A false positive optimization method and system based on a large language model and a medium

Abstract

The application provides a false alarm optimization method and system based on a large language model, and a medium, and relates to the technical field of network security. The method provided by the application comprises the following steps: periodically acquiring multi-source data from a security device, and performing feature extraction and feature fusion on the multi-source data to obtain a fused feature set; periodically or on demand, analyzing log data and behavior patterns to obtain a historical data feature set; a large language model learns the fused feature set and the historical data feature set to automatically optimize system rules to obtain an optimized rule set; and based on the optimized rule set, the large language model automatically identifies and classifies false alarms to generate an optimization strategy. The purpose is to improve the false alarm problem in the traditional network security system, significantly improve the detection efficiency, and adapt to new threat features and traffic changes to ensure the adaptive ability and detection flexibility in a complex network environment, and achieve efficient and accurate protection effect.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a false alarm optimization method, system, and medium based on a large language model. Background Technology

[0002] With the rapid development of network technology and the accelerated pace of digital transformation, the application of various network security devices in enterprises and organizations is becoming increasingly widespread. Firewalls, intrusion detection systems, and web application protection systems have become important tools for defending against network attacks. However, along with the widespread deployment of these security devices, false positives have also arisen. Many security devices rely on fixed rules for detection, and when encountering complex network environments and changing traffic patterns, they often incorrectly mark normal behavior as abnormal, generating false positives. False positives not only waste system resources but also increase the workload of security operations personnel, forcing them to manually filter and process these false positives, leading to slower response times and affecting the overall security protection effectiveness.

[0003] The core issue of false positives lies in the over-reliance of existing security detection mechanisms on static rules. These rules are typically based on known threat patterns, but when faced with dynamically changing network environments, they often prove too strict or insufficient to accurately describe current traffic patterns, leading to frequent false positives. Furthermore, the detection rules of different security devices operate independently, lacking coordination and unified optimization mechanisms, increasing the likelihood of rule conflicts and redundancy, further exacerbating the false positive rate. The system's inability to learn and adjust rules on its own means it cannot improve based on historical data or false positive information, thus failing to effectively address the false positive problem.

[0004] In existing technologies, rule-based methods for optimizing false alarms reduce false alarms by periodically updating and adjusting existing detection rules. These rules are typically defined based on known attack patterns or behavioral characteristics, and the system triggers an alert when network behavior matches a predefined rule. However, the limitation of these rules is that they are too static and cannot adapt to real-time changes in the network environment and emerging network threats, making them prone to false alarms.

[0005] In existing technologies, machine learning-based false positive optimization methods train on large amounts of network traffic data to identify and distinguish between normal and abnormal behavior. Deep learning-based false positive optimization methods, by constructing complex neural network models, can handle large-scale network data and extract high-level features. However, both techniques rely on large amounts of historical data for training and lack the ability to adjust in real time. This results in their inability to respond quickly to the latest network traffic or attack patterns. Therefore, there is an urgent need to provide a solution to improve upon these problems. Summary of the Invention

[0006] The purpose of this invention is to learn the latest multi-source data periodically through a large language model, continuously optimize rules, classify false alarms in detail and recommend optimization strategies, and improve the problems of existing technologies that rely on historical data, are not dynamic and flexible enough, and lack real-time adjustment capabilities.

[0007] In a first aspect, the present invention provides a false alarm optimization method based on a large language model, comprising:

[0008] Periodically acquire multi-source data from security devices, and perform feature extraction and feature fusion on the multi-source data to obtain a fused feature set;

[0009] Analyze log data and behavioral patterns regularly or as needed to obtain historical data feature sets;

[0010] The large language model learns the fused feature set and the historical data feature set to automatically optimize the system rules and obtain an optimized rule set.

[0011] Based on the optimization rule set, false alarms are automatically identified and subdivided using a large language model to generate optimization strategies.

[0012] The false alarm optimization method based on a large language model provided by this invention has the technical effects of being dynamic, flexible, efficient and accurate.

[0013] Optionally, the multi-source data includes firewall logs, intrusion detection system data, historical threat intelligence, real-time network traffic, and user behavior data.

[0014] Optionally, obtaining the fused feature set includes: periodically collecting the multi-source data from different security devices and performing data cleaning, extracting key features from the multi-source data to obtain feature sets, and performing weighted feature fusion on the feature sets from different data sources to obtain the fused feature set.

[0015] Optionally, when analyzing log data and behavioral patterns periodically or on demand to obtain a historical data feature set, the system analyzes log data and behavioral patterns according to a preset time interval or an on-demand triggering mechanism, identifies potential threats and characteristics of the log data and behavioral patterns, and obtains the historical data feature set.

[0016] Optionally, obtaining the optimized rule set includes: based on the rule optimization function, the large language model automatically optimizes the system rules by learning the fused feature set and the historical data feature set, and generates different detection strategies based on the fused feature set and the historical data feature set, and obtains the optimized rule set based on the detection strategies; the system rules include the built-in rules of the Web application firewall, the built-in rules of the intrusion detection system, and the built-in rules of endpoint detection and response; the optimized rule set includes removing redundant rules, generating new rules, and optimizing existing rules.

[0017] Optionally, when generating an optimization strategy by automatically identifying and classifying false alarms using a large language model based on the optimization rule set, the process includes: clustering or classifying all false alarms using the large language model based on the optimization rule set to obtain false alarm classification results; automatically generating a corresponding fine classification model based on the features of the false alarm classification results; and generating a corresponding optimization strategy based on the fine classification model.

[0018] Secondly, the present invention provides a false alarm optimization system based on a large language model, comprising:

[0019] The data processing module is used to periodically acquire multi-source data from security devices, and to perform feature extraction and feature fusion on the multi-source data to obtain a fused feature set;

[0020] The data analysis module is used to analyze log data and behavioral patterns periodically or on demand to obtain historical data feature sets;

[0021] The rule optimization module is used by the large language model to automatically optimize the system rules by learning the fused feature set and the historical data feature set to obtain an optimized rule set;

[0022] The strategy generation module, based on the optimization rule set, automatically identifies and classifies false alarms using a large language model to generate optimization strategies.

[0023] The information display module is used to display various key information during system operation; these key information include rule optimization progress, rule changes, large language model learning progress, historical adjustment records of security rules, system detection accuracy, system false alarm rate, system real-time detection status, false alarm categories, and false alarm handling status.

[0024] The system control module is used to perform management operations on the system based on real-time conditions. These management operations include false alarm management, rule adjustment and update, log data rollback and recovery, adjustment of large language model parameters, and configuration of rule adaptive strategies.

[0025] Thirdly, the present invention also provides a storage medium storing a program, characterized in that, when the program is executed by a processor, it implements the false alarm optimization method based on a large language model as described in any one of claims 1-6. Attached Figure Description

[0026] Figure 1 A flowchart illustrating a false alarm optimization method based on a large language model, provided as an embodiment of the present invention;

[0027] Figure 2 The flowchart illustrates the data cleaning and feature extraction processes in a false positive optimization method based on a large language model, as provided in this embodiment of the invention.

[0028] Figure 3 This is a structural diagram of a false alarm optimization system based on a large language model, provided for an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0030] See Figure 1 This invention provides a false positive optimization method based on a large language model, comprising the following steps:

[0031] S1. Periodically acquire multi-source data from security devices, and perform feature extraction and feature fusion on the multi-source data to obtain a fused feature set;

[0032] S2. Analyze log data and behavioral patterns periodically or on demand to obtain historical data feature sets;

[0033] S3, the large language model learns to integrate feature sets with historical data feature sets, and automatically optimizes system rules to obtain an optimized rule set;

[0034] S4. Based on the optimized rule set, the system automatically identifies and classifies false alarms using a large language model, and generates an optimization strategy.

[0035] In some embodiments, the multi-source data in step S1 includes firewall logs, intrusion detection system data, historical threat intelligence, real-time network traffic, and user behavior data. The aim is to leverage the powerful understanding and learning capabilities of large language models to uniformly analyze and integrate multi-source data from different security devices, thereby achieving automated rule optimization.

[0036] In some embodiments, when obtaining the fused feature set in step S1, multi-source data is periodically collected from different security devices and the data is cleaned. Feature extraction is performed on the multi-source data to obtain feature sets. The feature sets from different data sources are then weighted and fused to obtain the fused feature set.

[0037] Feature extraction: The system extracts key features from multi-source data of security devices to form a feature set.

[0038] ,

[0039] in, Indicates the first Feature sets of data sources To construct a feature set of Each specific feature item.

[0040] Feature fusion: The system fuses features from different data sources to generate a fused feature set. Furthermore, higher weights are assigned to key data sources to ensure they play a greater role in the final rule optimization.

[0041] ,

[0042] in, Indicates the first The importance weight of each data source.

[0043] In some embodiments, in step S2, the system continuously analyzes the latest log data and behavioral patterns according to a set time interval or an on-demand triggering mechanism to identify potential threats and their characteristics, ensuring the system's rapid adaptation to changing environments. The analysis process generates a historical data feature set. :

[0044] ,

[0045] in, This indicates newly acquired log data. This function extracts key features from log data, such as request frequency, request time, request method, and user-agent string, to form a historical data feature set. Used for rule updates.

[0046] In some embodiments, the system rules in step S3 are built-in rules of different defense systems. The system rules can be built-in rules of Web application firewalls, built-in rules of intrusion detection systems, and built-in rules of endpoint detection and response.

[0047] In some embodiments, in step S3, based on the rule optimization function, the Large Language Model (LLM) automatically optimizes the system rules by learning the fusion feature set and the historical data feature set, generating the corresponding fusion optimization rule set and data optimization rule set, and obtaining the optimization rule set based on the fusion optimization rule set and the data optimization rule set.

[0048] Specifically, LLM learns to fuse feature sets. Automatic optimization system rules Generate a set of fusion optimization rules The formula used is as follows:

[0049] ,

[0050] in, To integrate and optimize the rule set, This is a rule optimization function used to optimize the fused feature set. (e.g., request frequency, IP address, access time, etc.) Automatically adjust existing rules to improve detection accuracy and reduce false alarms; This is based on all possible candidate rule sets predefined by the system; The utility function is used to evaluate the candidate rule set. When facing feature sets Considering the overall performance over time, this function is typically designed as a weighted balance between accuracy and complexity.

[0051] ,

[0052] in, It is an accuracy metric used to quantify rule sets. In feature set The detection accuracy and false alarm rate; It is a complexity penalty term used to measure the size of the rule set or computational cost, and to avoid generating overly redundant or inefficient rules. and These are preset weighting coefficients used to adjust the model's balance between pursuing high accuracy and maintaining rule simplicity.

[0053] Within this framework, large language models can leverage their powerful pattern recognition and logical reasoning capabilities to intelligently explore the implications of existing rules. Modifications (such as adjusting parameters, adding new rules, and removing redundant rules) are made to find a utility function that can improve the utility function. The system identifies the optimal rule set that maximizes the maximum value. Furthermore, through multi-source data integration and rule optimization modules, the system can automatically generate and adjust security rules based on real-time data, effectively reducing rule conflicts and redundancy, thereby improving detection accuracy and consistency, and enhancing overall protection capabilities.

[0054] Specifically, after analyzing log data and behavioral patterns, LLM sets system rules. Generate or optimize the data to create a set of data optimization rules. This ensures that the rules match the current network traffic characteristics and threat patterns. The formula used is as follows:

[0055] ,

[0056] in, Optimize the rule set for the data (limit the number of times it can be cracked, prevent port scanning attacks, prevent spoofed requests, etc.). This is a rule optimization function used to optimize rules based on the latest historical data feature set. Generate a suitable detection strategy. The system will When applied to real-time detection, rules are automatically updated and iterated, ensuring continuous improvement in detection accuracy. Through this continuous iteration, the system can efficiently adapt to new threats, improving the flexibility and accuracy of detection. For example, if the feature set... If an IP address sends unusual requests within a short period, the rule optimization function will generate new rules to limit the request frequency of that IP address, preventing brute-force attacks. Through this mechanism, the system can dynamically adjust the rule set. This adapts the system to the current network environment and security requirements. Through this adaptive optimization mechanism, the system possesses the ability to continuously learn and dynamically adjust, enabling it to respond accurately and efficiently to new attack characteristics and maintain high adaptability in complex network environments, thereby comprehensively improving the level of security protection.

[0057] Specifically, the optimization rules are reflected in the following two aspects:

[0058] Identifying Redundant and Conflicting Rules: Based on the fused feature set formed after multi-source data fusion, the large language model can discover rules with overlapping functions or logical conflicts between different security devices. For example, if a firewall rule has explicitly blocked access from a malicious IP, but the IDS system still generates alerts for traffic from that IP, this constitutes obvious rule redundancy. The large language model can accurately identify such situations and suggest unified processing of the rule set or removal of redundant rules, thereby significantly improving system processing efficiency and alert accuracy.

[0059] Rule Generation and Refinement: Based on historical data feature sets, the large language model can uncover new attack patterns and automatically generate corresponding detection rules or optimize existing rules. For example, when the large language model identifies a new slow attack pattern—where attackers exhaust server resources by sending requests at extremely low frequencies and with long connection times, thus evading traditional IDS detection—the large language model can automatically generate a new rule. This rule not only monitors request frequency but also integrates multiple features such as request duration and request content to achieve more accurate detection. This approach significantly improves the timeliness and coverage of rule updates, reducing the burden of manual maintenance.

[0060] In some embodiments, to address the problem of inefficiency and reliance on manual intervention in false alarm handling in traditional security systems, step S4 introduces LLM (Language Modeling). This transforms false alarm handling from passive, rudimentary manual adjustments to proactive, precise, and automated optimization. The steps for automatically identifying and classifying false alarms include: clustering or classifying all false alarms using a large language model based on the optimization rule set; automatically generating corresponding fine-classification models based on the characteristics of each type of false alarm; and generating corresponding optimization strategies based on the fine-classification models. The specific process is as follows:

[0061] The system first clusters or classifies all false alarms, and sets up a false alarm dataset. Classified as Categories:

[0062] ,

[0063] in, For the first False alarms. LLM automatically generates corresponding classification models based on the characteristics of each type of false alarm in order to identify and manage different false alarm types, such as overly strict rules, abnormal data fluctuations, unrecognized new attacks, and environmental configuration problems.

[0064] Based on the false alarm classification results, the system generates targeted optimization suggestions for various false alarms. In particular, for cases where the rules are too strict or the data is abnormal, specific adjustment strategies are proposed, such as appropriately adjusting the rule sensitivity or filtering irrelevant data, to avoid invalid rule updates.

[0065] ,

[0066] in, To address Type X false alarms The generated optimization strategy, The function for generating the strategy.

[0067] Specifically, false alarm classification results can be categorized into the following types:

[0068] Business False Alarm: This refers to normal business behavior being incorrectly identified as threatening behavior by the security system. For example, an automated operations and maintenance script might trigger a malicious scan alert due to its high-frequency API calls. LLM analyzes the script's historical behavior and business processes to determine its normal behavior and classify it as a "business false alarm."

[0069] False alarms due to environmental changes: Changes in the network environment may render existing rules ineffective, leading to false alarms. For example, if a company launches a new service, causing a large-scale change in accessing IP addresses, traditional rules will interpret this as abnormal traffic. LLM will recognize this environmental change and categorize it as an "environmental change false alarm."

[0070] User behavior false alarms: Reasonable but non-routine actions performed by specific users for their duties are identified as abnormal by the system. For example, developers conducting stress tests or security personnel performing penetration tests may trigger DDoS or intrusion detection rules. LLM can combine user identity, operation history, and access environment to determine whether such behavior falls within the authorized scope, thus classifying it as a "user behavior false alarm".

[0071] Specifically, corresponding optimization strategies are generated for different false positive classification results:

[0072] In response to false alarms related to business operations, LLM recommends adding the IP address or URL path of the operation and maintenance script to the whitelist or adjusting the threshold of the relevant rules to make it more tolerant of the business traffic.

[0073] To address false alarms related to environmental changes: LLM will recommend updating rules to accommodate the new CDN IP address range, or adjusting the sensitivity of the rules so that they no longer treat normal IP changes as abnormal.

[0074] In response to false alarms about user behavior, LLM will recommend temporary or permanent exemptions for specific user behaviors, or prompt the administrator to conduct manual verification, and provide detailed contextual information (such as the user's role, behavior records, etc.) to facilitate quick decision-making by the administrator.

[0075] Through this module's refined false alarm classification and optimization strategy recommendations, such as rule relaxation, dynamic threshold adjustment, introduction of behavioral analysis, and system adaptive learning, the system can manage false alarms with precision and provide administrators with effective adjustment suggestions based on different false alarm types. This will reduce unnecessary rule adjustment operations and improve detection accuracy and system response efficiency.

[0076] See Figure 2 This invention provides a flowchart of data cleaning and feature extraction in a false positive optimization method based on a large language model, including: first, inputting data (firewall logs, IDS system data, historical threat intelligence, real-time network traffic), then cleaning the data (such as removing invalid, duplicate, and erroneous data, standardizing the format, and handling missing values), then extracting key features from the cleaned data (such as request time, request frequency, time interval, data packet information, and URL features), and finally organizing all the extracted features to form a regular data format.

[0077] See Figure 3 This invention provides a false alarm optimization system architecture diagram based on a large language model, including:

[0078] The data processing module 100 is used to periodically acquire multi-source data from security devices, and to perform feature extraction and feature fusion on the multi-source data to obtain a fused feature set;

[0079] Data analysis module 200 is used to analyze log data and behavioral patterns periodically or on demand to obtain historical data feature sets;

[0080] Rule optimization module 300 is used by the large language model to automatically optimize the system rules to obtain an optimized rule set by learning the fused feature set and the historical data feature set;

[0081] The strategy generation module 400, based on the optimization rule set, automatically identifies and classifies false alarms using a large language model to generate an optimization strategy.

[0082] The information display module 500 is used to display various key information during system operation; the key information includes rule optimization progress, rule changes, large language model learning status, historical adjustment records of security rules, system detection accuracy, system false alarm rate, system real-time detection status, false alarm categories and false alarm handling status;

[0083] The system control module 600 is used to perform management operations on the system according to the real-time situation. The management operations include false alarm management operations, adjusting and updating rules, backtracking and restoring log data, adjusting large language model parameters, and configuring rule adaptive strategies.

[0084] Specifically, the information display module 500 primarily provides users with various key information regarding system operation, helping them understand in real time the system's effectiveness in false alarm optimization and rule learning. The displayed content includes:

[0085] Rule optimization progress: The system uses a large language model to automatically optimize existing security rules and displays the optimization progress and changes to help users track the system's self-adjustment process.

[0086] Model Learning Performance: Showcases key data on the large language model's rule learning performance, such as learning completion rate, false positive rate decline trend, and handling of new threats, enabling users to clearly understand the model's adaptive learning effectiveness.

[0087] Rule Update Log: The system displays a historical record of security rule adjustments, including updates to model recommendations, solutions to rule conflicts, and application optimization strategies, allowing users to easily view the evolution of the system's rules.

[0088] Real-time detection feedback: Displays the system's detection accuracy, false alarm rate, and real-time detection status, helping users evaluate the system's detection performance in the current environment and determine the effectiveness of rule adjustments.

[0089] False Alarm Classification and Handling Status: The system displays the identified false alarm categories and the handling status of each category, allowing users to track the effectiveness of false alarm handling in real time and ensure the accuracy of rule optimization.

[0090] Specifically, the system control module 600 provides flexible management functions, allowing users to optimize system configurations based on real-time conditions. This module allows users to directly operate on the system's large language model, rule updates, and false alarm handling, ensuring the system can quickly adapt to changing network environments. Key functions include:

[0091] False alarm management: Users can manually manage specific false alarms, including marking, ignoring, or adjusting rule sensitivity, thereby enabling rapid response in special scenarios.

[0092] Rule adjustment and update: Based on the optimization suggestions generated by the system from the large language model, users can manually choose whether to apply these updates or adjust the rules. They can also directly modify specific rule parameters to meet specific network requirements.

[0093] Log backtracking and recovery: Users can view and backtrack the system's rule optimization logs and model training history, and restore to a specific version when necessary to ensure that the system can quickly recover to a stable state when problems occur.

[0094] Model learning parameter adjustment: Users can fine-tune the learning rate and feature extraction parameters of the large language model based on the detection results to further optimize the accuracy of false positive management and rule optimization.

[0095] Rule Adaptive Strategy Configuration: Users can define rule adaptive trigger conditions and optimization strategies, and ensure the flexibility and real-time nature of rule updates by adjusting the sensitivity of detection.

[0096] The system control module allows users to easily adjust various functions during system operation, ensuring flexibility in rule optimization, false alarm management, and model learning. While supporting automated optimization, the system also provides manual adjustment capabilities, making rule optimization more accurate and real-time.

[0097] This invention also provides a computer-readable storage medium storing a program that, when executed by a processor, implements the false alarm optimization method based on a large language model described in the above embodiments.

[0098] The computer-readable storage medium can be an internal storage unit of any data processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device of any data processing device, such as a plug-in hard disk, SmartMediaCard (SMC), SD card, or FlashCard equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices of any data processing device. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0099] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A false alarm optimization method based on a large language model, characterized in that, include: Periodically acquire multi-source data from security devices, and perform feature extraction and feature fusion on the multi-source data to obtain a fused feature set; Analyze log data and behavioral patterns regularly or as needed to obtain historical data feature sets; The large language model learns the fused feature set and the historical data feature set to automatically optimize the system rules and obtain an optimized rule set. Based on the optimization rule set, a large language model is used to automatically identify and classify false alarms, and generate optimization strategies. This includes: based on the optimization rule set, the large language model clusters or classifies all false alarms to obtain false alarm classification results; automatically generates corresponding fine classification models based on the characteristics of the false alarm classification results; and generates corresponding optimization strategies based on the fine classification models. The false alarm classification results include business false alarms, environmental change false alarms, and user behavior false alarms.

2. The false alarm optimization method according to claim 1, characterized in that, The multi-source data includes firewall logs, intrusion detection system data, historical threat intelligence, real-time network traffic, and user behavior data.

3. The false alarm optimization method according to claim 1, characterized in that, Obtaining the fused feature set includes: periodically collecting the multi-source data from different security devices and cleaning the data; extracting key features from the multi-source data to obtain feature sets; and performing weighted feature fusion on the feature sets from different data sources to obtain the fused feature set.

4. The false alarm optimization method according to claim 1, characterized in that, When analyzing log data and behavioral patterns periodically or on demand to obtain a historical data feature set, the system analyzes log data and behavioral patterns according to a preset time interval or an on-demand triggering mechanism, identifies potential threats and characteristics of the log data and behavioral patterns, and obtains the historical data feature set.

5. The false alarm optimization method according to claim 1, characterized in that, Obtaining the optimized rule set includes: based on the rule optimization function, the large language model automatically optimizes the system rules by learning the fusion feature set and the historical data feature set respectively, generating corresponding fusion optimization rule sets and data optimization rule sets, and obtaining the optimized rule set based on the fusion optimization rules and the data optimization rule sets; the system rules include the built-in rules of the Web application firewall, the built-in rules of the intrusion detection system, and the built-in rules of endpoint detection and response.

6. A false alarm optimization system based on a large language model, characterized in that, include: The data processing module is used to periodically acquire multi-source data from security devices, and to perform feature extraction and feature fusion on the multi-source data to obtain a fused feature set; The data analysis module is used to analyze log data and behavioral patterns periodically or on demand to obtain historical data feature sets; The rule optimization module is used by the large language model to automatically optimize the system rules by learning the fused feature set and the historical data feature set to obtain an optimized rule set; The strategy generation module, based on the optimization rule set, automatically identifies and finely classifies false alarms using a large language model to generate optimization strategies. This includes: based on the optimization rule set, the large language model clusters or classifies all false alarms to obtain false alarm classification results; automatically generating corresponding fine-classification models based on the characteristics of the false alarm classification results; and generating corresponding optimization strategies based on the fine-classification models. The false alarm classification results include business false alarms, environmental change false alarms, and user behavior false alarms. The information display module is used to display various key information during system operation; these key information include rule optimization progress, rule changes, large language model learning progress, historical adjustment records of security rules, system detection accuracy, system false alarm rate, system real-time detection status, false alarm categories, and false alarm handling status. The system control module is used to perform management operations on the system based on real-time conditions. These management operations include false alarm management, rule adjustment and update, log data rollback and recovery, adjustment of large language model parameters, and configuration of rule adaptive strategies.

7. A storage medium storing a program, characterized in that, When the program is executed by the processor, it implements the false alarm optimization method based on a large language model as described in any one of claims 1-5.

Images