the network based on the reply data sent by the target device; wherein the target device is at least associated with abnormal access within the network.

[0320] In some embodiments, the determination module 502 is used to determine that if the action performed in the kth step is associated with the missing target information, the processing decision associated with the kth step in the decision logic tree is: obtaining the associated information associated with the action performed in the kth step, and determining the risk level of the action performed in the kth step at least based on the associated information; wherein the associated information is associated with the target information.

[0321] In some embodiments, the determination module 502 is used to determine that if the action performed in the kth step is associated with the port risk, the processing decision associated with the kth step is: calling at least one interface to block the target port; wherein the target port is associated with the port risk.

[0322] In some embodiments, the determination module 502 is used to determine the processing decision corresponding to the kth step in the decision logic tree as follows if the action performed in the kth step is associated with an attack action:

[0323] Determine the association relationship between the attack action and the attack operations contained in other abnormal data, and build an abnormal association graph based on the association relationship.

[0324] In some embodiments, the acquisition module 501 is used to acquire classified sample data; wherein the classified sample data includes abnormal data corresponding to security events of multiple abnormal types;

[0325] The processing module 503 is used to train the initial classification module based on the classification sample data and the abnormal type to obtain the classification module.

[0326] Based on the above embodiments, the present application also provides an electronic device, Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 6 As shown, the electronic device 6 may include a processor 601 and a memory 602; wherein the memory 602 stores a computer program, and when the computer program is executed by the processor 601, it can implement the abnormal data processing method provided in any of the previous embodiments.

[0327] Based on the foregoing embodiments, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor of an electronic device, the abnormal data processing method provided in any of the previous embodiments can be implemented.

[0328] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0329] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0330] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0331] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0332] It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM) and other memories; it can also be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0333] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0334] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0335] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0336] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0337] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0338] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0339] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for processing abnormal data, characterized in that: The method comprises: Get exception data; Analyze and process the abnormal data through a large language model to determine a processing strategy; Based on the processing strategy, the operation corresponding to the abnormal data is processed.

2. The method according to claim 1, characterized in that The large language model at least includes a disassembly module; the analyzing and processing the abnormal data by using the large language model to determine the processing strategy includes: Decomposing the abnormal data by the decomposing module to obtain a first set including at least one decomposing data; Analyze and process the disassembled data in the first set to determine the risk status of the abnormal data; Based on the risk status, the treatment strategy is determined.

3. The method according to claim 2, characterized in that The abnormal data is disassembled by the disassembling module to obtain a first set including at least one disassembled data, including: Performing semantic recognition on the abnormal data by the disassembling module to obtain a second set of at least one step included in the operation process represented by the abnormal data; The at least one step in the second set is decomposed into operation object granularity to obtain the first set; wherein the operation object at least includes the data and / or device object targeted by the operation process.

4. The method according to claim 3, characterized in that The at least one step includes a kth step and a k+1th step; the k+1th step is the next step of the kth step; k is an integer greater than or equal to 1; the at least one step in the second set is decomposed into operation object granularity to obtain the first set, including: The k-th step is disassembled at the granularity of the operation object by the disassembly module to obtain disassembly data of the k-th step; wherein the disassembly data of the k-th step includes problem data at the granularity of the operation object; Determine the disassembly data of the k+1th step based on the answer data of the mth question data contained in the disassembly data of the kth step; wherein m is an integer greater than or equal to 1; Determine that the disassembly data of the first step to the disassembly data of the Kth step are the first set; wherein K is the number of steps included in the second set; and K is an integer greater than or equal to 2.

5. The method according to claim 2, characterized in that: The abnormal data is disassembled by the disassembling module to obtain a first set including at least one disassembled data, including: Determine target prompt data; Based on the target prompt data, the disassembly module is controlled to disassemble the abnormal data to obtain the first set.

6. The method according to claim 5, characterized in that The target prompt data is determined, including: Get sample prompt data; The target prompt data is determined from the sample prompt data based on a degree of matching between the prompt data in the sample prompt data and the category of the abnormal data.

7. The method according to claim 2, characterized in that The method further comprises: Acquire sample prompt data; wherein the sample prompt data includes prompt data corresponding to various types of abnormal events; The initial disassembly module is trained using the sample prompt data to obtain the disassembly module.

8. The method according to claim 2, characterized in that: The first set includes the disassembled data of the first step to the disassembled data of the Kth step; the operation of the abnormal data representation includes the first step to the Kth step; K is an integer greater than or equal to 2; the large language model also includes a classification module; the processing strategy includes a decision logic tree; the determining the processing strategy based on the risk state includes: Determining, by the classification module, an action to be performed at the k-th step based on the risk status of the k-th step; wherein k is an integer greater than or equal to 1 and less than or equal to K; Determine a decision logic tree based on the actions respectively performed in the first step to the Kth step; The operation corresponding to processing the abnormal data based on the processing strategy includes: Based on the processing decisions respectively corresponding to the first step to the K-th step in the decision logic tree, the actions respectively executed in the first step to the K-th step are processed accordingly.

9. The method according to claim 8, characterized in that The determining of a decision logic tree based on the actions respectively performed in the first step to the Kth step includes: If the action performed in the k-th step is associated with text data analysis, the processing decision associated with the k-th step in the decision logic tree is determined to be: obtaining target text data from the k-th step and performing a thought chain analysis on the target text data.

10. The method according to claim 8, characterized in that The determining of a decision logic tree based on the actions respectively performed in the first step to the Kth step includes: If the action performed in the kth step is associated with abnormal access within the network, the processing decision associated with the kth step in the decision logic tree is determined as: determining and sending inquiry data to the target device, obtaining and determining the risk level of the abnormal access within the network based on the reply data sent by the target device; wherein the target device is at least associated with the abnormal access within the network.

11. The method according to claim 8, characterized in that The determining of a decision logic tree based on the actions respectively performed in the first step to the Kth step includes: If the action performed in the kth step is associated with the missing target information, the processing decision associated with the kth step in the decision logic tree is determined as follows: obtaining associated information associated with the action performed in the kth step, and determining the risk level of the action performed in the kth step at least based on the associated information; wherein the associated information is associated with the target information.

12. The method according to claim 8, characterized in that The determining of a decision logic tree based on the actions respectively performed in the first step to the Kth step includes: If the action performed in the k-th step is associated with a port risk, the processing decision associated with the k-th step is determined to be: calling at least one interface to block a target port; wherein the target port is associated with the port risk.

13. The method according to any one of claims 9 to 11, characterized in that: The determining of a decision logic tree based on the actions respectively performed in the first step to the Kth step further includes: If the action performed in the k-th step is associated with an attack action, the processing decision corresponding to the k-th step in the decision logic tree is determined to be: Determine the association relationship between the attack action and the attack operations included in other abnormal data, and construct an abnormal association graph based on the association relationship.

14. The method according to claim 8, characterized in that The method further comprises: Acquire classified sample data; wherein the classified sample data includes abnormal data corresponding to security events of multiple abnormal types; Based on the classification sample data and the abnormal type, an initial classification module is trained to obtain the classification module.

15. An abnormal data processing device, characterized in that: The device comprises: Acquisition module, used to obtain abnormal data; A determination module, used to analyze and process the abnormal data through a large language model to determine a processing strategy; A processing module is used to process the operation corresponding to the abnormal data based on the processing strategy.

16. An electronic device, characterized in that: The electronic device comprises a processor and a memory; wherein: a computer program is stored in the memory; when the computer program is executed by the processor, the abnormal data processing method as claimed in any one of claims 1 to 14 can be implemented.

17. A computer-readable storage medium, characterized in that: The storage medium stores a computer program; when the computer program is executed by a processor of an electronic device, the abnormal data processing method as described in any one of claims 1 to 14 can be implemented.

Images