Security event query method and device, electronic equipment and storage medium

Abstract

The invention discloses a security event query method and device, electronic equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: acquiring a security event query request text; the security event query request text is sent to a server side, the server side analyzes the security event query request text through an artificial intelligence large model, and a first format security event abstract is generated according to an analysis result; obtaining a first-format security event abstract from the server; converting the security event abstract in the first format into a security event abstract in a second format; and pushing the second-format security event abstract to a dialogue page for display. The efficiency and accuracy of security event query are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a security event query method, device, electronic device and storage medium. Background Art

[0002] As the Internet plays an increasingly indispensable role in all walks of life, network security has attracted more and more attention. For network security, recording and analyzing past network security incidents can play a vital role in solving and preventing network security problems. At present, after a network security incident occurs, manual analysis and manual reporting are often used to deal with it, which is inefficient and prone to errors. Developing an automated and standardized network security incident query process has become an urgent problem to be solved in response to network security threats. Summary of the invention

[0003] The present application provides a security event query method, device, electronic device and storage medium for realizing automatic security event query and improving query efficiency and accuracy.

[0004] In a first aspect, a security event query method is provided, comprising:

[0005] Get the security event query request text;

[0006] The security event query request text is sent to the server, and the server parses the security event query request text through the artificial intelligence big model, and generates a first format security event summary according to the parsing result;

[0007] Get the first format security event summary from the server;

[0008] Converting a security event summary in a first format into a security event summary in a second format;

[0009] Push the second format security event summary to the conversation page for display.

[0010] In the embodiments of the present application, a large artificial intelligence model is used to automatically query security events and automatically generate security event summaries, and the security event summaries are automatically pushed to users for viewing, avoiding the tedious process of manual query and recording in the past, improving the efficiency and accuracy of security event queries, and providing a guarantee for efficient response to network security incidents.

[0011] In some embodiments, the server parses the security event query request text through an artificial intelligence big model, and generates a first format security event summary according to the parsing result, specifically including:

[0012] The server parses the security event query request text through an artificial intelligence big model to obtain query conditions;

[0013] The artificial intelligence big model obtains the record information of all security events that meet the query conditions from the security event record file according to the query conditions;

[0014] The artificial large model generates a security event summary in a first format according to the acquired record information of the security event and a preset summary template.

[0015] By parsing the query conditions, the security event records that the user wants to query can be accurately obtained, and the information of the security event records can be automatically classified according to the modules in the summary template through the preset summary template, so that the various parts of the security event summary can be displayed to the user more clearly.

[0016] In some embodiments, the security event query method further includes:

[0017] Get security report generation request;

[0018] In response to the security report generation request, generate a security report title and a security report preview link associated with the first security event summary; the security report preview link points to a preview page, and the preview page is used to display the content of the security report generated based on the first format security event summary;

[0019] Push the security report title and security report preview link to the conversation page for display.

[0020] Through the above method, a preview function of the security report can be provided to the user. The user can check whether the security report meets the requirements through the effect of the preview report displayed on the preview page, so that the user can obtain a more satisfactory query result and query experience.

[0021] In some embodiments, obtaining a security event summary in a first format from a server, converting the security event summary in the first format into a security event summary in a second format, further includes:

[0022] storing the security event summary in a first format in a cache;

[0023] The security event query method also includes:

[0024] Get the security report preview request triggered by the security report preview link;

[0025] In response to the security report preview request, jump to the preview page pointed to by the security report link; the preview page loads a pre-designed preview template;

[0026] A security event summary in a first format is obtained from a cache, the obtained security event summary in the first format is converted into a security event summary in a second format, and content of the security event summary in the second format is inserted into a designated area of ​​a preview template in blocks for display.

[0027] Through the above method, a preview page display method for a security report is provided. The preview page of the security report is directly generated based on the first format security event summary in the cache, and the content to be displayed is directly loaded into a pre-designed preview template. The loading method of the preview page is simple and fast.

[0028] In some embodiments, obtaining the security event query request text further includes:

[0029] An operation identifier for recording the security event query request text;

[0030] Storing the first format security event summary in a cache also includes:

[0031] Binding the first format security event summary to the operation identifier;

[0032] In response to the security report generation request, generating a security report title and a security report preview link associated with the first security event summary, further comprising:

[0033] Bind the security report preview link to the operation ID;

[0034] Get the first-format security event summary from the cache, including:

[0035] According to the operation identifier bound to the security report preview link, a corresponding first-format security event summary is obtained from the cache, where the first-format security event summary and the security report preview link are bound with the same operation identifier.

[0036] In the above manner, when searching for the first format security digest in the cache, matching can be performed through the operation identifier, which simplifies the process of searching for the corresponding first format security digest in the cache and ensures the accuracy of the search result.

[0037] In some embodiments, the security event query method further includes:

[0038] Get security report download request;

[0039] In response to the security report download request, the security report generated based on the security event summary in the first format is stored locally in a set file format.

[0040] Through the above methods, you can download the security report so that you can view or share it at any time.

[0041] In some embodiments, the preview page also includes a link to download the security report;

[0042] Get a security report download request, including:

[0043] Get the security report download request triggered by the security report download link based on the preview page;

[0044] In response to the security report download request, the security report generated based on the security event summary in the first format is stored locally in a set file format, specifically including:

[0045] In response to the security report download request, generating a security report in a set format based on the content displayed on the preview page;

[0046] Store formatted safety reports locally.

[0047] In the above manner, the security report generated based on the content displayed on the preview page can be downloaded directly on the preview page.

[0048] In a second aspect, a security event query device is provided, comprising:

[0049] A text acquisition module is used to obtain the security event query request text;

[0050] The transceiver module is used to send the security event query request text to the server; obtain the first format security event summary from the server;

[0051] The push module converts the security event summary in the first format into the security event summary in the second format; and pushes the security event summary in the second format to the dialogue page for display.

[0052] According to a third aspect, an electronic device is provided, including:

[0053] A memory is used to store a computer program; a processor is used to implement any one of the methods in the first aspect when executing the computer program stored in the memory.

[0054] According to a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of the first aspects is implemented.

[0055] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1One of the flowcharts of the security event query method provided in the embodiment of the present application;

[0057] Figure 2 One of the user interface schematic diagrams provided in the embodiment of the present application;

[0058] Figure 3 The second user interface diagram provided in the embodiment of the present application;

[0059] Figure 4 Flow chart 2 of the security event query method provided in the embodiment of the present application;

[0060] Figure 5 The third user interface diagram provided in the embodiment of the present application;

[0061] Figure 6 Flow chart 3 of the security event query method provided in the embodiment of the present application;

[0062] Figure 7 A fourth user interface diagram provided in an embodiment of the present application;

[0063] Figure 8 Flow chart 4 of the security event query method provided in the embodiment of the present application;

[0064] Fig. 9 The fifth user interface diagram provided in the embodiment of the present application;

[0065] Fig.10 The sixth user interface diagram provided in the embodiment of the present application;

[0066] Fig.11 Flow chart 5 of the security event query method provided in the embodiment of the present application;

[0067] Fig.12 A schematic diagram of the structure of a security event query device provided in an embodiment of the present application;

[0068] Fig.13 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0070] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0071] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0072] As the Internet plays an increasingly indispensable role in all walks of life, network security has attracted more and more attention. For network security, recording and analyzing past network security incidents can play a vital role in solving and preventing network security problems. At present, after a network security incident occurs, manual analysis and manual reporting are often used to deal with it, which is inefficient and prone to errors. Developing an automated and standardized network security incident query process has become an urgent problem to be solved in response to network security threats.

[0073] In view of this, embodiments of the present application provide a security event query method, device, electronic device and storage medium for realizing automated query of network security events.

[0074] Figure 1 This is one of the flowcharts of the security event query method provided in the embodiment of the present application. The method can be executed by a security event query device, which can be composed of hardware and / or software, and is not limited here. Figure 1 As shown, the method comprises the following steps:

[0075] S101: Obtain security event query request text;

[0076] In this step, the security event query device needs to obtain the security event query request text to trigger the security event query operation. Specifically, the security event query device can be a smart device such as a mobile phone, and the security event query device can be installed with an application for obtaining the security event query request text, such as a browser, etc. The security event query device has a display screen for displaying the user interface of the application. Figure 2 This is one of the user interface schematic diagrams provided in the embodiment of the present application, such as Figure 2 As shown, in the user interface of the application, the user can enter the security event query request text on the dialogue page by key input, voice input, etc. For example, "Please help me generate a security summary for the past week" can be entered to trigger a security event query operation.

[0077] S102: Send the security event query request text to the server, which parses the security event query request text through an artificial intelligence big model and generates a first format security event summary based on the parsing result.

[0078] In this step, after obtaining the security event query text, the security event query device sends the security event query text to the server, uses the artificial intelligence big model deployed on the server to parse the security event query request text, and generates a first format security event summary based on the parsed structure, thereby using the artificial intelligence big model to realize automatic query of security events and automatic generation of security event summaries, avoiding the tedious process of manual operation in the past.

[0079] In the specific implementation process, the server parses the security event query request text through the artificial intelligence big model to obtain the query conditions. Specifically, the query conditions may include the time of occurrence of the security event, the type of security event, and the main attacker, etc. The query conditions may be one or more. The more query conditions there are, the more accurate the query results can be. The artificial intelligence big model can use self-recognition language processing and other technologies to parse specific query conditions from the security event query request text. For example, if the security event query request text is "Please help me generate a security summary for the past week", it can be parsed that the time of occurrence of the security event is within the range of the past week, then the artificial intelligence big model can query the security events in the past week. For example, if the security event query request text is "Please help me generate a security summary of the XXX virus in the past week", it can be parsed that the time of occurrence of the security event is within the range of the past week, and the type of security event is a security event caused by the XXX virus, then the artificial intelligence big model can query the security events caused by the XXX virus in the past week, which will not be repeated here.

[0080] In general, each security incident will be automatically recorded in the security incident log file after it occurs. The recorded content may include the time when the security incident occurred, the type of security incident, the main attacker, the current disposal method, etc. The security incident log file can be stored on the server side or in a dedicated storage device. The security incident log file can be a file in CSV format, which is a simple text file format that can easily exchange data between different applications and systems. After parsing the query conditions, the artificial intelligence model automatically obtains the record information of all security incidents that meet the query conditions from the security incident log file, thereby realizing automatic query of security incidents.

[0081] After the query is completed, the artificial intelligence model generates a security event summary in the first format based on the acquired security event record information and the preset summary template. Specifically, in order to clearly display the content of the security event to the user so that the user can quickly and efficiently grasp the content of the security event, the artificial intelligence model can split the acquired security event record information and then fill it into the specified module of the preset summary template. For example, the preset summary template may include modules such as the type of security event, the main attacker, security suggestions and solutions, and the next step disposal plan. The artificial intelligence model can split the acquired security event record information and fill the relevant information into the corresponding part of the summary template. It can also use deep learning technology to automatically generate security suggestions and solutions, the next step disposal plan based on past experience, and fill it into the corresponding part of the summary template.

[0082] Optionally, the file format of the first format security incident summary can be Markdown format. Markdown format is a lightweight markup language that is concise and intuitive and is often used to generate formatted text such as documents, summaries, reports, etc. In specific implementation, the first format security incident summary can also be in other formats, which is not limited here.

[0083] S103: Obtain a security event summary in the first format from the server.

[0084] In this step, after the server generates the security event summary in the first format, it returns the security event summary in the first format to the security event query device, and the security event query device obtains the security event summary in the first format from the server for subsequent display to the user.

[0085] S104: Convert the security event summary in the first format into the security event summary in the second format.

[0086] The second format of the security event summary is a format that is convenient for display in the user interface. For example, in this step, the security event query device can convert the security summary in Markdown format into HTML statements through the Marked library to display it in the browser's user interface.

[0087] S105: Push the security event summary in the second format to the conversation page for display.

[0088] In this step, the security event query device pushes the second format security event summary to the dialogue page of the user interface, adds style rendering for display, so that the user can view the query results of the security event. Figure 3 The second user interface diagram provided in the embodiment of the present application is as follows: Figure 3 As shown, in the dialogue page of the user interface, the user can view the content of the security incident summary. Specifically, the content of the security incident summary may include the type of security incident, major attackers, security recommendations and solutions, next steps and other sections, which are not limited here.

[0089] The security incident query method provided in this application utilizes a large artificial intelligence model to automatically query security incidents and automatically generate security incident summaries, avoiding the previous tedious process of manual query and recording, improving the efficiency and accuracy of security incident query, and providing a guarantee for efficient response to network security incidents.

[0090] Figure 4 This is a second flow chart of the security event query method provided in the embodiment of the present application. Figure 4 As shown, the security event query method provided in the embodiment of the present application also includes the following steps:

[0091] S401: Obtain a security report generation request;

[0092] In this step, the security event query device obtains a security report generation request, which is used to instruct the security event query device to generate a security report to provide it to the user for preview and download.

[0093] Figure 5 This is the third user interface diagram provided for the embodiment of the present application.

[0094] Optional, such as Figure 5 As shown, the user can click the "Generate Report" link below the security event summary on the dialogue page to enable the security event query device to obtain a security report generation request.

[0095] Optional, such as Figure 5 As shown, the user can enter the security report generation request text in the text input box or voice input box of the dialogue page, so that the security event query device obtains the security report generation request, which is not limited here.

[0096] S402: In response to the security report generation request, generate a security report title and a security report preview link associated with the first security event summary.

[0097] In this step, the security event query device generates a security report title and a security report preview link associated with the first security event summary in response to the security report generation request. The security report preview link points to a preview page, which is used to display the content of the security report generated based on the first format security event summary in the user interface, so that the user can preview the content of the security report.

[0098] S403: Push the security report title and the security report preview link to the conversation page for display.

[0099] In this step, if Figure 5As shown, the security incident query device pushes the security report title and the security report preview link to the dialogue page for display. The security report preview link can be displayed on the dialogue page in the form of a "preview" button, etc. The user can click the "preview" button on the dialogue page to jump the user interface to the preview page to preview the security report. After the user previews the security report, he can choose to download the security report, not download the security report, adjust the security report format, re-perform the security incident query operation, or perform other operations based on the preview results, which are not limited here. For example, if the user is satisfied with the preview results, he can choose to download the security report and store the security report locally so that he can view or share the security report at any time. For example, if the user is not satisfied with the results of the security report, he can re-perform the security incident query operation, or adjust the format of the security report until a satisfactory security report is generated. By setting the preview function, users can obtain more satisfactory query results and query experience.

[0100] In some embodiments, when the security event query device performs the steps of obtaining the first-format security event summary from the server and converting the first-format security event summary into the second-format security event summary, the first-format security event summary can also be stored in the cache, so as to facilitate the generation of a security report using the cached first-format security event summary in the subsequent security report preview and download steps. For example, when a user performs a security event query operation through a browser, the first-format security event summary can be stored in the browser's cache. Figure 6 This is a flowchart of the security event query method provided in the embodiment of the present application. Figure 6 As shown, after the user clicks the security report preview link, the security event query method further includes the following steps:

[0101] S601: Obtain a security report preview request triggered by a security report preview link.

[0102] In this step, after the user clicks the security report preview link, the security event query device can obtain a security report preview request. The security report preview request is used to instruct the security event query device to jump the user interface to the preview page.

[0103] S602: In response to the security report preview request, jump to the preview page pointed to by the security report link; the preview page loads a pre-designed preview template.

[0104] In this step, the security event query device responds to the security report preview request and jumps to the preview page pointed to by the security report link to display the content of the security report. The preview page loads a pre-designed preview template, and the style of the preview template is the same as the style of the final downloaded security report.

[0105] S603: Obtain a security event summary in the first format from the cache, convert the obtained security event summary in the first format into a security event summary in the second format, and insert the content of the security event summary in the second format into a designated area of ​​the preview template for display.

[0106] Figure 7 The fourth user interface diagram provided in the embodiment of the present application is as follows: Figure 7 A schematic diagram of a preview page of a security report is shown. The preview template of the preview page includes multiple areas for displaying content such as title, security incident type, main attackers, security suggestions and solutions, and next step disposal suggestions. In step S603, the security incident query device obtains a first-format security incident summary from the cache, converts the obtained first-format security incident summary into a second-format security incident summary, and inserts the content of the second-format security incident summary into designated areas of the preview template for display.

[0107] In some embodiments, the security event query device may also record the operation identifier of the security event query request text in the step of obtaining the security event query request text. The operation identifier of the security event query request text may be randomly generated, for example, it may be a randomly generated string of numbers or generated according to a set rule, for example, the time of obtaining the security event query request text may be used as the operation identifier, which is not limited here. In the step of storing the first security event summary in the cache, the security event query device may also bind the first format security event summary to the operation identifier of the security event query request text. When the security event query device generates a security report title and a security report preview link associated with the first security event summary in response to the security report generation request, it may also bind the security report preview link to the operation identifier of the security event query request text. When the security event query device obtains the first format security event summary from the cache, it may search for the first format security event summary bound to the security report preview link in the cache according to the operation identifier bound to the security report preview link, and then obtain the first format security event summary from the cache for generating a security report. Since multiple first-format security event summaries may be stored in the cache after multiple security event query operations, the security report preview link and the corresponding first-format security event summary are bound to the same operation identifier, thereby associating the security report preview link and the first-format security event summary. This facilitates quick and accurate search and matching of the first-format security event summary from the cache, and generates a preview page for the security report.

[0108] Figure 8 Flow chart 4 of the security event query method provided in the embodiment of the present application. In some embodiments, the security event query method further includes the following steps:

[0109] S801: Obtain a security report download request.

[0110] In this step, the security event query device can obtain the security report download request in a variety of ways, which are not limited here.

[0111] Optional, Fig. 9 The fifth user interface diagram provided in the embodiment of the present application is as follows: Fig. 9 As shown, the security event query device, in response to a security report generation request, generates a security report title and a security report preview link associated with the first security event summary, and can also generate a security report download link associated with the first security event and display it on the dialogue page. For example, the security report download link can be displayed on the dialogue page in the form of a "Download" button. When the user clicks the "Download" button, the security query device can obtain a security report download request, thereby storing the security report locally without previewing the security report.

[0112] Optional, Fig.10 The sixth user interface diagram provided in the embodiment of the present application is as follows: Fig.10 As shown, the security report download link can be loaded directly on the preview page of the security report, or by long pressing or double-clicking the blank area of ​​the preview page, etc., the security report download link can be loaded on the preview page. The user can click on the security report download link loaded on the preview page of the security report to enable the security query device to obtain the security report download request. The preview page of the security report can also provide functions such as copying and printing the security report, which are not limited here.

[0113] S802: In response to the security report download request, the security report generated based on the security event summary in the first format is stored locally in a set file format.

[0114] In this step, the security event query device responds to the security report download request and stores the security report generated based on the first format security event summary in a set file format locally. For example, the security report can be stored locally in a file format such as PDF, WORD, etc., which is not limited here.

[0115] The following uses the example of clicking the security report download link loaded on the preview page to download a security report in PDF format to illustrate the download process of the security report. Fig.11 The fifth flowchart of the security event query method provided in the embodiment of the present application is as follows: Fig.11 As shown, the security event query device responds to the security report download request and stores the security report generated based on the first format security event summary in a set file format locally, specifically including the following steps:

[0116] S111: In response to the security report download request, generate a security report in a set format based on the content displayed on the preview page

[0117] In this step, the security report download request is triggered based on the user clicking the security report download link on the preview page, and a security report of a set format is generated directly based on the content displayed on the preview page. Taking the generation of a security report in PDF format as an example, the security event query device responds to the security report download request, calls the genPdf function, and passes the document node and PDF title of the current preview page as parameters to the function. The genPdf function first uses the html2Canvas library to convert the specified HTML page content into a Canvas image. In this process, cross-domain resources are allowed to prevent contamination. After the image is generated, the Canvas image data is saved as a Base64 string in JPEG format. Next, the genPdf function creates a PDF object that meets the A4 size standard through the jsPDF library. The width can be set to 595.28pt to ensure that the page content fits the width of the A4 paper, or it can be other sizes, which are not limited here. Then the pdf.addImage method is used to add the generated Canvas image data to the PDF document, and the page height is automatically adjusted to fit the proportional relationship of the image, thereby generating a PDF security report file.

[0118] S112: The safety report in the set format is stored locally.

[0119] In this step, the security report in the set format is automatically stored in the local storage space. In specific implementation, the security report file can be saved through the pdf.save() method, which is not limited here.

[0120] Based on the same technical concept, a security event query device is also provided in an embodiment of the present application, and the device can implement the above-mentioned security event query method process in the embodiment of the present application.

[0121] Fig.12 This is a schematic diagram of the structure of a security event query device provided in an embodiment of the present application. Fig.12 As shown, the device includes a text acquisition module 121, a transceiver module 122 and a push module 123.

[0122] The text acquisition module 121 is used to acquire the security event query request text.

[0123] The transceiver module 122 is used to send the security event query request text to the server; and obtain the first format security event summary from the server.

[0124] The push module 123 converts the security event summary in the first format into the security event summary in the second format; and pushes the security event summary in the second format to the dialog page for display.

[0125] In some embodiments, the security event query device also includes a response module, which is used to: obtain a security report generation request; in response to the security report generation request, generate a security report title and a security report preview link associated with the first security event summary; the security report preview link points to a preview page, which is used to display the content of the security report generated based on the first format security event summary; the push module 123 is also used to push the security report title and the security report preview link to the dialogue page for display.

[0126] In some embodiments, the transceiver module 122 is also used to store the security event summary in the first format in the cache. The response module is also used to obtain a security report preview request triggered by a security report preview link; in response to the security report preview request, jump to the preview page pointed to by the security report link; the preview page is loaded with a pre-designed preview template. The push module 123 is also used to obtain the security event summary in the first format from the cache, convert the obtained security event summary in the first format into a security event summary in the second format, and insert the content of the security event summary in the second format into the specified area of ​​the preview template for display.

[0127] In some embodiments, the text acquisition module 121 is also used to record the operation identifier of the security event query request text. The transceiver module 122 is also used to bind the first format security event summary to the operation identifier. The response module is also used to bind the security report preview link to the operation identifier. The push module 123 is specifically used to obtain the corresponding first format security event summary from the cache according to the operation identifier bound to the security report preview link, and the first format security event summary and the security report preview link are bound with the same operation identifier.

[0128] In some embodiments, the response module is further used to obtain a security report download request; in response to the security report download request, the security report generated based on the first format security event summary is stored locally in a set file format.

[0129] In some embodiments, the response module is also specifically used to obtain a security report download request triggered by a security report download link based on a preview page; in response to the security report download request, generate a security report in a set format based on the content displayed on the preview page; and store the security report in the set format locally.

[0130] In the embodiment of the present application, the functions of each module of the above-mentioned security event query device can be further split into more modules, or the functions of multiple modules can be merged into one module, which is not limited here.

[0131] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0132] Based on the same technical concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the functions of the aforementioned security event query device.

[0133] Fig.13 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0134] At least one processor 131, and a memory 132 connected to the at least one processor 131. The specific connection medium between the processor 131 and the memory 132 is not limited in the embodiment of the present application. Fig.13 In the example, the processor 131 and the memory 132 are connected via the bus 130. The bus 130 is Fig.13 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 130 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Fig.13 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 131 can also be called a controller, and there is no limitation on the name.

[0135] In the embodiment of the present application, the memory 132 stores instructions that can be executed by at least one processor 131. The at least one processor 131 can execute a security event query method discussed above by executing the instructions stored in the memory 132. The processor 131 can implement Fig.12 The functions of each module in the device shown.

[0136] Among them, the processor 131 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 132 and calling data stored in the memory 132, the various functions of the device and processing data, the device can be monitored as a whole.

[0137] In the embodiment of the present application, the processor 131 may include one or more processing units, and the processor 131 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 131. In some embodiments, the processor 131 and the memory 132 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0138] The processor 131 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of a security event query method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0139] The memory 132 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 132 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 132 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 132 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0140] By designing and programming the processor 131, the code corresponding to a data processing method introduced in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1A security event query method of the embodiment shown. How to design and program the processor 13 is a technology well known to those skilled in the art and will not be described in detail here.

[0141] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0142] Based on the same technical concept, the embodiment of the present application provides a computer storage medium, which includes: computer program code, when the computer program code runs on a computer, the computer executes any of the security event query methods discussed above. Since the principle of solving the problem by the above-mentioned computer storage medium is similar to that of a security event query method, the implementation of the above-mentioned computer storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0143] In the specific implementation process, the computer storage medium may include: Universal Serial Bus Flash Drive (USB), mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other storage media that can store program codes.

[0144] Based on the same technical concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the security event query methods discussed above. Since the principle of solving the problem by the above computer program product is similar to that of a security event query method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0145] The computer program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more conductors, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0146] The method in the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM or other programmable device.

[0147] The computer program or instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0148] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0149] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the instructions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A security event query method, characterized in that: include: Get the security event query request text; The security event query request text is sent to the server, and the server parses the security event query request text through an artificial intelligence big model, and generates a first format security event summary according to the parsing result; Obtaining the security event summary in the first format from the server; Converting the security event summary in the first format into a security event summary in a second format; The second-format security event summary is pushed to the conversation page for display.

2. The method according to claim 1, characterized in that The server parses the security event query request text through an artificial intelligence big model, and generates a first format security event summary according to the parsing result, specifically including: The server parses the security event query request text through an artificial intelligence big model to obtain query conditions; The artificial intelligence big model obtains the record information of all security events that meet the query conditions from the security event record file according to the query conditions; The artificial large model generates the first format security event summary according to the acquired record information of the security event and a preset summary template.

3. The method according to claim 1 or 2, characterized in that Also includes: Get security report generation request; In response to the security report generation request, generating a security report title and a security report preview link associated with the first security event summary; The security report preview link points to a preview page, and the preview page is used to display the content of the security report generated based on the security event summary in the first format; The security report title and the security report preview link are pushed to the conversation page for display.

4. The method according to claim 3, characterized in that The obtaining the first-format security event summary from the server and converting the first-format security event summary into a second-format security event summary further includes: storing the security event summary in the first format in a cache; The method further comprises: Obtaining a security report preview request triggered by the security report preview link; In response to the security report preview request, jump to the preview page pointed to by the security report link; the preview page is loaded with a pre-designed preview template; The security event summary in the first format is obtained from the cache, the obtained security event summary in the first format is converted into a security event summary in a second format, and the content of the security event summary in the second format is inserted into the designated area of ​​the preview template in blocks for display.

5. The method according to claim 4, characterized in that The obtaining of the security event query request text also includes: Recording the operation identifier of the security event query request text; The storing the first format security event summary in a cache further includes: Binding the first-format security event summary to the operation identifier; The step of generating a security report title and a security report preview link associated with the first security event summary in response to the security report generation request further includes: Binding the security report preview link to the operation identifier; The obtaining the security event summary in the first format from the cache specifically includes: According to the operation identifier bound to the security report preview link, a corresponding first-format security event summary is obtained from a cache, where the first-format security event summary is bound to the security report preview link with the same operation identifier.

6. The method according to claim 3, characterized in that Also includes: Get security report download request; In response to the security report download request, the security report generated based on the security event summary in the first format is stored locally in a set file format.

7. The method according to claim 6, characterized in that The preview page also includes a link to download the security report; The request for obtaining the security report download specifically includes: Obtain a security report download request triggered by a security report download link on the preview page; In response to the security report download request, storing the security report generated based on the security event summary in the first format locally in a set file format specifically includes: In response to the security report download request, generating the security report in the set format based on the content displayed on the preview page; The safety report in the set format is stored locally.

8. A security event query device, characterized in that: include: A text acquisition module is used to obtain the security event query request text; A transceiver module, used to send the security event query request text to the server; Obtaining the security event summary in the first format from the server; The push module converts the security event summary in the first format into the security event summary in the second format; and pushes the security event summary in the second format to the dialogue page for display.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method according to any one of claims 1 to 7 when executing a computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images