Method and system for carrying out operation disposal on security event through large model
By collecting and storing security event handling records, generating observable objects and using large models to analyze and judge security events, the defects of relying on manual experience in the existing technology are solved, and the effects of automated analysis and continuous learning are achieved.
Patent Information
- Application Number
- CN202411861523.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-17
- Publication Date
- 2025-03-25
AI Technical Summary
In the prior art, the analysis and judgment of security events relies on the experience of security engineers and cannot achieve automation. In addition, large language models lack domain-specific experience in security alarm analysis and cannot be continuously learned and optimized.
By collecting security event handling records, observable objects are generated and stored in the database. After receiving the alarm information, the big model extracts feature information, finds the database and injects it into the Q&A context, and combines historical experience to conduct security alarm analysis.
It has realized the automated analysis and analysis of security incidents, accumulated experience in security operations, improved security operation and maintenance capabilities, and was able to continuously learn and optimize, and adapt to the ever-changing security threat environment.
Smart Images
Figure CN119691756A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of security operation and maintenance, and specifically to a method and system for operational handling of security incidents through a large model. Background Art
[0002] In the field of security incident management, the analysis and judgment of security alerts are of great significance for quickly responding to security incidents and improving the level of enterprise security operations. Traditional security alert judgment mainly relies on the personal experience accumulation of security engineers, which is often transmitted through communication between people and lacks systematic precipitation and knowledge sharing. Therefore, when the security operation personnel change, it is easy to affect the stability and sustainability of the security operation system, and even the accuracy of judgment will decrease.
[0003] In recent years, the rapid development of Large Language Model (LLM) technology has introduced new tools into the security field. It has strong general knowledge and natural language processing capabilities, which can help security personnel to conduct preliminary analysis and identification of security alerts to a certain extent. However, the current large language model's analysis of security alerts is mainly based on the general knowledge acquired during its training, and lacks the domain-specific experience accumulated during the security operation process. Therefore, it is difficult to achieve the ability to gradually optimize and refine the alarm information in the long-term operation like security engineers. At the same time, the large language model cannot iterate its own judgment ability through feedback in actual applications, lacks a mechanism to achieve experience accumulation and continuous improvement, and cannot adapt to the ever-changing security threat environment.
[0004] Therefore, how to combine the general knowledge of the large language model and, on this basis, build an automated security incident analysis and assessment method that can accumulate security operation experience and have continuous learning and optimization capabilities is the core issue that this patent needs to solve. Summary of the invention
[0005] The present application provides a method and system for operational handling of security incidents through a large model, which can solve the technical problem in the prior art that the operational handling of security incidents relies on the experience of technical personnel and is difficult to automate.
[0006] In a first aspect, an embodiment of the present application provides a method for operationally handling security incidents through a large model, the method comprising:
[0007] Collect security incident handling records, which include tasks, task logs, and event summaries generated during the operational handling of alarm information;
[0008] Generate observable objects based on security incident handling records and store them in a database. The observable objects include object type, object value, object label, and object description. The object description contains analysis and processing logic for alarm information and operational handling implications.
[0009] After receiving the alarm information, the big model extracts feature information based on the alarm information, and the feature information includes object type and object value; the big model searches the database based on the feature information to obtain observable objects, and injects the observable objects into the big model question and answer context. The big model combines the context to obtain the security alarm analysis result.
[0010] In conjunction with the first aspect, in one implementation, the tasks include analysis, response, source tracing, review, and optimization of the alarm information;
[0011] Analysis work includes security device log analysis, IP or domain name intelligence analysis, and sample analysis;
[0012] Response efforts include network isolation, process shutdown, and file deletion;
[0013] The traceability work includes attacker information analysis and vulnerability entry analysis;
[0014] The review work includes whether the alarms of each security device are complete, whether the logs of each stage are complete, whether the timeliness of the emergency handling process meets expectations, and whether the vulnerabilities are repaired in time;
[0015] Optimization work includes adding a whitelist of false positives.
[0016] In combination with the first aspect, in one implementation, the event summary includes alarm information, analysis results for the alarm information, a processing procedure for the alarm information, and operational handling implications for the alarm information.
[0017] In conjunction with the first aspect, in one implementation, the observable object includes valid information in security incident handling;
[0018] The object types include domain, process name, file name, hash, IP and / or port; each object type has at least one object value.
[0019] In combination with the first aspect, in one implementation, the object tag includes a specific summary based on the object type and the object value.
[0020] In combination with the first aspect, in one implementation, the observable object is stored in a database in the form of structured fields.
[0021] In combination with the first aspect, in one implementation, the method further includes:
[0022] When the big model performs operational processing on the alarm information, if new features are collected, the new features are added to the observable object to update the observable object.
[0023] In a second aspect, an embodiment of the present application provides a system for operating and handling security incidents through a large model, the system comprising:
[0024] A data collection module, which is used to collect security incident handling records, including tasks, task logs, and event summaries generated during the operation and handling of alarm information;
[0025] A data processing module, which is used to generate observable objects according to security incident handling records and store them in a database. The observable objects include object type, object value, object label, and object description. The object description contains analysis and processing logic for alarm information and operational handling enlightenment;
[0026] The big model is used to extract feature information based on the alarm information after receiving the alarm information, and the feature information includes object type and object value; it is also used to search the database based on the feature information to obtain observable objects, and inject the observable objects into the big model question and answer context. The big model combines the context to obtain the security alarm analysis result.
[0027] In conjunction with the second aspect, in one implementation, the observable object includes valid information in security incident handling;
[0028] The object types include domain, process name, file name, hash, IP and / or port; each object type has at least one object value;
[0029] The object label includes a specific summary based on the object type and the object value.
[0030] In combination with the second aspect, in one implementation, the big model is also used to add new features to the observable object to update the observable object when the big model performs operational processing on the alarm information.
[0031] The beneficial effects brought by the technical solution provided in the embodiments of the present application include:
[0032] By storing security incident handling experience in the form of observable objects in the database, it is convenient for large models to improve security operation and maintenance capabilities based on the database. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] Figure 1 This is a flow chart of an embodiment of a method for operating and handling security incidents through a large model in this application;
[0034] Figure 2 This is a flow chart of an embodiment of a method for operating and handling security incidents through a large model in this application;
[0035] Figure 3 A schematic diagram of the functional modules of an embodiment of a system for operationally handling security incidents through a large model. DETAILED DESCRIPTION
[0036] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0037] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.
[0038] In a first aspect, an embodiment of the present application provides a method for operationally handling security incidents through a large model.
[0039] In one embodiment, referring to Figure 1 and Figure 2 , Figure 1 This is a flow chart of an embodiment of a method for operating and handling security incidents through a large model in this application. Figure 2 This is a flow chart of an embodiment of the method for operating and handling security incidents through a large model in this application. Figure 1 and Figure 2 As shown in the figure, the methods for operational handling of security incidents through big models include:
[0040] Step S1: Collect security incident handling records, which include tasks, task logs, and event summaries generated during the operation and handling of alarm information.
[0041] Step S2: Generate observable objects based on security incident handling records and store them in the database. The observable objects include object type, object value, object label, and object description. The object description contains analysis and processing logic for the alarm information and operational handling implications.
[0042] Step S3: After receiving the alarm information, the big model extracts feature information according to the alarm information, and the feature information includes object type and object value. The big model searches the database according to the feature information to obtain observable objects, and injects the observable objects into the big model question and answer context. The big model combines the context to obtain the security alarm analysis result.
[0043] The present invention mainly solves the problem that the analysis and judgment of security incidents rely on the experience of security engineers and cannot be accumulated on the security operation platform, forming an automated security operation analysis capability that can be continuously improved with the operational handling experience of security incidents. Specifically, after the operational analysis and handling of security incidents are completed, the present invention uses a large model to extract valuable observable objects, and accumulates the experience of various security incidents in historical operations through the observable object library. After a related security incident occurs in the future, the large model is used to extract features from new security incidents to query the observable object library to obtain historical experience, so as to help the model judge new security incidents based on historical judgment experience.
[0044] Furthermore, in one embodiment, the above tasks include analysis, response, tracing, review, and optimization of alarm information.
[0045] Analysis work includes security device log analysis, IP or domain name intelligence analysis, and sample analysis.
[0046] Response efforts include network isolation, process termination, and file deletion.
[0047] The tracing work includes attacker information analysis and vulnerability entry analysis.
[0048] The review work includes whether the alarms of various security devices are complete, whether the logs of each stage are complete, whether the timeliness of the emergency handling process meets expectations, and whether the vulnerabilities are repaired in a timely manner.
[0049] Optimization work includes adding a whitelist of false positives.
[0050] In this embodiment, the handling of security alarms must first be standardized. When security alarms are handled by security engineers for security operations, corresponding tasks, task logs, event summaries, etc. need to be recorded.
[0051] The task refers to a series of specific tasks after receiving the security alert, including analysis of the security alert (such as security device log analysis, IP or domain name intelligence analysis, sample analysis, etc.), response (such as network isolation, process stop, file deletion, etc.), tracing (such as attacker information analysis, vulnerability entry analysis, etc.), review (such as whether the alarms of each security device are complete, whether the logs of each stage are complete, whether the timeliness of the emergency handling process meets expectations, whether the vulnerabilities are repaired in time, etc.), optimization (such as adding false alarms to the whitelist, etc.), etc.
[0052] Task log refers to the detailed log of the task processing process.
[0053] The incident summary refers to the summary and distillation of the alarm information and all tasks after the entire security incident is handled (for example, all completeable tasks are completed, except for shelved tasks) (for example, the characterization of a security incident corresponding to the alarm information, the extraction of event features of the security incident, the event analysis and processing logic of the security incident, and the exploration of the implications of the security incident for subsequent security incident operational processing, etc.).
[0054] Furthermore, in one embodiment, the above-mentioned observable object includes valid information in the handling of security incidents.
[0055] The object types include domain, process name, file name, hash, IP and / or port. Each object type has at least one object value.
[0056] The object labels described above include specific summaries based on object type and object value.
[0057] The above observable objects are stored in the database in the form of structured fields.
[0058] In this embodiment, for the sake of convenience of explanation, an office software application such as "WPXX" is used as an example, in which a malicious IP marked by intelligence is connected and a security alarm is triggered. After in-depth analysis by security engineers, it is found that the incident is caused by the WPXX program, which has the characteristics of P2P update to accelerate the update of its distribution version. This characteristic causes the process to generate a scanning-like behavior, connect to a large number of Internet IPs through a specific port, and try to download updates through p2p nodes. In this process, the access touches the address marked as a malicious IP by intelligence, resulting in an alarm. The actual analysis conclusion is that it is a false alarm.
[0059] In the above case, the software process (referring to the above WPXX) and the specific source port have a very high reference value for similar events in the future. This is what we often call the event operation experience of security engineers, which is crucial for subsequent disposal and judgment. This patented solution automatically reads complete tasks, task processing logs, event summaries and other data for completed events, and automatically generates observable object data.
[0060] Observable object data format is as follows:
[0061] Object type: proc_name (the object type can be domain, proc_name, filename, hash, IP, and Port, etc. Users can customize and add object types).
[0062] Object value: wpxxcloudsvr.exe.
[0063] Object tags: office software, p2p, port 6881, scanning behavior, whitelist.
[0064] Object description: This software process provides external P2P connection related functions from port 6881, and a detailed summary of the security alerts that may be triggered and the reasons for each.
[0065] In the large model prompt word template generated based on observable objects, detailed format requirements for object descriptions are predefined to standardize content output.
[0066] After completing the above processing, the experience of artificial event operation is converted by the big model into the observable object database and stored in the form of structured fields, completing the experience accumulation process.
[0067] For newly generated security alerts, such as a new malicious IP address access event generated by a terminal security, or an alarm generated by a host external port scan generated by a network security, etc. Newly added security alerts will be submitted to the big model for observable object feature extraction. The prompt words indicate that we have an observable object database (the prompt words include the data structure and examples of the library), and that the data in it are summaries of security event operation experience. The big model is required to analyze whether there are key observable object features, i.e. object types and object values, in the alert information. If there are, the features in the event can be extracted to query the observable object database.
[0068] For the two alarms in the above example, the big model will analyze the process name (proc_name) of the connected malicious IP in the output terminal alarm. The big model analysis finds that the scan is fixed from a source IP and source port to the outside, and the source IP and source port will be extracted as features (IP, Port).
[0069] After the relevant features are extracted, the observable object database will be automatically queried based on the type and value of the features, and the observable object related data after the query will continue to be returned and injected into the large model question and answer context. For example, in the above example, the query results of the observable object database for the two alarms are both that the process wpxx will use the port 6881 to try p2p connections to a large number of Internet IPs for product update operations experience.
[0070] After obtaining this information, the big model analyzes and judges the alarm in combination with the context, and then has the operational experience of security incidents. It can accurately judge that this incident is a false alarm, not a real attack incident, and it is a false alarm triggered by the installation of the wpxx software and the p2p business behavior of this software.
[0071] Note that there is also a semantic similarity retrieval method related to the vector database in the association analysis, but this method is not suitable for very precise retrieval in scenarios such as observable objects. For example, port 6881 and port 6882 are very similar, but the difference in port number has a completely different security meaning. Therefore, after the patent solution is fully verified, the large model is used to extract the precise original features in the alarm, and then the observable object library is obtained by calling the API to ensure the accuracy of the data.
[0072] Furthermore, in one embodiment, the above method further includes:
[0073] When the big model performs operational processing on the alarm information, if new features are collected, the new features are added to the observable object to update the observable object.
[0074] In this embodiment, the results of the large model combined with the observable object database will be handled by the security engineer. During the process, relevant content may be improved or other clues discovered by manual mining may be added. The large model will be iterated again to extract relevant content to improve the original observable object database. It should be noted that humans can also directly participate in the maintenance of the observable object database, supplement important objects observed by humans, or update the core content of objects.
[0075] In summary, the present invention uses a big model to extract and establish an observable object library after standardizing the security operation and disposal process, and extracts features of subsequent new security incidents through the big model to dynamically search the observable object library to obtain operational experience data, thereby effectively improving the accuracy of security alarm analysis and judgment, and at the same time accumulating human operational experience, solving the problems that traditional security operation experience cannot be effectively accumulated and human experience cannot be continuously and unconsciously empowered in automated analysis.
[0076] On the second aspect, the embodiments of the present application also provide a system for operationally handling security incidents through a large model.
[0077] In one embodiment, referring to Figure 3 , Figure 3 This is a functional module diagram of an embodiment of a system for operating and handling security incidents through a large model in this application. Figure 3 As shown in the figure, the system for operational handling of security incidents through the big model includes:
[0078] The data collection module 1 is used to collect security incident handling records, which include tasks, task logs, and event summaries generated during the operation and handling of alarm information.
[0079] Data processing module 2 is used to generate observable objects based on security incident handling records and store them in a database. The observable objects include object type, object value, object label, and object description. The object description contains analysis and processing logic for alarm information and operational handling insights.
[0080] The large model 3 is used to extract feature information according to the alarm information after receiving the alarm information, and the feature information includes object type and object value. It is also used to search the database according to the feature information to obtain observable objects, inject the observable objects into the large model question and answer context, and the large model combines the context to obtain the security alarm analysis result.
[0081] The present invention mainly solves the problem that the analysis and judgment of security incidents rely on the experience of security engineers and cannot be accumulated on the security operation platform, forming an automated security operation analysis capability that can be continuously improved with the operational handling experience of security incidents. Specifically, after the operational analysis and handling of security incidents are completed, the present invention uses a large model to extract valuable observable objects, and accumulates the experience of various security incidents in historical operations through the observable object library. After a related security incident occurs in the future, the large model is used to extract features from new security incidents to query the observable object library to obtain historical experience, so as to help the model judge new security incidents based on historical judgment experience.
[0082] Furthermore, in one embodiment, the above tasks include analysis, response, tracing, review, and optimization of alarm information.
[0083] Analysis work includes security device log analysis, IP or domain name intelligence analysis, and sample analysis.
[0084] Response efforts include network isolation, process termination, and file deletion.
[0085] The tracing work includes attacker information analysis and vulnerability entry analysis.
[0086] The review work includes whether the alarms of various security devices are complete, whether the logs of each stage are complete, whether the timeliness of the emergency handling process meets expectations, and whether the vulnerabilities are repaired in a timely manner.
[0087] Optimization work includes adding a whitelist of false positives.
[0088] In this embodiment, the handling of security alarms must first be standardized. When security alarms are handled by security engineers for security operations, corresponding tasks, task logs, event summaries, etc. need to be recorded.
[0089] The task refers to a series of specific tasks after receiving the security alert, including analysis of the security alert (such as security device log analysis, IP or domain name intelligence analysis, sample analysis, etc.), response (such as network isolation, process stop, file deletion, etc.), tracing (such as attacker information analysis, vulnerability entry analysis, etc.), review (such as whether the alarms of each security device are complete, whether the logs of each stage are complete, whether the timeliness of the emergency handling process meets expectations, whether the vulnerabilities are repaired in time, etc.), optimization (such as adding false alarms to the whitelist, etc.), etc.
[0090] Task log refers to the detailed log of the task processing process.
[0091] The incident summary refers to the summary and distillation of the alarm information and all tasks after the entire security incident is handled (for example, all completeable tasks are completed, except for shelved tasks) (for example, the characterization of a security incident corresponding to the alarm information, the extraction of event features of the security incident, the event analysis and processing logic of the security incident, and the exploration of the implications of the security incident for subsequent security incident operational processing, etc.).
[0092] Furthermore, in one embodiment, the above-mentioned observable object includes valid information in the handling of security incidents.
[0093] The object types include domain, process name, file name, hash, IP and / or port. Each object type has at least one object value.
[0094] The object labels described above include specific summaries based on object type and object value.
[0095] The above observable objects are stored in the database in the form of structured fields.
[0096] In this embodiment, for the sake of convenience of explanation, an office software application such as "WPXX" is used as an example, in which a malicious IP marked by intelligence is connected and a security alarm is triggered. After in-depth analysis by security engineers, it is found that the incident is caused by the WPXX program, which has the characteristics of P2P update to accelerate the update of its distribution version. This characteristic causes the process to generate a scanning-like behavior, connect to a large number of Internet IPs through a specific port, and try to download updates through p2p nodes. In this process, the access touches the address marked as a malicious IP by intelligence, resulting in an alarm. The actual analysis conclusion is that it is a false alarm.
[0097] In the above case, the software process (referring to the above WPXX) and the specific source port have a very high reference value for similar events in the future. This is what we often call the event operation experience of security engineers, which is crucial for subsequent disposal and judgment. This patented solution automatically reads complete tasks, task processing logs, event summaries and other data for completed events, and automatically generates observable object data.
[0098] Observable object data format is as follows:
[0099] Object type: proc_name (the object type can be domain, proc_name, filename, hash, IP, and Port, etc. Users can customize and add object types).
[0100] Object value: wpxxcloudsvr.exe.
[0101] Object tags: office software, p2p, port 6881, scanning behavior, whitelist.
[0102] Object description: This software process provides external P2P connection related functions from port 6881, and a detailed summary of the security alerts that may be triggered and the reasons for each.
[0103] In the large model prompt word template generated based on observable objects, detailed format requirements for object descriptions are predefined to standardize content output.
[0104] After completing the above processing, the experience of artificial event operation is converted by the big model into the observable object database and stored in the form of structured fields, completing the experience accumulation process.
[0105] For newly generated security alerts, such as a new malicious IP address access event generated by a terminal security, or an alarm generated by a host external port scan generated by a network security, etc. Newly added security alerts will be submitted to the big model for observable object feature extraction. The prompt words indicate that we have an observable object database (the prompt words include the data structure and examples of the library), and that the data in it are summaries of security event operation experience. The big model is required to analyze whether there are key observable object features, i.e. object types and object values, in the alert information. If there are, the features in the event can be extracted to query the observable object database.
[0106] For the two alarms in the above example, the big model will analyze the process name (proc_name) of the connected malicious IP in the output terminal alarm. The big model analysis finds that the scan is fixed from a source IP and source port to the outside, and the source IP and source port will be extracted as features (IP, Port).
[0107] After the relevant features are extracted, the observable object database will be automatically queried based on the type and value of the features, and the observable object related data after the query will continue to be returned and injected into the large model question and answer context. For example, in the above example, the query results of the observable object database for the two alarms are both that the process wpxx will use the port 6881 to try p2p connections to a large number of Internet IPs for product update operations experience.
[0108] After obtaining this information, the big model analyzes and judges the alarm in combination with the context, and then has the operational experience of security incidents. It can accurately judge that this incident is a false alarm, not a real attack incident, and it is a false alarm triggered by the installation of the wpxx software and the p2p business behavior of this software.
[0109] Note that there is also a semantic similarity retrieval method related to the vector database in the association analysis, but this method is not suitable for very precise retrieval in scenarios such as observable objects. For example, port 6881 and port 6882 are very similar, but the difference in port number has a completely different security meaning. Therefore, after the patent solution is fully verified, the large model is used to extract the precise original features in the alarm, and then the observable object library is obtained by calling the API to ensure the accuracy of the data.
[0110] Furthermore, in one embodiment, the above method further includes:
[0111] When the big model performs operational processing on the alarm information, if new features are collected, the new features are added to the observable object to update the observable object.
[0112] In this embodiment, the results of the large model combined with the observable object database will be handled by the security engineer. During the process, relevant content may be improved or other clues discovered by manual mining may be added. The large model will be iterated again to extract relevant content to improve the original observable object database. It should be noted that humans can also directly participate in the maintenance of the observable object database, supplement important objects observed by humans, or update the core content of objects.
[0113] In summary, the present invention uses a big model to extract and establish an observable object library after standardizing the security operation and disposal process, and extracts features of subsequent new security incidents through the big model to dynamically search the observable object library to obtain operational experience data, thereby effectively improving the accuracy of security alarm analysis and judgment, and at the same time accumulating human operational experience, solving the problems that traditional security operation experience cannot be effectively accumulated and human experience cannot be continuously and unconsciously empowered in automated analysis.
[0114] Among them, the functional implementation of each module in the above-mentioned system for operationally handling security incidents through a big model corresponds to the steps in the above-mentioned method embodiment for operationally handling security incidents through a big model, and its functions and implementation process will not be repeated here one by one.
[0115] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.
[0116] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.
[0117] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.
[0118] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B. "And / or" in the text is only a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.
[0119] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.
[0120] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as mentioned above, and includes a number of instructions for a terminal device to execute the above-mentioned methods of each embodiment of the present application.
[0121] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.
Claims
1. A method for operational handling of security incidents through a large model, characterized in that: The method comprises: Collect security incident handling records, which include tasks, task logs, and event summaries generated during the operational handling of alarm information; Generate observable objects based on security incident handling records and store them in a database. The observable objects include object type, object value, object label, and object description. The object description contains analysis and processing logic for alarm information and operational handling implications. After receiving the alarm information, the big model extracts feature information based on the alarm information, and the feature information includes object type and object value; the big model searches the database based on the feature information to obtain observable objects, and injects the observable objects into the big model question and answer context. The big model combines the context to obtain the security alarm analysis result.
2. The method for operational handling of security incidents through a large model as claimed in claim 1, characterized in that: The tasks include analysis, response, tracing, review, and optimization of alarm information; Analysis work includes security device log analysis, IP or domain name intelligence analysis, and sample analysis; Response efforts include network isolation, process shutdown, and file deletion; The traceability work includes attacker information analysis and vulnerability entry analysis; The review work includes whether the alarms of various security devices are complete, whether the logs of each stage are complete, whether the timeliness of the emergency handling process meets expectations, and whether the vulnerabilities are repaired in time; Optimization work includes adding a whitelist of false positives.
3. The method for operational handling of security incidents through a large model as claimed in claim 1, characterized in that: The event summary includes alarm information, analysis results for the alarm information, processing procedures for the alarm information, and operational handling implications for the alarm information.
4. The method for operational handling of security incidents through a large model as claimed in claim 1, characterized in that: The observable object contains valid information in the handling of security incidents; The object types include domain, process name, file name, hash, IP and / or port; each object type has at least one object value.
5. The method for operational handling of security incidents through a large model as claimed in claim 1, characterized in that: The object label includes a specific summary based on the object type and the object value.
6. The method for operational handling of security incidents through a large model as claimed in claim 1, characterized in that: The observable objects are stored in the database in the form of structured fields.
7. The method for operational handling of security incidents through a large model as claimed in claim 1, characterized in that: The method further comprises: When the big model performs operational processing on the alarm information, if new features are collected, the new features are added to the observable object to update the observable object.
8. A system for operational handling of security incidents through a large model, characterized in that: The system comprises: A data collection module, which is used to collect security incident handling records, including tasks, task logs, and event summaries generated during the operation and handling of alarm information; A data processing module, which is used to generate observable objects according to security incident handling records and store them in a database. The observable objects include object type, object value, object label, and object description. The object description contains analysis and processing logic for alarm information and operational handling enlightenment; The big model is used to extract feature information based on the alarm information after receiving the alarm information, and the feature information includes object type and object value; it is also used to search the database based on the feature information to obtain observable objects, and inject the observable objects into the big model question and answer context. The big model combines the context to obtain the security alarm analysis result.
9. The system for operating and handling security incidents through a large model as claimed in claim 8, characterized in that: The observable object contains valid information in the handling of security incidents; The object types include domain, process name, file name, hash, IP and / or port; each object type has at least one object value; The object label includes a specific summary based on the object type and the object value.
10. The system for operating and handling security incidents through a large model as claimed in claim 8, characterized in that: The large model is also used to add new features to the observable object to update the observable object when the large model performs operational processing on the alarm information.