Abnormality level identification system based on abnormality traceability

Abstract

The invention relates to the technical field of data processing, in particular to an exception level identification system based on exception traceability, which performs data analysis on target exception data and associated exception data of the first i levels based on a preset large language model, judges whether an exception source exists in an associated object of the i-th level or not, and if the exception source is not determined, identifies an exception level of the associated object of the i-th level. The method comprises the following steps: adding associated abnormal data of a next level in input data of a large language model to judge whether an abnormal source exists in an associated object of the next level, and performing step-by-step traceability analysis on the abnormal source of a target object to obtain a target abnormal report by updating the data input in the large language model step by step. The method is used for representing the abnormal condition corresponding to the target object and the propagation condition of the abnormal condition, feature extraction and mapping are further carried out on the related abnormal data through the classification model on the basis of the target abnormal report, the target abnormal level of the target object is recognized, and the recognition accuracy of the target abnormal level is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an abnormality level identification system based on abnormality tracing. Background Art

[0002] With the rapid development of the global Internet, network security issues are becoming increasingly severe. Traditional network security technologies mainly focus on passive defense measures such as firewalls, intrusion detection systems, intrusion prevention systems, and anti-virus software. With the rapid development of big data analysis and behavioral analysis, active defense technologies that rely on big data analysis, abnormal intelligence, behavioral analysis, and other means have gradually become a research hotspot. By compiling blacklists and analyzing the abnormal behaviors and traffic characteristics of target objects, it is possible to warn of potential attack risks of target objects in advance, significantly improving the overall defense capabilities of network security.

[0003] Although the above technologies can defend against known threats to a certain extent, in the face of evolving new attack methods and complex correlations between objects, traditional technologies focus on considering the abnormal behavior and traffic characteristics of the target object itself, and it is difficult to conduct a comprehensive and overall assessment of the abnormal situation of the target object, resulting in low accuracy in identifying abnormalities of the target object, and it seems somewhat powerless in terms of data protection, threat prevention, and risk identification.

[0004] Therefore, how to improve the recognition accuracy of the abnormal level of the target object, thereby improving the reliability of the abnormal recognition results in the fields of data protection, threat protection, risk identification, etc. has become an urgent problem to be solved. Summary of the invention

[0005] In view of the above technical problems, the technical solution adopted by the present invention is an abnormality level identification system based on abnormality tracing, which includes a processor and a memory storing a computer program, and the memory also stores a trained classification model, target abnormality data A corresponding to the target object, and a target abnormality level identification system based on abnormality tracing. 0 , the associated abnormal data set A corresponding to the target object = {A 1 , A 2 , ..., A i , ..., A M}, where A i ={A i 1. A i 2, ..., A i j(i) , ..., A i N(i)}, A i j(i)It refers to the associated abnormal data corresponding to the j(i)th i-th level associated object corresponding to the target object, the associated abnormal data includes the corresponding target abnormal data and the corresponding abnormal degree, i=1, 2, ..., M, M refers to the number of levels of the associated objects corresponding to the target object, j(i)=1, 2, ..., N(i), N(i) refers to the total number of i-th associated objects corresponding to the target object. When the computer program is executed by the processor, the following steps are implemented: S1, initialize i=1.

[0006] S2, A 0 , A 1 , ..., A i Input into the preset large language model to obtain the intermediate exception report and exception source identification result, where the intermediate exception report includes the intermediate exception source, intermediate exception means and intermediate exception path, and the exception source identification result is a determined exception source or an undetermined exception source.

[0007] S3, if the abnormal source identification result is an undetermined abnormal source, update i=i+1, return to execute step S2, until the preset conditions are met, and use the intermediate abnormality report corresponding to the preset conditions as the target abnormality report, wherein the target abnormality report includes the target abnormality source, the target abnormality means and the target abnormality path, and the target abnormality path includes the target abnormality source, the target object, and several target associated objects between the target abnormality source and the target object.

[0008] S4, according to A and the target anomaly report, the associated anomaly data corresponding to the target anomaly source and the target anomaly data A corresponding to the target object are 0 , the associated abnormality data corresponding to several target associated objects between the target abnormality source and the target object, and the target abnormality report are input into the trained classification model to obtain the target abnormality level corresponding to the target object.

[0009] The present invention has at least the following beneficial effects: initializing i=1, setting A 0 , A 1 , ..., A i Input into the preset large language model, obtain the intermediate exception report and the abnormal source identification result, if the abnormal source identification result is an undetermined abnormal source, update i=i+1, return to the operation steps of executing the large language model until the preset conditions are met, and take the corresponding intermediate exception report when the preset conditions are met as the target exception report, according to A and the target exception report, the associated exception data corresponding to the target abnormal source and the target exception data A corresponding to the target object 0, the associated abnormal data corresponding to several target associated objects between the target abnormal source and the target object, and the target abnormal report are input into the trained classification model to obtain the target abnormal level corresponding to the target object. It can be seen that when performing data analysis through the preset large language model, the associated abnormal data of the associated objects at the next level are added to determine whether there is an abnormal source corresponding to the target object in the associated objects at the next level. By updating the data input into the large language model step by step, the abnormal source corresponding to the target object is traced back step by step. Finally, when the preset conditions are met, the corresponding intermediate abnormal report is used as the target abnormal report to characterize the abnormal situation corresponding to the target object and its propagation situation. Further, on the basis of the target abnormal report, the classification model is used to extract and map the relevant abnormal data to identify the target abnormal level of the target object, thereby improving the recognition accuracy of the target abnormal level. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0011] Figure 1 A flowchart of a processor executing a computer program to implement an exception level identification system based on exception tracing provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0012] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0013] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It is understood that, where appropriate, the above-mentioned terms used to distinguish similar objects can be interchanged so that the present invention can also implement other embodiments other than the above-mentioned illustrated embodiments or described embodiments. In addition, the terms "including" and "having" and any variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0014] The first embodiment provides an abnormality level identification system based on abnormality tracing, and the abnormality level identification system based on abnormality tracing includes a processor and a memory storing a computer program, and the memory also stores a trained classification model, target abnormal data A corresponding to the target object, and a 0 , the associated abnormal data set A corresponding to the target object = {A 1 , A 2 , ..., A i , ..., A M}, where A i ={A i 1. A i 2, ..., A i j(i) , ..., A i N(i)}, A i j(i) It refers to the associated abnormal data corresponding to the j(i)th i-th level associated object corresponding to the target object, the associated abnormal data includes the corresponding target abnormal data and the corresponding abnormal degree, i=1, 2, ..., M, M refers to the number of levels of the associated objects corresponding to the target object, j(i)=1, 2, ..., N(i), N(i) refers to the total number of i-th associated objects corresponding to the target object, when the computer program is executed by the processor, the following steps are implemented, such as Figure 1 As shown: S1, initialize i=1.

[0015] Among them, the target object can refer to the object that needs to be identified by abnormal level, such as IP, domain name and other objects to be identified in the field of network security. By identifying the abnormal level of the target object, it is possible to warn of potential abnormal risks in advance and improve the overall defense capability of network security in the fields of data protection, threat prevention, risk identification, etc.

[0016] The associated object corresponding to the target object may refer to an object that has multiple association relationships with the target object, such as communication relationship, business relationship, attack relationship, etc. By analyzing the associated abnormal data of the associated object corresponding to the target object and combining it with the target abnormal data of the target object itself, the abnormal situation of the target object can be deeply analyzed and understood, thereby improving the accuracy of identifying the abnormal level of the target object and providing a reliable basis for subsequent decision-making and processing.

[0017] For example, when the target object is a target IP, the associated object corresponding to the target object can be the associated IP corresponding to the target IP. The target IP and the associated IP, as well as several associated IPs, can have multiple association relationships such as client and server relationship, peer-to-peer communication relationship, same subnet relationship, same network architecture relationship, same business system relationship, same supply chain relationship, attacker and victim relationship, etc. The target IP and the associated IP, as well as several associated IPs, exchange data with each other, and the abnormal situation of the associated IP will affect the abnormal situation of the target IP.

[0018] The target exception data may include data update time, data creation time, objects affected by the exception, objects directly sourced from the exception, exception type, exception description and other related data.

[0019] The specific categories of abnormal types can be set by the implementer according to the actual situation. For example, in the field of network security, the abnormal types corresponding to IP can include denial of service attacks, port scanning attacks, malware infections, SQL injection attacks, ARP spoofing attacks, zero-day vulnerability attacks and other abnormal types.

[0020] The abnormal direct source object may refer to the direct source of the abnormal situation corresponding to the target object. This embodiment requires tracing the original source of the abnormal situation corresponding to the target object to conduct a comprehensive and in-depth analysis of the abnormal situation of the target object, thereby improving the recognition accuracy of the abnormal level of the target object.

[0021] The abnormality degree is used to characterize the possibility and severity of abnormality of the corresponding associated object. It can be obtained by performing several abnormality level identifications on the associated object in the historical time and analyzing the obtained abnormality levels.

[0022] Specifically, this embodiment analyzes the target abnormal data of the target object and the associated abnormal data of the associated objects step by step, identifies the source of the abnormal situation of the target object, that is, identifies the abnormal source corresponding to the target object, so as to clarify the abnormal propagation situation corresponding to the abnormal situation of the target object, improve the analysis depth and comprehensiveness of the abnormal situation of the target object, thereby improving the recognition accuracy of the abnormal level of the target object, and providing a reliable basis for subsequent decision-making and processing.

[0023] In a specific implementation, the memory further stores a plurality of initial objects and association relationships between each initial object and other initial objects and target objects, wherein the association relationships include direct associations and indirect associations. The associated objects of the target object are obtained by the following steps: S10, according to the association relationship between each initial object and the target object, determining the initial object directly associated with the target object as the first-level associated object corresponding to the target object.

[0024] S20, according to the association relationship between each initial object and other initial objects, determine the initial object directly associated with each u-th level associated object corresponding to the target object as the u+1-th level associated object corresponding to the target object, where u=1, 2, ..., M-1.

[0025] Among them, after determining the first u-level associated objects corresponding to the target object, the initial objects directly associated with each u-th level associated object are determined as the u+1-th level associated objects corresponding to the target object from the initial objects that have not been determined as associated objects, so as to gradually determine the associated objects of each level of the target object.

[0026] As described above, through the association relationship between the initial object and other initial objects and the target object, a step-by-step approach is adopted to systematically and comprehensively determine the associated objects of the target object at all levels. This has a good analysis effect on complex object relationship networks, and can assist in analyzing the propagation path and source of abnormal situations, and better understand the behavioral characteristics and mutual influence relationships of the object group, thereby improving the recognition accuracy of the abnormal level of the target object.

[0027] In a specific implementation, the target abnormal data A corresponding to the target object 0 Obtain it by following the steps below: S100, obtaining initial abnormal data corresponding to the target object.

[0028] S200: Clean the initial abnormal data to obtain first intermediate abnormal data corresponding to the target object.

[0029] S300: Perform word embedding conversion on the first intermediate abnormal data to obtain second intermediate abnormal data corresponding to the target object.

[0030] S400, standardize the second intermediate abnormal data to obtain target abnormal data A corresponding to the target object 0 .

[0031] Among them, data cleaning can refer to operations such as noise filtering, missing value filling and outlier processing on initial abnormal data to improve data quality.

[0032] Word vector conversion may refer to converting the first intermediate abnormal data into a vector representation of a preset dimension through word vector technology.

[0033] Standardization processing can refer to converting the processed data into a format acceptable to the model, such as padding the text sequence to a fixed length, min-max standardization, z-score regularization, and other standardization methods to meet the input requirements of the classification model.

[0034] Among them, those skilled in the art know that any data cleaning method, word vector technology and standardization processing method in the prior art falls within the protection scope of the present invention and will not be described in detail here.

[0035] The method for obtaining the associated abnormal data corresponding to each associated object is consistent with the method for obtaining the target abnormal data, which will not be described in detail here.

[0036] In a specific implementation, the memory further stores K historical abnormality levels corresponding to each associated object corresponding to the target object, the historical abnormality levels include description level, general level, important level and emergency level, and the abnormality degree corresponding to the associated object is obtained by the following steps: S500, obtaining a first preset urgency level corresponding to the description level, a second preset urgency level corresponding to the general level, a third preset urgency level corresponding to the important level, and a fourth preset urgency level corresponding to the emergency level.

[0037] S600 , obtaining an average value of the urgency level corresponding to each associated object according to K historical abnormality levels, a first preset urgency level, a second preset urgency level, a third preset urgency level, and a fourth preset urgency level corresponding to each associated object.

[0038] S700: Determine the average value of the urgency level corresponding to each associated object as the abnormality level corresponding to each associated object.

[0039] The preset urgency levels corresponding to the abnormality levels gradually increase in the order of description level, general level, important level and emergency level. Correspondingly, the first preset urgency level < the second preset urgency level < the third preset urgency level < the fourth preset urgency level.

[0040] For any associated object, the average urgency corresponding to the K historical abnormality levels of the current associated object is calculated based on the first preset urgency, the second preset urgency, the third preset urgency and the fourth preset urgency. The larger the average urgency, the higher the possibility and severity of the abnormality of the current associated object. Therefore, the average urgency corresponding to each associated object is determined as the abnormality corresponding to each associated object.

[0041] As described above, based on the K historical abnormality levels corresponding to the associated objects and the preset urgency levels corresponding to each type of historical abnormality level, the average value of the urgency levels corresponding to the associated objects is obtained and used as the corresponding abnormality level to characterize the possibility and severity of the abnormality occurring in the current associated objects. When combining the associated abnormality data of the associated objects and the target abnormality data of the target objects themselves for abnormal situation analysis, a data basis is provided for determining the abnormality source and abnormality path, thereby improving the recognition accuracy of the abnormality level of the target object.

[0042] S2, A 0 , A 1 , ..., A i Input into the preset large language model to obtain the intermediate exception report and exception source identification results, where the intermediate exception report includes the intermediate exception source, intermediate exception means and intermediate exception path, and the exception source identification results include determined exception sources and undetermined exception sources.

[0043] Among them, the target abnormal data and the associated abnormal data corresponding to the first i levels of associated objects are input into the preset large language model for data analysis, and it is determined whether there is abnormal source data of the abnormal situation of the target object in the associated abnormal data corresponding to the i-th level of associated objects, that is, whether there is an abnormal source corresponding to the target object in the i-th level of associated objects, which is used as an intermediate abnormal source to trace the abnormal situation of the target object. And the abnormal means corresponding to the target object are obtained, which are used as intermediate abnormal means to determine the target abnormal means. And the path of abnormal propagation is determined according to the association relationship between the intermediate abnormal source and the associated object, which is used as the intermediate abnormal path to determine the target abnormal path.

[0044] The preset large language model can be trained based on the abnormality-related data of each object in the target object-related field to improve the matching of the preset large language model with the target object and related objects, thereby improving the analysis accuracy of the target abnormal data and related abnormal data, and further improving the recognition accuracy of the target object abnormality level.

[0045] In the above, based on the preset large language model, data analysis is performed on the target abnormal data and the associated abnormal data corresponding to the first i levels of associated objects to determine whether there is an abnormal source corresponding to the target object in the i-th level of associated objects, which serves as the data basis for determining the target abnormality report, thereby improving the accuracy of the analysis of the abnormal propagation situation and further improving the accuracy of the recognition of the abnormal level of the target object.

[0046] S3, if the abnormal source identification result is an undetermined abnormal source, update i=i+1, return to execute step S2, until the preset conditions are met, and use the intermediate abnormality report corresponding to the preset conditions as the target abnormality report, wherein the target abnormality report includes the target abnormality source, the target abnormality means and the target abnormality path, and the target abnormality path includes the target abnormality source, the target object, and several target associated objects between the target abnormality source and the target object.

[0047] Among them, if the abnormal source identification result is an undetermined abnormal source, the intermediate abnormal source, intermediate abnormal means and intermediate abnormal path corresponding to the abnormal source identification result are empty, then i=i+1 is updated, and the target abnormal data and the associated abnormal data corresponding to the associated objects of the first i levels are continuously input into the preset large language model for data analysis, that is, the associated abnormal data of the associated objects of the next level are added during the data analysis, so as to determine whether there is an abnormal source corresponding to the target object in the associated objects of the next level, and the abnormal source corresponding to the target object is traced back step by step by updating the data input in the large language model step by step. Finally, when the preset conditions are met, the corresponding intermediate abnormal report is used as the target abnormal report to characterize the abnormal situation corresponding to the target object and its propagation situation, providing a data basis for identifying the abnormal level of the target object.

[0048] The target anomaly source can refer to the fundamental source or initiating factor that can cause the abnormal situation of the target object, which is finally determined after a series of analysis and tracing processes. It is the initial cause of the entire anomaly. Other related abnormal situations, abnormal propagation paths, etc. are often directly or indirectly related to the target anomaly source.

[0049] Target abnormal means can refer to the specific operations, behaviors, methods or ways that are finally determined and related to causing abnormal conditions in the target object, that is, the direct or indirect mode of action that actually causes the target object to become abnormal. By clarifying the target abnormal means, the specific process and impact of the abnormality can be more clearly understood.

[0050] In a specific implementation, satisfying the preset condition means that the abnormal source identification result is a determined abnormal source.

[0051] In a specific implementation, when the abnormal source identification result is a determined abnormal source, the target abnormal source refers to the associated object with the highest abnormality among the i-th level associated objects corresponding to the target object.

[0052] In a specific implementation manner, satisfying the preset condition means that A 0 , A 1 , ..., A M After inputting into the preset large language model, the abnormal source identification result obtained is an undetermined abnormal source.

[0053] In one embodiment, if A 0 , A 1 , ..., A M After inputting into the preset large language model, if the abnormal source identification result obtained is an undetermined abnormal source, then the target abnormal source refers to the associated object with the highest abnormality among the M-th level associated objects corresponding to the target object.

[0054] As mentioned above, when the source of the exception is not determined, when performing data analysis through the preset large language model, the associated exception data of the next level of associated objects is added to determine whether there is an exception source corresponding to the target object in the next level of associated objects, and by updating the data input in the large language model step by step, the exception source corresponding to the target object is traced back step by step. Finally, when the preset conditions are met, the corresponding intermediate exception report is used as the target exception report to characterize the abnormal situation corresponding to the target object and its propagation situation, which provides a data basis for identifying the abnormal level of the target object, thereby improving the recognition accuracy of the abnormal level of the target object.

[0055] S4, according to A and the target anomaly report, the associated anomaly data corresponding to the target anomaly source and the target anomaly data A corresponding to the target object are 0 , the associated abnormality data corresponding to several target associated objects between the target abnormality source and the target object, and the target abnormality report are input into the trained classification model to obtain the target abnormality level corresponding to the target object.

[0056] Among them, the pre-trained classification model is used to extract and map the features of the input data, and output the target abnormality level corresponding to the target object, which is used to characterize the abnormality degree of the target object and provide a reliable basis for subsequent decision-making and processing.

[0057] The classification model can be trained based on the abnormal data and corresponding abnormal levels of each object in the field corresponding to the target object to improve the classification accuracy of the classification model, thereby improving the recognition accuracy of the abnormal level of the target object.

[0058] In a specific implementation, the trained classification model includes a first classification model and a second classification model, the target abnormal data includes target sequence data and target text data, the associated abnormal data includes associated sequence data and associated text data, and S4 further includes the following steps: S41, inputting the associated sequence data corresponding to the target abnormal source, the target sequence data corresponding to the target object, and the associated sequence data corresponding to several target associated objects between the target abnormal source and the target object into the first classification model to obtain the first abnormality level corresponding to the target object.

[0059] S42, input the associated text data corresponding to the target exception source, the target text data corresponding to the target object, the associated text data corresponding to several target associated objects between the target exception source and the target object, and the target exception report into the second classification model to obtain the second exception level corresponding to the target object.

[0060] S43: Acquire a target abnormality level corresponding to the target object according to the first abnormality level and the second abnormality level.

[0061] Among them, the target sequence data may include data related to the time series such as the data update time and data creation time corresponding to the target object, and the target text data may include data related to the object affected by the exception, the direct source object of the exception, the exception type, and the exception description and text.

[0062] The first classification model may focus on analyzing time series related data, and the second classification model may focus on analyzing text related data. For example, the first classification model may refer to a GRU (Gated Recurrent Unit) model, and the second classification model may refer to an XLNet model.

[0063] The architecture design of the GRU model includes an input layer, an embedding layer, a GRU layer, and a fully connected layer. The input layer accepts the associated sequence data corresponding to the target anomaly source, the target sequence data corresponding to the target object, and the associated sequence data corresponding to several target associated objects between the target anomaly source and the target object. The embedding layer maps the input sequence data into a low-dimensional vector representation. The GRU layer extracts the time dependency and features in the sequence data through its gating mechanism. The fully connected layer maps the output of the GRU layer to the classification result, thereby realizing effective classification of anomaly levels at the level of time series data.

[0064] The XLNet model is a Transformer-based pre-trained language model with powerful text understanding and generation capabilities. The architecture of the XLNet model includes an input layer, a Transformer layer, and a fully connected layer. The input layer accepts associated text data corresponding to the target exception source, target text data corresponding to the target object, associated text data corresponding to several target associated objects between the target exception source and the target object, and a target exception report. The Transformer layer extracts contextual relationships and features from the input text data. The fully connected layer maps the output of the Transformer layer to the classification result, thereby achieving effective classification of exception levels at the text data level.

[0065] Therefore, the target sequence data and target text data corresponding to the target object, as well as the associated sequence data and associated text data corresponding to the associated object are respectively obtained, so as to perform feature extraction and mapping on the associated sequence data corresponding to the target abnormality source, the target sequence data corresponding to the target object, and the associated sequence data corresponding to several target associated objects between the target abnormality source and the target object based on the first classification model to obtain the first abnormality level corresponding to the target object, and perform feature extraction and mapping on the associated text data corresponding to the target abnormality source, the target text data corresponding to the target object, the associated text data corresponding to several target associated objects between the target abnormality source and the target object, and the target abnormality report based on the second classification model to obtain the second abnormality level corresponding to the target object.

[0066] Furthermore, based on the first abnormality level and the second abnormality level, a target abnormality level corresponding to the target object is obtained, so as to comprehensively consider the analysis results of the abnormal data related to the time series and the abnormal data related to the text, improve the comprehensiveness of the analysis of the abnormal situation of the target object, and thus improve the recognition accuracy of the target abnormality level.

[0067] In a specific implementation, the first abnormality level and the second abnormality level include a description level, a general level, an important level, and an emergency level, and the preset urgency levels corresponding to the abnormality levels gradually increase in the order of the description level, the general level, the important level, and the emergency level. S43 includes the following steps: S431: If the first abnormality level and the second abnormality level are consistent, the first abnormality level is determined as the target abnormality level.

[0068] S432: If the first abnormality level and the second abnormality level are inconsistent, the abnormality level with the highest preset urgency between the first abnormality level and the second abnormality level is determined as the target abnormality level.

[0069] Above, initialize i=1 and set A 0 , A 1 , ..., A i Input into the preset large language model, obtain the intermediate exception report and the abnormal source identification result, if the abnormal source identification result is an undetermined abnormal source, update i=i+1, return to the operation steps of executing the large language model until the preset conditions are met, and take the corresponding intermediate exception report when the preset conditions are met as the target exception report, according to A and the target exception report, the associated exception data corresponding to the target abnormal source and the target exception data A corresponding to the target object 0 , the associated abnormal data corresponding to several target associated objects between the target abnormal source and the target object, and the target abnormal report are input into the trained classification model to obtain the target abnormal level corresponding to the target object. It can be seen that when performing data analysis through the preset large language model, the associated abnormal data of the associated objects at the next level are added to determine whether there is an abnormal source corresponding to the target object in the associated objects at the next level. By updating the data input into the large language model step by step, the abnormal source corresponding to the target object is traced back step by step. Finally, when the preset conditions are met, the corresponding intermediate abnormal report is used as the target abnormal report to characterize the abnormal situation corresponding to the target object and its propagation situation. Further, on the basis of the target abnormal report, the classification model is used to extract and map the relevant abnormal data to identify the target abnormal level of the target object, thereby improving the recognition accuracy of the target abnormal level.

[0070] Although some specific embodiments of the present invention have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present invention. It should also be understood by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. An abnormality level identification system based on abnormality tracing, characterized in that: The abnormality level identification system based on abnormality tracing includes a processor and a memory storing a computer program, wherein the memory also stores a trained classification model, target abnormality data A corresponding to the target object, and the like. 0 , the associated abnormal data set A corresponding to the target object = {A 1 , A 2 , ..., A i , ..., A M }, where A i ={A i 1. A i 2, ..., A i j(i) , ..., A i N(i) }, A i j(i) It refers to the associated abnormal data corresponding to the j(i)th i-th level associated object corresponding to the target object, the associated abnormal data includes the corresponding target abnormal data and the corresponding abnormal degree, i=1, 2, ..., M, M refers to the number of levels of the associated objects corresponding to the target object, j(i)=1, 2, ..., N(i), N(i) refers to the total number of i-th associated objects corresponding to the target object, when the computer program is executed by the processor, the following steps are implemented: S1, initialize i=1; S2, A 0 , A 1 , ..., A i Input into the preset large language model to obtain the intermediate anomaly report and the anomaly source identification result, wherein the intermediate anomaly report includes the intermediate anomaly source, the intermediate anomaly means and the intermediate anomaly path, and the anomaly source identification result is a determined anomaly source or an undetermined anomaly source; S3: if the abnormal source identification result is an undetermined abnormal source, update i=i+1, return to execute step S2, until the preset condition is met, and use the corresponding intermediate abnormal report when the preset condition is met as the target abnormal report, wherein the target abnormal report includes the target abnormal source, the target abnormal means and the target abnormal path, and the target abnormal path includes the target abnormal source, the target object, and several target associated objects between the target abnormal source and the target object; S4, according to A and the target abnormality report, the associated abnormality data corresponding to the target abnormality source and the target abnormality data A corresponding to the target object 0 , the associated abnormality data corresponding to several target associated objects between the target abnormality source and the target object, and the target abnormality report are input into the trained classification model to obtain the target abnormality level corresponding to the target object.

2. The abnormality level identification system based on abnormality tracing according to claim 1 is characterized in that: The memory also stores a plurality of initial objects, and association relationships between each initial object and other initial objects and the target object, wherein the association relationships include direct associations and indirect associations, and the associated objects of the target object are obtained by the following steps: S10, according to the association relationship between each initial object and the target object, determining the initial object directly associated with the target object as the first-level associated object corresponding to the target object; S20, according to the association relationship between each initial object and other initial objects, determine the initial object directly associated with each u-th level associated object corresponding to the target object as the u+1-th level associated object corresponding to the target object, where u=1, 2, ..., M-1.

3. The abnormality level identification system based on abnormality tracing according to claim 1 is characterized in that: The target abnormal data A corresponding to the target object 0 Obtain it by following the steps below: S100, obtaining initial abnormal data corresponding to the target object; S200, performing data cleaning on the initial abnormal data to obtain first intermediate abnormal data corresponding to the target object; S300, performing word embedding conversion on the first intermediate abnormal data to obtain second intermediate abnormal data corresponding to the target object; S400, performing standardization processing on the second intermediate abnormal data to obtain target abnormal data A corresponding to the target object 0 .

4. The abnormality level identification system based on abnormality tracing according to claim 1 is characterized in that: The memory also stores K historical abnormality levels corresponding to each associated object corresponding to the target object, wherein the historical abnormality levels include description level, general level, important level and emergency level. The abnormality degree corresponding to the associated object is obtained by the following steps: S500, obtaining a first preset urgency level corresponding to the description level, a second preset urgency level corresponding to the general level, a third preset urgency level corresponding to the important level, and a fourth preset urgency level corresponding to the emergency level; S600, obtaining an average value of the urgency level corresponding to each associated object according to K historical abnormality levels corresponding to each associated object, the first preset urgency level, the second preset urgency level, the third preset urgency level, and the fourth preset urgency level; S700: Determine the average value of the urgency level corresponding to each associated object as the abnormality level corresponding to each associated object.

5. The abnormality level identification system based on abnormality tracing according to claim 1 is characterized in that: The satisfying of the preset condition means that the abnormal source identification result is a determined abnormal source.

6. The abnormality level identification system based on abnormality tracing according to claim 5 is characterized in that: When the abnormal source identification result is a determined abnormal source, the target abnormal source refers to the associated object with the highest abnormality among the i-th level associated objects corresponding to the target object.

7. The abnormality level identification system based on abnormality tracing according to claim 1 is characterized in that: The satisfying of the preset condition refers to 0 , A 1 , ..., A M After inputting into the preset large language model, the abnormal source identification result obtained is an undetermined abnormal source.

8. The abnormality level identification system based on abnormality tracing according to claim 7 is characterized in that: If A 0 , A 1 , ..., A M After inputting into the preset large language model, if the abnormal source identification result obtained is an undetermined abnormal source, then the target abnormal source refers to the associated object with the highest abnormality among the M-th level associated objects corresponding to the target object.

9. The abnormality level identification system based on abnormality tracing according to claim 1 is characterized in that: The trained classification model includes a first classification model and a second classification model, the target abnormal data includes target sequence data and target text data, the associated abnormal data includes associated sequence data and associated text data, and S4 further includes the following steps: S41, inputting the associated sequence data corresponding to the target abnormal source, the target sequence data corresponding to the target object, and the associated sequence data corresponding to a plurality of target associated objects between the target abnormal source and the target object into the first classification model, and obtaining a first abnormality level corresponding to the target object; S42, inputting the associated text data corresponding to the target abnormal source, the target text data corresponding to the target object, the associated text data corresponding to a plurality of target associated objects between the target abnormal source and the target object, and the target abnormal report into the second classification model, and obtaining a second abnormality level corresponding to the target object; S43: Acquire a target abnormality level corresponding to the target object according to the first abnormality level and the second abnormality level.

10. The abnormality level identification system based on abnormality tracing according to claim 9 is characterized in that: The first abnormality level and the second abnormality level include a description level, a general level, an important level and an emergency level, and the preset urgency levels corresponding to the abnormality levels gradually increase in the order of the description level, the general level, the important level and the emergency level. S43 includes the following steps: S431, if the first abnormality level is consistent with the second abnormality level, determining the first abnormality level as the target abnormality level; S432: If the first abnormality level and the second abnormality level are inconsistent, determining the abnormality level with the highest preset urgency between the first abnormality level and the second abnormality level as the target abnormality level.

Images