A network attack cross-platform cooperative protection processing method and device

Abstract

The application discloses a network attack cross-platform cooperative protection processing method and device, and relates to the technical field of network security. The method comprises the following steps: each heterogeneous security device captures security log data in real time, and converts the security log data into an uplink protocol packet containing security event semantic description, and sends the uplink protocol packet to a central server; an internal large language model is used to analyze and infer the uplink protocol packet, so that an attack chain of network attack behavior is constructed, a downlink protocol packet containing an action intention is generated based on the attack chain and a preset disposal strategy library, and the downlink protocol packet is sent to a target heterogeneous security device; and the target heterogeneous security device converts the downlink protocol packet into an operation instruction executable by the target heterogeneous security device through an internal translation engine. In the application, different types of security device logs and instructions are converted into unified and machine-understandable semantic information in the interaction process, so that real-time association, intention recognition and automatic two-way cooperation of security events are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a cross-platform collaborative protection and processing method and apparatus for network attacks. Background Technology

[0002] In today's digital age, enterprises face increasingly severe cybersecurity challenges, especially when dealing with major security defense tasks, where existing systems have exposed numerous shortcomings. On the one hand, the larger and more complex the business structure of an enterprise, the more fragmented its internal security information becomes. Security data generated by various departments and business processes are managed separately, lacking unified integration, making it difficult for security personnel to quickly sift through massive amounts of scattered information to find attack clues, greatly hindering accurate assessment of the security situation. At the same time, different security devices come from multiple vendors, with different protocols and diverse types, such as firewalls, intrusion detection systems, and endpoint protection software. The alert conclusions of these security devices are difficult to share and recognize in a short time, failing to form an efficient linkage mechanism and delaying the best defense decision-making opportunity.

[0003] In existing network security architectures, security devices from different vendors (such as firewalls, intrusion detection systems (IDS), and endpoint protection devices (EDR)) employ their own proprietary communication protocols and log formats, such as Syslog, NetFlow, SNMP, or custom APIs. These protocols primarily address the "transmission" of data but fail to solve the "understanding" problem. When a security incident (such as an APT attack) occurs, clues to its attack chain are often scattered across the logs of different devices. For example, a firewall might log connections from unusual IPs, an IDS might identify suspicious traffic payloads, and an EDR might detect malicious processes on the endpoint.

[0004] Traditional security information and event management systems attempt to solve this problem through "post-processing": they aggregate all logs and then match them using pre-defined association rules. However, this approach has a drawback:

[0005] (1) Delayed correlation. Information is "collected first, then analyzed," and the correlation process has a delay of minutes, missing the best response opportunity;

[0006] (2) Semantic gap. Association rules are based on keyword or pattern matching, which lacks a deep understanding of the real attack intent behind the logs. The rule base often fails for unknown attacks or variants of existing attacks.

[0007] (3) One-way communication. The data flow is mainly from the device to the center. It is difficult for the center to issue unified and high-level collaborative instructions to heterogeneous devices (such as "isolate all suspicious connections of this host"). Instead, it can only issue specific but fragmented commands to specific devices.

[0008] Therefore, there is an urgent need for a new technical solution that goes beyond simply transmitting data. It enables semantic understanding and two-way collaboration of heterogeneous security information at the protocol level, fundamentally solving the problems of information silos and collaboration barriers, improving overall emergency response efficiency, and comprehensively enhancing enterprise network security protection capabilities. Summary of the Invention

[0009] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a cross-platform collaborative protection and processing method and apparatus for network attacks. It aims to define a new paradigm for security information exchange by embedding the semantic understanding and generation capabilities of a large model at the protocol layer. This paradigm directly converts logs and instructions from security devices of different manufacturers and types into unified, machine-understandable semantic information during the interaction process, thereby achieving real-time correlation of security events, intent recognition, and efficient automated two-way collaboration. This overcomes the defects in the prior art, such as correlation lag, semantic gap, and one-way communication.

[0010] One aspect of the present invention provides a cross-platform collaborative protection method for network attacks, comprising:

[0011] Each heterogeneous security device captures security log data in real time. Through the semantic recognition model built into the heterogeneous security device, the security log data is converted into uplink protocol messages containing semantic descriptions of security events and sent to the central server.

[0012] The central server receives and aggregates uplink protocol messages sent by each heterogeneous security device. It analyzes and infers the uplink protocol messages using a large language model built into the central server and finely tuned based on an enterprise-specific knowledge base, in order to construct an attack chain of network attack behavior. Based on the attack chain and a pre-set handling strategy library, it generates downlink protocol messages containing action intent and sends them to the target heterogeneous security device.

[0013] The target heterogeneous security device uses its built-in translation engine to convert the downlink protocol messages into operation instructions that it can execute, and then feeds back the execution results of the operation instructions to the central server.

[0014] In another aspect, the present invention provides a cross-platform collaborative protection and processing device for network attacks, comprising:

[0015] Multiple heterogeneous security devices are used to capture security log data in real time. The security log data is converted into uplink protocol messages containing semantic descriptions of security events through a semantic recognition model built into the heterogeneous security devices and sent to the central server.

[0016] In addition, a central server is used to receive and aggregate uplink protocol messages sent by each heterogeneous security device. Through a large language model built into the central server and finely tuned based on an enterprise proprietary knowledge base, the uplink protocol messages are analyzed and reasoned to construct an attack chain of network attack behavior. Based on the attack chain and a pre-set handling strategy library, downlink protocol messages containing action intent are generated and sent to the target heterogeneous security device.

[0017] The target heterogeneous security device is also used to convert the downlink protocol message into an operation instruction that can be executed by the target heterogeneous security device through a built-in translation engine, and to feed back the execution result of the operation instruction to the central server.

[0018] The present invention provides a cross-platform collaborative protection and processing method and apparatus for network attacks, which has the following beneficial effects:

[0019] (1) This invention embeds the semantic description of security events in the communication protocol into the semantic understanding capability of the large model, so that the communication protocol itself evolves from a "data transmission pipeline" to a "semantic exchange bridge". By standardizing and semantically converting heterogeneous logs at the protocol level, the large model of the central server no longer processes scattered and unrelated strings, but directly analyzes structured events with semantic tags of attack tactics and attack techniques. Combined with the context enhancement of the private knowledge graph, it can accurately identify complex attack chains and significantly reduce the false alarm rate.

[0020] (2) This invention adopts an original distributed collaborative architecture of "central reasoning + edge translation". The central server's large language model is responsible for deep reasoning and decision-making of complex attack chains, while the lightweight model of edge devices (such as various heterogeneous security devices) is responsible for real-time bidirectional "semantic-instruction" translation with specific heterogeneous security devices. This architecture takes into account the intelligence of decision-making, the real-time nature of execution, and the wide adaptability. Attached Figure Description

[0021] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0022] Figure 1 This is a flowchart illustrating a cross-platform collaborative network attack protection method provided in one embodiment of this application. Figure 1 ;

[0023] Figure 2 This is a flowchart illustrating a cross-platform collaborative network attack protection method provided in one embodiment of this application. Figure 2 ;

[0024] Figure 3This is a schematic diagram of the structure of a cross-platform collaborative protection and processing device for network attacks provided in another embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] The core idea of ​​this application is to integrate the capabilities of large models into the design of communication protocols, rather than simply using large models as a backend analysis engine. To more clearly illustrate the technical solution of this invention, the following embodiments are preferably described using the MCP (Model Context Protocol) as an example, but the technical concept is equally applicable to the modification of other protocols.

[0027] See Figure 1-2 One embodiment of this application provides a cross-platform collaborative protection method for network attacks. This method achieves cross-platform collaborative protection against network attacks based on a network system composed of multiple heterogeneous security devices and a central server. Specifically, the method of this embodiment includes the following steps:

[0028] Step S101 Each heterogeneous security device captures security log data in real time. Through the semantic recognition model built into the heterogeneous security device, the security log data is converted into uplink protocol messages containing semantic descriptions of security events and sent to the central server.

[0029] In order to bring the capabilities of the large model down to the level and integrate them into the design of the communication protocol, this embodiment creatively standardizes and semantically transforms heterogeneous logs at the protocol level. This allows the large model on the central server to no longer process scattered and unrelated strings, but to directly analyze structured events with semantic tags of attack tactics and attack techniques forwarded by heterogeneous security devices through the protocol.

[0030] Specifically, let's take the MCP protocol as an example. The MCP protocol is a model context protocol, and its message structure includes a header and a body. The header defines the basic metadata of the message, such as: protocol version, message ID, source device ID, target device ID, timestamp, encryption and signature identifiers, etc. The body defines the actual request data of the message. This invention creatively sets up a security event semantic description module in the message body of the MCP protocol. The content of this module is a semantic payload, not raw logs or simple instructions. It carries data content with a unified structure and semantic tags generated after the initial parsing of the large model. This data content can be a JSON object.

[0031] For example, a security event semantic description module (semantic payload) may include:

[0032] (1) message_type: Message type. Preferably, four core types are defined:

[0033] Event_Report: Event reporting, used by the device to report security events to the central server.

[0034] Action_Command: Action command, used by the center to issue disposal instructions to the device.

[0035] Info_Query: Information query, used by the center to query specific status or data from the device.

[0036] Knowledge_Update: Knowledge updates are used to distribute new threat intelligence or asset information.

[0037] (2) event_semantics: Event semantics module (dedicated to uplink protocol messages), containing standardized semantic tags parsed by the large model, such as:

[0038] attack_tactic: "InitialAccess".

[0039] attack_technique: "Phishing" (phishing attack).

[0040] source_entity: {"type":"IP","value":"1.2.3.4"}.

[0041] target_entity: {"type":"Host","value":"WebServer01"}.

[0042] confidence_score: 0.85.

[0043] (3) action_semantics: Action semantics module (used only for downlink messages), containing high-level and abstract action intents, such as:

[0044] action_intent: "Isolate_Host" (Isolate Host).

[0045] target_entity: {"type":"Host","value":"WebServer01"}.

[0046] duration: "24h".

[0047] raw_data: Raw data. Encapsulates the unmodified raw log or command content for auditing and tracing.

[0048] The following details the execution process of this step:

[0049] Among the various heterogeneous security devices deployed in the system, an MCP protocol adapter plugin is installed for each heterogeneous security device (such as a firewall of a certain brand). The adapter plugin embeds a semantic recognition model that is fine-tuned for the log format of the heterogeneous security device. The semantic recognition model preferably includes a lightweight semantic parsing model or an efficient semantic rule engine.

[0050] The adapter plugin in the heterogeneous security device captures the device's security logs in real time, such as firewall blocking logs. The semantic recognition model in the adapter plugin performs instant semantic analysis on the logs to extract attack tactics, attack techniques and other attack methods, as well as key information such as source / target entities.

[0051] Based on the parsing results, the adapter plugin generates an MCP uplink protocol message (the link from the edge device to the central server is considered uplink). It encapsulates the security log into the raw_data field of the raw data and fills the parsed semantic information into the corresponding tag of the event_semantics module. Then, it sends this MCP uplink message to the central MCP server through an encrypted channel.

[0052] The above steps bring the semantic parsing process forward to the source of data generation, realizing "understanding while generating". The understood semantic content is then sent to the central server. The central server's model no longer processes scattered and unrelated strings, but directly analyzes structured events with semantic tags of attack tactics and attack techniques forwarded by heterogeneous security devices through protocols. This fundamentally solves the problem of analysis lag in traditional security information and event management (SIEM) solutions.

[0053] The following details the specific implementation scheme of the adapter plugins deployed in heterogeneous security devices:

[0054] 1. Design of MCP protocol adapter plugin

[0055] The MCP protocol adapter plugin is a key execution unit deployed on heterogeneous security devices (edge ​​devices) or their adjacent network nodes. Its design goal is to achieve efficient, real-time bidirectional semantic translation with low resource consumption. The internal structure of the adapter plugin is designed as follows:

[0056] (1) Data capture and preprocessing module

[0057] The plugin's interface design adopts a pluggable input interface design, supporting multiple data acquisition methods, including listening to the Syslog port, polling the device interface as an API client, reading log files in real time, and acting as a NetFlow / sFlow collector, etc.

[0058] The preprocessing logic includes a built-in, efficient regular expression filter to discard explicit, worthless health checks or heartbeat logs before parsing. A lightweight circular buffer acts as a memory cache to handle sudden spikes in log traffic and prevent information loss.

[0059] (2) Core of Uplink Semantic Transformation

[0060] The semantic recognition of the adapter plugin adopts a hybrid mode of "rule engine + lightweight model", specifically:

[0061] By using parsing rule templates in the semantic rule engine (e.g., parsing rule templates defined in YAML format), structured, fixed-format, and semantically clear log fields (such as the firewall's "allow / deny" logs) are directly mapped to target semantic tags under the event semantic module event_semantics in the security event semantic description module of the MCP uplink protocol.

[0062] A lightweight semantic parsing model is used to perform named entity recognition and event classification on unstructured or semi-structured security logs (such as IDS alert descriptions and application server error stacks). The identified entity information (e.g., IP addresses, CVE numbers, hostnames, etc.) and event types are mapped to target semantic tags under the `event_semantics` module in the security event semantic description module of the MCP uplink protocol. The lightweight semantic parsing model can be a lightweight Transformer model trained using model distillation techniques, such as a 3-layer model distilled from BERT-based models. This model is specifically fine-tuned for security log language and is responsible for performing named entity recognition to extract entity information such as IP addresses, CVE numbers, and hostnames, and for event type classification.

[0063] Furthermore, the recognition process of the lightweight semantic parsing model is as follows:

[0064] (1) The entity information in the security log is identified by the Named Entity Recognition (NER) model. According to the predefined conversion rules, the identified entity information is uniformly converted into a standardized JSON object structure with predetermined fields. For example, the identified entity information is uniformly converted into a JSON object in the format {"type":"EntityType", "value":"EntityValue","context":"..."}.

[0065] (2) Security logs are categorized into a predefined hierarchical directory of security events using an event classification model. This directory is compatible with industry standards, such as the Sigma rule classification.

[0066] Example 1: "Failedpasswordforuseradmin"->Authentication.Login.Failure.

[0067] Example 2: "Connectionfrom1.2.3.4toport22"->Network.Connection.Attempt.

[0068] Example 3: "Executionofpowershell.exewithencodedcommand"->Execution.Process.Creation.

[0069] (3) The entity information, event type and security log context information are mapped to the attack tactic tags and attack technique tags in the MITRE ATT&CK framework through the mapping model.

[0070] After being processed by the above three-layer transformation rules, the security log is finally transformed into a structured and semantic event semantic module event_semantics semantic payload, providing high-quality input for subsequent intelligent analysis.

[0071] The final output of this step strictly follows the MCP protocol specification, generating an MCP uplink protocol message that includes the event semantics module event_semantics.

[0072] Step S102 The central server receives and aggregates uplink protocol messages sent by each heterogeneous security device. It analyzes and infers the uplink protocol messages using a large language model built into the central server and finely tuned based on an enterprise-specific knowledge base, in order to construct an attack chain of network attack behavior. Based on the attack chain and a pre-set handling strategy library, it generates downlink protocol messages containing action intent and sends them to the target heterogeneous security device.

[0073] Specifically, the central server receives uplink protocol messages from each heterogeneous security device and dynamically aggregates these messages into attack sessions according to a predetermined period. It extracts entity information involved in security events from each attack session and queries a pre-built, dynamically updated knowledge graph for knowledge related to these entities. The attack sessions and retrieved knowledge are then input into a fine-tuned large language model. The large language model determines the causal relationships between security events based on the input content and constructs attack chains for network attacks. The business impact caused by these attack chains is assessed, and the confidence level of the attack chains and assessment results is calculated. Based on the attack chain with the highest confidence level and its resulting business impact, the optimal response strategy is selected from a pre-set handling strategy library. Finally, the optimal response strategy is encoded into a downlink protocol message containing the action intent.

[0074] Furthermore, the MCP central server does not deploy a general-purpose large model, but rather a dedicated, secure large model that integrates a private knowledge base and employs a retrieval-enhanced generation architecture. Its parsing algorithm flow is as follows:

[0075] (1) Input a standardized uplink protocol message stream from multiple heterogeneous security devices with MCP adapters.

[0076] (2) Perform event stream clustering and session construction

[0077] Based on the timestamps and entity information in the messages (such as the same source IP, target host, and username), discrete event messages within a predetermined time period (e.g., within 5 minutes) are dynamically aggregated into an "attack session" or "event context".

[0078] (3) Knowledge retrieval and context enhancement

[0079] For each attack session, a knowledge retrieval step is performed to extract core entity information (such as host WebServer01, vulnerability CVE-2021-44228) from the attack session. This entity information is then used as the basis for querying relevant information from the enterprise's private knowledge graph.

[0080] This knowledge graph is pre-built and updated in real time, and includes the following:

[0081] ① Asset knowledge: host operating system, open ports, services carried, physical location, administrator;

[0082] ② Vulnerability knowledge: CVSS score of the vulnerability, exploitation conditions, and available exploits;

[0083] ③ Intelligence and knowledge: the reputation of malicious IPs and the associated attack groups;

[0084] ④ Historical knowledge: Has the asset or user been involved in any security incidents in the past?

[0085] (4) Generative reasoning and attack chain construction

[0086] The original attack session (clustered MCP messages) and the retrieved security event-related knowledge context are input together into the core reasoning module of the large language model.

[0087] The large language model was fine-tuned to perform the following tasks:

[0088] Causal inference: Based on the logical sequence of ATT&CK tactics and retrieved knowledge, determine the causal relationship between events and construct the most likely attack chain. For example, the model might infer that it is reasonable for "T1078 (valid account login)" to occur before "T1219 (remote access software)".

[0089] Impact assessment: Based on the importance of the assets (retrieved from the knowledge graph), assess the potential business impact if the current attack chain continues.

[0090] Confidence score: Outputs a confidence score between 0 and 1 for the constructed attack chain and evaluation results.

[0091] (5) Generation of disposal suggestions and instruction encoding

[0092] Based on the attack chain with the highest confidence and impact assessment, the large language model selects the best response strategy from its built-in handling strategy library. This strategy is encoded into a high-level and abstract MCP downlink protocol message (the downlink from the central server to each edge device is the downlink).

[0093] For example, the policy of "containing lateral movement of high-risk hosts" can be encoded as: {"action_intent":"Contain_Compromised_Host","target_entity":{"type":"Host","value":"WebServer01"},"priority":"High"}.

[0094] Finally, it outputs one or more standardized downlink protocol messages that can be directly sent to MCP adapter plugins of various heterogeneous security devices.

[0095] Step S103 The target heterogeneous security device uses its built-in translation engine to convert the downlink protocol messages into operation instructions that it can execute, and then feeds back the execution results of the operation instructions to the central server.

[0096] In this step, the target heterogeneous security device queries the intent and operation template mapping table in the translation engine to obtain an operation template that matches the action intent and the current target heterogeneous security device. It extracts the entity information parameters of the attack chain from the downlink protocol message, dynamically fills the entity information parameters into the operation template, and generates an operation instruction that can be executed by the current target heterogeneous security device.

[0097] Specifically, the downlink command translation engine in the target heterogeneous security device adopts an "action intent-template mapping" mechanism. The translation engine internally maintains a mapping table that maps the high-level action intent in the MCP downlink protocol message to the operation template of one or more specific heterogeneous security devices.

[0098] Example of operation template:

[0099] ① Regarding the intent to "isolate the host," the operation template for a certain brand of firewall is: aclnumber<acl_num> rule<rule_id> denyipsource<{target_entity.ip}>.

[0100] ② Regarding the intent to "isolate the host," the operational template for Linux servers is as follows:

[0101] iptables-IINPUT-s<{target_entity.ip}>-jDROP.

[0102] The translation engine extracts entity information parameters involved in security events from downlink protocol messages, such as entities under the target_entity tag, and fills them into the selected operation template to generate CLI commands or API calls that can be executed by heterogeneous security devices.

[0103] For example, the translation process for a certain brand of firewall is as follows:

[0104] Action intent input: Isolate_Host (isolate host)

[0105] Target parameter: {target_entity.ip} = 192.168.1.100 (IP address of the host to be isolated)

[0106] Device-specific template: aclnumber<acl_num> rule<rule_id> deny ip source<{target_entity.ip}>

[0107] Translation process: The engine obtains the IP address 192.168.1.100 from the command and queries the currently available ACL number and rule ID of the firewall (e.g., ...).<acl_num> = 3001,<rule_id> = 5), and then fill it into the operation template.

[0108] Translation result: ACL number 3001, rule 5, deny ip source 192.168.1.100

[0109] The above translation result is a very specific configuration command that can be executed directly on the brand's firewall command line interface (CLI). The command means: add rule number 5 to access control list number 3001 to deny all packets from IP address 192.168.1.100.

[0110] Finally, the target heterogeneous security device executes the translated command, and the adapter plugin returns an uplink protocol message containing the execution result to the central server, forming a feedback loop.

[0111] The cross-platform collaborative network attack protection method in this embodiment embeds the semantic description of security events in the communication protocol into the semantic understanding capability of a large model. By standardizing and semantically transforming heterogeneous logs at the protocol level, the large model of the central server no longer processes scattered and unrelated strings, but directly analyzes structured events with semantic tags of attack tactics and attack techniques. Combined with context enhancement of the private knowledge graph, it can accurately identify complex attack chains. In addition, the large language model of the central server in this embodiment is responsible for deep reasoning and decision-making of complex attack chains, while the lightweight model of edge devices (such as various heterogeneous security devices) is responsible for real-time bidirectional "semantic-instruction" translation with specific heterogeneous security devices. This architecture takes into account the intelligence of decision-making, the real-time nature of execution, and broad adaptability.

[0112] See Figure 3 Another embodiment of the present invention provides a cross-platform collaborative protection and processing device 200 for network attacks, including multiple heterogeneous security devices 201 and a central server 202. The cross-platform collaborative protection and processing device 200 for network attacks is capable of executing the cross-platform collaborative protection and processing method for network attacks in the method embodiment.

[0113] Specifically, the cross-platform collaborative network attack protection and processing device 200 includes:

[0114] Multiple heterogeneous security devices 201 are used to capture security log data in real time. Through the semantic recognition model built into the heterogeneous security devices, the security log data is converted into uplink protocol messages containing semantic descriptions of security events and sent to the central server.

[0115] In addition, the central server 202 is used to receive and aggregate uplink protocol messages sent by each heterogeneous security device, analyze and reason about the uplink protocol messages through a large language model built into the central server and finely tuned based on an enterprise proprietary knowledge base, in order to construct an attack chain of network attack behavior, generate downlink protocol messages containing action intent based on the attack chain and a pre-set handling strategy library, and send them to the target heterogeneous security device.

[0116] The target heterogeneous security device 201 is also used to convert the downlink protocol message into an operation instruction that can be executed by the target heterogeneous security device through a built-in translation engine, and to feed back the execution result of the operation instruction to the central server.

[0117] It should be noted that the technical solutions corresponding to the cross-platform collaborative protection and processing device 200 for network attacks provided in this embodiment, which can be used to execute various method embodiments, have similar implementation principles and technical effects to the methods, and will not be repeated here.

[0118] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A cross-platform collaborative protection and handling method for network attacks, characterized in that, include: Each heterogeneous security device captures its own security log data in real time. Through the semantic recognition model built into the heterogeneous security device, the security log data is converted into uplink protocol messages containing semantic descriptions of security events and sent to the central server. The central server receives and aggregates uplink protocol messages sent by each heterogeneous security device. It analyzes and infers the uplink protocol messages using a large language model built into the central server and finely tuned based on an enterprise-specific knowledge base, in order to construct an attack chain of network attack behavior. Based on the attack chain and a pre-set handling strategy library, it generates downlink protocol messages containing action intent and sends them to the target heterogeneous security device. The target heterogeneous security device uses its built-in translation engine to convert the downlink protocol messages into operation instructions that it can execute, and then feeds back the execution results of the operation instructions to the central server. The step of converting the security log data into uplink protocol messages containing security event semantic descriptions using a semantic recognition model built into heterogeneous security devices includes: the semantic recognition model comprising a semantic rule engine and a lightweight semantic parsing model; using parsing rule templates in the semantic rule engine to directly map structured, fixed-format, and semantically clear log fields to target semantic tags in the security event semantic description; and using the lightweight semantic parsing model to perform named entity recognition and event classification on unstructured or semi-structured security logs, mapping the identified entity information and event types to target semantic tags in the security event semantic description. The steps of performing named entity recognition and event classification on unstructured or semi-structured security logs using the lightweight semantic parsing model, and mapping the identified entity information and event types to target semantic tags in the security event semantic description, include: identifying entity information in the security logs using a named entity recognition model; converting the identified entity information into a standardized JSON object structure with predetermined fields according to predefined conversion rules; classifying the security logs into a predefined hierarchical directory of security events using an event classification model; and mapping the entity information, event types, and contextual information of the security logs to attack tactical tags and attack technique tags in the network security adversarial behavior knowledge base framework using a mapping model. The process includes the following steps: the central server receives and aggregates uplink protocol messages from each heterogeneous security device; it analyzes and infers the uplink protocol messages using a large language model built into the central server and finely tuned based on an enterprise-specific knowledge base to construct an attack chain for network attack behavior; and it generates downlink protocol messages containing action intent based on the attack chain and a pre-built handling strategy library. These steps include: dynamically aggregating uplink protocol messages from various heterogeneous security devices into attack sessions according to a predetermined period; extracting entity information involved in security events from each attack session and querying knowledge related to the entity information from a pre-built, dynamically updated knowledge graph; inputting the attack sessions and the retrieved knowledge into the finely tuned large language model, which determines the causal relationship between security events based on the input content and constructs the attack chain for network attack behavior; assessing the business impact caused by the attack chain and calculating the confidence level of the attack chain and the assessment results; selecting the best response strategy from the pre-built handling strategy library based on the attack chain with the highest confidence level and its resulting business impact; and encoding the best response strategy into a downlink protocol message containing action intent.

2. The cross-platform collaborative protection method for network attacks according to claim 1, characterized in that, The step of the target heterogeneous security device converting the downlink protocol message into operation instructions executable by the target heterogeneous security device through its built-in translation engine includes: The target heterogeneous security device queries the intent and operation template mapping table in the translation engine to obtain an operation template that matches the action intent and the current target heterogeneous security device. It extracts the entity information parameters of the attack chain from the downlink protocol message, dynamically fills the entity information parameters into the operation template, and generates an operation instruction that can be executed by the current target heterogeneous security device.

3. A cross-platform collaborative network attack protection and processing device, characterized in that... include: Multiple heterogeneous security devices are used to capture security log data in real time. The security log data is converted into uplink protocol messages containing semantic descriptions of security events through a semantic recognition model built into the heterogeneous security devices and sent to the central server. In addition, a central server is used to receive and aggregate uplink protocol messages sent by each heterogeneous security device. Through a large language model built into the central server and finely tuned based on an enterprise proprietary knowledge base, the uplink protocol messages are analyzed and reasoned to construct an attack chain of network attack behavior. Based on the attack chain and a pre-set handling strategy library, downlink protocol messages containing action intent are generated and sent to the target heterogeneous security device. The target heterogeneous security device is also used to convert the downlink protocol message into an operation command that can be executed by the target heterogeneous security device through a built-in translation engine, and to feed back the execution result of the operation command to the central server; The heterogeneous security devices are further configured to: use a semantic recognition model that includes a semantic rule engine and a lightweight semantic parsing model; use the parsing rule templates in the semantic rule engine to directly map structured, fixed-format, and semantically clear log fields to target semantic tags in the security event semantic description; use the lightweight semantic parsing model to perform named entity recognition and event classification on unstructured or semi-structured security logs, and map the identified entity information and event types to target semantic tags in the security event semantic description; The aforementioned heterogeneous security devices are further configured to: identify entity information in security logs using a named entity recognition model; convert the identified entity information into a standardized JSON object structure with predetermined fields according to predefined conversion rules; categorize security logs into a predefined hierarchical directory of security events using an event classification model; and map the entity information, event types, and context information of security logs to attack tactical tags and attack technique tags in a network security adversarial behavior knowledge base framework using a mapping model. The central server is further configured to: dynamically aggregate uplink protocol messages from various heterogeneous security devices into attack sessions according to a predetermined period; extract entity information involved in security events from each attack session, and query knowledge related to the entity information from a pre-built, dynamically updated knowledge graph; input the attack sessions and the retrieved knowledge into a fine-tuned large language model, which determines the causal relationship between security events based on the input content and constructs an attack chain of network attack behavior; assess the business impact caused by the attack chain, calculate the confidence level of the attack chain and the assessment results, and select the best response strategy from a pre-set handling strategy library based on the attack chain with the highest confidence level and its resulting business impact; and encode the best response strategy into a downlink protocol message containing the action intent.

4. The cross-platform collaborative network attack protection and processing device according to claim 3, characterized in that, The target heterogeneous security device is also used for: The translation engine queries the intent and operation template mapping table to obtain the operation template that matches the action intent and the current target heterogeneous security device. The entity information parameters of the attack chain are extracted from the downlink protocol message and dynamically filled into the operation template to generate an operation instruction that can be executed by the current target heterogeneous security device.

Images