Network threat evidence obtaining method, program product, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a network threat evidence obtaining method, a program product, electronic equipment and a storage medium, and relates to the technical field of artificial intelligence. The method comprises the steps of obtaining original data; preprocessing the original data to obtain an initial digital forensics report; performing abnormal event detection on the initial digital forensics report, and generating a text forensics file based on an abnormal event; performing event blocking and vector embedding on the text evidence obtaining file to obtain a vector file; and receiving query information input by the user, and generating an evidence obtaining report based on the query information and the vector file. According to the method, abnormal events can be automatically detected, event blocking and vector embedding can be carried out, key information of the events can be extracted, the threat evidence obtaining efficiency and accuracy are improved, and the problem that an existing method is low in threat evidence obtaining efficiency is solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and more specifically, to a network threat evidence collection method, program product, electronic device, and storage medium. Background Art

[0002] With the rapid development of information technology, digital devices are widely used in people's lives and work. Network security issues are becoming increasingly prominent, and network attack methods are constantly being updated. For example, malware, phishing, DDoS attacks, etc. occur frequently. These attacks not only pose a serious threat to personal privacy and corporate data security, but may also cause significant economic losses. In this context, the importance of threat forensics and incident response in maintaining digital security has become increasingly significant. They are committed to discovering evidence and reconstructing event sequences to effectively respond to network threats. However, the threat forensics and incident response process faces many challenges. For example, in network incidents, the amount of data is exploding, and the data types are complex and diverse, which brings great difficulties to data management and processing, and also makes threat forensics and incident response resources seriously consumed, time-consuming and labor-intensive, and requires extremely high professional knowledge. Existing tools can usually only analyze artifacts one by one, and cannot consider all relevant data at the same time. It is difficult to achieve automated analysis, which seriously affects the efficiency and accuracy of threat forensics. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a network threat forensics method, program product, electronic device and storage medium, which can automatically detect abnormal events and perform event segmentation and vector embedding, can extract key information of the events, improve the efficiency and accuracy of threat forensics, and solve the problem of low efficiency of threat forensics in existing methods.

[0004] The present invention provides a network threat evidence collection method, which includes:

[0005] Get the original data;

[0006] Preprocessing the raw data to obtain an initial digital forensics report;

[0007] Performing abnormal event detection on the initial digital forensic report and generating a text forensic file based on the abnormal event;

[0008] Performing event segmentation and vector embedding on the text forensics file to obtain a vector file;

[0009] Receive query information input by a user, and generate a forensic report based on the query information and the vector file.

[0010] In the above implementation process, more critical event information is extracted through abnormal event detection and event embedding, avoiding information loss or incomplete processing, improving the efficiency and accuracy of threat forensics, and solving the problem of low efficiency of threat forensics in existing methods.

[0011] Furthermore, the original data includes text data and non-text data, and the preprocessing of the original data to obtain an initial digital forensics report includes:

[0012] Converting the non-text data into a form of text plus image metadata;

[0013] Generate text files with text class data and event attributes;

[0014] The processed raw data is modally fused to obtain the initial digital forensics report.

[0015] In the above implementation process, non-text data is converted into text output, which can obtain event information more comprehensively, achieve the purpose of efficiently integrating multimodal data, and improve data processing efficiency and the accuracy of output results.

[0016] Further, the detecting of abnormal events on the initial digital forensic report and generating a text forensic file based on the abnormal events includes:

[0017] comparing each event in the initial digital forensic report to predefined rules;

[0018] If any event meets the predefined rules, the event is an abnormal event.

[0019] In the above implementation process, predefined rules can be used to filter out abnormal events from the initial digital forensics report, avoiding unnecessary processing of a large number of normal events and improving analysis efficiency.

[0020] Furthermore, the text forensics file is segmented into events and vector embedded to obtain a vector file, including:

[0021] The abnormal events in the text forensics file are divided into blocks to generate event blocks, wherein the event blocks include all attributes of the events.

[0022] In the above implementation process, the integrity and independence of each event are retained through event segmentation, which is convenient for subsequent processing and analysis.

[0023] Furthermore, the text forensics file is segmented into events and vector embedded to obtain a vector file, including:

[0024] Performing a vector embedding operation on the event block to obtain an event vector;

[0025] Generate a vector file using the event vector.

[0026] In the above implementation process, the semantic information in the time block can be converted into a vector through the vector embedding operation, and each vector will serve as a mathematical representation of each event for easy processing and analysis.

[0027] Further, the receiving query information input by the user and generating a forensic report based on the query information and the vector file includes:

[0028] Generate a query RI based on the query information;

[0029] Encode and embed the query RI to obtain a query vector VRI;

[0030] Obtaining the most relevant event based on the correlation between the query vector VRI and the event vector in the vector file;

[0031] A forensic report is generated based on the most relevant events and the corresponding raw text data.

[0032] In the above implementation process, the most relevant events most relevant to the query information input by the user are obtained, so as to provide the user with comprehensive and accurate threat information.

[0033] Further, obtaining the most relevant event based on the correlation between the query vector VRI and the event vector in the vector file includes:

[0034] Calculate the cosine similarity between the query vector VRI and all event vectors;

[0035] The first K events with the highest cosine similarity scores are obtained as the most relevant events, where K is an adjustable value.

[0036] In the above implementation process, the most relevant events can be obtained by calculating the cosine similarity.

[0037] The present application also provides a network threat evidence collection device, which includes:

[0038] A data acquisition module, used to acquire original data;

[0039] A preprocessing module, used for preprocessing the raw data to obtain an initial digital forensics report;

[0040] An anomaly detection module, used to detect abnormal events on the initial digital forensic report and generate a text forensic file based on the abnormal events;

[0041] A block segmentation and embedding module, used for performing event segmentation and vector embedding on the text forensics file to obtain a vector file;

[0042] The report generation module is used to receive query information input by a user and generate a forensic report based on the query information and the vector file.

[0043] In the above implementation process, more critical event information is extracted through abnormal event detection and event embedding, avoiding information loss or incomplete processing, improving the efficiency and accuracy of threat forensics, and solving the problem of low efficiency of threat forensics in existing methods.

[0044] An embodiment of the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, a network threat forensics method is implemented.

[0045] An embodiment of the present application further provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above-mentioned network threat evidence collection method.

[0046] The embodiment of the present application further provides a readable storage medium, wherein the readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the above-mentioned network threat evidence collection method is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A flowchart of a network threat evidence collection method provided in an embodiment of the present application;

[0049] Figure 2 A flowchart of preprocessing raw data provided in the embodiment of the present application;

[0050] Figure 3 A flowchart of abnormal event detection provided by an embodiment of the present application;

[0051] Figure 4 An event embedding flowchart provided for an embodiment of the present application;

[0052] Figure 5 A flowchart for generating a forensic report provided in an embodiment of the present application;

[0053] Figure 6A flowchart for obtaining the most relevant events provided in an embodiment of the present application;

[0054] Figure 7 A structural block diagram of a network threat evidence collection device provided in an embodiment of the present application.

[0055] icon:

[0056] 100-data acquisition module; 200-preprocessing module; 300-anomaly detection module; 400-blocking and embedding module; 500-report generation module. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0058] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0059] Please see Figure 1 , Figure 1 A flowchart of a network threat evidence collection method provided in an embodiment of the present application. The method can generate a corresponding evidence collection report based on a user's query, including the following steps:

[0060] Step S100: obtaining original data;

[0061] Step S200: pre-processing the original data to obtain an initial digital forensics report;

[0062] Step S300: performing abnormal event detection on the initial digital forensic report, and generating a text forensic file based on the abnormal event;

[0063] Step S400: performing event segmentation and vector embedding on the text forensics file to obtain a vector file;

[0064] Step S500: receiving query information input by a user, and generating a forensic report based on the query information and the vector file.

[0065] This method extracts more critical event information through abnormal event detection and event embedding, avoids information loss or incomplete processing, improves the efficiency and accuracy of threat forensics, and solves the problem of low efficiency of threat forensics in existing methods.

[0066] For example, the present application may perform data processing and event correlation analysis based on multiple models in a large model Agent.

[0067] The raw data in step S100 includes text data and non-text data, including but not limited to network device logs, text records in system logs, email content, text information in documents, system files, application data, etc. The raw data is stored in a CSV file format, for example, to facilitate data sorting and analysis.

[0068] like Figure 2 As shown in FIG. 1 , it is a flowchart of preprocessing of raw data. The preprocessing in step S200 specifically includes the following steps:

[0069] Step S201: converting the non-text data into a form of text plus image metadata;

[0070] For example, a multimodal model can be used to process non-text data. For multimodal information such as images contained in non-text data, such as images taken by network surveillance cameras, binary images related to malware, etc., a multimodal large model selection (vLLM) such as the Llava model can be used to output the analysis corresponding to the image, and the analysis results can be converted into text and image metadata for splicing (metadata such as image type, timestamp, etc.). For example, for images containing malware features, the Llava model can identify and describe key features, such as specific code segments, file structures, etc., and convert them into text.

[0071] Step S202: Generate a text file from text data and event attributes;

[0072] Text data, such as text records in system logs, email content, text information in documents, and event-related attributes, such as the event's unique identifier (ID), detailed description, specific content, severity level (such as urgent, high, medium, low, etc.), occurrence time, date, and other information are stored in text files.

[0073] Step S203: Perform modal fusion on the processed raw data to obtain an initial digital forensics report.

[0074] Specifically, the processed non-text data and text data are merged to obtain an initial digital forensics report containing rich event information.

[0075] The preprocessing of raw data enables efficient integration of multimodal data: non-text data such as images are converted into text output, which is integrated with other text data, enabling more comprehensive acquisition of event information. This effectively solves the problem that traditional tools are difficult to handle multiple types of data and significantly improves data processing efficiency.

[0076] The abnormal event detection in step S300 is to filter out relevant data from the large amount of data in the initial digital forensics report, thereby reducing the amount of data that needs to be processed later. Figure 3 As shown, it is a flowchart of abnormal event detection, specifically:

[0077] Step S301: Compare each event in the initial digital forensic report with predefined rules;

[0078] Step S302: If any event meets the predefined rules, the event is an abnormal event.

[0079] Each event in the initial digital forensics report is tested, and the attributes of the event, such as event type, occurrence time, source IP address, operation behavior, etc., are compared with the corresponding conditions in the predefined rules. If the attributes of an event meet the abnormal conditions defined in the rules, the event is determined to be an abnormal event. For example, the event log: "Ordinary privilege user Zhang San deleted the firewall configuration file", this event matches the rule "A user account performed an operation that does not meet its authority range", so the event is determined to be an abnormal event; for example, if a process accesses sensitive files of the system or a certain IP makes abnormally frequent connection attempts in a short period of time, the event will be determined to be an abnormal event.

[0080] Once an abnormal event is detected, it will be selected and recorded in a new final text forensic file D. This file D will be used specifically to store all events identified as abnormal. These events will serve as the focus of further analysis and processing, providing key clues for in-depth investigation of network events, while also avoiding unnecessary processing of a large number of normal events and improving analysis efficiency.

[0081] Event embedding refers to event segmentation and vector embedding. In order to allow the large language model (LLM) to obtain more accurate context information and generate forensic reports based on the context information, events need to be segmented. Event segmentation plays a vital role in accurately and efficiently retrieving information from external knowledge bases.

[0082] like Figure 4 As shown in the figure, it is an event embedding flowchart, which specifically includes the following steps:

[0083] Step S401: block the abnormal events in the text forensics file to generate event blocks, and the event blocks include all attributes of the events.

[0084] Step S402: performing a vector embedding operation on the event block to obtain an event vector;

[0085] Step S403: Generate a vector file from the event vector.

[0086] The event block operation divides the text forensic file D (which contains the filtered abnormal events) into each independent event (each log is an event), so that each event becomes a separate block. Each event block contains all the relevant attributes of the event. This event-based block method ensures the integrity and independence of the information in each block, which is convenient for subsequent processing and analysis.

[0087] Use a vector embedding model such as the mxbai-embed-large embedding model to perform vector embedding operations on the text data after block processing, and extract a vector containing semantic information for each event, so that the event information originally in text form is converted into a numerical form that the model can understand and calculate, which is convenient for mathematical operations and semantic analysis. Finally, after block segmentation and embedding, a dense vector file ED is output for the text forensic file D. Each vector will be used as a mathematical representation of each event for subsequent comparison and analysis with the data in the knowledge base, providing a basis for accurate retrieval of relevant information.

[0088] Through event segmentation and embedding operations, the problem of input / output token length limitation of the LLM model is effectively solved. When processing long documents or complex network security reports, all relevant information can be accurately processed to avoid information loss or incomplete processing, which improves the performance of the LLM model in processing threat forensics and analysis tasks.

[0089] In summary, through abnormal event detection and event embedding, more critical event information is extracted as the context of the LLM model, so that the large model can output more accurate causal relationships and logical connections between events.

[0090] In step S500, the user can ask the big model to generate an event forensics report related to the user's query by communicating with the big model Agent system. Figure 5 The following is a flowchart for generating a forensic report:

[0091] Step S510: Generate a query RI based on the query information;

[0092] Step S520: Encode and embed the query RI to obtain a query vector VRI;

[0093] Step S530: obtaining the most relevant event based on the correlation between the query vector VRI and the event vector in the vector file;

[0094] Step S540: Generate a forensic report based on the most relevant event and the corresponding original text data.

[0095] Among them, Figure 6 As shown, it is a flowchart for obtaining the most relevant events, specifically:

[0096] Step S531: Calculate the cosine similarity between the query vector VRI and all event vectors;

[0097] Step S532: obtaining the first K events with the highest cosine similarity scores as the most relevant events, where K is an adjustable value.

[0098] The query information input by the user can be processed by the large language model (LLM) to generate a more context-relevant query RI (Resource Identifier, a unique identifier of a resource), and the query RI is encoded and embedded using the embedding model to generate the sentence vector VRI of the query for vector retrieval. This process measures their relevance by calculating the cosine similarity between each event vector in the vector file ED and the query vector VRI. The calculation formula for cosine similarity is:

[0099]

[0100] Among them, q is the query vector and t is the event vector in the vector file ED.

[0101] Search the entire vector file ED for events that are highly similar to VRI, and filter out the most relevant events based on the calculated similarity scores. Since there may be multiple highly relevant information, select the top K events with the highest similarity scores (the value of K is adjustable), and retrieve the original text information corresponding to these K events.

[0102] The most relevant events and the corresponding raw text information are sent to the Large Language Model (LLM) for further processing to identify and extract key information and explore potential correlations between events. For example, by analyzing the time sequence of events, operation logic, and entities involved, the causal relationship and logical connection between events are established. Finally, based on the analysis of the events, the Agent system uses LLM to generate an enhanced forensic report, including threat evidence, detailed analysis of the events, in-depth interpretation of event correlations, and mitigation measures proposed for the events. For example, for network security events, LLM will analyze the type of attack, possible attack sources, the scope of the affected systems, etc., and provide corresponding response suggestions based on these analysis results. The forensic report will present the timeline of the event, detailed analysis of key events, correlations between events, and response suggestions in a clear and organized manner, providing analysts with comprehensive and accurate information to help them better understand the overall picture of the event and make reasonable decisions.

[0103] As one of the application scenarios, such as in a security operation scenario, various types of data related to the alarm are first collected, including firewall logs, intrusion detection system (IDS) alarm information, server system logs, and multimodal data such as some network traffic data packets involved in the incident.

[0104] After data collection is completed, the metadata in the form of images is analyzed by the Llava-Llama3 model, and the effective information in the image is extracted and converted into text; at the same time, the log and alarm information in text format is cleaned and structured. All relevant data are fused to generate an initial report, which contains a preliminary description of the event and key information of each data.

[0105] Next, the abnormal event detection module screens the initial report according to preset rules, such as abnormal port scanning patterns, frequent identity authentication failures, etc., and records the events that meet the abnormal characteristics into file D.

[0106] Then the event is divided into blocks, which are reasonably divided according to the event attributes and length to ensure that each event block is suitable for subsequent processing. The block-divided events are embedded into vectors by the mxbai-embed-large model. The technician initiates a query to understand the specific path and impact range of the intrusion behavior. According to the optimized query, the relevant information is retrieved from the file D, and the most relevant content is found through cosine similarity calculation to generate preliminary mining and analysis of the event; finally, based on the analysis of the preliminary event, a forensic report containing the chronological order of each stage of the intrusion is generated to help security analysts quickly respond to and handle this network security incident.

[0107] This method can accurately associate events and reconstruct timelines: it can explore potential connections between events, clearly sort out the logical relationships between events from different systems and different time periods, overcome the difficulty of traditional methods in associating scattered events, and retrieve more information related to abnormal events from event records through event segmentation, effectively supplementing the context required for event analysis, greatly improving the accuracy of event association analysis, and thus achieving more accurate timeline reconstruction.

[0108] The present application also provides a network threat evidence collection device, which is applied to the above-mentioned network threat evidence collection method, such as Figure 7 The figure is a structural block diagram of a network threat evidence collection device, which includes but is not limited to:

[0109] A data acquisition module 100 is used to acquire original data;

[0110] A preprocessing module 200 is used to preprocess the raw data to obtain an initial digital forensics report;

[0111] An anomaly detection module 300, used to detect anomalies in the initial digital forensic report and generate a text forensic file based on the anomalies;

[0112] A block segmentation and embedding module 400 is used to perform event segmentation and vector embedding on the text forensic file to obtain a vector file;

[0113] The report generation module 500 is used to receive query information input by a user and generate a forensic report based on the query information and the vector file.

[0114] The specific implementation process of each module has been specifically described in the above method embodiment and can be similarly applied to each module, so it will not be repeated here.

[0115] An embodiment of the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, a network threat forensics method is implemented.

[0116] An embodiment of the present application further provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above-mentioned network threat evidence collection method.

[0117] The embodiment of the present application further provides a readable storage medium, wherein the readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the above-mentioned network threat evidence collection method is executed.

[0118] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0119] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0120] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0121] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0122] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0123] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A network threat evidence collection method, characterized in that: The method comprises: Get the original data; Preprocessing the raw data to obtain an initial digital forensics report; Performing abnormal event detection on the initial digital forensic report and generating a text forensic file based on the abnormal event; Performing event segmentation and vector embedding on the text forensics file to obtain a vector file; Receive query information input by a user, and generate a forensic report based on the query information and the vector file.

2. The network threat evidence collection method according to claim 1, characterized in that: The original data includes text data and non-text data, and the preprocessing of the original data to obtain an initial digital forensics report includes: Converting the non-text data into a form of text plus image metadata; Generate text files with text class data and event attributes; The processed raw data is modally fused to obtain the initial digital forensics report.

3. The network threat evidence collection method according to claim 1, characterized in that: The detecting of abnormal events on the initial digital forensic report and generating a text forensic file based on the abnormal events includes: comparing each event in the initial digital forensic report to predefined rules; If any event meets the predefined rules, the event is an abnormal event.

4. The network threat evidence collection method according to claim 1, characterized in that: The step of performing event segmentation and vector embedding on the text forensics file to obtain a vector file includes: The abnormal events in the text forensics file are divided into blocks to generate event blocks, wherein the event blocks include all attributes of the events.

5. The network threat evidence collection method according to claim 4, characterized in that: The step of performing event segmentation and vector embedding on the text forensics file to obtain a vector file includes: Performing a vector embedding operation on the event block to obtain an event vector; Generate a vector file using the event vector.

6. The network threat evidence collection method according to claim 1, characterized in that: The receiving query information input by the user and generating a forensic report based on the query information and the vector file includes: Generate a query RI based on the query information; Encode and embed the query RI to obtain a query vector VRI; Obtaining the most relevant event based on the correlation between the query vector VRI and the event vector in the vector file; A forensic report is generated based on the most relevant events and the corresponding raw text data.

7. The network threat evidence collection method according to claim 6, characterized in that: The obtaining of the most relevant event based on the correlation between the query vector VRI and the event vector in the vector file comprises: Calculate the cosine similarity between the query vector VRI and all event vectors; The first K events with the highest cosine similarity scores are obtained as the most relevant events, where K is an adjustable value.

8. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the network threat evidence collection method according to any one of claims 1 to 7 is implemented.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the network threat evidence collection method according to any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the network threat evidence collection method according to any one of claims 1 to 7 is executed.

Images