Script matching method and device, equipment and storage medium

Abstract

The invention belongs to the technical field of network security, and discloses a script matching method, script matching equipment, a storage medium and a script matching device. Text information corresponding to a target alarm event is input into a preset cross encoder, and a script correlation score is obtained; the script correlation score is used for representing the matching degree between the target alarm event and an associated script, and the preset cross coding is an encoder obtained based on large language model training; according to the method, related scripts are sorted according to script correlation scores, a target script is screened out according to a sorting result, and compared with a traditional script selection mode, limitation exists, and when scripts and alarm types are variable, the scripts cannot be selected quickly and correctly, so that the processing efficiency is low. Semantic matching between the alarm event and the script is completed through the preset cross coding, and the target script is determined according to the script correlation score, so that the script matching accuracy is improved, and the processing efficiency of safety operation personnel is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a script matching method, equipment, storage medium and device. Background Art

[0002] At present, with the development of software, for product categories such as SIEM and SOAR, there is a need to automatically handle alarms. However, the existing practice is to pre-set a large number of playbooks (a piece of Python code that can call the product API to perform various operations). When a specific alarm is triggered, the user is asked to select a corresponding playbook to execute a response. However, the above method has limitations. When the types of playbooks and alarms are varied, it is difficult for junior security operations personnel to have the experience and energy to quickly and correctly select the playbook. Therefore, it cannot be highly automated, resulting in low processing efficiency. Summary of the Invention

[0003] The main purpose of the present invention is to provide a script matching method, equipment, storage medium and device, aiming to solve the limitations of traditional script selection methods. When the scripts and alarm types are varied, the script cannot be selected quickly and correctly, resulting in low processing efficiency. Technical problems.

[0004] To achieve the above object, the present invention provides a script matching method, which is applied to a cloud server. The script matching method includes the following steps:

[0005] Input the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score, which is used to characterize the matching degree between the target alarm event and the associated script. The preset cross encoder is an encoder obtained by training a large language model;

[0006] The related scripts are sorted according to the script relevance scores, and the target script is screened out according to the sorting results.

[0007] Optionally, the step of inputting the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score includes:

[0008] Input the text information corresponding to the target alarm event into the preset cross encoder to determine the alarm type;

[0009] Determining, according to the alarm type, an associated script for the target alarm event from a preset script set;

[0010] A script relevance score is determined based on the confidence level corresponding to the associated script.

[0011] Optionally, the step of determining, according to the alarm type, an associated script for the target alarm event from a preset script set includes:

[0012] Filtering a script set of a target type from a preset script set according to the alarm type;

[0013] The text information corresponding to the target alarm event is matched with the text information corresponding to the script set to determine the associated script of the target alarm event.

[0014] Optionally, the step of matching the text information corresponding to the target alarm event with the text information corresponding to the script set to determine the associated script of the target alarm event includes:

[0015] Matching the text information corresponding to the target alarm event with the text information corresponding to the script set to obtain a matching result;

[0016] Determine whether the script in the script set is suitable for handling the target alarm event according to the matching result, and obtain a determination result;

[0017] Determine the associated script of the target alarm event according to the judgment result.

[0018] Optionally, the step of determining the script relevance score according to the confidence level corresponding to the associated script includes:

[0019] Determining the confidence level of the word according to the judgment result;

[0020] A script relevance score is determined based on the confidence level.

[0021] Optionally, the step of sorting the related scripts according to the script relevance scores and filtering out the target script according to the sorting results includes:

[0022] Sort the related scripts according to the script relevance scores according to a preset arrangement rule to obtain a sorting result;

[0023] Target scripts are screened out according to the sorting results and preset screening rules.

[0024] Optionally, before the step of inputting the text information corresponding to the target alarm event into a preset cross encoder to obtain the script relevance score, the step further includes:

[0025] Build an alarm sample set based on historical security alarm events;

[0026] The description information corresponding to the alarm sample set and the description information of the preset script are input into an initial cross encoder for training to obtain a preset cross encoder.

[0027] Optionally, the step of inputting the alarm sample set and the description information of the preset scenario into an initial cross encoder for training to obtain a preset cross encoder includes:

[0028] Inputting the description information corresponding to the alarm event in the alarm sample set and the description information of the preset script into the initial cross encoder, determining whether the preset script is suitable for handling the alarm event, and obtaining a determination result;

[0029] Determining whether the initial cross encoder is trained according to the judgment result;

[0030] If so, the trained cross encoder is output as the preset cross encoder.

[0031] Optionally, the step of screening out target scripts according to the sorting results and preset screening rules includes:

[0032] Target scripts with score exceeding a preset score are filtered out from the sorting results according to preset filtering rules.

[0033] Optionally, after the step of sorting the related scripts according to the script relevance scores and selecting the target script according to the sorting results, the method further includes:

[0034] Associating the alarm event with the target script and generating a recommendation list;

[0035] The recommendation list is pushed to security operations personnel.

[0036] In addition, to achieve the above-mentioned purpose, the present invention also proposes a script matching device, which includes a memory, a processor, and a script matching program stored on the memory and runnable on the processor, and the script matching program is configured to implement the script matching steps as described above.

[0037] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a script matching program is stored. When the script matching program is executed by a processor, the steps of the script matching method described above are implemented.

[0038] In addition, to achieve the above-mentioned purpose, the present invention further proposes a script matching device, which includes:

[0039] A local matching module is used to input the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score, which is used to represent the matching degree between the target alarm event and the associated script. The preset cross encoder is an encoder obtained by training a large language model;

[0040] The script screening module is used to sort the related scripts according to the script relevance scores and screen out the target script according to the sorting results.

[0041] Optionally, the local matching module is further configured to input text information corresponding to the target alarm event into a preset cross encoder to determine the alarm type;

[0042] The local matching module is further configured to determine, according to the alarm type, an associated script of the target alarm event from a preset script set;

[0043] The local matching module is further used to determine a script relevance score based on the confidence level corresponding to the associated script.

[0044] Optionally, the local matching module is further configured to filter out a script set of a target type from a preset script set according to the alarm type;

[0045] The local matching module is further used to match the text information corresponding to the target alarm event with the text information corresponding to the script set to determine the associated script of the target alarm event.

[0046] Optionally, the local matching module is further configured to match the text information corresponding to the target alarm event with the text information corresponding to the script set to obtain a matching result;

[0047] The local matching module is further configured to determine, based on the matching result, whether the script in the script set is suitable for handling the target alarm event, and obtain a determination result;

[0048] The local matching module is further used to determine the associated script of the target alarm event according to the judgment result.

[0049] Optionally, the local matching module is further configured to determine the confidence level of the word based on the judgment result;

[0050] The local matching module is further used to determine a script relevance score based on the confidence level.

[0051] Optionally, the script screening module is further configured to sort the related scripts according to a preset arrangement rule based on the script relevance score to obtain a sorting result;

[0052] The local screening module is further used to screen out target scripts based on the sorting results and preset screening rules.

[0053] Optionally, the script matching device further comprises an encoder construction module;

[0054] The encoder construction module is further used to construct an alarm sample set based on historical security alarm events;

[0055] The encoder construction module is further used to input the description information corresponding to the alarm sample set and the description information of the preset script into the initial cross encoder for training to obtain the preset cross encoder.

[0056] Optionally, the encoder construction module is further configured to input description information corresponding to the alarm event in the alarm sample set and description information of the preset script into an initial cross encoder, determine whether the preset script is suitable for handling the alarm event, and obtain a determination result;

[0057] The encoder construction module is further configured to determine whether the initial cross encoder training is completed according to the judgment result;

[0058] The encoder construction module is further configured to output the trained cross encoder as a preset cross encoder if the trained cross encoder is true.

[0059] The present invention obtains a script relevance score by inputting text information corresponding to the target alarm event into a preset cross-encoder, wherein the script relevance score is used to characterize the matching degree between the target alarm event and the associated script. The preset cross-encoder is an encoder obtained based on large language model training; the associated scripts are sorted according to the script relevance score, and the target script is screened out according to the sorting result. Compared with the traditional script selection method, there are limitations. When the script and alarm types are variable, the script cannot be selected quickly and correctly, resulting in low processing efficiency. The present invention completes the semantic matching between the alarm event and the script through preset cross-encoding, and determines the target script according to the script relevance score, thereby improving the accuracy of script matching, thereby improving the processing efficiency of security operations personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a structural diagram of a script matching device in a hardware operating environment involved in an embodiment of the present invention;

[0061] Figure 2 This is a flow chart of the first embodiment of the script matching method of the present invention;

[0062] Figure 3 This is a schematic diagram of encoder training in the first embodiment of the script matching method of the present invention;

[0063] Figure 4 This is a schematic diagram of the relevance scoring process of the first embodiment of the script matching method of the present invention;

[0064] Figure 5 This is a flow chart of a second embodiment of the script matching method of the present invention;

[0065] Figure 6This is a structural block diagram of the first embodiment of the script matching device of the present invention.

[0066] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0067] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0068] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of a script matching device in the hardware operating environment involved in the embodiment of the present invention.

[0069] like Figure 1 As shown, the script matching device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), and optionally the user interface 1003 may also include a standard wired interface and a wireless interface. The wired interface of the user interface 1003 may be a USB interface in the present invention. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable memory (NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0070] Those skilled in the art will understand that Figure 1 The structure shown in does not constitute a limitation on the script matching device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0071] like Figure 1 As shown, the memory 1005 identified as a computer storage medium may include an operating system, a network communication module, a user interface module, and a script matching program.

[0072] exist Figure 1In the script matching device shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the user device; the script matching device calls the script matching program stored in the memory 1005 through the processor 1001, and executes the script matching method provided by the embodiment of the present invention.

[0073] Based on the above hardware structure, an embodiment of the script matching method of the present invention is proposed.

[0074] Reference Figure 2 , Figure 2 This is a flow chart of the first embodiment of the script matching method of the present invention, which provides the first embodiment of the script matching method of the present invention.

[0075] In this embodiment, the script matching method is applied to a cloud server, and the script matching method includes the following steps:

[0076] Step S10: Input the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score.

[0077] It should be noted that the execution subject in this embodiment can be a device that includes a script matching system. The script matching system has the functions of alarm management, case management, script management, orchestration engine, security response and object management. The device can be a mobile phone, a computer, or a tablet. In this embodiment and the following embodiments, the script matching method of the present invention is explained using a computer as an example.

[0078] It is understandable that the script relevance score is used to characterize the matching degree between the target alarm event and the associated script, and the preset cross-encoder is an encoder obtained by training based on a large language model. The preset cross-encoder can be an encoder obtained by training based on a large language model in advance, wherein the training process of the cross-encoder can refer to Figure 3 The encoder training diagram shown in the figure inputs natural language sentence A and sentence B, and gives a correlation score between the two, which is applicable to a variety of scenarios. For example, in a question-and-answer scenario, sentence A is a question and sentence B is an article fragment, which is used to score the extent to which the article fragment can answer the question. In order to improve the encoder's understanding ability, this solution uses a large language model with security knowledge as a cross-encoder to give a matching score to each "alarm-script" pair, thereby realizing semantic-based response script recommendations. The script can refer to a means of associating handling applications and actions when handling security alarm events. The underlying driver of the script is the workflow engine, which then calls security protection facilities.

[0079] It should be understood that this solution obtains a script relevance score by inputting the text information corresponding to the target alarm event into a preset cross-encoder. The text information may refer to the descriptive information corresponding to the target alarm event, and the descriptive information is represented in text form. By inputting this descriptive information into the preset cross-encoder, a script relevance score between the alarm and the script is determined, and the script relevance score can be represented by a value between 0 and 1.

[0080] Furthermore, the step S10 also includes: inputting the text information corresponding to the target alarm event into a preset cross-encoder to determine the alarm type; determining the associated script of the target alarm event from a preset script set according to the alarm type; and determining the script relevance score according to the confidence level corresponding to the associated script.

[0081] It should be noted that the text information corresponding to the target alarm event (i.e., descriptive information in text form) is input into a preset cross-encoder to determine the alarm type, wherein the alarm type corresponding to the target alarm event can be determined through alarm preprocessing, alarm analysis, and alarm merging. The alarm preprocessing can be performed by screening out massive alarm events, eliminating false alarms, and merging the remaining alarms to remove duplicates to obtain alarms to be analyzed. The alarm type can refer to the type of network security affected by the target alarm event, such as: access alarms, malware alarms, vulnerability alarms, denial of service alarms, etc. There will be different handling methods for different alarm types, so different associated scripts need to be matched according to the alarm type.

[0082] It is understood that, based on the alarm type, the associated scripts are determined from a preset script set, and the script relevance score is determined based on the confidence level of the associated scripts. The preset script set can be a large number of pre-set script sets corresponding to the product. This solution automatically selects the target script through the script relevance score, thereby improving processing efficiency.

[0083] Furthermore, the step of determining the associated script of the target alarm event from a preset script set based on the alarm type includes: filtering out a script set of the target type from the preset script set based on the alarm type; matching the text information corresponding to the target alarm event with the text information corresponding to the script set to determine the associated script of the target alarm event.

[0084] It should be noted that the target type of script set is selected from the preset script set based on the alarm type. The target type can be a script type determined for the alarm type. For example, when the alarm type is a login failure alarm type, the script type is a handling type determined based on the login operation. The script set to be matched is selected from the preset script set based on the handling type corresponding to the login operation.

[0085] It is understandable that the text similarity is determined by matching the text information corresponding to the above-mentioned script set to be matched with the text information corresponding to the target alarm event, and related scripts are screened out from the script set based on the text similarity.

[0086] Furthermore, the step of matching the text information corresponding to the target alarm event with the text information corresponding to the script set to determine the associated script of the target alarm event includes: matching the text information corresponding to the target alarm event with the text information corresponding to the script set to obtain a matching result; judging whether the scripts in the script set are suitable for handling the target alarm event based on the matching result to obtain a judgment result; and determining the associated script of the target alarm event based on the judgment result.

[0087] It should be noted that the text information corresponding to the target alarm event is matched with the text information corresponding to the script set to obtain a matching result; the matching result refers to the text similarity, and the text similarity can be the similarity obtained through semantic matching. The similarity is used to judge whether the scripts in the script set are suitable for handling the target alarm event to obtain a judgment result.

[0088] It is understandable that the judgment result includes two results, yes or no, and includes the confidence level of the words corresponding to the two results, so as to determine the associated script of the target alarm event according to the confidence level of the words.

[0089] Furthermore, the step of determining the script relevance score based on the confidence level corresponding to the associated script includes: determining the confidence level of the word based on the judgment result; and determining the script relevance score based on the confidence level.

[0090] It should be noted that the confidence level of the word may be the confidence level corresponding to the word "yes" or "no", and the confidence level may be expressed in the form of a percentage.

[0091] It is understood that, to further illustrate this solution, reference may be made to Figure 4 The relevance scoring process is shown in the figure. In this solution, the input and output of the large model are both text, and it also provides confidence scores for each word (token) in the output text. Therefore, during implementation, the "alarm description N" and "script description M" are input into the large model as text, and the large model is asked to assign a relevance score between 0 and 1.

[0092] Step S20: Sort the related scripts according to the script relevance scores, and select the target script based on the sorting results.

[0093] It is understandable that this solution sorts the related scripts by the script relevance score, thereby filtering out the target script according to the sorting result, and the sorting result can be the related script sorting result obtained by sorting according to the score of the script relevance score.

[0094] This embodiment obtains a script relevance score by inputting text information corresponding to the target alarm event into a preset cross-encoder, wherein the script relevance score is used to characterize the matching degree between the target alarm event and the associated script. The preset cross-encoder is an encoder obtained based on large language model training; the associated scripts are sorted according to the script relevance score, and the target script is screened out according to the sorting result. Compared with the traditional script selection method, there are limitations. When the script and alarm types are variable, the script cannot be selected quickly and correctly, resulting in low processing efficiency. This embodiment completes the semantic matching between the alarm event and the script through preset cross-encoding, and determines the target script according to the script relevance score, thereby improving the accuracy of script matching, thereby improving the processing efficiency of security operations personnel.

[0095] Based on the above Figure 2 The first embodiment shown in FIG. 2 is a second embodiment of the script matching method of the present invention, referring to FIG. Figure 5 , Figure 5 2 is a flow chart of the second embodiment of the script matching method of the present invention.

[0096] In this embodiment, step S20 further includes:

[0097] Step S201: Sort the related scripts according to the script relevance scores according to a preset arrangement rule to obtain a sorting result.

[0098] It should be noted that this solution can sort the script relevance scores according to a preset arrangement rule, where the preset arrangement rule can be an arrangement rule from large to small, and sort the related scripts to obtain the sorted related scripts.

[0099] Step S202: Filter out target scripts according to the sorting results and preset filtering rules.

[0100] It should be noted that the target script is screened out from the associated scripts sorted from largest to smallest by a preset screening rule. The preset screening rule can be a pre-set method for screening the scripts in the sorting results according to a preset score to obtain the target script.

[0101] Furthermore, the step S202 also includes: filtering out target scripts with scoring scores exceeding a preset score from the sorting results according to a preset filtering rule.

[0102] In the specific implementation, the target scripts with a score exceeding the preset score are filtered out from the sorting results through the preset filtering rules. For example, the preset score is set to 0.8, and the scripts with a score exceeding 0.8 are output as target scripts. The above example values ​​are only used for illustration.

[0103] In this embodiment, after step S20, the method further includes: associating the alarm event with the target script and generating a recommendation list; and pushing the recommendation list to security operations personnel.

[0104] In the specific implementation, this solution selects the top few "alarm-scripts" with the highest correlation scores to build a recommendation list for recommendation and displays it to security operations personnel, so that security operations personnel can filter out the optimal script through the recommendation list to handle the target alarm event.

[0105] This embodiment obtains a script relevance score by inputting text information corresponding to the target alarm event into a preset cross-encoder, wherein the script relevance score is used to characterize the matching degree between the target alarm event and the associated script, and the preset cross-encoder is an encoder obtained based on large language model training; the associated scripts are sorted according to preset arrangement rules according to the script relevance score to obtain a sorting result; the target script is screened out according to the sorting result and preset screening rules. Compared with the traditional script selection method, there are limitations. When the script and alarm types are variable, the script cannot be selected quickly and correctly, resulting in low processing efficiency. This embodiment completes the semantic matching between the alarm event and the script through preset cross-encoding, and determines the target script according to the script relevance score, thereby improving the accuracy of script matching, thereby improving the processing efficiency of security operations personnel.

[0106] Based on the above Figure 5 The second embodiment shown proposes the third embodiment of the script matching method of the present invention.

[0107] In this embodiment, the step S10 also includes: constructing an alarm sample set based on historical security alarm events; inputting the description information corresponding to the alarm sample set and the description information of the preset script into the initial cross encoder for training to obtain a preset cross encoder.

[0108] It should be noted that in this scheme, a cross-encoder is obtained by training using the self-learning new task capability of the large language model. This scheme constructs an alarm sample set through historical security alarm events, and inputs the description information corresponding to the alarm sample set and the description information of the preset script into the initial cross-encoder for training to obtain a preset cross-encoder.

[0109] It can be understood that this solution first gives the large language model learning samples to act as a cross-encoder to determine whether there are several relevant samples, and then allows the large language model to judge specific inputs. The training process in this solution can be carried out in the form of question-answering templates to perform sample training, thereby guiding the large model to execute the cross-encoder examples, and then output the trained cross-encoder.

[0110] Furthermore, the step of inputting the description information of the alarm sample set and the preset script into the initial cross-encoder for training to obtain the preset cross-encoder includes: inputting the description information corresponding to the alarm event in the alarm sample set and the description information of the preset script into the initial cross-encoder, judging whether the preset script is suitable for handling the alarm event, and obtaining a judgment result; judging whether the initial cross-encoder is trained according to the judgment result; if so, outputting the trained cross-encoder as the preset cross-encoder.

[0111] It should be noted that the description information corresponding to the alarm event in the alarm sample set and the description information of the preset script are input into the initial cross-encoder to determine whether the preset script is suitable for handling the alarm event and obtain a judgment result; the judgment result is composed of yes or no, and the result in the judgment result is used to determine whether the initial cross-encoder training is completed. In this scheme, when yes or no exists at the same time in the judgment result, it is determined that the training is completed. If it only contains yes or no results, it is determined that the training has failed and training needs to be continued.

[0112] It is understandable that, if the training is completed, the trained cross encoder is output as the preset cross encoder.

[0113] In a specific implementation, for example, the security response script recommendation engine determines whether the script is suitable for handling the alert based on an alert description and a response script description. You can only answer "yes" or "no". Here are a few examples:

[0114] Script: Sample 1 Script Description...

[0115] Alarm: Sample 1 Alarm Description Content...

[0116] Judgment: Yes.

[0117] Script: Sample 2 Script Description...

[0118] Alarm: Sample 2 Alarm Description Content...

[0119] Judgment: No.

[0120] According to the above judgment results, the cross encoder training is determined to be complete, and the cross encoder is used in the actual processing process, for example:

[0121] Script: The script describes the content of M...

[0122] Alarm: Alarm description N content...

[0123] Judgment: Yes.

[0124] For further explanation, please refer to Figure 4 The encoder execution process in the relevance scoring process diagram shown above illustrates the encoder execution process. In this solution, the pre-trained cross-encoder only requires the large model to answer "yes" or "no" in actual processing. The confidence level of the "yes" or "no" word is then converted into a confidence level between 0 and 1, which is the relevance score. Finally, the algorithm selects the top few "alert-script" recommendations with the highest relevance scores and displays them to security operations personnel.

[0125] This embodiment obtains a script relevance score by inputting text information corresponding to the target alarm event into a preset cross-encoder, wherein the script relevance score is used to characterize the matching degree between the target alarm event and the associated script. The preset cross-encoder is an encoder obtained based on large language model training; the associated scripts are sorted according to the script relevance score, and the target script is screened out according to the sorting result. Compared with the traditional script selection method, there are limitations. When the script and alarm types are variable, the script cannot be selected quickly and correctly, resulting in low processing efficiency. This embodiment completes the semantic matching between the alarm event and the script through preset cross-encoding, and determines the target script according to the script relevance score, thereby improving the accuracy of script matching, thereby improving the processing efficiency of security operations personnel.

[0126] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a script matching program is stored. When the script matching program is executed by a processor, the steps of the script matching method described above are implemented.

[0127] Reference Figure 6 , Figure 6 This is a structural block diagram of the first embodiment of the script matching device of the present invention.

[0128] like Figure 6 As shown, the script matching device proposed in the embodiment of the present invention includes:

[0129] The local matching module 10 is used to input the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score, which is used to represent the matching degree between the target alarm event and the associated script. The preset cross encoder is an encoder obtained by training a large language model;

[0130] The script screening module 20 is used to sort the related scripts according to the script relevance scores and screen out the target script according to the sorting results.

[0131] This embodiment obtains a script relevance score by inputting text information corresponding to the target alarm event into a preset cross-encoder, wherein the script relevance score is used to characterize the matching degree between the target alarm event and the associated script. The preset cross-encoder is an encoder obtained based on large language model training; the associated scripts are sorted according to the script relevance score, and the target script is screened out according to the sorting result. Compared with the traditional script selection method, there are limitations. When the script and alarm types are variable, the script cannot be selected quickly and correctly, resulting in low processing efficiency. This embodiment completes the semantic matching between the alarm event and the script through preset cross-encoding, and determines the target script according to the script relevance score, thereby improving the accuracy of script matching, thereby improving the processing efficiency of security operations personnel.

[0132] Furthermore, the local matching module 10 is further configured to input text information corresponding to the target alarm event into a preset cross encoder to determine the alarm type;

[0133] The local matching module 10 is further configured to determine, according to the alarm type, an associated script of the target alarm event from a preset script set;

[0134] The local matching module 10 is further configured to determine a script relevance score based on the confidence level corresponding to the associated script.

[0135] Furthermore, the local matching module 10 is further configured to filter out a target type of script set from a preset script set according to the alarm type;

[0136] The local matching module 10 is further configured to match the text information corresponding to the target alarm event with the text information corresponding to the script set to determine the associated script of the target alarm event.

[0137] Furthermore, the local matching module 10 is further configured to match the text information corresponding to the target alarm event with the text information corresponding to the script set to obtain a matching result;

[0138] The local matching module 10 is further configured to determine whether the script in the script set is suitable for handling the target alarm event based on the matching result, and obtain a determination result;

[0139] The local matching module 10 is further configured to determine an associated scenario of the target alarm event according to the judgment result.

[0140] Furthermore, the local matching module 10 is further configured to determine the confidence level of the word based on the judgment result;

[0141] The local matching module 10 is further configured to determine a script relevance score based on the confidence level.

[0142] Furthermore, the script screening module 20 is further configured to sort the related scripts according to a preset arrangement rule based on the script relevance score to obtain a sorting result;

[0143] The local screening module 20 is further used to screen out target scripts according to the sorting results and preset screening rules.

[0144] Furthermore, the script matching device further comprises an encoder construction module;

[0145] The encoder construction module is further used to construct an alarm sample set based on historical security alarm events;

[0146] The encoder construction module is further used to input the description information corresponding to the alarm sample set and the description information of the preset script into the initial cross encoder for training to obtain the preset cross encoder.

[0147] Furthermore, the encoder construction module is further configured to input the description information corresponding to the alarm event in the alarm sample set and the description information of the preset script into the initial cross encoder, determine whether the preset script is suitable for handling the alarm event, and obtain a determination result;

[0148] The encoder construction module is further configured to determine whether the initial cross encoder training is completed according to the judgment result;

[0149] The encoder construction module is further configured to output the trained cross encoder as a preset cross encoder if the trained cross encoder is true.

[0150] Furthermore, the script screening module 20 is also used to screen out target scripts with a score exceeding a preset score from the sorting results according to a preset screening rule.

[0151] Furthermore, the script screening module 20 is further configured to associate the alarm event with the target script and generate a recommendation list;

[0152] The script screening module 20 is further used to push the recommendation list to security operations personnel.

[0153] The present invention also provides A1, a script matching method, the script matching method comprising the following steps:

[0154] Input the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score, which is used to characterize the matching degree between the target alarm event and the associated script. The preset cross encoder is an encoder obtained by training a large language model;

[0155] The related scripts are sorted according to the script relevance scores, and the target script is screened out according to the sorting results.

[0156] A2. The script matching method as described in A1, wherein the step of inputting the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score comprises:

[0157] Input the text information corresponding to the target alarm event into the preset cross encoder to determine the alarm type;

[0158] Determining, according to the alarm type, an associated script for the target alarm event from a preset script set;

[0159] A script relevance score is determined based on the confidence level corresponding to the associated script.

[0160] A3. The script matching method as described in A2, wherein the step of determining the associated script of the target alarm event from a preset script set according to the alarm type comprises:

[0161] Filtering a script set of a target type from a preset script set according to the alarm type;

[0162] The text information corresponding to the target alarm event is matched with the text information corresponding to the script set to determine the associated script of the target alarm event.

[0163] A4. The script matching method as described in A3, wherein the step of matching the text information corresponding to the target alarm event with the text information corresponding to the script set to determine the associated script of the target alarm event comprises:

[0164] Matching the text information corresponding to the target alarm event with the text information corresponding to the script set to obtain a matching result;

[0165] Determine whether the script in the script set is suitable for handling the target alarm event according to the matching result, and obtain a determination result;

[0166] Determine the associated script of the target alarm event according to the judgment result.

[0167] A5. The script matching method as described in A4, wherein the step of determining the script relevance score according to the confidence level corresponding to the associated scripts includes:

[0168] Determining the confidence level of the word according to the judgment result;

[0169] A script relevance score is determined based on the confidence level.

[0170] A6. The script matching method described in A5, wherein the steps of sorting the related scripts according to the script relevance scores and selecting the target script according to the sorting results include:

[0171] Sort the related scripts according to the script relevance scores according to a preset arrangement rule to obtain a sorting result;

[0172] Target scripts are screened out according to the sorting results and preset screening rules.

[0173] A7. The script matching method according to A6, wherein before the step of inputting the text information corresponding to the target alarm event into a preset cross encoder and obtaining the script relevance score, the method further comprises:

[0174] Build an alarm sample set based on historical security alarm events;

[0175] The description information corresponding to the alarm sample set and the description information of the preset script are input into an initial cross encoder for training to obtain a preset cross encoder.

[0176] A8. The script matching method as described in A7, wherein the step of inputting the alarm sample set and the description information of the preset script into an initial cross encoder for training to obtain the preset cross encoder comprises:

[0177] Inputting the description information corresponding to the alarm event in the alarm sample set and the description information of the preset script into the initial cross encoder, determining whether the preset script is suitable for handling the alarm event, and obtaining a determination result;

[0178] Determining whether the initial cross encoder is trained according to the judgment result;

[0179] If so, the trained cross encoder is output as the preset cross encoder.

[0180] A9. The script matching method as described in A6, wherein the step of screening out the target script according to the sorting results and the preset screening rules comprises:

[0181] Target scripts with score exceeding a preset score are filtered out from the sorting results according to preset filtering rules.

[0182] A10. The script matching method according to A8, further comprising: sorting the related scripts according to the script relevance scores and selecting the target script according to the sorting results;

[0183] Associating the alarm event with the target script and generating a recommendation list;

[0184] The recommendation list is pushed to security operations personnel.

[0185] It should be understood that the above is only an example and does not constitute any limitation to the technical solution of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any limitation on this.

[0186] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of it according to actual needs to achieve the purpose of the embodiment scheme, and no limitation is made here.

[0187] In addition, for technical details not fully described in this embodiment, please refer to the script matching method provided in any embodiment of the present invention, and will not be repeated here.

[0188] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0189] The serial numbers of the embodiments of the present invention are for descriptive purposes only and do not represent superiority or inferiority of the embodiments. In a unit claim that enumerates several means, several of these means may be embodied by the same item of hardware. The use of the terms first, second, and third, etc., does not denote any order; these terms should be interpreted as designations.

[0190] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus the necessary general hardware platform, or of course by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory image (ROM) / random access memory (RAM), a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0191] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A script matching method, characterized in that: The script matching method comprises the following steps: Input the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score, which is used to characterize the matching degree between the target alarm event and the associated script. The preset cross encoder is an encoder obtained by training a large language model; The related scripts are sorted according to the script relevance scores, and the target script is screened out according to the sorting results.

2. The script matching method according to claim 1, wherein: The step of inputting the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score includes: Input the text information corresponding to the target alarm event into the preset cross encoder to determine the alarm type; Determining, according to the alarm type, an associated script for the target alarm event from a preset script set; A script relevance score is determined based on the confidence level corresponding to the associated script.

3. The script matching method according to claim 2, wherein: The step of determining the associated script of the target alarm event from a preset script set according to the alarm type includes: Filtering a script set of a target type from a preset script set according to the alarm type; The text information corresponding to the target alarm event is matched with the text information corresponding to the script set to determine the associated script of the target alarm event.

4. The script matching method according to claim 3, wherein: The step of matching the text information corresponding to the target alarm event with the text information corresponding to the script set to determine the associated script of the target alarm event includes: Matching the text information corresponding to the target alarm event with the text information corresponding to the script set to obtain a matching result; Determine whether the script in the script set is suitable for handling the target alarm event according to the matching result, and obtain a determination result; Determine the associated script of the target alarm event according to the judgment result.

5. The script matching method according to claim 4, wherein: The step of determining the script relevance score according to the confidence level corresponding to the associated script includes: Determining the confidence level of the word according to the judgment result; A script relevance score is determined based on the confidence level.

6. The script matching method according to claim 5, wherein: The step of sorting the related scripts according to the script relevance scores and filtering out the target script according to the sorting results includes: Sort the related scripts according to the script relevance scores according to a preset arrangement rule to obtain a sorting result; Target scripts are screened out according to the sorting results and preset screening rules.

7. The script matching method according to claim 6, wherein: Before the step of inputting the text information corresponding to the target alarm event into a preset cross encoder to obtain the script relevance score, the method further includes: Build an alarm sample set based on historical security alarm events; The description information corresponding to the alarm sample set and the description information of the preset script are input into an initial cross encoder for training to obtain a preset cross encoder.

8. A script matching device, characterized in that: The script matching device includes: a memory, a processor, and a script matching program stored in the memory and executable on the processor. When the script matching program is executed by the processor, the script matching method according to any one of claims 1 to 7 is implemented.

9. A storage medium, characterized in that: The storage medium stores a script matching program, which, when executed by a processor, implements the script matching method as described in any one of claims 1 to 7.

10. A script matching device, characterized in that: The script matching device comprises: A local matching module is used to input the text information corresponding to the target alarm event into a preset cross encoder to obtain a script relevance score, which is used to represent the matching degree between the target alarm event and the associated script. The preset cross encoder is an encoder obtained by training a large language model; The script screening module is used to sort the related scripts according to the script relevance scores and screen out the target script according to the sorting results.

Images