A security event correlation analysis and question answering method, system and medium

Abstract

The application provides a kind of security event correlation analysis and question and answer method, system and medium, the method comprises the following steps: context-aware query completion: receiving the original query of user input, and obtaining the history record of current dialogue, according to the original query and the history record of current dialogue form context-enhanced query;Dynamic task identification: according to the context-enhanced query, output prediction task model in combination with dynamic task identification strategy;Multi-dimensional retrieval: multi-dimensional retrieval is carried out on the prediction task model, and the final knowledge context package is obtained;Knowledge-driven response generation: generate knowledge-driven response based on the knowledge context package, output the final security analysis report after the generated content is verified.The application realizes efficient, accurate and interpretable intelligent correlation analysis of multi-source heterogeneous security data by constructing multi-dimensional knowledge base, designing dynamic task identification mechanism and realizing context-aware query completion.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity and artificial intelligence, and in particular to a method, system and medium for security event correlation analysis and question answering based on hybrid retrieval enhancement generation. Background Technology

[0002] Currently, Large Language Models (LLMs) are demonstrating significant potential in the cybersecurity field, particularly in the automation and intelligentization of Security Operations Centers (SOCs). To address the inherent knowledge limitations and "illusion" problems of LLMs, Retrieval-Augmented Generation (RAG) technology has become a mainstream solution. RAGs combine LLMs with external knowledge bases to dynamically retrieve relevant information during the reasoning process, thereby improving the accuracy, reliability, and timeliness of responses. In SOC scenarios, RAGs are widely used for tasks such as threat intelligence retrieval, attack path analysis, and log summary generation. For example, existing research has constructed RAG-based question-answering systems for network attack investigation and attribution, significantly improving factual accuracy and providing evidence tracing. Other works attempt to combine RAGs with cybersecurity knowledge graphs to enhance the understanding and reasoning capabilities of complex attack chains. Furthermore, research has explored integrating RAGs into SIEM platforms to achieve the summarization and response suggestion generation of multi-source alerts. These works collectively demonstrate that RAG is a key bridge connecting LLMs with massive amounts of security data, laying the foundation for AI-driven SOC automation.

[0003] Despite the initial success of RAG technology in SOCs, existing solutions still face significant technical bottlenecks when processing complex and heterogeneous real-world security data, making it difficult to meet the demands for efficient, accurate, and interpretable threat correlation analysis. Specific problems include:

[0004] First, the existing RAG framework heavily relies on static or semi-static external threat intelligence databases, such as MITRE ATT&CK and CVE databases, while failing to effectively integrate and utilize structured operational data generated within the SOC that reflects real-time security posture (such as IDS / EDR alerts, access logs, and honeypot interaction records). This "information silo" phenomenon results in analysis lacking contextual support, making it impossible to conduct in-depth cross-source and cross-time correlations, thus limiting the ability to comprehensively assess advanced persistent threats (APTs).

[0005] Secondly, for the retrieval of internal structured alarm data, existing methods mainly adopt semantic retrieval based on vector similarity. However, this method faces three major challenges when processing security logs: (1) Insufficient real-time performance: The massive and high-concurrency alarm stream requires the vector index to be updated in real time, but this is almost infeasible in terms of computational cost and engineering implementation when the scale of millions or even tens of millions of records is reached; (2) Semantic dilution: Security logs generally contain a large number of repetitive patterns (such as failed login attempts from different IPs), resulting in high semantic similarity in the vector space, but different actual meanings, and the retrieval results are easily confused due to key differences; (3) Lack of relational semantics: Traditional vector embedding is "flat" and cannot express complex logic such as foreign key associations between database tables, multi-table JOIN, and nested filtering conditions. Therefore, it cannot support advanced queries such as cross-table aggregation and statistical analysis, which greatly limits the depth and flexibility of analysis.

[0006] Finally, existing solutions generally lack a refined understanding and guidance of user query intent. Most systems treat all queries equally, performing broad-area searches directly, which is not only inefficient but also prone to introducing irrelevant information, reducing the relevance of the final output. Meanwhile, while existing Text-to-SQL methods can handle structured queries, they typically require extensive labeled data for fine-tuning, consuming huge resources and being sensitive to changes in database schemas, making it difficult to adapt to the rapidly evolving data sources and attack patterns in SOC environments.

[0007] In summary, existing technologies have significant shortcomings in integrating internal and external data, handling the complex relationships in structured logs, and understanding analyst intent. Therefore, this invention aims to propose a security event correlation analysis and question-answering method for SOC scenarios based on hybrid retrieval and enhanced generation. By constructing a multi-dimensional knowledge base, designing a dynamic task identification mechanism, and implementing context-aware query completion, this method effectively solves the aforementioned problems, achieving efficient, accurate, and interpretable intelligent correlation analysis of multi-source heterogeneous security data. Summary of the Invention

[0008] The main objective of this invention is to provide a method for security event correlation analysis and question answering based on hybrid retrieval enhancement, the method comprising the following steps:

[0009] Step S1, Context-aware query completion: Receive the original query input by the user and obtain the history of the current conversation, and form a context-enhanced query based on the original query and the history of the current conversation;

[0010] Step S2, Dynamic Task Identification: Based on the context-enhanced query, and combined with the dynamic task identification strategy, output a predicted task model;

[0011] Step S3, Multi-dimensional retrieval: Perform multi-dimensional retrieval on the prediction task model to obtain the final knowledge context package;

[0012] Step S4, Knowledge-driven response generation: Generate a knowledge-driven response based on the knowledge context package, and output the final security analysis report after the generated content passes verification.

[0013] A further technical solution of the present invention is that step S1 includes:

[0014] Step S101: Receive the original query input by the user. And retrieve the history of the current conversation. , including the previous A complete "query-response" pair represents the entire dialogue history from the first round to the current round, used for context understanding and reference resolution; Indicates the first The query statement issued by the user, that is, the question or instruction that the user puts on the system; Indicates the system's response to the first... Round query The generated response content, namely the analysis results, suggestions, or explanations returned by the system, This indicates that the current number is the [number]. A round of dialogue, meaning that in the current message, the one being processed is the first round. Secondary user input;

[0015] Step S102: Extract a set of key entities from the historical records, including IP addresses, domain names, file hashes, and usernames;

[0016] Step S103: If the current query lacks a specific entity, the most relevant entity is matched from the key entity set and injected into the query to form a context-enhanced query.

[0017] A further technical solution of the present invention is that step S2 includes:

[0018] Step S201, Build a task template library It is a set of problem templates and corresponding task types, formally represented as: ,in An abstract problem template. For the corresponding task type, A predefined set of task types; a template for each question. This is achieved by abstracting real analyst queries. Specifically, the method involves identifying and replacing specific entities in the original question with standardized placeholders. The predefined set of task types includes: honeypot events, threat intelligence matching, security alert analysis, access behavior auditing, and threat correlation and response.

[0019] Step S202: Complete the query with context. Generate its vector representation using a lightweight embedding model. Its dimensions are predetermined by the embedded model architecture adopted;

[0020] Step S203, Calculate With all templates Cosine similarity:

[0021] ;

[0022] S204: Before selection The most similar template And according to its corresponding task tag Constructing the prompt context This is used to guide large language models in task classification.

[0023] S205: Query With the context of the prompt Input a large language model, perform a zero-shot classification task, and output the predicted task type. :

[0024] .

[0025] A further technical solution of the present invention is that step S3 includes:

[0026] Step S31, structured data retrieval, specifically includes:

[0027] S311: Based on the task type output by the task identification module Identify the set of data sources associated with this task. It is a structured and secure database;

[0028] S312: Enhance queries from context The key target entities were parsed out, including IP address, domain name, user account, file hash, and process name;

[0029] S313: In the selected set of data sources Execute context-aware aggregate queries Extract multidimensional information related to the target entity and generate a structured summary. The content includes: attack timeline, list of related security events, and statistical metrics. The output format is as follows:

[0030] ;

[0031] in, This represents a structured evidence summary extracted and aggregated from the internal security database. This represents a context-aware aggregate function that supports cross-table joins, nested filtering, and time-series aggregation operations. Indicates based on task type A defined set of relevant data sources; This indicates a context-enhanced query.

[0032] A further technical solution of the present invention is that step S3 further includes:

[0033] S32: Expert-guided retrieval, specifically including the following steps:

[0034] S321: Establish an expert knowledge base It is used to store unstructured security analysis experience and operating procedures, including: security incident assessment process, threat response strategy templates, analysis guidelines for typical attack patterns, and SOC standard operating procedures;

[0035] S322: Based on the identified task type Through a predefined deterministic mapping function Search for the most relevant guidance documents:

[0036] .

[0037] A further technical solution of the present invention is that step S3 further includes:

[0038] Step S33: Term disambiguation retrieval, specifically including:

[0039] S331: Building a Domain Terminology Library , recorded as Each keyword Includes the following attributes: standard terminology definition, and a set of synonyms. Pre-trained embedding vectors Generated using a lightweight embedding model;

[0040] S332: For queries The process involves word segmentation, filtering out stop words and identified named entities to obtain a list of query terms to be disambiguated. ;

[0041] S333: For each word Calculate its relationship with all term keywords Cosine similarity:

[0042] in For words The embedding vector;

[0043] S334: For each If it is related to a certain keyword The similarity reaches the maximum and is not lower than the preset threshold. Then Add to the glossary :

[0044] ;

[0045] S335: Integrate the three types of search results into a unified knowledge context package:

[0046] .

[0047] A further technical solution of the present invention is that step S4 includes:

[0048] S401: Determine whether the input query belongs to the predefined task distribution category, i.e., the type output by the task identification module. Does it meet the requirements? ;

[0049] If the task distribution is known, a unified multi-slot hint template is used for hint construction. This unified multi-slot hint template includes the following core elements:

[0050] Dialogue history: Preserves the context of multiple rounds of interaction to ensure semantic coherence;

[0051] Search results Injecting multidimensional knowledge from structured retrieval, expert-guided retrieval, and terminology disambiguation retrieval;

[0052] Output format constraints: Clearly define generation requirements, such as "step-by-step explanation", "list the sources of evidence", and "avoid speculative descriptions", to improve the standardization and auditability of the response;

[0053] If it does not belong to any predefined task type, a general reasoning prompt template is enabled. This general reasoning prompt template weakens the dependence on the search results and uses the common sense and logical reasoning ability of the large language model itself to make a robust response, preventing system crashes or uncontrolled output due to search failures.

[0054] S402: Input the constructed prompt into the large language model. It performs natural language generation tasks and outputs a well-structured and semantically accurate analytical response.

[0055] S403: Perform traceability verification on the generated content, checking each factual statement, threat assessment, and response suggestion in the response to ensure that they can all be mapped to the search results. Specific data entries in;

[0056] S404: After verification, the final security analysis report is output; the report includes: threat event description, chain of evidence, attack impact assessment, and actionable response recommendations.

[0057] To achieve the above objectives, the present invention also proposes a security event correlation analysis and question-and-answer system, characterized in that the system includes a memory, a processor, and a security event correlation analysis and question-and-answer program stored on the processor, wherein the security event correlation analysis and question-and-answer program is executed by the processor to perform the steps of the method described above.

[0058] To achieve the above objectives, the present invention also proposes a computer-readable storage medium, characterized in that the computer-readable storage medium stores a security event correlation analysis and question-and-answer program, which, when run by a processor, executes the steps of the method described above.

[0059] The beneficial effects of the security event correlation analysis and question-and-answer method, system, and medium of this invention are:

[0060] This invention, through the above technical solution, receives the original query input by the user and obtains the history of the current dialogue. Based on the original query and the history of the current dialogue, a context-enhanced query is formed. Based on the context-enhanced query, a predictive task model is output using a dynamic task recognition strategy. The predictive task model is then subjected to multi-dimensional retrieval to obtain the final knowledge context package. A knowledge-driven response is generated based on the knowledge context package. After the generated content passes verification, a final security analysis report is output. By constructing a multi-dimensional knowledge base, designing a dynamic task recognition mechanism, and implementing context-aware query completion, efficient, accurate, and interpretable intelligent correlation analysis of multi-source heterogeneous security data is achieved. Attached Figure Description

[0061] Figure 1 This is a flowchart illustrating a preferred embodiment of the security event correlation analysis and question-and-answer method of the present invention.

[0062] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. Detailed Implementation

[0063] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0064] This invention proposes a security event correlation analysis and question-answering method. This method is applicable to real-time correlation, threat assessment, and response suggestion generation of multi-source heterogeneous security alert data in Security Operations Centers (SOCs), and is particularly suitable for intelligent auxiliary analysis in high-concurrency, dynamically evolving network attack scenarios. This invention aims to propose a security event correlation analysis and question-answering method based on hybrid retrieval and enhanced generation for SOC scenarios. By constructing a multi-dimensional knowledge base, designing a dynamic task identification mechanism, and implementing context-aware query completion, it effectively solves the aforementioned problems, achieving efficient, accurate, and interpretable intelligent correlation analysis of multi-source heterogeneous security data.

[0065] like Figure 1 As shown, a preferred embodiment of the security event correlation analysis and question-and-answer method of the present invention includes the following steps:

[0066] Step S1, Context-Aware Query Completion: Receive the original query input by the user and obtain the history of the current conversation. Form a context-enhanced query based on the original query and the history of the current conversation.

[0067] To address the issue of ambiguous referencing in multi-turn dialogues (such as "How should this IP be handled?"), this invention designs a context-aware query completion mechanism.

[0068] Step S10 as shown specifically includes the following steps:

[0069] Step S101: Receive the original query input by the user. And retrieve the history of the current conversation. , including the previous A complete "query-response" pair represents the entire dialogue history from the first round to the current round, used for context understanding and reference resolution. Indicates the first The query statement issued by the user, that is, the question or instruction that the user puts on the system; Indicates the system's response to the first... Round query The generated response content refers to the analysis results, suggestions, or explanations returned by the system. This indicates that the current number is the [number]. A round of dialogue, meaning that in the current message, the one being processed is the first round. Secondary user input.

[0070] Step S102: Extract the set of key entities from the historical records This includes IP address, domain name, file hash, username, etc.

[0071] Step S103: If the current query If there is no clearly defined entity, then from The most relevant entities are matched and injected into the query to form a context-enhanced query. .

[0072] For example: If the previous output was "The attack source IP is 172.26.*.*", and the current query is "How to deal with this IP?", then it should be completed as "How to deal with the attack source IP 172.26.*.*?"

[0073] Step S2, Dynamic Task Identification: Based on the context-enhanced query, a predictive task model is output using the dynamic task identification strategy.

[0074] To improve retrieval accuracy, this invention introduces a task recognition mechanism based on dynamic few-sample enhancement.

[0075] Step S2 specifically includes the following steps:

[0076] S201: Building a Task Template Library It is a set of problem templates and corresponding task types, formally represented as: ,in An abstract problem template. For the corresponding task type, A predefined set of task types. Each question template. This is achieved by abstracting real analyst queries. Specifically, the method involves identifying and replacing specific entities in the original question (such as IP addresses, domain names, file hashes, usernames, etc.) with standardized placeholders (e.g., ...). <ip> 、 <domain> 、 <filehash> 、 <user>This process preserves the semantic structure of the question and the query intent, while also making it general and reusable.

[0077] Predefined task type set This includes, but is not limited to, the following five categories: honeypot incidents, threat intelligence matching, security alert analysis, access behavior auditing, and threat correlation and response.

[0078] The following is a task template library Several example entries:

[0079] Question Template 1: List all from <ip>The honeypot interaction logs include attack payloads and timestamps.

[0080] Task Type 1: Honeypot Event Inquiry

[0081] Question Template 2: Check <ip>Does it appear on the latest threat intelligence blacklist? If so, please provide the associated malware family and confidence level.

[0082] Task Type 2: Threat Intelligence Matching

[0083] Question Template 3: Analysis and Threat Organization <threatactor>All relevant historical security alerts were analyzed, along with statistics on the most frequently exploited CVEs and attack preferences.

[0084] Task Type 3: Security Alert Analysis

[0085] Question Template 4: Rebuild User <user>All access activities in the past 24 hours, including login time, commands executed, and resources accessed.

[0086] Task Type 4: Access Behavior Auditing

[0087] This template library is dynamically expandable and can be continuously expanded through manual annotation or by combining pattern mining capabilities of large language models to cover more security analysis scenarios.

[0088] S202: Query after context completion Use lightweight embedding models (such as BAAI / llm-embedder) to generate their vector representations. Its dimensions are predetermined by the embedded model architecture adopted.

[0089] S203: Calculation With all templates Cosine similarity:

[0090] .

[0091] S204: Before selection The most similar template And according to its corresponding task tag Constructing the prompt context It is used to guide large language models in task classification.

[0092] S205: Query With the context of the prompt Input a large language model, perform a zero-shot classification task, and output the predicted task type. :

[0093] .

[0094] This mechanism avoids the high computational complexity of traditional Text-to-SQL methods, which require traversing all database tables and fields. By decoupling task recognition into semantic matching-based template retrieval and classification, the system's computational complexity is reduced from... (in For table numbers, The average number of fields was significantly reduced to (in (the number of predefined task types), and This holds true in typical SOC scenarios, thereby significantly improving the system's response efficiency and scalability.

[0095] Step S3, Multi-dimensional retrieval: Perform multi-dimensional retrieval on the prediction task model to obtain the final knowledge context package.

[0096] This step primarily involves the innovative construction of a three-channel hybrid retrieval architecture, which separately processes structured security data, expert analysis rules, and domain terminology disambiguation, enabling the collaborative injection of multi-dimensional knowledge and improving the accuracy and interpretability of the large language model in security incident analysis.

[0097] Step S3 specifically includes the following steps:

[0098] Step S31, structured data retrieval. Step S31 specifically includes:

[0099] S311: Based on the task type output by the task identification module Identify the set of data sources associated with this task. It is a structured security database that stores data such as honeypot logs, endpoint detection and response alerts, firewall logs, and access behavior logs.

[0100] S312: Enhance queries from context The system can extract key target entities, including but not limited to IP addresses, domain names, user accounts, file hashes, and process names.

[0101] S313: In the selected set of data sources Execute context-aware aggregate queries Extract multidimensional information related to the target entity and generate a structured summary. The content includes: attack timeline, list of related security events, and statistical metrics (such as attack frequency, duration, and number of affected assets). The output format is:

[0102] .

[0103] in, This represents a structured evidence summary extracted and aggregated from the internal security database. This represents a context-aware aggregate function that supports cross-table joins, nested filtering, and time-series aggregation operations. Indicates based on task type A defined set of relevant data sources; This indicates a context-enhanced query.

[0104] It should be noted that the structured security database in this invention is a logical data set, and its physical implementation can be built based on technologies such as relational databases, time-series databases, or search engines. The specific data model is determined by the security data acquisition system of the deployment environment. This invention achieves decoupling of the underlying data storage structure through a logical mapping mechanism between task types and data sources, ensuring the universality and deployability of the solution in different security infrastructure environments without affecting the technical effect of this invention.

[0105] Step S32, expert-guided search. Step S32 specifically includes:

[0106] S321: Establish an expert knowledge base It is used to store unstructured security analysis experience and operating procedures, including but not limited to: security incident assessment process, threat response strategy templates, analysis guidelines for typical attack patterns, and SOC standard operating procedures.

[0107] S322: Based on the identified task type Through a predefined deterministic mapping function Search for the most relevant guidance documents:

[0108] .

[0109] For example, when the task is "threat association and response", the system returns guidance materials such as "multi-source evidence fusion analysis process" and "emergency response plan template" to guide the large language model to follow the standardized analysis path.

[0110] Step S33, term disambiguation retrieval. Step S33 specifically includes the following steps:

[0111] S331: Building a Domain Terminology Library , recorded as Each keyword Includes the following attributes:

[0112] (1) Standard Terminology Definition

[0113] (2) Collection of synonyms (e.g., "lateral movement")

[0114] (3) Pre-trained embedding vectors It is generated using a lightweight embedding model (such as BAAI / llm-embedder).

[0115] S332: For queries The process involves word segmentation, filtering out stop words and identified named entities to obtain a list of query terms to be disambiguated. .

[0116] S333: For each word Calculate its relationship with all term keywords Cosine similarity:

[0117] .

[0118] in For words The embedding vector.

[0119] S334: For each If it is related to a certain keyword The similarity reaches the maximum and is not lower than the preset threshold. (For example, 0.75), then Add to the glossary :

[0120] .

[0121] S335: Integrate the three types of search results into a unified knowledge context package:

[0122] .

[0123] This complex context will serve as the core input for the subsequent response generation stage, ensuring that the large language model generates accurate and reliable analytical conclusions based on a full understanding of semantics, context, and terminology.

[0124] Step S4, Knowledge-driven response generation: Generate a knowledge-driven response based on the knowledge context package, and output the final security analysis report after the generated content passes verification.

[0125] Step S4 specifically includes:

[0126] S401: Determine whether the input query belongs to the predefined task distribution category, i.e., the type output by the task identification module. Does it meet the requirements? :

[0127] If the task distribution is known, a unified multi-slot prompt template is used for prompt construction. This template includes the following core elements:

[0128] Dialogue history: Preserves the context of multiple rounds of interaction to ensure semantic coherence;

[0129] Search results Injecting multidimensional knowledge from structured retrieval, expert-guided retrieval, and terminology disambiguation retrieval;

[0130] Output format constraints: Clearly define generation requirements, such as "step-by-step explanation", "listing sources of evidence", and "avoiding speculative descriptions", to improve the standardization and auditability of the response.

[0131] If the query does not belong to any predefined task type, such as fuzzy query content, irrelevant security analysis, or a task template that cannot be matched, a general inference suggestion template is enabled. This template reduces reliance on search results and primarily utilizes the common sense and logical reasoning capabilities of the large language model itself for robust responses, preventing system crashes or uncontrolled output due to search failures.

[0132] S402: Input the constructed prompt into the large language model. It performs natural language generation tasks and outputs a well-structured and semantically accurate analytical response.

[0133] S403: Perform traceability verification on the generated content, checking each factual statement, threat assessment, and response suggestion in the response to ensure that they can all be mapped to the search results. The specific data entries (such as log record ID, threat intelligence source, expert rule number, etc.) ensure that all conclusions are based on evidence and prevent "illusion" output.

[0134] S404: After successful verification, the final security analysis report is output. The report content includes, but is not limited to:

[0135] (1) Description of the threat event;

[0136] (2) Chain of evidence;

[0137] (3) Impact assessment of the attack;

[0138] (4) Actionable response recommendations.

[0139] This mechanism enables controllable generation guided by domain knowledge, taking into account generation quality, interpretability, and security, and is suitable for security operation scenarios with high reliability requirements.

[0140] The beneficial effects of the security event correlation analysis and question-and-answer method of this invention are:

[0141] This invention, through the above technical solution, receives the original query input by the user and obtains the history of the current dialogue. Based on the original query and the history of the current dialogue, a context-enhanced query is formed. Based on the context-enhanced query, a predictive task model is output using a dynamic task recognition strategy. The predictive task model is then subjected to multi-dimensional retrieval to obtain the final knowledge context package. A knowledge-driven response is generated based on the knowledge context package. After the generated content passes verification, a final security analysis report is output. By constructing a multi-dimensional knowledge base, designing a dynamic task recognition mechanism, and implementing context-aware query completion, efficient, accurate, and interpretable intelligent correlation analysis of multi-source heterogeneous security data is achieved.

[0142] To achieve the above objectives, the present invention also proposes a security event correlation analysis and question-and-answer system, the system including a memory, a processor, and a security event correlation analysis and question-and-answer program stored on the processor. The security event correlation analysis and question-and-answer program is executed by the processor to perform the steps of the method described above, which will not be repeated here.

[0143] To achieve the above objectives, the present invention also proposes a computer-readable storage medium storing a security event correlation analysis and question-and-answer program, which, when run by a processor, executes the steps of the method described above, which will not be repeated here.

[0144] The above description is only a preferred embodiment of the present invention and does not limit the scope of the invention. Any equivalent structural or procedural changes made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of protection of the present invention.< / user> < / threatactor> < / ip> < / ip> < / user> < / filehash> < / domain> < / ip>

Claims

1. A method for security event correlation analysis and question answering, characterized in that, The method includes the following steps: Step S1, Context-aware query completion: Receive the original query input by the user and obtain the history of the current conversation, and form a context-enhanced query based on the original query and the history of the current conversation; Step S2, Dynamic Task Identification: Based on the context-enhanced query, and combined with the dynamic task identification strategy, output a predicted task model; Step S3, Multi-dimensional retrieval: Perform multi-dimensional retrieval on the prediction task model to obtain the final knowledge context package; Step S4, Knowledge-driven response generation: Generate a knowledge-driven response based on the knowledge context package, and output the final security analysis report after the generated content passes verification; Step S3 includes: Step S31, structured data retrieval, specifically includes: S311: Based on the task type output by the task identification module Identify the set of data sources associated with this task. It is a structured and secure database; S312: Enhance queries from context The key target entities were parsed out, including IP address, domain name, user account, file hash, and process name; S313: In the selected set of data sources Execute context-aware aggregate queries Extract multidimensional information related to the target entity and generate a structured summary. The content includes: attack timeline, list of related security events, and statistical metrics. The output format is as follows: ； in, This represents a structured evidence summary extracted and aggregated from the internal security database. This represents a context-aware aggregate function that supports cross-table joins, nested filtering, and time-series aggregation operations. Indicates based on task type A defined set of relevant data sources; This indicates context-enhanced queries; Step S3 further includes: S32: Expert-guided retrieval, specifically including the following steps: S321: Establish an expert knowledge base It is used to store unstructured security analysis experience and operating procedures, including: security incident assessment process, threat response strategy template, analysis guidelines for typical attack patterns, and SOC standard operating procedures; S322: Based on the identified task type Through a predefined deterministic mapping function Search for the most relevant guidance documents: ； Step S3 further includes: Step S33: Term disambiguation retrieval, specifically including: S331: Building a Domain Terminology Library , recorded as Each keyword Includes the following attributes: standard terminology definition, and a set of synonyms. Pre-trained embedding vectors Generated using a lightweight embedding model; S332: For queries The process involves word segmentation, filtering out stop words and identified named entities to obtain a list of query terms to be disambiguated. ; S333: For each word Calculate its relationship with all term keywords Cosine similarity: in For words The embedding vector; S334: For each If it is related to a certain keyword The similarity reaches the maximum and is not lower than the preset threshold. Then Add to the terminology dictionary : ； S335: Integrate the three types of search results into a unified knowledge context package: 。 2. The security event correlation analysis and question-and-answer method according to claim 1, characterized in that, Step S1 includes: Step S101: Receive the original query input by the user. And retrieve the history of the current conversation. , including the previous A complete "query-response" pair represents the entire dialogue history from the first round to the current round, used for context understanding and reference resolution; Indicates the first The query statement issued by the user, that is, the question or instruction that the user puts on the system; Indicates the system's response to the first... Round query The generated response content, namely the analysis results, suggestions, or explanations returned by the system, This indicates that the current number is the [number]. A round of dialogue, meaning that in the current message, the one being processed is the first round. Secondary user input; Step S102: Extract a set of key entities from the historical records, including IP addresses, domain names, file hashes, and usernames; Step S103: If the current query lacks a specific entity, the most relevant entity is matched from the key entity set and injected into the query to form a context-enhanced query.

3. The security event correlation analysis and question-and-answer method according to claim 2, characterized in that, Step S2 includes: Step S201, Build a task template library It is a set of problem templates and corresponding task types, formally represented as: ,in An abstract problem template. For the corresponding task type, A predefined set of task types; a template for each question. This is achieved by abstracting real analyst queries. Specifically, the method involves identifying and replacing specific entities in the original question with standardized placeholders. The predefined set of task types includes: honeypot events, threat intelligence matching, security alert analysis, access behavior auditing, and threat correlation and response. Step S202: Complete the query with context. Generate its vector representation using a lightweight embedding model. Its dimensions are predetermined by the embedded model architecture adopted; Step S203, Calculate With all templates Cosine similarity: ； S204: Before selection The most similar template And according to its corresponding task tag Constructing the prompt context This is used to guide large language models in task classification. S205: Query With the context of the prompt Input a large language model, perform a zero-shot classification task, and output the predicted task type. : 。 4. The security event correlation analysis and question-and-answer method according to claim 1, characterized in that, Step S4 includes: S401: Determine whether the input query belongs to the predefined task distribution category, i.e., the type output by the task identification module. Does it meet the requirements? ; If the task distribution is known, a unified multi-slot hint template is used for hint construction. This unified multi-slot hint template includes the following core elements: Dialogue history: Preserves the context of multiple rounds of interaction to ensure semantic coherence; Search results Injecting multidimensional knowledge from structured retrieval, expert-guided retrieval, and terminology disambiguation retrieval; Output format constraints: Clearly define generation requirements to improve the standardization and auditability of the response. These requirements include "step-by-step explanations", "listing sources of evidence", and "avoiding speculative descriptions". If it does not belong to any predefined task type, a general reasoning prompt template is enabled. This general reasoning prompt template weakens the dependence on the search results and uses the common sense and logical reasoning ability of the large language model itself to make a robust response, preventing system crashes or uncontrolled output due to search failures. S402: Input the constructed prompt into the large language model. It performs natural language generation tasks and outputs a well-structured and semantically accurate analytical response. S403: Perform traceability verification on the generated content, checking each factual statement, threat assessment, and response suggestion in the response to ensure that they can all be mapped to the search results. Specific data entries in; S404: After verification, the final security analysis report is output; the report includes: threat event description, chain of evidence, attack impact assessment, and actionable response recommendations.

5. A security event correlation analysis and question-and-answer system, characterized in that, The system includes a memory, a processor, and a security event correlation analysis and question-and-answer program stored on the processor, wherein the security event correlation analysis and question-and-answer program is executed by the processor to perform the steps of the method as described in any one of claims 1 to 4.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a security event correlation analysis and question-and-answer program, which, when run by a processor, performs the steps of the method as described in any one of claims 1 to 4.

Images