An emergency response automation alarm handling system with a large language model as a kernel

Abstract

The application discloses an emergency response automation alarm handling system with a large language model as a kernel. The operation process of the system comprises: inputting alarm content of a target device; analyzing the alarm content and outputting suspicious factors and their descriptions; analyzing and outputting auxiliary analysis data types of the suspicious factors; analyzing the weight of each auxiliary analysis data type; obtaining original data; combining and extracting auxiliary analysis data and encapsulating; encapsulating each type of auxiliary analysis data and weight extracted; outputting the false alarm index and reason of the suspicious factors based on the encapsulated weight and data; calculating and outputting the average false alarm index and reason of all suspicious factors. The application utilizes the text analysis and reasoning ability of the large model itself, constructs multiple processing agents based on emergency response alarm analysis and judgment, and realizes an automatic alarm handling system through reasonable task arrangement, thereby providing a new technical means for automatic analysis of device alarms.

Description

Technical Field

[0001] This invention relates to the field of emergency response, and in particular to an automated alarm handling system for emergency response based on a large language model. Background Technology

[0002] Emergency response engineering specifically refers to the ability to promptly locate the attack point and quickly deploy defenses to prevent further exploitation by external attackers when an organization suffers a cyberattack. Typically, we use alarm devices to monitor the activity of various hosts on the internal network. When a host exhibits abnormal behavior, an alarm is triggered. Security engineers then further analyze the generated attack alarms to determine whether they represent a genuine intrusion attack.

[0003] As network environments become increasingly complex and enterprise intranets grow larger, the number of attack alerts is also increasing, placing a growing burden on security engineers. To reduce the workload of security engineers in investigating alerts and improve their efficiency, in addition to improving the quality of alarm matching rules on devices, models can be trained to automatically handle historical alarm content by aggregating historical alarm features. However, when faced with new types of alarms, the trained models still cannot automatically analyze, judge, and handle these new types of alarms due to a lack of autonomous analysis and judgment capabilities.

[0004] Large-scale models trained on massive amounts of data possess considerable reasoning and code generation capabilities, and have a high level of knowledge reserves across various domains. They are widely used in various language processing tasks, such as text generation, language translation, and code generation, and can infer the potential meaning expressed by text. Based on these characteristics, by designing appropriate frameworks and prompts, problems that conventional models cannot handle in specific domains can be solved. For example, in development work, large-scale models can be used as code completion tools to understand the developer's intent and generate usable code. In vulnerability remediation, they can help humans quickly audit defective parts of the code and propose modifications.

[0005] Therefore, considering the characteristics exhibited by the large model, it can be found that it is very suitable for solving the problems faced by automated alarm handling in emergency response engineering. However, there are still many challenges in developing automated alarm handling tools based on the large model:

[0006] (1) False alarms and missed alarms are common problems in alarm handling. Traditional rule-matching alarm devices are prone to generating a large number of false alarms, and although large models have reasoning capabilities, they still make inaccurate judgments when faced with new attack methods. Therefore, how to design model training and optimization mechanisms to improve the accuracy of alarm analysis and reduce false alarms and missed alarms remains a major challenge.

[0007] (2) Diversity and complexity of alarm data: Enterprise network environments are typically very complex, and the alarms generated involve different types of attack methods and device information. Although large models have powerful data analysis capabilities, the diversity of alarm data sources, differences in data formats, and incomplete or noisy data can all affect the performance of the models. How to effectively clean and standardize data and ensure that the model can handle different types of alarms is a challenge that must be overcome.

[0008] The characteristics exhibited by the large model are in line with the capabilities required for automated alarm handling. However, due to the above difficulties, there is a lack of relevant automated alarm handling tools. Therefore, it is important and necessary to design relevant utilization methods and systems. Summary of the Invention

[0009] To address the problem that existing automated alarm handling tools cannot automatically handle new alarms, this invention provides an automated alarm handling system for emergency response based on a large language model.

[0010] The specific technical solution adopted in this invention is as follows:

[0011] In a first aspect, the present invention provides an automated alarm and handling system for emergency response based on a large language model, comprising a suspicious factor module, an auxiliary analysis data module, a weight allocation module, a data encapsulation module, and a result determination module;

[0012] The suspicious factor module is used to obtain the alarm summary of the current alarm in the target device, and extract suspicious factors in the alarm summary through a large language model and generate a description of each suspicious factor; the suspicious factors include files uploaded, commands executed or processes running at the time of the alarm, and the description of the suspicious factor includes the type of the suspicious factor;

[0013] The auxiliary analysis data module is used to acquire all the original data involved in this alarm, and based on the type of each suspicious factor, extract different types of auxiliary analysis data corresponding to each suspicious factor from the original data through a large language model. At the same time, it analyzes the auxiliary analysis data and outputs different types of auxiliary analysis data and their analysis results.

[0014] The weight allocation module assigns weights to various types of auxiliary analysis data through a large language model;

[0015] The data encapsulation module is used to encapsulate suspicious factors and their descriptions, auxiliary analysis data and their analysis results and weights through a large language model;

[0016] The result determination module uses the encapsulation results of the data encapsulation module to determine the false alarm index of suspicious factors through a large language model. It calculates the average false alarm index by combining the false alarm indices of each suspicious factor, determines whether the alarm is a false alarm based on the average false alarm index, and outputs the determination result and the reason for the determination of each suspicious factor.

[0017] A second aspect of the present invention provides an automated emergency response equipment alarm handling method based on a large model, implemented using the aforementioned equipment alarm handling system. The method includes the following steps:

[0018] The suspicious factor module obtains the alarm briefing of the target device, extracts the suspicious factors in the alarm briefing through the large language model, and generates a description of each suspicious factor;

[0019] The auxiliary analysis data module acquires all the raw data involved in this alarm, and based on the type of each suspicious factor, it extracts different types of auxiliary analysis data corresponding to each suspicious factor from the raw data through a large language model. At the same time, it analyzes the auxiliary analysis data and outputs different types of auxiliary analysis data and their analysis results.

[0020] The weight allocation module assigns weights to various types of auxiliary analysis data using a large language model;

[0021] The data encapsulation module encapsulates suspicious factors and their descriptions, auxiliary analysis data and their analysis results and weights through a large language model;

[0022] Based on the encapsulation results of the data encapsulation module, the result judgment module uses a large language model to determine the false alarm index of suspicious factors, calculates the average false alarm index by combining the false alarm indices of each suspicious factor, determines whether the alarm is a false alarm based on the average false alarm index, and outputs the judgment result and the reason for the judgment of each suspicious factor.

[0023] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0024] This invention presents an automated equipment alarm handling method and system based on a large model for emergency response engineering. It proposes an automated alarm handling tool based on the large model, establishing a practical framework for applying large models to the field of automated alarm handling, and is practical. This invention also provides customized Prompt strategies for various sub-tasks of alarm handling in emergency response, offering an effective method to improve the ability of large models to complete various sub-tasks of alarm handling. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the overall structure of an automated alarm handling system for emergency response, which uses a large language model as its core. Detailed Implementation

[0026] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the embodiments described below are intended to facilitate the understanding of the present invention and do not limit it in any way.

[0027] like Figure 1 As shown, this invention proposes an automated emergency response alarm handling system based on a large language model. It mainly consists of a suspicious factor module, an auxiliary data analysis module, a weight allocation module, a data encapsulation module, and a result determination module. This system is suitable for automated alarm handling. The large model mentioned in this invention refers to a large language model, such as the GPT model.

[0028] In the automated alarm handling system, the suspicious factor module is used to obtain alarm briefings from target devices and extract suspicious factors from these briefings. Specifically, the suspicious factor module obtains the alarm ID, calls the API to obtain the alarm briefing corresponding to the alarm platform using the alarm ID, and sends the obtained event briefing to the large model. Based on the content settings of the Prompt template, the large model will perform suspicious factor segmentation and corresponding descriptions on the alarm briefing.

[0029] In this embodiment, the target device is an EDR device or a SIEM system. The described alarm ID is an alarm identifier in the target device, used to mark each alarm; the specific ID format varies depending on the target device manufacturer. The described alarm summary is a description of the alarm content on the alarm platform, including the attack behavior involved in the alarm.

[0030] The described suspicious factors are specifically a breakdown of the attack behavior content in the alert briefing, such as uploaded files, executed commands, operational behaviors, and related processes.

[0031] The described Prompt template includes: describing the thought process of this suspicious factor splitting to the large model, and providing small samples and thought chains for the large model to learn the reasoning process.

[0032] In one embodiment of the present invention, the alarm briefing obtained is: "A certain file executed a certain command, which poses a certain security risk"; the certain file and certain command in the alarm briefing are the suspicious factors.

[0033] The specific thinking patterns include:

[0034] (1) Analyze and extract key information: Identify suspicious elements from the initial alarm information, such as internal IPs, external IPs, processes, files, etc. (2) Classify and summarize: Classify the identified suspicious information according to categories (such as process type, file type, command type, etc.). (3) Infer suspicious causes: Based on the characteristics of the alarm information, infer the suspicious elements and explain their possible sources or causes of risk. (4) Generate structured output: Return the analysis results in the specified format (JSON), ensuring that each piece of suspicious information has a clear type description, a related detailed description, and a status (e.g., "Pending Review").

[0035] The auxiliary analysis data module is used to analyze and judge the raw data types needed for suspicious factors. It includes four sub-modules: data type determination, data acquisition, data analysis and optimization, and data encapsulation. First, the auxiliary analysis data type corresponding to the suspicious factor is determined. Based on this data type, raw data is acquired, and the raw data of each type, along with its analysis, is output.

[0036] The data type determination submodule obtains the suspicious factors that have been separated. Based on the content settings of the Prompt template, the large model will analyze the suspicious factors to determine the required auxiliary analysis data types and corresponding content descriptions.

[0037] The described Prompt template includes: a reasoning process for obtaining auxiliary analytical data types using suspicious factor analysis, oriented towards large models; and provides small sample and thought chain Prompts for large models to learn the reasoning process. Specifically, the reasoning process includes: analyzing the original data types that may be helpful for analysis based on the category to which the suspicious factors belong.

[0038] The described auxiliary analysis data types are primarily data types that can be used to support the analysis of suspicious factors. For example, for a suspicious factor of file type, the corresponding auxiliary analysis data type might be the file size, path, content, and file extension; for a suspicious factor of command type, the corresponding auxiliary analysis data type might be the original text of the command; for a suspicious factor of process type, the corresponding auxiliary analysis data type might be the parent process, child process, and current process content. The specific corresponding auxiliary analysis data type is determined automatically by the large model.

[0039] In one embodiment of the present invention, for a certain suspicious factor, taking a certain file as an example, the required auxiliary analysis data type is the file's reputation, which is described as the file's reputation on threat intelligence websites.

[0040] The data acquisition submodule is used to call the API to obtain all raw data related to this alarm, including the commands, processes, and file types involved in this alarm. The raw data described mainly consists of detailed information about the processes, files, and commands related to this alarm from the forensics system.

[0041] The data analysis and optimization submodule is used to extract data from the acquired raw data that conforms to the data type description for auxiliary analysis and to perform certain parsing. Specifically, the data analysis and optimization submodule uses a large model to extract the required content from the raw data according to the classification results of the raw data, guided by the Prompt. The extracted data is the auxiliary analysis data, and the large model performs a brief analysis on the extracted auxiliary analysis data according to the description in the Prompt.

[0042] The described Prompt template includes: a description for large models on how to accurately extract and analyze content conforming to the original data type definitions from large amounts of raw data, and encapsulate it; providing small samples and thought-chain Prompts for large models to learn the reasoning process within. The description of how to extract and analyze specifically includes: extracting the most relevant content from the raw data text based on the classification and description of the original data type, and performing analysis on commands, file content, and process context. Specifically, if the auxiliary analysis data is command data, then the function and execution result of the command are analyzed; if the auxiliary analysis data is file-related data, then the content of the file is summarized, and whether the file contains malicious code is analyzed; if the auxiliary analysis data is process data, then the function and execution result of the process are analyzed.

[0043] The data encapsulation submodule is used to encapsulate the data types for auxiliary analysis, as well as the extracted raw data and parsed results. Specifically, the data encapsulation submodule uses the large model to encapsulate the auxiliary analysis data types, auxiliary analysis data content, and auxiliary analysis data analysis results output by the data type determination submodule, data acquisition submodule, and data analysis and optimization submodule, according to the Prompt description.

[0044] The weight allocation module is used to assign weights to various types of raw data based on the description of the auxiliary analysis data type.

[0045] The weight allocation module obtains the auxiliary analysis data type and corresponding content description and sends them to the large model. Based on the content settings of the Prompt template, the large model analysis assigns weights based on the original data type and description content.

[0046] The described Prompt template includes: a reasoning process for large models to derive the weights of each auxiliary analysis data type based on its description, and provides small samples and a thought process Prompt for the large model to learn from this reasoning process. Specifically, the reasoning process includes: assigning weights to each auxiliary analysis data type based on its classification, its description's self-analysis importance, and its relevance to the current alarm, in order to further evaluate the weight of the hazard information. The weighting rule is: a value between 0 and 1 is used, and the sum of the weights of all auxiliary analysis data types is equal to 1. Based on this reasoning process, the large model first understands the content of the auxiliary analysis data type based on its description, then analyzes various auxiliary analysis data in the original data, and determines its importance based on the weight of each auxiliary analysis data type.

[0047] The data encapsulation module is used to encapsulate auxiliary analysis data and its corresponding weights. Specifically, the data encapsulation module encapsulates the aforementioned suspicious factor module, auxiliary analysis data module, suspicious factor types and descriptions obtained from weight allocation, auxiliary analysis data of each type and their analysis, and weights of each auxiliary analysis data type, and sends them to the large model. Guided by the Prompt template, the large model will output the encapsulation results.

[0048] The described Prompt template includes: providing the format of the data content obtained from the encapsulation of the suspicious factor module, the auxiliary analysis data module, and the weight allocation module for large models, and providing case studies to guide the encapsulation structure of large models.

[0049] The result determination module is used to determine the false alarm index and cause of suspicious factors based on the acquired raw data and weights, and outputs the false alarm index and analysis of the cause. Specifically, the result determination module obtains the encapsulation result from the data encapsulation module and sends it to the large model. Based on the content settings of the Prompt template, the large model will comprehensively judge and output the false alarm index and cause of the suspicious factor based on the content and weights of each raw data. It calculates the average false alarm index of each suspicious factor, integrates the causes, determines whether the alarm is a false alarm based on the average false alarm index, and outputs the final false alarm index and the corresponding cause of each suspicious factor.

[0050] The described Prompt template includes: providing a thought process for large models, specifically analyzing raw data and weight parameters to demonstrate the false positive index of suspicious factors and providing the analysis process; and providing small samples and thought chain Prompts for large models to learn the reasoning process. This analysis process constitutes the determination of the cause, indicating why the suspicious factor is judged as a false positive or not a false positive.

[0051] In this embodiment, the false alarm index is limited to the range of 0 to 100. If the average false alarm index of each suspicious factor is greater than 50, it is determined to be a false alarm; otherwise, it is determined not to be a false alarm.

[0052] In one embodiment of the present invention, the final average false alarm index is 10, which is determined to be not a false alarm. The reason for the determination is: "Taking the suspicious factor of the file type as an example, the reason for the determination may be that the file type has a good reputation on the threat intelligence website and has not been marked as a high-risk file by any user."

[0053] The workflow of the entire automated alarm handling system includes the following steps:

[0054] (10) Enter the alarm ID.

[0055] (11) Obtain alarm event summary by alarm ID.

[0056] (12) Use large models to extract suspicious factors from event briefings.

[0057] (13) Use large model analysis to support the analysis of the original data types required for judging suspicious factors.

[0058] (14) Obtain the original data related to the alarm from the device.

[0059] (15) Use large models to extract and analyze the auxiliary analysis data types in the original data that meet the requirements for judging suspicious factors.

[0060] (16) Use large model output to assist in analyzing the weights of each type in the data type.

[0061] (17) Use a large model to encapsulate suspicious factors and their descriptions, auxiliary analysis data types, auxiliary analysis data and weights.

[0062] (18) Use large model analysis to encapsulate the data, generate the false alarm index of suspicious factors and the analysis process, calculate and output the average false alarm index of all suspicious factors and the reason for the judgment.

[0063] In summary, the final output will be an analysis report based on this alarm, which includes the average false alarm index of all suspicious factors in the alarm and the reason for the judgment.

Claims

1. An automated emergency response equipment alarm handling system based on a large language model, characterized in that, It includes a suspicious factor module, an auxiliary analysis data module, a weight allocation module, a data encapsulation module, and a result determination module; The suspicious factor module is used to obtain the alarm summary of the current alarm in the target device, send the alarm summary to the big language model, and input prompt words for extracting suspicious factors into the big language model, so that the big language model returns the suspicious factors and their descriptions in the alarm summary; the alarm summary is the description of the alarm on the alarm platform of the target device, including the suspicious operation content involved in the alarm. The types of suspicious factors include files uploaded, commands executed, or processes running during this alarm. The description of the suspicious factor includes: the type of the suspicious factor and an explanation of the risk source or cause of the suspicious factor. The auxiliary analysis data module includes a data acquisition submodule, a data type determination submodule, and a data analysis optimization submodule; The data acquisition submodule is used to acquire all the original data involved in this alarm, including all commands, processes and files involved in this alarm; The data type determination submodule is used to determine the auxiliary analysis data type based on the type of each suspicious factor using a large language model, and to generate a description of each auxiliary analysis data type. The auxiliary analysis data type is the original data type that helps in the analysis of the suspicious factor, including the original text of the command executed in this alarm, the content of the process running in this alarm, and the size, path, and content of the file uploaded in this alarm. The description of each auxiliary analysis data type is used to help the large language model understand the meaning of the auxiliary analysis data type. The data analysis and optimization submodule is used to input auxiliary analysis data types and their descriptions into the large language model, instructing the large language model to extract the most relevant auxiliary analysis data from all the original data texts of this alarm, and requiring the large language model to perform the following analyses on the auxiliary analysis data and output the analysis results: if the auxiliary analysis data is command data, analyze the function and execution result of the command; if the auxiliary analysis data is file-related data, analyze and summarize the content of the file and analyze whether the file contains malicious code; if the auxiliary analysis data is process data, analyze the function and running result of the process. The weight allocation module is used to send the auxiliary analysis data types and their descriptions to the large language model, so that the large model can independently analyze the importance of each auxiliary analysis data type and its correlation with the current alarm, and allocate weights to each auxiliary analysis data type according to the results of the importance and correlation analysis. The data encapsulation module is used to encapsulate suspicious factors and their descriptions, auxiliary analysis data and their analysis results and weights through a large language model to obtain data encapsulation results; The result determination module uses the encapsulation result of the data encapsulation module to determine the false alarm index of suspicious factors through a large language model, calculates the average false alarm index by combining the false alarm indices of each suspicious factor, determines whether the alarm is a false alarm based on the average false alarm index, and outputs the determination result and the reason for the determination of each suspicious factor.

2. The emergency response automated equipment alarm handling system based on a large language model as its kernel, as described in claim 1, is characterized in that, The specific steps for obtaining the alarm summary of the current alarm in the target device are as follows: obtain the alarm ID of the target device, and obtain the alarm summary corresponding to the alarm ID by calling the API of the target device.

3. The emergency response automated equipment alarm handling system based on a large language model as its kernel, as described in claim 1, is characterized in that... The prompts extracted from the suspicious factors include: 1) Identify suspicious factors from the input alarm briefings; 2) The identified suspicious factors are categorized into different types, including processes, files, and commands; 3) Based on the content of the alarm briefing, infer the suspicious factors and explain their possible sources or causes of risk; 4) Integrate each suspicious factor, its type, and a description of the source or cause of the risk into a single analysis result.

4. The emergency response automated equipment alarm handling system based on a large language model as its kernel, as described in claim 1, is characterized in that... The process of encapsulating suspicious factors and their descriptions, auxiliary analysis data and their analysis results and weights through a large language model involves sending the suspicious factors and their corresponding descriptions, auxiliary analysis data and their corresponding analysis results and weights to the large language model, providing the large language model with an encapsulation format, and providing encapsulation cases to the large language model so that the large language model can encapsulate the input data.

5. The emergency response automated equipment alarm handling system based on a large language model as its kernel, as described in claim 1, is characterized in that... The specific method for determining the false alarm index of a suspicious factor is as follows: input the encapsulation result of the data encapsulation module into the large language model, and let the large language model analyze the auxiliary analysis data and its weights to confirm the false alarm index of the suspicious factor. When the false alarm index is greater than the set threshold, it is determined to be a false alarm; otherwise, it is determined not to be a false alarm. The determination result and the analysis process of the auxiliary analysis data and its weights are returned. The analysis process is the reason for the determination of the suspicious factor.

6. A method for automated emergency response equipment alarm handling based on a large language model, characterized in that, The alarm handling method includes the following steps: Obtain the alarm summary of the current alarm from the target device, send the alarm summary to the large language model, and input prompt words for extracting suspicious factors into the large language model, so that the large language model returns the suspicious factors and their descriptions in the alarm summary; the alarm summary is the description of the alarm on the alarm platform of the target device, including the suspicious operation content involved in the alarm; the type of the suspicious factor includes the file uploaded, the command executed or the process running at the time of the alarm, and the description of the suspicious factor includes: the type of the suspicious factor and an explanation of the risk source or cause of the suspicious factor; Obtain all raw data related to this alarm, including all commands, processes, and files involved in this alarm; Based on the type of each suspicious factor, the auxiliary analysis data type is determined through a large language model, and a description of each auxiliary analysis data type is generated. The auxiliary analysis data type is the original data type that helps in the analysis of the suspicious factor, including the original text of the command executed in this alarm, the content of the process run in this alarm, and the size, path and content of the file uploaded in this alarm. The description of each auxiliary analysis data type is used to help the large language model understand the meaning of the auxiliary analysis data type. Input the auxiliary analysis data type and its description into the large language model, and instruct the large language model to extract the most relevant auxiliary analysis data from all the original data texts of this alarm. The large language model is required to perform the following analyses on the auxiliary analysis data and output the analysis results: If the auxiliary analysis data is command data, analyze the function and execution result of the command; if the auxiliary analysis data is file-related data, analyze and summarize the content of the file and analyze whether the file contains malicious code; if the auxiliary analysis data is process data, analyze the function and running result of the process. Send the auxiliary analysis data types and their descriptions to the large language model, allowing the large model to autonomously analyze the importance of each auxiliary analysis data type and its correlation with this alarm, and assign weights to each auxiliary analysis data type based on the results of the importance and correlation analysis. The data encapsulation results are obtained by encapsulating suspicious factors and their descriptions, auxiliary analysis data and their analysis results and weights through a large language model; Based on the encapsulation results of the data encapsulation module, the false alarm index of suspicious factors is determined by the large language model. The average false alarm index is calculated by combining the false alarm indices of each suspicious factor. Based on the average false alarm index, it is determined whether the alarm is a false alarm, and the determination result and the reason for the determination of each suspicious factor are output.

Images