LLM intelligent agent-based security event traceability and response method and system

Abstract

The invention relates to the field of network security, and provides a security event tracing and response method and system based on an LLM intelligent agent, and the method comprises the steps: collecting log information from network equipment, and extracting a security event with a high threat degree in the log information; identifying an attack mode of the security event based on LLM, and generating a response strategy including atomization operation steps according to the identified attack mode; the natural language instruction in the response strategy is converted into a tool calling instruction through the intelligent agent, and related tools are called to execute specific operation. By constructing an LLM-driven intelligent decision-making body, full-process automation from event analysis to response execution is achieved, the LLM deep reasoning ability and a safety tool chain are innovatively and deeply fused, an unstructured log is converted into an executable disposal scheme through the semantic understanding ability of the LLM deep reasoning ability, and the processing efficiency is improved. And designing a multi-stage reasoning framework of attack mode analysis-target decomposition-tool matching, and supporting dynamic generation of a customized response scheme conforming to an enterprise strategy.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a security event tracing and response method and system based on an LLM intelligent agent. Background Art

[0002] As digitalization accelerates, handling the increasing number of cybersecurity incidents has become a global challenge. As attack methods become increasingly sophisticated and covert, they pose a serious threat to national security, business operations, and personal privacy. Cybersecurity incident tracing and response, a core component of the defense system, aims to use technical means to track the attack source, restore the attack path, identify the attack methods, and implement closed-loop management based on the analysis results, thereby curbing the spread of attacks, remediating vulnerabilities, and preventing future risks.

[0003] The current mainstream technical solutions still rely on manual analysis and judgment. Security analysts need to manually correlate heterogeneous information such as firewall logs, EDR terminal behavior, and network traffic data across multiple systems and restore the attack path through empirical reasoning. This approach has three bottlenecks: (1) Manual operation is inefficient. According to Qi'anxin's "Cybersecurity Emergency Response Analysis Report (2024)", the average time required to handle a single security incident is more than 8 hours; (2) Manual tracing and response are highly dependent on the experience of security operations personnel and lack standardized processes. This can easily lead to misjudgments or missed judgments due to differences in personnel skills. Furthermore, repetitive work can lead to alarm fatigue, making it difficult to respond to large-scale security incidents. (3) Although traditional SOAR systems improve execution speed through scripted processes, their rule engines are unable to parse the contextual associations of complex attack chains. In addition, although automated solutions based on supervised learning can handle some structured alerts, they are limited by inherent flaws such as feature engineering's strong reliance on prior knowledge and model iteration lagging behind the evolution of attack methods, making it difficult to achieve an intelligent decision-making closed loop in a dynamic environment. Summary of the Invention

[0004] In response to the shortcomings of the existing technology, the present invention provides a security event tracing and response method and system based on LLM intelligent body, aiming to achieve full process automation from event analysis to response execution by building an LLM-driven intelligent decision-making body.

[0005] To achieve the above object, the present invention provides the following technical solutions: In the first aspect, a security event tracing and response method based on an LLM agent is provided, comprising the following steps: Collect log information from network devices and extract high-threat security events from the log information; Identify attack patterns of security incidents based on LLM and generate response strategies containing atomic operation steps based on the identified attack patterns; The intelligent agent converts the natural language instructions in the response strategy into tool call instructions, and calls the relevant tools to perform specific operations.

[0006] Preferably, the extraction of high-threat security events from log information specifically includes: Generate multiple security events based on log information, use the dynamic threat scoring model to obtain the threat level score of each security event, and extract security events with threat level scores higher than the preset threshold.

[0007] Preferably, identifying the attack pattern of the security incident specifically includes: Based on LLM, the local knowledge base and network security knowledge base are used to perform contextual association analysis on security events, the key entities in security events are parsed through semantic understanding technology, and the historical attack pattern library is combined to match potential attack types and dynamically construct attack chain hypotheses.

[0008] Preferably, generating a response strategy including atomic operation steps according to the identified attack pattern specifically includes: Based on the LLM and the contextual semantics of the attack chain assumptions, complex handling requirements are broken down into multi-step atomic tasks, and their execution priority and logical order are planned. Dynamically select the optimal execution tool combination from the pre-integrated security tool chain based on the type of atomic task and environmental parameters.

[0009] Preferably, before calling the relevant tool to perform the specific operation, the method further includes: Verify whether the current operation role has process management permissions. If not, trigger the manual review process.

[0010] Preferably, before calling the relevant tool to perform the specific operation, the method further includes: Determine whether the current operation is a high-risk operation. If so, force the operation to be simulated in an isolated sandbox. After confirming that there are no side effects through behavior monitoring, the operation can be executed in the actual environment.

[0011] Preferably, it is characterized in that, after calling the relevant tool to perform the specific operation, it also includes: Get the reverse operation instructions of the executed operation and record them.

[0012] Preferably, in the process of calling relevant tools to perform specific operations, for scenarios that require manual intervention, a structured handling work order is generated, the manual operation is recorded and fed back to the knowledge base of the intelligent agent.

[0013] In a second aspect, the present invention further provides a security event tracing and response system based on an LLM agent, comprising: The security event collection module is used to collect log information from network devices and extract high-threat security events from the log information; The event analysis and solution generation module is used to identify the attack pattern of security events based on LLM and generate a response strategy containing atomic operation steps based on the identified attack pattern; The solution implementation module is used to convert the natural language instructions in the response strategy into tool call instructions through the intelligent agent, and call relevant tools to perform specific operations.

[0014] In a third aspect, the present invention also provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the security event tracing and response method based on the LLM agent are implemented as described in any one of the above items.

[0015] In summary, the present invention has the following beneficial effects compared with the prior art: This invention collects log information from network devices and extracts high-threat security events from the log information. It then identifies attack patterns of security events based on LLM and generates a response strategy containing atomic operational steps based on the identified attack patterns. An intelligent agent converts the natural language instructions in the response strategy into tool call instructions, and calls the relevant tools to perform specific operations. By constructing an LLM-driven intelligent decision-making entity, it achieves full automation from event analysis to response execution. It innovatively integrates the LLM's deep reasoning capabilities with the security tool chain, transforming unstructured logs into executable solutions through its semantic understanding capabilities. A multi-stage reasoning framework, encompassing "attack pattern analysis, target decomposition, and tool matching," is designed to support the dynamic generation of customized response solutions that align with enterprise policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is an overall flow chart of a security incident tracing and response method based on an LLM agent provided in this embodiment; Figure 2 This is a flowchart of a security event tracing and response method based on LLM intelligent agent provided in this embodiment. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0018] In order to better understand the solutions in the embodiments of the present application, the technical terms in the embodiments of the present application are introduced below.

[0019] SOC (Security Operations Center): A security operations center integrates people, processes, and technology. It monitors all activity on endpoints, servers, databases, web applications, websites, and other systems around the clock to identify potential threats in real time. It also prevents, analyzes, and responds to cybersecurity incidents to improve the company's cybersecurity posture. By collecting the latest threat information, tracking infrastructure and attack groups, and proactively deploying security measures, the SOC identifies and remediates system or process vulnerabilities before attackers exploit them.

[0020] Large Language Model (LLM): A large language model (LLM) is an AI model based on deep learning technology. It is trained on massive amounts of text data and has the ability to understand and generate human language. LLMs are trained on large amounts of text data and can perform a wide range of tasks, including text summarization, translation, sentiment analysis, and more.

[0021] AI Agent (Artificial Intelligence Agent): Artificial Intelligence Agent, also known as AI Agent, is an intelligent system with a large language model as its core. It can autonomously perceive the environment, plan tasks, call tools and perform other complex operations.

[0022] Threat attribution: Threat attribution refers to the process of tracing and reconstructing cyberattacks or other suspected cybercriminal activities through the collection, analysis, and interpretation of digital evidence. It aims to determine the attacker's identity, actions, and intentions so that appropriate countermeasures can be implemented and necessary evidence can be provided to legal authorities. Attribution can be applied in a variety of scenarios, such as network intrusion investigations, malware analysis, data breaches, and suspected computer crime. Its primary goal is to identify the origin, path, and impact of an attack and track suspected criminal activity through the collection and analysis of digital evidence.

[0023] SOAR (Security Orchestration, Automation and Response): Security Orchestration, Automation and Response is an integrated security operations technology framework that aims to improve the efficiency of security incident handling by orchestrating security tool processes and automating response tasks.

[0024] Retrieval-Augmented Generation (RAG) is an AI technology that combines information retrieval techniques with language generation models. This technology retrieves relevant information from external knowledge bases and feeds it as prompts to large language models, enhancing the model's ability to handle knowledge-intensive tasks such as question answering, text summarization, and content generation.

[0025] SandBox: A sandbox is a security mechanism used to isolate running programs. Its purpose is to limit the access rights of untrusted processes or untrusted code at runtime.

[0026] EDR (Endpoint Detection and Response): Endpoint detection and response is a security protection technology for terminal devices (such as servers, workstations, and mobile devices). It continuously monitors endpoint activities, detects abnormal behavior, and provides automated response capabilities to quickly discover and deal with advanced threats.

[0027] NDR (Network Detection and Response): Network detection and response is a network security technology designed to monitor and detect security incidents in the network in real time and respond to these incidents in a timely manner.

[0028] Example 1 like Figure 1 and Figure 2 As shown, this embodiment provides a security event tracing and response method based on LLM agent, including the following steps: S100, collecting log information from network devices and extracting high-threat security events from the log information; Specifically, we collect raw log information from multiple source devices such as SOC platforms, EDR terminals, and firewalls, and standardize the log information into structured data to generate multiple security events. We then use a dynamic threat scoring model to obtain the threat level of each security event. The core formula of the dynamic threat scoring model is: ; Where V is the event severity, ranging from 1 to 10, C is the confidence level, ranging from 0 to 1, N is the number of associated alarms, α, β, and γ are the weight coefficients of V, C, and N respectively, and λ is the time decay factor.

[0029] Security events with a threat level score higher than a preset threshold are extracted and further processed as high-threat security events.

[0030] In other embodiments, machine learning or neural network algorithms may be used to extract high-threat security events from log information, and operation authority control may be integrated with RBAC / ABAC mechanisms.

[0031] S200, identifying the attack pattern of the security incident based on the LLM, and generating a response strategy including atomic operation steps according to the identified attack pattern; The attack pattern of a security incident includes key entities and attack types. This step first identifies the attack pattern of the security incident, including: LLM leverages local and cybersecurity knowledge bases, including MITRE ATT&CK tactics, the CVE vulnerability library, and threat intelligence signatures, to conduct contextual analysis of security incidents. Using semantic understanding technology, it parses key entities within security incidents, such as malicious IP addresses, abnormal process paths, and attack signatures. It then combines historical attack pattern libraries to match potential attack types, such as APT attacks, ransomware, and lateral movement, dynamically constructing attack chain hypotheses. This process requires only inputting security incidents into the LLM, which then analyzes them based on the local and cybersecurity knowledge bases, automatically outputting the corresponding key entities and attack types.

[0032] After attack pattern identification, LLM generates a response strategy with atomic steps based on the identified attack pattern. Specifically, LLM uses a predefined knowledge base of response strategy templates (including over 200 standardized process prompts) and combines the current event characteristics to generate a customized solution. The strategy generation process uses a two-tiered "goal decomposition-tool matching" mechanism, specifically including: Target decomposition: Based on the LLM and the contextual semantics of the attack chain assumptions, complex response requirements are broken down into multi-step atomic tasks, with their execution priorities and logical sequence planned. For example, in the case of a ransomware attack, the system generates a phased target sequence: "Block the attack source IP address → Isolate the infected host → Terminate the malicious process → Remediate the vulnerability → Restore backup data." Each atomic task is independently executable and has clear input and output parameters. For example, the "Isolate the infected host" task requires the host IP address, isolation method (such as EDR soft isolation), and isolation duration.

[0033] Tool matching: Based on the type of atomic task and environmental parameters, the optimal execution tool combination is dynamically selected from the pre-integrated security tool chain. For example, for the "block attack source IP" task, LLM automatically matches tools based on its own security knowledge, response policy template knowledge base, and parameter attack source type (such as external IP, internal jump server). If the IP address is external, the firewall API is called to add a blacklist rule; if the IP address is internal, the NDR (Network Detection and Response) system is linked to enforce micro-segmentation policies.

[0034] This embodiment reduces the time required to handle complex attack incidents through LLM's contextual analysis of security incidents, thereby greatly improving response timeliness.

[0035] It should be noted that the LLM, as the core inference engine in this embodiment, can be implemented using various large language models, such as the GPT series, Claude, and LLaMA. Its technical essence is to use natural language understanding and generation capabilities to perform attack pattern analysis and solution generation. Therefore, any LLM with similar capabilities can be used as an alternative, requiring only adjustments to the model interface adaptation layer to achieve compatibility.

[0036] This embodiment relies on LLM pre-training and a security knowledge base to identify attack patterns and generate response strategies for security incidents. It also employs various technical approaches, such as fine-tuning training, RAG, or prompt word engineering, to enhance the model's expertise, increasing its dynamic adaptability. Leveraging RAG technology, it leverages real-time access to the latest threat intelligence, improving the system's recognition coverage of new attack patterns. Furthermore, the model's knowledge base can be integrated with other threat intelligence platforms (such as VirusTotal and AlienVault OTX) or private enterprise vulnerability libraries, in addition to the MITRE ATT&CK framework.

[0037] S300: The intelligent agent converts the natural language instructions in the response strategy into tool call instructions, and calls the relevant tools to perform specific operations.

[0038] This step translates the LLM-generated response strategy into actual security actions through the agent's ability to autonomously invoke the security toolchain. Based on semantic parsing technology, the agent automatically converts natural language instructions (such as "isolate the infected host") into specific tool calls, such as triggering a host isolation procedure through the EDR platform's API.

[0039] Since this step uses automated processing and requires high permissions, to ensure operational security, this embodiment adopts multi-level permission management. Preferably, before or after calling the relevant tool to perform a specific operation, the following is also included: Permission pre-check mechanism: Verify whether the current operating role has process management permissions. If not, the manual review process is triggered. For example, the "Host Isolation" operation requires the "Emergency Response" permission tag, otherwise the manual review process is triggered.

[0040] Sandbox pre-verification: Determines whether the current operation is a high-risk operation. High-risk operations include deleting suspicious files and terminating system processes. If it is a high-risk operation, it is forced to simulate the operation in an isolated sandbox (Sandbox). After confirming that there are no side effects through behavior monitoring, the operation is executed in the actual environment, thereby optimizing operation reliability and reducing the rate of erroneous operations through the sandbox pre-verification mechanism.

[0041] Operation withdrawal: Obtain and record the reverse operation instructions of the executed operation. Reverse operation instructions include lifting isolation and restoring firewall rules. By recording the reverse operation instructions, it is convenient to roll back the error and withdraw the executed operation.

[0042] Preferably, when invoking relevant tools to perform specific operations, for scenarios requiring human intervention, such as data extraction for legal evidence, the agent generates a structured work order, clearly marking the steps requiring human confirmation, the associated chain of evidence, and potential risks, and pushes it to the SOC collaboration platform. After acquiring the manual operation, the agent records it and feeds it back into the agent's knowledge base, thereby driving the agent to continuously optimize its tool invocation strategy.

[0043] Specifically, the agent tool invocation mechanism of this embodiment achieves precise translation of natural language instructions into atomic security operations through dynamic semantic adaptation. Taking the LLM-generated instruction "Block malicious IP: 192.168.1.100" as an example, the agent first deconstructs the core elements (action type: block, target type: IP address, target value: 192.168.1.100) through semantic parsing. It then selects an interface from the security tool. If the IP address represents an external attack source, it automatically calls the perimeter firewall's API to add a blacklist rule; if it represents an internal lateral movement node, it triggers the NDR system's micro-segmentation policy configuration interface. When executing the high-risk "terminate malicious process" operation, the system first verifies whether the current operating role has process management privileges. If not, a dynamic privilege escalation request is automatically generated. The operation is then forcibly encapsulated as a sandboxed executable task for pre-verification. The process termination instruction is simulated in a virtualized environment. After confirming that there are no side effects by monitoring system service status changes and dependent process survival rates, a reverse operation script (process restart command and registry repair instructions) is simultaneously generated and stored in the operation audit chain. This dynamic tool chain adaptation mechanism based on semantic understanding, combined with permission hierarchical control and a two-tier verification architecture of sandbox rehearsal-production execution, enables the precise implementation of response strategies while ensuring operational security.

[0044] In a preferred embodiment, a complete closed-loop security incident handling system is achieved through automated report generation, closed-loop knowledge updating, and multi-dimensional impact assessment. The intelligent agent integrates data from the entire handling process, including attack signatures, tool call records, and execution results, into a structured report, generating a visual document containing an attack path map, operation timeline, and remediation recommendations.

[0045] This invention collects log information from network devices and extracts high-threat security events from the log information. It then identifies attack patterns of security events based on LLM and generates a response strategy containing atomic operational steps based on the identified attack patterns. An intelligent agent converts the natural language instructions in the response strategy into tool call instructions, and calls the relevant tools to perform specific operations. By constructing an LLM-driven intelligent decision-making entity, it achieves full automation from event analysis to response execution. It innovatively integrates the LLM's deep reasoning capabilities with the security tool chain, transforming unstructured logs into executable solutions through its semantic understanding capabilities. A multi-stage reasoning framework, encompassing "attack pattern analysis, target decomposition, and tool matching," is designed to support the dynamic generation of customized response solutions that align with enterprise policies.

[0046] At the implementation level, this invention breaks through the limitations of simple script calls in traditional automation systems and pioneers an intelligent toolchain collaboration mechanism based on natural language instructions. By developing a dynamic permission pre-check system and a sandbox pre-verification module, the security of high-risk operations is ensured. Furthermore, an automatic recording mechanism for reverse operation instructions facilitates error rollback.

[0047] This solution fundamentally reconstructs the security incident response paradigm, forming a complete technical closed loop from attack feature extraction of security incidents, intelligent decision generation to automated execution, providing a feasible solution for responding to large-scale and complex network security threats.

[0048] Based on the same inventive concept, an embodiment of the present invention further provides a security event tracing and response system based on an LLM agent, comprising: The security event collection module is used to collect log information from network devices and extract high-threat security events from the log information; The event analysis and solution generation module is used to identify the attack pattern of security events based on LLM and generate a response strategy containing atomic operation steps based on the identified attack pattern; The solution implementation module is used to convert the natural language instructions in the response strategy into tool call instructions through the intelligent agent, and call relevant tools to perform specific operations.

[0049] It should be noted that the technical details that are not fully described in this embodiment of the security event tracing and response system based on the LLM intelligent agent can be referred to the security event tracing and response method based on the LLM intelligent agent as described above provided in any embodiment of the present invention, and will not be repeated here.

[0050] Based on the same inventive concept, an embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, the steps of the security event tracing and response method based on the LLM intelligent agent are implemented as described above.

[0051] In some embodiments, the processor may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor is typically used to control the overall operation of the electronic device. In this embodiment, the processor is used to run program code or process data stored in the memory, such as the program code of the vehicle collision warning method.

[0052] The memory includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory can be an internal storage unit of the electronic device, such as the hard disk or memory of the electronic device. In other embodiments, the memory can also be an external storage device of the electronic device, such as a plug-in hard disk equipped on the electronic device, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card, etc. Of course, the memory can also include both the internal storage unit of the electronic device and its external storage device. In this embodiment, the memory is generally used to store operating methods and various application software installed in the electronic device, such as the program code of the vehicle collision warning method. In addition, the memory can also be used to temporarily store various types of data that have been output or are about to be output.

[0053] Based on the same inventive concept, the present invention also provides a readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the security event tracing and response method based on the LLM intelligent agent as described above.

[0054] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) containing computer-usable program code.

[0055] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0056] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0057] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0058] It will be understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present invention, and the present invention is not limited thereto. Those skilled in the art will appreciate that various modifications and improvements can be made without departing from the spirit and substance of the present invention, and such modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A security event tracing and response method based on LLM agent, characterized in that: The steps include: Collect log information from network devices and extract high-threat security events from the log information; Identify attack patterns of security incidents based on LLM and generate response strategies containing atomic operation steps based on the identified attack patterns; The intelligent agent converts the natural language instructions in the response strategy into tool call instructions, and calls the relevant tools to perform specific operations.

2. The security event tracing and response method based on LLM agent according to claim 1 is characterized in that: The security events with high threat levels in the extracted log information specifically include: Generate multiple security events based on log information, use the dynamic threat scoring model to obtain the threat level score of each security event, and extract security events with threat level scores higher than the preset threshold.

3. The security event tracing and response method based on LLM agent according to claim 1 is characterized in that: The identification of attack patterns of security incidents specifically includes: Based on LLM, the local knowledge base and network security knowledge base are used to perform contextual association analysis on security events, the key entities in security events are parsed through semantic understanding technology, and the historical attack pattern library is combined to match potential attack types and dynamically construct attack chain hypotheses.

4. The security event tracing and response method based on LLM agent according to claim 1 is characterized in that: Generating a response strategy including atomic operation steps based on the identified attack pattern specifically includes: Based on the LLM and the contextual semantics of the attack chain assumptions, complex handling requirements are broken down into multi-step atomic tasks, and their execution priority and logical order are planned. Dynamically select the optimal execution tool combination from the pre-integrated security tool chain based on the type of atomic task and environmental parameters.

5. The security event tracing and response method based on LLM agent according to claim 1 is characterized in that: Before calling the relevant tools to perform specific operations, the following steps are also included: Verify whether the current operation role has process management permissions. If not, trigger the manual review process.

6. The security event tracing and response method based on LLM agent according to claim 1 is characterized in that: Before calling the relevant tools to perform specific operations, the following steps are also included: Determine whether the current operation is a high-risk operation. If so, force the operation to be simulated in an isolated sandbox. After confirming that there are no side effects through behavior monitoring, the operation can be executed in the actual environment.

7. The LLM agent-based security event tracing and response method according to any one of claims 1, 5, and 6, characterized in that: After calling the relevant tools to perform specific operations, the following steps are also included: Get the reverse operation instructions of the executed operation and record them.

8. A security event tracing and response method based on LLM agent, characterized in that: In the process of calling relevant tools to perform specific operations, for scenarios that require manual intervention, a structured handling work order is generated, the manual operations are recorded and fed back to the knowledge base of the intelligent agent.

9. A security event tracing and response system based on LLM agent, characterized by: include: The security event collection module is used to collect log information from network devices and extract high-threat security events from the log information; The event analysis and solution generation module is used to identify the attack pattern of security events based on LLM and generate a response strategy containing atomic operation steps based on the identified attack pattern; The solution implementation module is used to convert the natural language instructions in the response strategy into tool call instructions through the intelligent agent, and call relevant tools to perform specific operations.

10. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the security event tracing and response method based on the LLM agent are implemented as described in any one of claims 1 to 8.

Images