Automatic operation and maintenance method and system based on artificial intelligence

Abstract

The invention relates to the technical field of network operation and maintenance, in particular to an automatic operation and maintenance method and system based on artificial intelligence, and the method comprises the steps: collecting detailed log information containing a security event in real time through a security information and event management system configured at a target endpoint; performing cleaning, labeling and structured processing on the log data by utilizing a proxy artificial intelligence system to generate standardized metadata, and performing MITRE ATTamp with the standardized metadata; mapping the CK knowledge base, identifying technical features and behavior patterns of attacks, comparing enriched log data with an external threat intelligence source, analyzing TTP of a known attack group, generating a threat intelligence association report, generating a targeted response plan by using a large language model, generating an executable command sequence according to the response plan, and generating a threat intelligence association report; the proxy executor is connected with the server through a WebSocket protocol, executes a command in a POSIX shell environment, captures and returns an execution result, verifies the execution result, carries out necessary command optimization, records an optimized response to a vector database, and automatically matches a historical event and triggers a predefined response process through a vector retrieval mechanism. And continuous threat monitoring and adaptive response are realized. According to the method, the problem that a closed loop aiming at a terminal executor, data enrichment and historical event recall cannot be formed by security operation and maintenance in the prior art can be solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network operation and maintenance, and in particular to an automatic operation and maintenance method and system based on artificial intelligence. BACKGROUND

[0002] With the continuous evolution of network attack means, the traditional security operation and maintenance mode is facing unprecedented challenges. The security operation and maintenance center (SOC) needs to cope with high-frequency, large-scale and diversified security incidents. The traditional SOAR (security orchestration, automation and response) platform relying on manual arrangement has obvious deficiencies in flexibility, scalability and advanced logic support, and it is difficult to quickly adapt to new attack technologies. Although the low-code or no-code platform has improved the automation threshold, its template-based and static characteristics make the system lag behind in responding to complex events and are difficult to dynamically respond to new threat behaviors. In addition, the traditional platform also lacks unified scheduling and intelligent support in terms of multi-tool linkage, knowledge accumulation, emergency response script generation, etc.

[0003] In order to improve the response efficiency and intelligent level, in recent years, some researches have explored the combination of large language models (LLM) and security operation, trying to drive automated decision-making and orchestration through natural language processing capabilities. For example, the IVAM framework proposes a three-stage process of "investigation-verification-active monitoring", and uses the MITRE ATT&CK framework, NIST standards and quantitative risk assessment to realize structured incident response. However, existing solutions mostly stay at the process level of abstraction or technical demonstration, lack deep linkage capabilities with terminal systems, and have not formed a closed-loop system for terminal actuators, data enrichment and historical incident recall, especially in terms of command generation, automatic adaptation and result optimization feedback. SUMMARY

[0004] In view of the above technical problems, the present application provides an automatic operation and maintenance method and system based on artificial intelligence to solve the problem that the existing security operation and maintenance cannot form a closed loop for terminal actuators, data enrichment and historical incident recall.

[0005] Other characteristics and advantages of the present application will become apparent from the following detailed description, or will be learned by practice of the present application.

[0006] According to an aspect of the present application, an automatic operation and maintenance method based on artificial intelligence is provided, which comprises: collecting log data containing security incident detailed information in real time through a security information and event management system configured on a target endpoint, wherein the security incident detailed information includes incident occurrence time, involved IP address, user identity information and incident type; The collected log data is enriched, and during enrichment, the log data is cleaned, labeled, and structured by an agent artificial intelligence system, standardized metadata is generated, and the metadata is mapped to tactics, techniques, and procedures in the MITRE ATT&CK knowledge base to identify technical characteristics and behavioral patterns of attacks; The enriched log data is compared with external threat intelligence sources to analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivation of the attack, and generate a threat intelligence correlation report; Based on the enriched log data and the threat intelligence correlation report, a large language model is used to generate a targeted response plan for the incident, which includes at least one of isolating affected systems, blocking malicious entities, applying security patches, and resetting compromised credentials; According to the response plan, an executable command sequence is generated, which includes at least one of firewall rule configuration for isolating network endpoints, intrusion prevention system update for blocking malicious IP addresses, and system management script for applying patches; The command sequence is executed on the target system by an agent executor, which establishes a stable connection with the server through the WebSocket protocol, runs the command in the POSIX-compatible shell environment, and captures the standard output, standard error, and status indicator, generating a structured JSON format response; The execution result of the target system is verified to check if the threat is successfully mitigated, if the execution result does not meet the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing execution parameters or reconstructing mitigation strategies, and the optimized response action is recorded in the vector database for subsequent similar events. Fast response; Using the vector representation of historical events and mitigation measures stored in the vector database, the similarity retrieval mechanism is used to identify pattern matching between new events and historical events, automatically trigger predefined response processes, and achieve continuous threat monitoring and adaptive response.

[0007] Further, the security information and event management system is further configured to monitor access logs of remote desktop protocols, virtual private networks, and secure shell protocols, and further includes: Detecting abnormal login times, multiple failed login attempts, and access requests from unknown IP addresses; Classify the detected abnormal behavior as a potential brute force attempt or unauthorized access; The classified log data is stored in JSON format, including timestamp, source IP address, target port, and event severity level.

[0008] Furthermore, the agent artificial intelligence system performs the following operations: Preprocessing the log data to remove redundant information and normalize field formats; Apply natural language processing technology to extract key event features, including attack timelines, affected hosts, and abnormal behavior patterns; Compare the extracted features with the TTP database of the MITRE ATT&CK knowledge base in real time to generate a mapping report containing attack technique numbers; The mapping report is combined with the normalized metadata to generate an enriched data set containing event context, attack type, and compliance requirements.

[0009] Furthermore, the method further comprises: Obtain TTP datasets of known attack groups and malware from external threat intelligence sources. The TTP datasets include attackers' motivations, common techniques, and historical attack records. Converting the enriched log data into a high-dimensional vector representation using vector embedding technology; Perform similarity search in the vector database, compare the cosine similarity of the current event vector with the historical attack vector, and identify the most similar threat pattern; Based on the similarity retrieval results, a threat intelligence correlation report is generated that includes attack attribution, potential targets, and recommended defense measures.

[0010] Furthermore, the large language model generates the response plan based on the following process: Input the enriched log data and the threat intelligence report to generate a natural language context describing the attack scenario; Parsing the context using the instruction-tuned large language model to generate the response plan comprising multiple mitigation steps; Prioritize each of the mitigation steps, based on a quantitative risk assessment approach, evaluating the potential impact and cost of implementation; Outputs a detailed response plan document that includes priorities, execution commands, and expected outcomes.

[0011] Furthermore, the generation of the command sequence includes the following sub-steps: Generate firewall rules based on the response plan, including configuring iptables rules to block inbound traffic from specific IP addresses or ports; Automatically generate scripts for updating intrusion prevention systems, including configurations to block known malicious domains or file hashes; Generate system patch installation scripts to ensure that affected systems install the latest security updates; Reusable command sequences are generated using templating methods to support adaptation across different operating systems and network environments.

[0012] Further, the proxy executor further performs the following operations: A bidirectional communication channel is established with the server through the Gorilla WebSocket library to ensure the real-time and reliability of command transmission; The command is executed in a POSIX-compatible shell environment, capturing standard output and standard error streams, and recording the success or failure status of command execution; Error analysis is performed on the failed command to identify the need for sudo permissions or other configuration changes; The execution result is encapsulated as a JSON response, including command output, error logs and status code, and sent back to the server for further processing.

[0013] Further, the implementation of the vector database includes the following sub-steps: The features of historical events and mitigation measures are converted into vector embeddings and stored in a dedicated vector database; The cosine similarity or Euclidean distance algorithm is used to calculate the similarity between new events and historical events; According to the similarity threshold, the pre-defined response process matching the historical event is automatically triggered; The vector database is updated regularly to include new threat intelligence and event data, ensuring the adaptability of the system to emerging threats.

[0014] According to the second aspect of the present disclosure, an artificial intelligence-based automated operation and maintenance system is provided, which comprises: A collection module is used to collect log data containing security event details in real time through a security information and event management system configured on a target endpoint, wherein the security event details include event occurrence time, involved IP address, user identity information and event type; A data enrichment module is used to enrich the collected log data, and during enrichment, the log data is cleaned, labeled and structured by a proxy artificial intelligence system to generate standardized metadata, and the metadata is mapped with strategies, techniques and procedures in the MITRE ATT&CK knowledge base to identify attack technical features and behavior patterns; A threat intelligence correlation module is used to compare the enriched log data with external threat intelligence sources, analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivation of the attack, and generate a threat intelligence correlation report; a mitigation recommendation module for generating a targeted incident response plan based on the enriched log data and the threat intelligence correlation report using a large language model, the response plan comprising at least one of isolating the affected system, blocking the malicious entity, applying a security patch, and resetting compromised credentials; a sequence building module, configured to generate an executable command sequence based on the response plan, the command sequence including at least one of a firewall rule configuration for isolating a network endpoint, an intrusion prevention system update for blocking malicious IP addresses, and a system management script for applying a patch; a response execution module, configured to execute the command sequence on the target system via an agent executor, wherein the agent executor establishes a stable connection with the server via the WebSocket protocol, runs the command in a POSIX-compliant shell environment, captures standard output, standard error, and status indicators, and generates a structured JSON-formatted response; A response verification and optimization module is used to verify the execution results of the target system to check whether the threat is successfully mitigated. If the execution results do not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing execution parameters, or reconstructing the mitigation strategy, and the optimized response actions are recorded in the vector database for rapid response to subsequent similar events; A continuous monitoring module is used to utilize the vector representations of historical events and mitigation measures stored in the vector database, identify pattern matching between new events and historical events through a similarity retrieval mechanism, automatically trigger predefined response processes, and achieve continuous threat monitoring and adaptive response.

[0015] The technical solution disclosed in this disclosure has the following beneficial effects: This approach integrates log data structured enrichment, TTP mapping, language model response generation, and command execution into an integrated process, connecting the entire chain from event identification to system response and achieving a highly efficient, closed-loop automated operations and maintenance system. This approach utilizes an agent-based AI system to clean, annotate, and structure logs. It then integrates the MITRE ATT&CK knowledgebase to identify and attribute attack behaviors. Furthermore, it uses a large-scale language model to automatically generate targeted response plans, significantly improving the intelligence of threat analysis and the accuracy of emergency response.

[0016] Compared to existing technologies, this invention further introduces a templated command sequence generation mechanism and a vector database with dynamic knowledge accumulation capabilities. This enables the system to not only adapt across operating systems and heterogeneous network environments, but also rapidly respond to and self-evolve similar patterns in subsequent events. The proxy executor uses WebSocket to achieve stable interaction with the target system, supporting command output capture and result verification. This provides feedback support for continuous improvement and refinement of execution strategies, significantly enhancing the system's resilience and automated governance capabilities in the face of unknown threats and complex attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flowchart of an automated operation and maintenance method based on artificial intelligence in an embodiment of this specification; Figure 2 This is a structural block diagram of an artificial intelligence-based automated operation and maintenance system in an embodiment of this specification. DETAILED DESCRIPTION

[0018] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the present disclosure will be more comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or that other methods, components, devices, steps, etc. may be employed. In other cases, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0019] The accompanying drawings are merely schematic illustrations of the present disclosure. Identical reference numerals in the drawings denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0020] The present invention provides an automated operation and maintenance method for a product based on artificial intelligence. Figure 1FIG2 is a flow chart of an artificial intelligence-based automated operation and maintenance method according to an embodiment of the present invention. The method can be applied to electronic devices such as personal computers, servers, and controllers. The method can be performed by a device that can be implemented by software and / or hardware. The method can specifically include the following steps S101-S106: In step S101, log data containing detailed information of security events is collected in real time through a security information and event management system configured on the target endpoint, wherein the detailed information of security events includes the time of occurrence of the event, the IP address involved, user identity information and the event type.

[0021] Among them, the security information and event management system is further configured to monitor the access logs of remote desktop protocol, virtual private network and secure shell protocol, and specifically includes: detecting abnormal login time, multiple failed login attempts and access requests from unknown IP addresses; classifying the detected abnormal behavior and marking it as potential brute force cracking attempts or unauthorized access; storing the classified log data in JSON format, including timestamp, source IP address, destination port and event severity level.

[0022] In this step, the Security Information and Event Management (SIEM) system deployed on the target endpoint (i.e., the monitored device) acquires and collects all security-related event log data in real time. The log data captured by the system records key information about the security incident, including but not limited to: Event timestamp: records the exact time when a security event occurs; Related IP addresses: including the attack source IP address and the target endpoint IP address; User identity information: user account and user ID involved in the attack or abnormal operation; Event Type: Clearly define the specific event category reflected by the log data (e.g., failed login, port scan, privilege escalation, etc.).

[0023] SIEM can monitor access logs for high-risk access protocols, including remote desktop protocol, virtual private network, and secure shell protocol. Security log monitoring for these protocols mainly includes the following: Abnormal login time detection: For example, abnormal login behavior during non-working hours or holidays; Monitoring for multiple failed login attempts: Multiple consecutive failed login attempts may indicate a brute force attack; Access requests from unknown IP addresses: Alarms are triggered when IP addresses that are not included in the whitelist access critical systems.

[0024] SIEM further classifies and labels the abnormal behaviors described above, classifying them as potential brute force attempts or unauthorized access. This classification can be performed using the following judgment formula: Set the abnormal login event collection to , where each event can be represented as: ; in, The time when the event occurred; The source IP associated with the event; For target users; The event category (such as "failed_login_attempt").

[0025] Define the brute force attack classification threshold as k. For any given IP address, if the following equation is met within a short window (e.g., 10 minutes), it is classified as a brute force attack: ; The classified security event log data is finally stored in JSON format.

[0026] In step S102, the collected log data is transmitted for enrichment. During enrichment, the log data is cleaned, annotated, and structured by an agent artificial intelligence system to generate standardized metadata. The metadata is then mapped with the strategies, techniques, and procedures in the MITRE ATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks.

[0027] This step is used to conduct in-depth analysis and data enrichment of the collected log data. The core goal of the data enrichment phase is to use the agent AI system to clean, annotate, and structure the initial log data, and accurately map it to the MITRE ATT&CK knowledge base to achieve automated identification of attack technical characteristics and behavioral patterns.

[0028] Specifically, the agent AI system performs operations in the following order: Preprocess the log data to remove redundant information and normalize the field format. Redundant information, such as duplicate log entries and irrelevant fields, is removed. Normalized log field formats, such as unifying timestamps in UTC ISO-8601 and IP addresses, are also standardized. For example, if the original log data record is [07 / 30 / 2025 12:00:00 PM] User admin failed login from IP 192.168.1.10, the normalized log data can be recorded as: {"timestamp": "2025-07-30T12:00:00Z", "user": "admin", "source_ip": "192.168.1.10", "event": "failed_login"}; Natural language processing (NLP) techniques are used to extract key event features, including attack timelines, affected hosts, and abnormal behavior patterns. Natural language processing (NLP) techniques, such as named entity recognition (NER) and text classification, can be used to automatically convert unstructured log information into structured feature sets.

[0029] The extracted features are compared with the TTP database of the MITRE ATT&CK knowledge base in real time to generate a mapping report containing attack technique numbers. The extracted features are compared with the TTP data of the MITRE ATT&CK knowledge base in real time. Based on the set mapping relationship, a specific attack technique number can be given in each mapping result; The mapping report is combined with the normalized metadata to generate an enriched data set containing event context, attack type, and compliance requirements.

[0030] In step S103, the enriched log data is compared with external threat intelligence sources, the TTPs of known attack groups or malware families are analyzed, the attribution and potential motivation of the attack are determined, and a threat intelligence correlation report is generated.

[0031] The generated enriched log dataset is cross-referenced and feature-correlated with external threat intelligence sources. The goal is to identify the attacker's potential identity, the attack group they belong to, the malware family they use, and their technical strategies (TTPs, Tactics, Techniques, and Procedures), thereby enabling attack attribution and motivation analysis. Specifically, the input data is the generated enriched log data, including timestamps, affected hosts, attack types, MITRE TTP IDs, user information, and source IP addresses. External threat intelligence sources include known attack groups and APT organization TTP patterns in the MITRE ATT&CK database, public intelligence platforms (such as MISP, AlienVault OTX, and VirusTotal Intelligence), enterprise subscription intelligence platforms (such as Recorded Future, CrowdStrikeIntel, and Anomali), historical attack sample databases, and malware signature libraries.

[0032] In determining the attribution and potential motive of the attack, one can assess the likely attribution of the attack organization or attack motive by feature matching the TTPs identified in the current incident (e.g. “Multiple SSH failed logins, MITRE T1110”) against the attack group TTP templates in the intelligence sources. Also, one can cross-reference the technical features in the incident (e.g. file hashes, communication ports, C2 domain names, registry behaviors, etc.) against the malware feature library. For example, if the behaviors “T1059 (Command and Scripting Interpreter) + T1543 (Boot or Logon Autostart Execution)” are present, it can point to a specific family such as “Emotet” or “Cobalt Strike”, which can be achieved through YARA rules, sandbox behavior logs, threat intelligence IOCs (Indicators of Compromise). Once the likely attack group or malware is determined, one can supplement the attack motive based on the historical background of the attack organization.

[0033] After the above attribution is completed, one can then integrate the content and automatically generate a structured threat intelligence correlation report. Exemplarily, the report content can include: the similarity score of the current incident and historical attack patterns; the pointed attack group name and TTP list; the suspicious malware family and its associated IOC; the attacker’s estimated target, possible motive; the security compliance impact (such as GDPR or NIST level risk reminder); the recommended defense suggestion and mitigation direction.

[0034] In step S104, based on the enriched log data and the threat intelligence correlation report, a large language model is used to generate a targeted response plan for the incident, the response plan including at least one of isolating the affected system, blocking malicious entities, applying security patches, and resetting compromised credentials.

[0035] Among them, on the basis of completing the enrichment processing and threat attribution analysis of security incidents, a large language model (LLM) is further introduced to generate a targeted response plan. This process is the key hub of the entire automated operation and maintenance process. Its purpose is to automatically output a clearly structured and operational disposal strategy based on contextual information, replacing the traditional method that relies on manual judgment and script editing. Specifically, the structured metadata generated in step S102 and the threat intelligence association report output in step S103 are used as joint inputs to construct an attack context described in natural language, including but not limited to the attack time, affected hosts, attack methods (such as MITRE TTP numbers), potential attackers and their motivations, impact level, and relevant compliance requirements. Subsequently, the natural language context is input as prompt information into the large language model that has been tuned by the instructions.

[0036] This large language model can have multi-round reasoning and context understanding capabilities. It can extract key threat features from the input content, infer the development trend of the event, and automatically generate a multi-step emergency response plan based on known mitigation measures templates. The large language model can reason and rank the optional mitigation actions based on the results of the quantitative risk assessment, and give priority to generating cost-effective response strategies. This process does not rely on static scripts, but achieves dynamic orchestration through the "zero-sample task planning" capability. For example, when faced with a type of SSH brute force attack, the model can automatically identify isolating the server, blocking the IP, resetting the login credentials of the attacked account, and adding multi-factor authentication configuration as preferred actions, and flexibly output combination solutions based on the severity of the incident and the system configuration environment.

[0037] The response plan takes the form of structured natural language output or a JSON-formatted policy checklist. Each recommended action includes the action goal, execution method, expected effect, and required tools. For example, a typical response plan might include: first isolating the affected system to prevent lateral movement, then immediately banning the relevant malicious IP addresses, and subsequently deploying the latest system patches to fix known vulnerabilities, and finally performing a credential reset operation on the exposed user accounts. During this process, the large language model also has the ability to remember context, and can combine historical incident response records for reasoning optimization, thereby generating more targeted and adaptive policy text.

[0038] In step S105, an executable command sequence is generated according to the response plan, the command sequence including at least one of firewall rule configuration for isolating network endpoints, intrusion prevention system update for blocking malicious IP addresses, and system management script for applying patches.

[0039] The generation of the command sequence includes the following sub-steps: generating firewall rules according to the response plan, including configuring iptables rules to block inbound traffic from specific IP addresses or ports; automatically generating a script for updating the intrusion prevention system, including configuration for blocking known malicious domain names or file hashes; generating a system patch installation script to ensure that the affected systems install the latest security updates; and using a templated approach to generate a reusable command sequence to support adaptation across different operating systems and network environments.

[0040] As explained, in the next step, the response plan generated by the large language model will be further converted into a command sequence that can be directly executed in the target environment, thereby realizing automated disposal operations. Its goal is to map high-level policy instructions to underlying technical implementations so that the response plan can be quickly implemented in a variety of operating systems and network environments. Specifically, the security actions involved in the response plan can be task-decomposed, and abstract instructions such as "isolate the affected system", "block malicious entities", and "apply security patches" can be mapped to specific firewall rules, intrusion prevention system (IDS / IPS) update commands, or system patch deployment scripts. The generation of command sequences needs to follow predefined templated logic and context adaptation principles. First, for firewall policies, based on the malicious IP, port information, or traffic characteristics identified in the response plan, iptables or other firewall rules are automatically generated to block related traffic from entering the target network in real time. For example, when the attack source IP is detected to be 192.168.1.200, the following command can be generated: iptables -A INPUT -s 192.168.1.200 -j DROP This type of command can achieve immediate isolation and defense, preventing the further spread of the attack.

[0041] For intrusion prevention system updates, an update script is automatically constructed to write known malicious domain names, IP addresses, or file hash values ​​into the intrusion prevention rule base, enabling automatic interception of similar attacks in the future. This script generation requires invoking the API or configuration interface corresponding to the IPS or IDS to dynamically add and activate rules. Regarding patch management, corresponding patch installation or software update commands, such as the yum update or apt-get upgrade command in a Linux environment, are generated based on the type and version of the affected host operating system, ensuring that components with security vulnerabilities can be quickly repaired.

[0042] To enhance adaptability and maintainability, the present invention employs a templated approach to generate reusable command sequences. Each response action template contains variable placeholders, such as the target IP address, port number, or patch package path. These variables are automatically populated at runtime based on the current event context, generating directly executable commands. This approach enables cross-platform support for diverse operating systems (e.g., Linux, Windows, BSD, etc.) and network environments. For example, for Windows firewall rules, the template uses the netsh advfirewall command format, while for Linux, the iptables or nftables command format is used. This allows for automatic selection of the appropriate template based on the affected host type.

[0043] In step S106, the command sequence is executed on the target system through an agent executor, which establishes a stable connection with the server through the WebSocket protocol, runs the command in a POSIX-compatible shell environment, captures standard output, standard error and status indicators, and generates a structured JSON format response.

[0044] The proxy executor also performs the following operations: establishes a two-way communication channel with the server through the Gorilla WebSocket library to ensure the real-time and reliability of command transmission; executes commands in a POSIX-compatible shell environment, captures standard output and standard error streams, and records the success or failure status of command execution; performs error analysis on failed commands to identify situations where sudo permissions or other configuration changes are required; and encapsulates the execution results into a JSON response containing command output, error log, and status code, and sends it back to the server for further processing.

[0045] For clarification, in this step, the command sequence generated in the previous step is sent to the target system, where the Agent Executor deployed on the target system is responsible for executing the actual operation tasks. The Agent Executor is a lightweight execution component with communication and command parsing capabilities. Its role is to establish a stable command transmission link between the server and the terminal, and complete command interpretation, execution, and result feedback in the target environment. The Agent Executor first establishes a stable connection with the host server through a bidirectional communication mechanism built on the Gorilla WebSocket library. Once the connection is established, the server can send command sequences to the target agent at any time. Upon receiving a new command, the Agent Executor immediately parses and executes it.

[0046] During command execution, the agent executor runs command sequences in a POSIX-compliant shell environment, ensuring compatibility with the standard command syntax of most Unix / Linux systems and cross-platform script execution. Each command's execution fully captures its standard output and standard error streams, and also records the command's return status indicator as a key indicator of execution success. For example, a return code of 0 typically indicates successful command execution, while a non-zero return value indicates an error or exception.

[0047] When a command fails, the agent not only logs the error but also analyzes the cause of the failure. This includes determining whether the command lacks necessary permissions (e.g., whether sudo is required), whether the target path exists, and whether the command format is correct. For example, if the error "Permission denied" is captured, it identifies the failure as a lack of administrator permissions and stores this status in the analysis field to facilitate subsequent adaptive adjustments or manual intervention.

[0048] The executor encapsulates the execution results of each command as a structured JSON object and returns it. This response structure may include fields such as the command body, standard output content, error log, status code, and execution time. This structured response not only facilitates log retention and auditing but also provides basic data support for automated verification and strategy optimization in subsequent steps.

[0049] In step S107, the execution result of the target system is verified to check whether the threat is successfully mitigated. If the execution result does not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing execution parameters or reconstructing the mitigation strategy, and the optimized response action is recorded in the vector database for rapid response to subsequent similar events.

[0050] Among them, after completing the remote execution of the command sequence, the execution result of the target system will be verified a posteriori to determine whether the current response action has successfully mitigated the security threat. The verification process is based on the structured JSON execution result returned in step S106, and automatically compares and analyzes the attack characteristics and response expectations. For example, if the return status code of a command execution is non-zero, or the standard error contains abnormal information such as permission denial, path error, missing dependency, etc., the system will automatically determine that it is "unsuccessfully mitigated"; on the contrary, if the execution status is normal, there is no error log, and the corresponding configuration changes can be observed in the system status (such as firewall rules taking effect, patch installation successful), it can be considered that "the threat has been mitigated."

[0051] If execution does not meet expectations, the adaptive optimization mechanism is triggered to intelligently iterate the current command sequence and execution parameters. This process includes fine-tuning the command format, supplementing missing permissions (such as automatically adding sudo), introducing waiting or retry logic, replacing incompatible component calling methods, and even reconstructing the entire mitigation strategy when necessary. For example, if the original instruction attempts to add rules using iptables and fails, the iteration can be changed to use nftables syntax to regenerate the rules, or a permission escalation instruction can be added before the command. If the original patch script download fails, the mirror source can be automatically changed and retried.

[0052] After each optimization and adjustment, the new command version is re-executed and the verification process is re-entered until the mitigation goal is confirmed to be achieved or the preset iteration limit is reached. At the same time, to achieve long-term intelligent evolution and knowledge accumulation, the optimized response actions are stored together with the event context and execution success characteristics in the vector database. The vector database converts the event context (such as TTP number, attack type, target system configuration) and the corresponding successful mitigation action into a high-dimensional vector through embedding. When new events occur subsequently, the verified optimal response plan is quickly recalled through similarity calculation. This mechanism greatly improves the system's response speed and strategy maturity to similar attacks, allowing past experience to be applied to new threats at the millisecond level, realizing the transition from single response to continuous intelligent evolution.

[0053] In step S108, the vector representations of historical events and mitigation measures stored in the vector database are used to identify pattern matching between new events and historical events through a similarity retrieval mechanism, and a predefined response process is automatically triggered to achieve continuous threat monitoring and adaptive response.

[0054] Leveraging a previously constructed vector database, an automated security response mechanism, driven by experience, has been formally established. The vector database pre-stores a large number of historical security events and their corresponding mitigation strategies. This data, after vector encoding, forms a high-dimensional representation that can be efficiently searched and compared by machines. This high-dimensional representation not only incorporates surface-level event features (such as IP address, time, and attack type), but also incorporates contextual semantic information, such as TTP numbers, attack paths, affected system structures, and response effectiveness. This allows each historical event to be presented in a "semantically compressed" state within the database. Upon receiving a new security event, it is first enriched and attributed, converted into a unified vector representation, and then rapidly compared with existing events in the database using a vector search engine (e.g., based on cosine similarity, Euclidean distance, or ANN approximation algorithms).

[0055] When a historical case highly similar to the current incident is identified, the proven effective response strategy from that historical incident is immediately invoked, eliminating the need for re-planning by the language model or manual intervention, significantly reducing response latency. For example, if a typical remote desktop brute force attack is detected, and after vectorization, its similarity to a historical "RDP+T1110+APT41" combined attack event in the database reaches 0.95 or higher, the emergency response command sequence successfully used in that incident, such as isolating the terminal, blacklisting the IP address, and enhancing the authentication mechanism, can be directly extracted and immediately issued to the target environment for execution.

[0056] In one embodiment, the method further includes: obtaining a TTP dataset of known attack groups and malware from an external threat intelligence source, wherein the TTP dataset includes the attacker's motivations, common techniques, and historical attack records; using vector embedding technology to convert the enriched log data into a high-dimensional vector representation; performing similarity retrieval in a vector database, comparing the cosine similarity of the current event vector with the historical attack vector, and identifying the most similar threat pattern; and generating the threat intelligence association report including attack attribution, potential targets, and recommended defense measures based on the similarity retrieval results.

[0057] Specifically, by introducing a structured TTP dataset and vector embedding modeling, the system enhances its reasoning and response capabilities when facing unknown threats. This involves obtaining a complete TTP dataset containing information about attack groups, malware signatures, and their tactics, techniques, and procedures from external threat intelligence sources (such as MITRE ATT&CK, MISP, AlienVault, VirusTotal Intelligence, or commercial intelligence service platforms). TTP datasets typically cover known attacker motivations (such as financial gain, political interference, or military intelligence), frequently used technical paths (such as initial access methods, lateral movement techniques, and data exfiltration channels), and historical attack records (including metadata such as time, target, and toolchain). These TTP samples are structurally analyzed and uniformly converted into high-dimensional vector representations, and a knowledge index library is established for attribution. Furthermore, when an actual security incident occurs, the enriched log data generated in step S102 is embedded and encoded to form an event feature vector consistent with the structure of the TTP vector library. This embedding process can be completed based on the contextual embedding structure provided by a large language model or a pre-trained model (such as the Transformer encoder, BERT-derived model, LLM with retrieval interface, etc.), ensuring that the generated vector maintains both contextual semantic consistency and high-dimensional feature discrimination.

[0058] In addition, the large language model generates the response plan based on the following process: input the enriched log data and the threat intelligence report to generate a natural language context describing the attack scenario; use the instruction-tuned large language model to parse the context to generate the response plan containing multiple mitigation steps; prioritize each mitigation step and evaluate the potential impact and execution cost of the step based on a quantitative risk assessment method; output a detailed response plan document containing priorities, execution commands and expected results.

[0059] During the response plan generation process, a large-scale language model plays a key role in transforming complex security context into actionable strategies. This process first stitches enriched logs and threat intelligence reports into a complete natural language context, constructing a semantic description of the attack scenario. For example, "On March 15, 2025, multiple failed SSH login attempts were detected on Server-1, with the source IP address 192.168.1.200. This behavior aligns with the T1110 policy for the 'Credential Access' phase of the APT28 organization. The risk level is high, and immediate isolation measures and user credential reset are recommended." This context is fed as a prompt into the large-scale language model, which has been fine-tuned using security operations instructions. Upon receiving this input, the model automatically generates a response plan text containing multiple optional mitigation steps and prioritizes each step. This prioritization is calculated based on the Quantified Risk Assessment (QRA) methodology, which quantifies the benefits of a decision by combining the cost of executing the step with the expected impact.

[0060] In one embodiment, the implementation of the vector database includes the following sub-steps: The features of historical events and mitigation measures are converted into vector embeddings and stored in a dedicated vector database. The similarity between new events and historical events is calculated using cosine similarity or Euclidean distance algorithms. Based on the similarity threshold, a predefined response process matching the historical event is automatically triggered. The vector database is regularly updated to incorporate new threat intelligence and event data to ensure the system's adaptability to emerging threats.

[0061] Based on the same idea, Figure 2 The figure shows a block diagram of an artificial intelligence-based automated operation and maintenance system according to an embodiment of the present invention. The system includes: A collection module 201 is configured to collect log data containing detailed information of security events in real time through a security information and event management system configured on a target endpoint, wherein the detailed information of security events includes the time of occurrence of the event, the IP address involved, the user identity information, and the event type; Data enrichment module 202, which is used to transmit the collected log data for enrichment. During enrichment, the log data is cleaned, annotated, and structured by an agent artificial intelligence system to generate standardized metadata. The metadata is then mapped to the strategies, techniques, and procedures in the MITRE ATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks. A threat intelligence correlation module 203 is configured to compare the enriched log data with external threat intelligence sources, analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivations of the attacks, and generate a threat intelligence correlation report; a mitigation recommendation module 204 for generating a targeted incident response plan based on the enriched log data and the threat intelligence correlation report using a large language model, the response plan comprising at least one of isolating the affected system, blocking the malicious entity, applying a security patch, and resetting compromised credentials; a sequence construction module 205 for generating an executable command sequence based on the response plan, the command sequence including at least one of a firewall rule configuration for isolating a network endpoint, an intrusion prevention system update for blocking malicious IP addresses, and a system management script for applying a patch; a response execution module 206 for executing the command sequence on the target system via an agent executor, wherein the agent executor establishes a stable connection with the server via the WebSocket protocol, runs the command in a POSIX-compliant shell environment, captures standard output, standard error, and status indicators, and generates a structured JSON-formatted response; Response verification and optimization module 207 is used to verify the execution results of the target system to check whether the threat is successfully mitigated. If the execution results do not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing execution parameters, or reconstructing the mitigation strategy, and the optimized response actions are recorded in the vector database for rapid response to subsequent similar events; The continuous monitoring module 208 is used to utilize the vector representations of historical events and mitigation measures stored in the vector database, identify pattern matching between new events and historical events through a similarity retrieval mechanism, and automatically trigger a predefined response process to achieve continuous threat monitoring and adaptive response.

[0062] The specific details of the above system have been described in detail in the implementation method part. For undisclosed details, please refer to the implementation method part, and thus will not be repeated here.

[0063] This system integrates log data structured enrichment, TTP mapping, language model response generation, and command execution into a unified process, bridging the entire chain from event identification to system response, and achieving a highly efficient, closed-loop automated operations and maintenance system. This approach utilizes an agent-based AI system to clean, annotate, and structure logs. It then integrates the MITRE ATT&CK knowledge base to identify and attribute attack behaviors. Furthermore, it uses a large-scale language model to automatically generate targeted response plans, significantly improving the intelligence of threat analysis and the accuracy of emergency response.

[0064] Compared to existing technologies, this invention further introduces a templated command sequence generation mechanism and a vector database with dynamic knowledge accumulation capabilities. This enables the system to not only adapt across operating systems and heterogeneous network environments, but also rapidly respond to and self-evolve similar patterns in subsequent events. The proxy executor uses WebSocket to achieve stable interaction with the target system, supporting command output capture and result verification. This provides feedback support for continuous improvement and refinement of execution strategies, significantly enhancing the system's resilience and automated governance capabilities in the face of unknown threats and complex attack behaviors.

[0065] The above figures are merely illustrative of the processes included in the methods according to exemplary embodiments of the present disclosure and are not intended to be limiting. It is readily understood that the processes illustrated in the above figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0066] It should be noted that although several modules or units of the system are mentioned in the detailed description above, this division is not mandatory. In fact, according to the exemplary embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0067] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and embodiments are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the claims.

[0068] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An automated operation and maintenance method based on artificial intelligence, characterized in that: The method comprises: Collecting log data containing detailed information about security events in real time through a security information and event management system deployed on the target endpoint, including the time of the event, the IP address involved, user identity information, and the event type; The collected log data is passed to enrichment, where it is cleaned, annotated, and structured by an agent AI system to generate standardized metadata. This metadata is then mapped against the strategies, techniques, and procedures in the MITRE ATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks. Comparing the enriched log data with external threat intelligence sources to analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivations of the attacks, and generate threat intelligence correlation reports; generating a targeted incident response plan using a large language model based on the enriched log data and the threat intelligence correlation report, the response plan comprising at least one of isolating the affected system, blocking the malicious entity, applying a security patch, and resetting compromised credentials; generating an executable command sequence based on the response plan, the command sequence including at least one of a firewall rule configuration for isolating a network endpoint, an intrusion prevention system update for blocking malicious IP addresses, and a system management script for applying a patch; Executing the command sequence on the target system through an agent executor, wherein the agent executor establishes a stable connection with the server through the WebSocket protocol, runs the command in a POSIX-compliant shell environment, captures standard output, standard error, and status indicators, and generates a structured JSON-formatted response; Verify the execution results of the target system to check whether the threat is successfully mitigated. If the execution results do not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing execution parameters, or reconstructing the mitigation strategy, and the optimized response actions are recorded in the vector database for rapid response to subsequent similar events; By utilizing the vector representations of historical events and mitigation measures stored in the vector database, a similarity retrieval mechanism is used to identify pattern matching between new events and historical events, automatically triggering a predefined response process to achieve continuous threat monitoring and adaptive response.

2. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that: The security information and event management system is further configured to monitor access logs of remote desktop protocol, virtual private network and secure shell protocol, and specifically includes: Detect abnormal login times, multiple failed login attempts, and access requests from unknown IP addresses; Classify detected anomalous behavior and mark it as a potential brute force attempt or unauthorized access; The classified log data is stored in JSON format, including timestamp, source IP address, destination port and event severity level.

3. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that: The agent artificial intelligence system performs the following operations: Preprocessing the log data to remove redundant information and normalize field formats; Apply natural language processing technology to extract key event features, including attack timelines, affected hosts, and abnormal behavior patterns; Compare the extracted features with the TTP database of the MITRE ATT&CK knowledge base in real time to generate a mapping report containing attack technique numbers; The mapping report is combined with the normalized metadata to generate an enriched data set containing event context, attack type, and compliance requirements.

4. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that: The method further comprises: Obtain TTP datasets of known attack groups and malware from external threat intelligence sources. The TTP datasets include attackers' motivations, common techniques, and historical attack records. Converting the enriched log data into a high-dimensional vector representation using vector embedding technology; Perform similarity search in the vector database, compare the cosine similarity of the current event vector with the historical attack vector, and identify the most similar threat pattern; Based on the similarity retrieval results, a threat intelligence correlation report is generated that includes attack attribution, potential targets, and recommended defense measures.

5. The automated operation and maintenance method based on artificial intelligence according to claim 4, characterized in that: The large language model generates the response plan based on the following process: Input the enriched log data and the threat intelligence report to generate a natural language context describing the attack scenario; Parsing the context using the instruction-tuned large language model to generate the response plan comprising multiple mitigation steps; Prioritize each of the mitigation steps, based on a quantitative risk assessment approach, evaluating the potential impact and cost of implementation; Outputs a detailed response plan document that includes priorities, execution commands, and expected outcomes.

6. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that: The generation of the command sequence includes the following sub-steps: Generate firewall rules based on the response plan, including configuring iptables rules to block inbound traffic from specific IP addresses or ports; Automatically generate scripts for updating intrusion prevention systems, including configurations to block known malicious domains or file hashes; Generate system patch installation scripts to ensure that affected systems install the latest security updates; Use a templating approach to generate reusable command sequences to support adaptation across different operating systems and network environments.

7. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that: The agent executor also performs the following operations: Establish a two-way communication channel with the server through the Gorilla WebSocket library to ensure the real-time and reliability of command transmission; Executes commands in a POSIX-compliant shell environment, captures standard output and standard error streams, and records the success or failure status of command execution; Perform error analysis on failed commands to identify situations where sudo privileges or other configuration changes are required; The execution result is encapsulated as a JSON response, including command output, error log, and status code, and sent back to the server for further processing.

8. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that: The implementation of the vector database includes the following sub-steps: Convert the features of historical events and mitigation measures into vector embeddings and store them in a dedicated vector database; Use cosine similarity or Euclidean distance algorithms to calculate the similarity between new events and historical events; Automatically trigger predefined response processes that match historical events based on similarity thresholds; The vector database is regularly updated to incorporate new threat intelligence and event data to ensure the system's adaptability to emerging threats.

9. An automated operation and maintenance system based on artificial intelligence, comprising: a collection module configured to collect log data containing detailed information about security events in real time through a security information and event management system configured on a target endpoint, wherein the detailed information about security events includes the time of occurrence of the event, the IP addresses involved, user identity information, and the type of event; The data enrichment module is used to pass the collected log data for enrichment. During enrichment, the agent artificial intelligence system cleans, annotates, and structures the log data, generates standardized metadata, and maps the metadata with the strategies, techniques, and procedures in the MITRE ATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks. a threat intelligence correlation module, configured to compare the enriched log data with external threat intelligence sources, analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivations of the attacks, and generate a threat intelligence correlation report; a mitigation recommendation module for generating a targeted incident response plan based on the enriched log data and the threat intelligence correlation report using a large language model, the response plan comprising at least one of isolating the affected system, blocking the malicious entity, applying a security patch, and resetting compromised credentials; a sequence building module, configured to generate an executable command sequence based on the response plan, the command sequence including at least one of a firewall rule configuration for isolating a network endpoint, an intrusion prevention system update for blocking malicious IP addresses, and a system management script for applying a patch; a response execution module, configured to execute the command sequence on the target system via an agent executor, wherein the agent executor establishes a stable connection with the server via the WebSocket protocol, runs the command in a POSIX-compliant shell environment, captures standard output, standard error, and status indicators, and generates a structured JSON-formatted response; A response verification and optimization module is used to verify the execution results of the target system to check whether the threat is successfully mitigated. If the execution results do not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing execution parameters, or reconstructing the mitigation strategy, and the optimized response actions are recorded in the vector database for rapid response to subsequent similar events; A continuous monitoring module is used to utilize the vector representations of historical events and mitigation measures stored in the vector database, identify pattern matching between new events and historical events through a similarity retrieval mechanism, automatically trigger predefined response processes, and achieve continuous threat monitoring and adaptive response.

Images