An artificial intelligence-based automated operation method and system

Abstract

The application relates to the technical field of network operation and maintenance, in particular to an automatic operation and maintenance method and system based on artificial intelligence. The method collects detailed log information containing security events in real time through a security information and event management system configured at a target endpoint, then uses an agent artificial intelligence system to clean, label and structure process the log data, generates standardized metadata, maps the metadata with an MITRE ATT&CK knowledge base, identifies the technical features and behavior patterns of attacks, compares the enriched log data with external threat intelligence sources, analyzes the TTP of known attack groups, generates a threat intelligence correlation report, uses a large language model to generate a targeted response plan, generates an executable command sequence according to the response plan, connects the agent executor with the server through a WebSocket protocol, executes the command in a POSIX shell environment, captures and returns the execution result, verifies the execution result, performs necessary command optimization, records the optimized response to a vector database, automatically matches historical events through a vector retrieval mechanism, triggers a predefined response process, and realizes continuous threat monitoring and adaptive response. The application can solve the problem that the existing security operation and maintenance cannot form a closed loop of terminal executor, data enrichment and historical event recall.

Description

Technical Field

[0001] This invention relates to the field of network operation and maintenance technology, and in particular to an automated operation and maintenance method and system based on artificial intelligence. Background Technology

[0002] As cyberattack methods continue to evolve, traditional security operations and maintenance (SOA) models are facing unprecedented challenges. Security Operations Centers (SOCs) need to handle high-frequency, large-scale, and diverse security incidents. Traditional SOAR (Security Orchestration, Automation, and Response) platforms, which rely on manual orchestration, exhibit significant shortcomings in flexibility, scalability, and advanced logic support, making it difficult to quickly adapt to new attack techniques. While low-code or no-code platforms raise the barrier to automation, their template-based and static characteristics cause systems to lag in response to complex events, making it difficult to dynamically address new threat behaviors. Furthermore, traditional platforms lack unified scheduling and intelligent support in areas such as multi-tool integration, knowledge accumulation, and incident response documentation generation.

[0003] To improve response efficiency and intelligence, recent research has explored combining Large Language Models (LLMs) with security operations, attempting to drive automated decision-making and orchestration through natural language processing capabilities. For example, the IVAM framework proposes a three-stage process of "investigation-verification-proactive monitoring" and utilizes the MITRE ATT&CK framework, NIST standards, and quantitative risk assessment to achieve structured event response. However, existing solutions mostly remain at the process-level abstraction or technical demonstration, lacking deep integration with end-systems and failing to form a closed-loop system for end-execution, data enrichment, and historical event retrieval, especially lacking systematic design in command generation, automatic adaptation, and result optimization feedback. Summary of the Invention

[0004] In view of the above technical problems, the present invention provides an automated operation and maintenance method and system based on artificial intelligence to solve the problem that the existing technology of security operation and maintenance has failed to form a closed loop for terminal actuators, data enrichment and historical event recall.

[0005] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part by practice of this disclosure.

[0006] According to one aspect of the present invention, an automated operation and maintenance method based on artificial intelligence is proposed, the method comprising:

[0007] By configuring a security information and event management system on the target endpoint, log data containing detailed information about security events is collected in real time, including the time of the event, the IP addresses involved, user identity information, and the event type.

[0008] The collected log data is enriched. During the enrichment process, the log data is cleaned, labeled, and structured by an agent artificial intelligence system to generate standardized metadata. The metadata is then mapped to the strategies, techniques, and procedures in the MITRE ATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks.

[0009] The enriched log data is compared with external threat intelligence sources to analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivation of the attacks, and generate a threat intelligence correlation report.

[0010] Based on the enriched log data and the threat intelligence correlation report, a targeted incident response plan is generated using a large language model. The response plan includes at least one of the following: isolating the affected system, blocking malicious entities, applying security patches, and resetting compromised credentials.

[0011] According to the response plan, an executable command sequence is generated, which includes at least one of the following: firewall rule configuration for isolating network endpoints, intrusion prevention system update for blocking malicious IP addresses, and system management script for applying patches.

[0012] The command sequence is executed on the target system through a proxy executor. The proxy executor establishes a stable connection with the server via the WebSocket protocol, runs the commands in a POSIX-compliant shell environment, and captures standard output, standard error, and status indicators to generate a structured JSON response.

[0013] The execution results of the target system are verified to check whether the threat has been successfully mitigated. If the execution results do not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing the execution parameters, or reconstructing the mitigation strategy. The optimized response actions are recorded in the vector database for rapid response to subsequent similar events.

[0014] By utilizing the vector representations of historical events and mitigation measures stored in the vector database, a similarity retrieval mechanism is used to identify pattern matching between new events and historical events, automatically triggering a predefined response process to achieve continuous threat monitoring and adaptive response.

[0015] Furthermore, the security information and event management system is further configured to monitor access logs for Remote Desktop Protocol, Virtual Private Network, and Secure Shell Protocol, and specifically includes:

[0016] Detect abnormal login times, multiple failed login attempts, and access requests from unknown IP addresses;

[0017] Detected abnormal behavior is categorized and marked as potential brute-force attempts or unauthorized access;

[0018] The categorized log data is stored in JSON format, including timestamps, source IP addresses, destination ports, and event severity levels.

[0019] Furthermore, the agent AI system performs the following operations:

[0020] The log data is preprocessed to remove redundant information and standardize field formats;

[0021] Natural language processing techniques are used to extract key event features, including attack timelines, affected hosts, and abnormal behavior patterns.

[0022] The extracted features are compared in real time with the TTP database of the MITRE ATT&CK knowledge base to generate a mapping report containing attack technique IDs.

[0023] The mapping report is combined with the standardized metadata to generate an enriched dataset that includes event context, attack type, and compliance requirements.

[0024] Furthermore, the method also includes:

[0025] TTP datasets of known attack groups and malware are obtained from external threat intelligence sources. These TTP datasets include attackers' motivations, common techniques, and historical attack records.

[0026] The enriched log data is converted into a high-dimensional vector representation using vector embedding techniques.

[0027] Perform similarity retrieval in the vector database, compare the cosine similarity between the current event vector and the historical attack vector, and identify the most similar threat patterns;

[0028] Based on the similarity search results, a threat intelligence correlation report is generated, which includes attack attribution, potential targets, and recommended defense measures.

[0029] Furthermore, the large language model generates the response plan based on the following process:

[0030] Input the enriched log data and the threat intelligence report to generate a natural language context describing the attack scenario;

[0031] The large language model, tuned with instructions, is used to parse the context and generate the response plan, which includes multiple mitigation steps.

[0032] Each mitigation step is prioritized, and its potential impact and implementation cost are assessed based on a quantitative risk assessment method.

[0033] The output includes a detailed response plan document containing priorities, commands to be executed, and expected results.

[0034] Furthermore, the generation of the command sequence includes the following sub-steps:

[0035] Based on the response plan, generate firewall rules, including configuring iptables rules to block inbound traffic to specific IP addresses or ports;

[0036] Automatically generate scripts for updating the intrusion prevention system, including configurations to block known malicious domains or file hashes;

[0037] Generate system patch installation scripts to ensure that affected systems install the latest security updates;

[0038] Use a templated approach to generate reusable command sequences to support adaptation across different operating systems and network environments.

[0039] Furthermore, the agent executor also performs the following operations:

[0040] By establishing a bidirectional communication channel with the server through the Gorilla WebSocket library, the real-time and reliable transmission of commands can be ensured.

[0041] Execute commands in a POSIX-compliant shell environment, capture standard output and standard error streams, and log the success or failure status of command execution;

[0042] Perform error analysis on commands that fail to execute, and identify situations where sudo privileges or other configuration changes are required;

[0043] The execution result is encapsulated into a JSON response, including command output, error logs, and status codes, and sent back to the server for further processing.

[0044] Furthermore, the implementation of the vector database includes the following sub-steps:

[0045] Features of historical events and mitigation measures are converted into vector embeddings and stored in a dedicated vector database;

[0046] Use cosine similarity or Euclidean distance algorithms to calculate the similarity between new events and historical events;

[0047] Based on a similarity threshold, a predefined response process matching historical events is automatically triggered;

[0048] Regularly update the vector database to incorporate new threat intelligence and incident data to ensure the system's adaptability to emerging threats.

[0049] According to a second aspect of this disclosure, an automated operation and maintenance system based on artificial intelligence is provided, the system comprising:

[0050] The collection module is used to collect log data containing detailed information about security events in real time through a security information and event management system configured on the target endpoint. The detailed information about security events includes the time of the event, the IP address involved, the user's identity information, and the event type.

[0051] The data enrichment module is used to enrich the collected log data. During the enrichment process, the log data is cleaned, labeled and structured by an agent artificial intelligence system to generate standardized metadata. The metadata is then mapped to the strategies, techniques and procedures in the MITRE ATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks.

[0052] The threat intelligence correlation module is used to compare the enriched log data with external threat intelligence sources, analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivation of the attack, and generate a threat intelligence correlation report.

[0053] The mitigation recommendation module is used to generate targeted event response plans based on the enriched log data and the threat intelligence correlation report using a large language model. The response plan includes at least one of the following: isolating the affected system, blocking malicious entities, applying security patches, and resetting compromised credentials.

[0054] A sequence building module is used to generate an executable command sequence according to the response plan. The command sequence includes at least one of the following: firewall rule configuration for isolating network endpoints, intrusion prevention system update for blocking malicious IP addresses, and system management script for applying patches.

[0055] The response execution module is used to execute the command sequence on the target system through a proxy executor. The proxy executor establishes a stable connection with the server via the WebSocket protocol, runs commands in a POSIX-compatible shell environment, and captures standard output, standard error, and status indicators to generate a structured JSON format response.

[0056] The response verification and optimization module is used to verify the execution results of the target system and check whether the threat has been successfully mitigated. If the execution results do not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing the execution parameters, or reconstructing the mitigation strategy. The optimized response action is recorded in the vector database for rapid response to subsequent similar events.

[0057] The continuous monitoring module utilizes the vector representations of historical events and mitigation measures stored in the vector database to identify pattern matching between new events and historical events through a similarity retrieval mechanism, automatically triggering predefined response processes to achieve continuous threat monitoring and adaptive response.

[0058] The technical solution disclosed herein has the following beneficial effects:

[0059] This method integrates log data structuring and enrichment, TTP mapping, language model response generation, and command execution mechanisms into a unified process, streamlining the entire chain from event identification to system response and achieving a highly efficient, closed-loop automated operation and maintenance system. It utilizes an agent-based artificial intelligence system to clean, label, and structure logs, combines this with the MITRE ATT&CK knowledge base to identify and attribute attack behaviors, and further automatically generates targeted response plans through a large-scale language model, significantly improving the intelligence level of threat analysis and the accuracy of incident response.

[0060] Compared to existing technologies, this invention further introduces a templated generation mechanism for command sequences and the dynamic knowledge accumulation capability of a vector database. This enables the system to not only adapt to cross-operating systems and heterogeneous network environments, but also to achieve rapid response and self-evolution in subsequent events based on similar patterns. The proxy executor achieves stable interaction with the target system based on WebSocket, supports command output capture and result verification, and provides feedback support for continuous improvement and refined execution strategies. This significantly enhances the system's responsiveness and automated governance level in the face of unknown threats and complex attack behaviors. Attached Figure Description

[0061] Figure 1 This is a flowchart illustrating an automated operation and maintenance method based on artificial intelligence, as described in the embodiments of this specification.

[0062] Figure 2 This is a structural block diagram of an AI-based automated operation and maintenance system as described in the embodiments of this specification. Detailed Implementation

[0063] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0064] Furthermore, the accompanying drawings are merely illustrative of this disclosure. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0065] This invention provides an automated operation and maintenance method for products based on artificial intelligence. (Refer to...) Figure 1 The diagram shown illustrates a flowchart of an automated operation and maintenance method based on artificial intelligence, provided in an embodiment of the present invention. This method can be applied to electronic devices such as personal computers, servers, and controllers. The method can be executed by a device, which can be implemented by software and / or hardware. Specifically, the method may include the following steps S101-S106:

[0066] In step S101, log data containing detailed information about security events is collected in real time by configuring a security information and event management system on the target endpoint. The detailed information about security events includes the time of the event, the IP address involved, the user's identity information, and the event type.

[0067] The security information and event management system is further configured to monitor access logs of remote desktop protocols, virtual private networks, and secure shell protocols. Specifically, it includes: detecting abnormal login times, multiple failed login attempts, and access requests from unknown IP addresses; classifying the detected abnormal behaviors and marking them as potential brute-force attacks or unauthorized access; and storing the classified log data in JSON format, including timestamps, source IP addresses, target ports, and event severity levels.

[0068] In this step, a Security Information and Event Management (SIEM) system deployed on the target endpoint (i.e., the monitored device) acquires and collects all security-related event log data in real time. The log data acquired by the system records detailed information about the occurrence of security events, including but not limited to:

[0069] Event timestamp: Records the precise time when a security incident occurred;

[0070] Relevant IP addresses: including the IP address of the attack source and the IP address of the target endpoint;

[0071] User identity information: User accounts and user IDs involved in attacks or abnormal operations;

[0072] Event type: Clearly define the specific event category reflected by the log data (e.g., login failure, port scan, privilege escalation, etc.).

[0073] SIEM can monitor access logs for high-risk access protocols, including remote desktop protocols, virtual private networks, and Secure Shell protocols. Security log monitoring for these protocols primarily includes the following:

[0074] Detection of abnormal login times: such as abnormal login behavior during non-working hours or holidays;

[0075] Monitoring for multiple failed login attempts: Multiple consecutive failed login attempts may indicate a brute-force attack.

[0076] Unknown IP address access requests: Alarms are triggered, especially when IPs not included in the whitelist access critical systems.

[0077] For the above-mentioned abnormal behaviors, SIEM further performs a classification and labeling operation, dividing the detected abnormal behaviors into potential brute-force attacks or unauthorized access behaviors. This classification can be performed using the following formula:

[0078] Set the abnormal login event set as Each event can be represented as:

[0079] ;

[0080] in, The time when the event occurred; The source IP associated with the event; For target users; For the event category (e.g., "failed_login_attempt").

[0081] Define the brute-force attack classification threshold as k. Then, for any given IP address, if the following expression is satisfied within a short time window (e.g., 10 minutes), it is classified as a brute-force attack:

[0082] ;

[0083] Finally, the categorized security event log data is stored in JSON format.

[0084] In step S102, the collected log data is enriched. During enrichment, the log data is cleaned, labeled, and structured by an agent artificial intelligence system to generate standardized metadata. The metadata is then mapped to the strategies, techniques, and procedures in the MITREATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks.

[0085] This step involves in-depth analysis and data enrichment of the collected log data. The core objective of the data enrichment stage is to perform cleaning, labeling, and structuring processing on the initial log data through an agent-based artificial intelligence system, and to accurately map it to the MITREATT&CK knowledge base, thereby achieving automated identification of attack techniques and behavioral patterns.

[0086] Specifically, the agent AI system performs operations in the following order:

[0087] The log data is preprocessed to remove redundant information and standardize field formats. Redundant information removal includes duplicate log entries and irrelevant fields; standardizing log field formats includes unifying the timestamp format to UTC ISO-8601 and IP address formatting. For example, if the original log data is recorded as "[07 / 30 / 2025 12:00:00 PM] User admin failed login from IP 192.168.1.10", then after standardization, the log data can be recorded as follows:

[0088] {"timestamp": "2025-07-30T12:00:00Z", "user": "admin", "source_ip": "192.168.1.10", "event": "failed_login"};

[0089] Key event features are extracted using natural language processing (NLP) techniques, including attack timelines, affected hosts, and abnormal behavior patterns. Specifically, NLP techniques such as Named Entity Recognition (NER) and text classification methods can be used to automatically transform unstructured log information into a structured feature set.

[0090] The extracted features are compared in real time with the TTP database of the MITRE ATT&CK knowledge base to generate a mapping report containing attack technique IDs. Specifically, by comparing the extracted features with the TTP data of the MITRE ATT&CK knowledge base in real time, and based on the established mapping relationship, a specific attack technique ID can be given in each mapping result.

[0091] The mapping report is combined with the standardized metadata to generate an enriched dataset that includes event context, attack type, and compliance requirements.

[0092] In step S103, the enriched log data is compared with external threat intelligence sources, the TTPs of known attack groups or malware families are analyzed, the attribution and potential motivation of the attack are determined, and a threat intelligence association report is generated.

[0093] The process involves cross-referencing and feature correlation between the generated enriched log dataset and external threat intelligence sources. The goal is to identify the attacker's potential identity, affiliated attack group, malware family, and their techniques (TTPs, tactics, techniques, and procedures), thereby enabling attack attribution and motivation analysis. Specifically, the input data consists of the generated enriched log data, including timestamps, affected hosts, attack type, MITRE TTP ID, user information, and source IP. External threat intelligence sources include: known attack groups and APT organization TTP patterns in the MITRE ATT&CK database, publicly available intelligence platforms (such as MISP, AlienVault OTX, VirusTotal Intelligence, etc.), enterprise subscription intelligence platforms (such as Recorded Future, CrowdStrikeIntel, Anomali), historical attack sample databases, and malware signature databases.

[0094] In determining the attribution and potential motives of an attack, signature matching can be performed between TTPs identified in the current incident (such as "multiple failed SSH logins, MITRE T1110") and attack group TTP templates in intelligence sources to assess the possible attack group or motive. Additionally, cross-referencing can be performed based on technical characteristics of the incident (such as file hashes, communication ports, C2 domains, registry behavior, etc.) with malware signature databases. For example, if the behavior "T1059 (Command and Scripting Interpreter) + T1543 (Boot or Logon Autostart Execution)" appears, it may point to a specific family such as "Emotet" or "Cobalt Strike," which can be achieved through YARA rules, sandbox behavior logs, and threat intelligence IOCs (Indicators of Compromise). Once the possible attack group or malware is identified, the attack motive can be supplemented by the historical background of the attack group.

[0095] After completing the above attribution, the content can be integrated to automatically generate a structured threat intelligence correlation report. For example, the report content may include: a similarity score between the current event and historical attack patterns; the name of the targeted attack group and a list of TTPs; suspicious malware families and their associated IOCs; the attacker's estimated targets and possible motives; security compliance impact (such as GDPR or NIST level risk alerts); and recommended defense recommendations and mitigation directions.

[0096] In step S104, based on the enriched log data and the threat intelligence correlation report, a targeted event response plan is generated using a large language model. The response plan includes at least one of isolating the affected system, blocking malicious entities, applying security patches, and resetting compromised credentials.

[0097] This process, building upon the enrichment of security incidents and threat attribution analysis, further introduces a Large Language Model (LLM) to generate targeted response plans. This process is a crucial hub in the entire automated operations and maintenance workflow, aiming to automatically output clearly structured and actionable handling strategies based on contextual information, replacing the traditional method of relying on manual judgment and script editing. Specifically, the structured metadata generated in step S102 and the threat intelligence correlation report output in step S103 are used as joint inputs to construct a natural language description of the attack context, including but not limited to attack time, affected hosts, attack methods (such as MITRE TTP numbers), potential attackers and their motives, impact level, and relevant compliance requirements. Subsequently, this natural language context is input as prompt information into the instruction-optimized LLM.

[0098] This large-scale language model possesses multi-turn reasoning and contextual understanding capabilities, enabling it to extract key threat features from input content, infer the development trend of events, and automatically generate multi-step emergency response plans by combining known mitigation measure templates. Based on the results of quantitative risk assessment, the large language model can reason and prioritize optional mitigation actions, generating response strategies with high cost-effectiveness. This process does not rely on static scripts but achieves dynamic orchestration through "zero-shot task planning" capabilities. For example, when facing a type of SSH brute-force attack, the model can automatically identify server isolation, IP blocking, resetting the login credentials of the attacked account, and adding multi-factor authentication configurations as preferred actions, and flexibly output combined solutions based on the severity of the event and the system configuration environment.

[0099] The response plan takes the form of structured natural language output or a JSON-formatted policy list. Each suggested action includes the action objective, execution method, expected outcome, and required tools. For example, a typical response plan might include: first, isolating the affected system to prevent lateral movement; then, immediately blocking the relevant malicious IP addresses; subsequently, deploying the latest system patches to fix known vulnerabilities; and finally, resetting the credentials of exposed user accounts. During this process, the large language model also possesses contextual memory capabilities, enabling it to combine historical event response records for reasoning optimization, thereby generating more targeted and adaptive policy text.

[0100] In step S105, an executable command sequence is generated according to the response plan. The command sequence includes at least one of the following: firewall rule configuration for isolating network endpoints, intrusion prevention system update for blocking malicious IP addresses, and system management script for applying patches.

[0101] The generation of the command sequence includes the following sub-steps: generating firewall rules according to the response plan, including configuring iptables rules to block inbound traffic from specific IP addresses or ports; automatically generating scripts for updating the intrusion prevention system, including configurations to block known malicious domain names or file hashes; generating system patch installation scripts to ensure that affected systems install the latest security updates; and using a templated approach to generate reusable command sequences to support adaptation across different operating systems and network environments.

[0102] As an explanation, the next step further transforms the response plan generated by the large language model into a sequence of commands that can be directly executed in the target environment, thereby achieving automated handling. The goal is to map high-level policy instructions to low-level technical implementations, enabling the response plan to be quickly deployed and executed across various operating systems and network environments. Specifically, the security actions involved in the response plan can be decomposed into tasks, mapping abstract instructions such as "isolate affected systems," "block malicious entities," and "apply security patches" to specific firewall rules, intrusion prevention system (IDS / IPS) update commands, or system patch deployment scripts. The generation of the command sequence must follow predefined templated logic and context adaptation principles. First, for firewall policies, based on the malicious IP, port information, or traffic characteristics identified in the response plan, iptables or other firewall rules are automatically generated to block relevant traffic from entering the target network in real time. For example, when the attack source IP is detected as 192.168.1.200, the following command can be generated:

[0103] iptables -A INPUT -s 192.168.1.200 -j DROP

[0104] These types of commands enable immediate isolation and defense, preventing the further spread of attacks.

[0105] For intrusion prevention system (IPS) updates, update scripts are automatically built, writing known malicious domains, IPs, or file hashes into the IPS rule base to automatically block similar attacks in the future. This script generation requires calling APIs or configuration interfaces corresponding to IPS or IDS to dynamically add and activate rules. Regarding patch management, based on the affected host operating system type and version, corresponding patch installation or software update commands are generated, such as `yum update` or `apt-get upgrade` commands in a Linux environment, ensuring that vulnerable components can be quickly patched.

[0106] To enhance adaptability and maintainability, this invention employs a template-based approach to generate reusable command sequences. Each response action template includes variable placeholders, such as the target IP address, port number, or patch package path. These variables are automatically populated at runtime based on the current event context, generating a directly executable command. This approach enables cross-platform support for different operating systems (such as Linux, Windows, and BSD) and network environments. For example, for Windows firewall rules, the template uses the `netsh advfirewall` command format, while for Linux, it uses the `iptables` or `nftables` command format, allowing for automatic selection of the appropriate template based on the affected host type.

[0107] In step S106, the command sequence is executed on the target system through a proxy executor. The proxy executor establishes a stable connection with the server via the WebSocket protocol, runs the commands in a POSIX-compatible shell environment, and captures standard output, standard error, and status indicators to generate a structured JSON format response.

[0108] The proxy executor also performs the following operations: establishes a bidirectional communication channel with the server through the Gorilla WebSocket library to ensure the real-time and reliable transmission of commands; executes commands in a POSIX-compliant shell environment, captures standard output and standard error streams, and records the success or failure status of command execution; performs error analysis on failed commands to identify situations requiring sudo privileges or other configuration changes; and encapsulates the execution results into a JSON response, including command output, error logs, and status codes, and sends it back to the server for further processing.

[0109] To explain, in this step, the command sequence generated in the previous step is sent to the target system, where an agent executor deployed on the target system is responsible for executing the actual operation tasks. The agent executor is a lightweight execution component with communication and command parsing capabilities. Its role is to establish a stable command transmission link between the server and the terminal, and to interpret, execute, and provide results in the target environment. The agent executor first establishes a stable connection with the host server through a bidirectional communication mechanism built on the Gorilla WebSocket library. After the connection is established, the server can send command sequences to the target agent at any time. Upon receiving a new command, the agent executor immediately parses it and enters the execution process.

[0110] During command execution, the proxy executor runs the command sequence in a POSIX-compliant shell environment, ensuring compatibility with standard command syntax in most Unix / Linux systems and guaranteeing cross-platform script executability. The execution of each command is fully captured, including its standard output and standard error streams. Furthermore, the command's return status indicators are recorded as crucial evidence of successful execution. For example, a return code of 0 typically indicates successful command execution, while a non-zero return value indicates an error or exception.

[0111] When a command fails to execute, the agent executor not only logs the error information but also further analyzes the reason for the failure. This includes determining whether necessary permissions are lacking (e.g., whether execution with sudo is required), whether the target path exists, and whether the command format is correct. For example, if the captured error is "Permission denied," it can be identified as a lack of administrator privileges, and this status is written to the analysis field to assist in subsequent adaptive adjustments or manual intervention.

[0112] The executor encapsulates the execution result of each command into a structured JSON object and sends it back. This response structure can include fields such as the executed command body, standard output content, error log, status code, and execution time. This structured response not only facilitates log retention and auditing but also provides basic data support for automated verification and strategy optimization in subsequent steps.

[0113] In step S107, the execution result of the target system is verified to check whether the threat has been successfully mitigated. If the execution result does not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing the execution parameters, or reconstructing the mitigation strategy. The optimized response action is recorded in the vector database for rapid response to subsequent similar events.

[0114] After the remote execution of the command sequence is completed, the execution result on the target system will be verified post-hocly to determine whether the current response action has successfully mitigated the security threat. The verification process is based on the structured JSON execution result returned in step S106, and automatically compares and analyzes it with attack characteristics and expected responses. For example, if a command execution returns a non-zero status code, or if the standard error contains abnormal information such as permission denial, path error, or missing dependencies, the system will automatically determine that "mitigation was unsuccessful"; conversely, if the execution status is normal, there are no error logs, and the corresponding configuration changes can be observed in the system status (such as firewall rules taking effect or patches being installed successfully), then it can be considered that "the threat has been mitigated".

[0115] If the execution does not meet expectations, an adaptive optimization mechanism is triggered to intelligently iterate the current command sequence and execution parameters. This process includes: fine-tuning the command format, supplementing missing permissions (such as automatically adding sudo), introducing wait or retry logic, replacing incompatible component invocation methods, and even refactoring the entire mitigation strategy when necessary. For example, if the original command fails to add rules using iptables, the rules can be regenerated using nftables syntax during the iteration, or a privilege escalation command can be added before the command; or if the original patch script fails to download, the mirror source can be automatically changed and retried.

[0116] After each optimization and adjustment, a new command version is re-executed, and the verification process is repeated until the mitigation goal is confirmed or the preset iteration limit is reached. Simultaneously, to achieve long-term intelligent evolution and knowledge accumulation, the optimized response actions, along with the event context and successful execution features, are stored in a vector database. The vector database uses embedding to transform the event context (such as TTP number, attack type, target system configuration) and corresponding successful mitigation actions into high-dimensional vectors. When new events occur, similarity calculations quickly recall the validated optimal response scheme. This mechanism significantly improves the system's response speed and strategy maturity to similar attacks, enabling past experience to be applied to new threats at the millisecond level, achieving a shift from single-response to continuous intelligent evolution.

[0117] In step S108, the vector representations of historical events and mitigation measures stored in the vector database are used to identify pattern matching between new events and historical events through a similarity retrieval mechanism, automatically triggering a predefined response process to achieve continuous threat monitoring and adaptive response.

[0118] Leveraging the previously established vector database, an automated security response mechanism based on "experience-driven" principles was formally established. The vector database pre-stores a large number of historical security events and their corresponding mitigation strategies. After vectorization encoding, this data forms a high-dimensional representation that can be efficiently retrieved and compared by machines. This high-dimensional representation not only includes the surface features of the event (such as IP, time, and attack type) but also integrates contextual semantic information, such as TTP number, attack path, affected system structure, and response effect, ensuring that each historical event exists in the database in a "semantically compressed" form. Upon receiving a new security event, it is first enriched and attributed, then transformed into a unified vector representation. A vector retrieval engine (such as one based on cosine similarity, Euclidean distance, or ANN approximation algorithms) is then used to quickly compare it with existing events in the database.

[0119] Once a historical case highly similar to the current event is identified, the system immediately invokes the proven and effective response strategy from that historical event, eliminating the need for replanning by the language model or manual intervention, thus significantly reducing response latency. For example, when a typical remote desktop brute-force attack is received, and after vectorization, its similarity to a historical "RDP+T1110+APT41" combined attack event in the database reaches 0.95 or higher, the system can directly extract the emergency response command sequence successfully used in that event, such as isolating the terminal, blacklisting the IP, and strengthening the authentication mechanism, and immediately deliver it to the target environment for execution.

[0120] In one embodiment, the method further includes: obtaining a TTP dataset of known attack groups and malware from an external threat intelligence source, the TTP dataset including attacker motivations, common techniques, and historical attack records; converting the enriched log data into a high-dimensional vector representation using vector embedding technology; performing a similarity search in a vector database, comparing the cosine similarity between the current event vector and historical attack vectors, and identifying the most similar threat patterns; and generating a threat intelligence association report containing attack attribution, potential targets, and recommended defense measures based on the similarity search results.

[0121] Specifically, by introducing a structured TTP dataset and vector embedding modeling, the ability to reason and respond to unknown threats is enhanced. This involves obtaining a complete TTP dataset containing information on attack groups, malware characteristics, and their tactics, techniques, and procedures from external threat intelligence sources (such as MITRE ATT&CK, MISP, AlienVault, VirusTotalIntelligence, or commercial intelligence service platforms). TTP datasets typically cover the attacker's known motives (e.g., economic interests, political interference, military intelligence), frequently used technical paths (e.g., initial access methods, lateral movement methods, data leakage channels), and historical attack records (including metadata such as time, target, and toolchain). After structural analysis of these TTP samples, they are uniformly transformed into high-dimensional vector representations, and a knowledge index library for attribution judgment is established. Simultaneously, when an actual security incident occurs, the enriched log data generated in step S102 is embedded and encoded to form an event feature vector consistent with the TTP vector library structure. This embedding process can be completed based on the contextual embedding structure provided by a large language model or a pre-trained model (such as the Transformer encoder, BERT derived model, LLM with retrieval interface, etc.), ensuring that the generated vectors maintain the consistency of contextual semantics while possessing high-dimensional feature discriminativeness.

[0122] As a supplement, the large language model generates the response plan based on the following process: inputting the enriched log data and the threat intelligence report, generating a natural language context describing the attack scenario; parsing the context using the instruction-tuned large language model, generating the response plan containing multiple mitigation steps; prioritizing each mitigation step, assessing the potential impact and execution cost of the steps based on a quantitative risk assessment method; and outputting a detailed response plan document containing priorities, execution commands, and expected results.

[0123] In the response plan generation process, a large language model plays a crucial role in transforming complex security contexts into actionable strategies. The process first concatenates enriched logs and threat intelligence reports into a complete natural language context, constructing a semantic description of the attack scenario. For example: "On March 15, 2025, multiple failed SSH login attempts were detected on Server-1, with the source IP being 192.168.1.200. The behavior conforms to the T1110 policy of the 'Credential Access' phase in the APT28 organization, indicating a high risk level. Immediate isolation measures and resetting user credentials are recommended." This context is input as a prompt to a large language model that has been optimized through security operations instructions. Upon receiving the input, the model automatically generates a response plan text containing multiple optional mitigation steps and prioritizes each step. The prioritization is calculated based on the Quantitative Risk Assessment (QRA) method, whose core idea is to quantify the decision-making benefits by combining the execution cost and expected impact of each step.

[0124] In one embodiment, the implementation of the vector database includes the following sub-steps:

[0125] Features of historical events and mitigation measures are converted into vector embeddings and stored in a dedicated vector database; cosine similarity or Euclidean distance algorithms are used to calculate the similarity between new events and historical events; based on a similarity threshold, predefined response processes matching historical events are automatically triggered; the vector database is regularly updated to incorporate new threat intelligence and event data to ensure the system's adaptability to emerging threats.

[0126] Based on the same line of thought, such as Figure 2 The diagram shown is a structural block diagram of an automated operation and maintenance system based on artificial intelligence provided in an embodiment of the present invention. The system includes:

[0127] The collection module 201 is used to collect log data containing detailed information about security events in real time through a security information and event management system configured on the target endpoint. The detailed information about security events includes the time of the event, the IP address involved, the user's identity information, and the event type.

[0128] The data enrichment module 202 is used to enrich the collected log data. During the enrichment process, the log data is cleaned, labeled and structured by the agent artificial intelligence system to generate standardized metadata. The metadata is then mapped to the strategies, techniques and programs in the MITRE ATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks.

[0129] The threat intelligence association module 203 is used to compare the enriched log data with external threat intelligence sources, analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivation of the attack, and generate a threat intelligence association report.

[0130] The mitigation recommendation module 204 is used to generate a targeted event response plan based on the enriched log data and the threat intelligence correlation report using a large language model. The response plan includes at least one of the following: isolating the affected system, blocking malicious entities, applying security patches, and resetting compromised credentials.

[0131] The sequence construction module 205 is used to generate an executable command sequence according to the response plan. The command sequence includes at least one of the following: firewall rule configuration for isolating network endpoints, intrusion prevention system update for blocking malicious IP addresses, and system management script for applying patches.

[0132] The response execution module 206 is used to execute the command sequence on the target system through a proxy executor. The proxy executor establishes a stable connection with the server through the WebSocket protocol, runs the commands in a POSIX-compatible shell environment, and captures standard output, standard error and status indicators to generate a structured JSON format response.

[0133] The response verification and optimization module 207 is used to verify the execution result of the target system, check whether the threat has been successfully mitigated, and if the execution result does not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing the execution parameters or reconstructing the mitigation strategy, and the optimized response action is recorded in the vector database for rapid response to subsequent similar events.

[0134] The continuous monitoring module 208 is used to utilize the vector representations of historical events and mitigation measures stored in the vector database, identify pattern matching between new events and historical events through a similarity retrieval mechanism, automatically trigger a predefined response process, and achieve continuous threat monitoring and adaptive response.

[0135] The specific details of the above system have been described in detail in the method section of the implementation plan. For any undisclosed details, please refer to the implementation plan of the method section, and therefore will not be repeated here.

[0136] This system integrates log data structuring and enrichment, TTP mapping, language model response generation, and command execution mechanisms into a unified process, streamlining the entire chain from event identification to system response and achieving a highly efficient, closed-loop automated operation and maintenance system. This method utilizes an agent-based artificial intelligence system to clean, label, and structure logs, combines the MITREATT&CK knowledge base to identify and attribute attack behaviors, and further automatically generates targeted response plans through large-scale language models, significantly improving the intelligence level of threat analysis and the accuracy of incident response.

[0137] Compared to existing technologies, this invention further introduces a templated generation mechanism for command sequences and the dynamic knowledge accumulation capability of a vector database. This enables the system to not only adapt to cross-operating systems and heterogeneous network environments, but also to achieve rapid response and self-evolution in subsequent events based on similar patterns. The proxy executor achieves stable interaction with the target system based on WebSocket, supports command output capture and result verification, and provides feedback support for continuous improvement and refined execution strategies. This significantly enhances the system's responsiveness and automated governance level in the face of unknown threats and complex attack behaviors.

[0138] The accompanying drawings are merely illustrative of the processes included in the methods according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the drawings do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0139] It should be noted that although several modules or units of the system have been mentioned in the detailed description above, this division is not mandatory. In fact, according to exemplary embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0140] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0141] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. An automated operation and maintenance method based on artificial intelligence, characterized in that, The method includes: By configuring a security information and event management system on the target endpoint, log data containing detailed information about security events is collected in real time, including the time of the event, the IP addresses involved, user identity information, and the event type. The collected log data is enriched. During the enrichment process, the log data is cleaned, labeled, and structured by an agent artificial intelligence system to generate standardized metadata. The metadata is then mapped to the strategies, techniques, and procedures in the MITRE ATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks. The enriched log data is compared with external threat intelligence sources to analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivation of the attacks, and generate a threat intelligence correlation report. Based on the enriched log data and the threat intelligence correlation report, a targeted incident response plan is generated using a large language model. The response plan includes at least one of the following: isolating the affected system, blocking malicious entities, applying security patches, and resetting compromised credentials. According to the response plan, an executable command sequence is generated, which includes at least one of the following: firewall rule configuration for isolating network endpoints, intrusion prevention system update for blocking malicious IP addresses, and system management script for applying patches. The command sequence is executed on the target system through a proxy executor. The proxy executor establishes a stable connection with the server via the WebSocket protocol, runs the commands in a POSIX-compliant shell environment, and captures standard output, standard error, and status indicators to generate a structured JSON response. The execution results of the target system are verified to check whether the threat has been successfully mitigated. If the execution results do not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing the execution parameters, or reconstructing the mitigation strategy. The optimized response actions are recorded in the vector database for rapid response to subsequent similar events. By utilizing the vector representations of historical events and mitigation measures stored in the vector database, a similarity retrieval mechanism is used to identify pattern matching between new events and historical events, automatically triggering a predefined response process to achieve continuous threat monitoring and adaptive response.

2. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that, The security information and event management system is further configured to monitor access logs for Remote Desktop Protocol, Virtual Private Network, and Secure Shell Protocol, and specifically includes: Detect abnormal login times, multiple failed login attempts, and access requests from unknown IP addresses; Detected abnormal behavior is categorized and marked as potential brute-force attempts or unauthorized access; The categorized log data is stored in JSON format, including timestamps, source IP addresses, destination ports, and event severity levels.

3. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that, The agent AI system performs the following operations: The log data is preprocessed to remove redundant information and standardize field formats; Natural language processing techniques are used to extract key event features, including attack timelines, affected hosts, and abnormal behavior patterns. The extracted features are compared in real time with the TTP database of the MITRE ATT&CK knowledge base to generate a mapping report containing attack technique IDs. The mapping report is combined with the standardized metadata to generate an enriched dataset that includes event context, attack type, and compliance requirements.

4. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that, The method further includes: TTP datasets of known attack groups and malware are obtained from external threat intelligence sources. These TTP datasets include attackers' motivations, common techniques, and historical attack records. The enriched log data is converted into a high-dimensional vector representation using vector embedding techniques. Perform similarity retrieval in the vector database, compare the cosine similarity between the current event vector and the historical attack vector, and identify the most similar threat patterns; Based on the similarity search results, a threat intelligence correlation report is generated, which includes attack attribution, potential targets, and recommended defense measures.

5. The automated operation and maintenance method based on artificial intelligence according to claim 4, characterized in that, The large language model generates the response plan based on the following process: Input the enriched log data and the threat intelligence report to generate a natural language context describing the attack scenario; The large language model, tuned with instructions, is used to parse the context and generate the response plan, which includes multiple mitigation steps. Each mitigation step is prioritized, and its potential impact and implementation cost are assessed based on a quantitative risk assessment method. The output includes a detailed response plan document containing priorities, commands to be executed, and expected results.

6. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that, The generation of the command sequence includes the following sub-steps: Based on the response plan, generate firewall rules, including configuring iptables rules to block inbound traffic to specific IP addresses or ports; Automatically generate scripts for updating the intrusion prevention system, including configurations to block known malicious domains or file hashes; Generate system patch installation scripts to ensure that affected systems install the latest security updates; Use a templated approach to generate reusable command sequences to support adaptation across different operating systems and network environments.

7. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that, The agent executor also performs the following operations: By establishing a bidirectional communication channel with the server through the Gorilla WebSocket library, the real-time and reliable transmission of commands can be ensured. Execute commands in a POSIX-compliant shell environment, capture standard output and standard error streams, and log the success or failure status of command execution; Perform error analysis on commands that fail to execute, and identify situations where sudo privileges or other configuration changes are required; The execution result is encapsulated into a JSON response, including command output, error logs, and status codes, and sent back to the server for further processing.

8. The automated operation and maintenance method based on artificial intelligence according to claim 1, characterized in that, The implementation of the vector database includes the following sub-steps: Features of historical events and mitigation measures are converted into vector embeddings and stored in a dedicated vector database; Use cosine similarity or Euclidean distance algorithms to calculate the similarity between new events and historical events; Based on a similarity threshold, a predefined response process matching historical events is automatically triggered; Regularly update the vector database to incorporate new threat intelligence and incident data to ensure the system's adaptability to emerging threats.

9. An automated operation and maintenance system based on artificial intelligence, the system comprising: The collection module is used to collect log data containing detailed information about security events in real time through a security information and event management system configured on the target endpoint. The detailed information about security events includes the time of the event, the IP address involved, the user's identity information, and the event type. The data enrichment module is used to enrich the collected log data. During the enrichment process, the log data is cleaned, labeled and structured by an agent artificial intelligence system to generate standardized metadata. The metadata is then mapped to the strategies, techniques and programs in the MITREATT&CK knowledge base to identify the technical characteristics and behavioral patterns of attacks. The threat intelligence correlation module is used to compare the enriched log data with external threat intelligence sources, analyze the TTPs of known attack groups or malware families, determine the attribution and potential motivation of the attack, and generate a threat intelligence correlation report. The mitigation recommendation module is used to generate targeted event response plans based on the enriched log data and the threat intelligence correlation report using a large language model. The response plan includes at least one of the following: isolating the affected system, blocking malicious entities, applying security patches, and resetting compromised credentials. A sequence building module is used to generate an executable command sequence according to the response plan. The command sequence includes at least one of the following: firewall rule configuration for isolating network endpoints, intrusion prevention system update for blocking malicious IP addresses, and system management script for applying patches. The response execution module is used to execute the command sequence on the target system through a proxy executor. The proxy executor establishes a stable connection with the server via the WebSocket protocol, runs commands in a POSIX-compatible shell environment, and captures standard output, standard error, and status indicators to generate a structured JSON format response. The response verification and optimization module is used to verify the execution results of the target system and check whether the threat has been successfully mitigated. If the execution results do not achieve the expected effect, iterative optimization is performed by adjusting the command sequence, optimizing the execution parameters, or reconstructing the mitigation strategy. The optimized response action is recorded in the vector database for rapid response to subsequent similar events. The continuous monitoring module utilizes the vector representations of historical events and mitigation measures stored in the vector database to identify pattern matching between new events and historical events through a similarity retrieval mechanism, automatically triggering predefined response processes to achieve continuous threat monitoring and adaptive response.

Images