An AI large model-based security log analysis system, method, device and medium

Abstract

An AI large model-based security log analysis system, method, device and medium, relating to the field of security log analysis. In the system, an alarm monitoring intelligent agent is configured to convert an original alarm event into an alarm message object in response to receiving the original alarm event; a research and judgment expert intelligent agent is configured to generate a research and judgment conclusion based on the alarm message object; a survey task generation intelligent agent is configured to generate a survey task chain based on the research and judgment conclusion; a data survey intelligent agent is configured to call a data probe to execute a task in the survey task chain and obtain a response, and generate an original survey object queue based on the response; a coordination intelligent agent is configured to generate an operation dependency relationship chain based on the original survey object queue; a graph modeling intelligent agent is configured to generate an attack path graph based on the survey object queue; and a report generation intelligent agent is configured to generate a log analysis report based on the attack path graph. The technical solution provided by the present application can comprehensively and intelligently analyze security logs.

Description

Technical Field

[0001] This application relates to the technical field of security log analysis, specifically to a security log analysis system, method, device, and medium based on an AI large model. Background Technology

[0002] With the rapid development of information technology, various network attack methods are emerging one after another, and attack behaviors are becoming increasingly complex and covert. In-depth analysis of security logs can promptly identify potential security threats and provide strong support for the network security protection of enterprises and organizations.

[0003] Currently, there are several existing methods in the industry. Method one is rule-based analysis, which pre-sets a series of rules and thresholds; when data in the security logs meets these rules, corresponding alerts are triggered. Method two is statistical analysis, which analyzes and models security log data to identify anomalies and trends, thereby uncovering potential security threats. Method one requires continuous manual updating and maintenance of the rule base to adapt to constantly changing attack patterns. Method two has limited ability to identify complex attack behaviors and unknown threat patterns. Existing security log analysis methods are struggling to cope with increasingly complex and diverse cyberattacks.

[0004] Therefore, a secure log analysis system capable of dealing with diverse cyberattacks is needed. Summary of the Invention

[0005] This application provides a security log analysis system, method, device, and medium based on an AI (Artificial Intelligence) large model, which can perform comprehensive and intelligent analysis of security logs, generate attack path maps and log analysis reports, and help to effectively respond to security threats.

[0006] The first aspect of this application provides a security log analysis system based on an AI large model, the system comprising:

[0007] An alarm monitoring agent is used to respond to a received original alarm event and convert the original alarm event into an alarm message object;

[0008] An expert intelligent agent is used to extract the original alarm text and alarm classification tags from the alarm message object, retrieve additional related information from the private domain knowledge base based on the alarm classification tags, fuse the additional related information with the original alarm text to generate enhanced alarm text, perform chain reasoning on the enhanced alarm text through a preset large language model, and generate an analysis conclusion by combining preset multi-dimensional factors.

[0009] An investigation task generation agent is used to extract the disposal suggestion field and attack technology tag from the judgment conclusion, generate a basic task by matching the attack technology tag with a predefined task template library, generate an additional task by the disposal suggestion field and asset sensitivity weight, adjust the priority of the basic task and the additional task according to the real-time probe load, and generate an investigation task chain according to the priority.

[0010] A data survey agent is used to call data probes to execute tasks in the survey task chain and obtain responses, parse the responses according to probe type and mark risk levels to generate survey results, and generate an original survey object queue based on the survey results.

[0011] A collaborative and coordinating intelligent agent is used to perform object aggregation and dependency mining on the original survey object queue to generate a new survey object queue, and to schedule the task dependency order and construct the operation dependency chain through a directed acyclic graph.

[0012] A graph modeling agent is used to traverse the survey object queue, determine target objects whose risk level exceeds a first preset threshold and contain propagation behavior characteristics, and generate an attack path graph based on the operation dependency relationship chain through a hierarchical graph construction algorithm.

[0013] A report-generating agent is used to generate a log analysis report based on the attack path graph.

[0014] By adopting the above technical solutions, the alarm monitoring agent can quickly respond to original alarm events and transform them into alarm message objects, providing a unified and standardized data format for subsequent processing. The analysis expert agent extracts key information and retrieves additional related information from a private knowledge base, integrates this information to generate enhanced alarm text, uses a large language model for chain-like reasoning, and combines multi-dimensional factors to generate analysis conclusions. This process fully utilizes multi-source information, improving the accuracy and comprehensiveness of the analysis, and enabling in-depth exploration of potential threats and correlations behind alarm events. The investigation task generation agent intelligently matches predefined task templates to generate basic tasks based on different fields in the analysis conclusions, generates additional tasks by combining disposal suggestions and asset sensitivity, and can dynamically adjust task priorities and generate investigation task chains based on real-time probe load. This intelligent task generation method prioritizes critical tasks, improving overall response speed. The data investigation agent calls data probes to execute tasks in the investigation task chain, parses responses according to probe type, marks risk levels, generates investigation results, and then generates the original investigation object queue. This precise task execution and result parsing method can quickly extract valuable information from massive amounts of data and effectively assess risks. The collaborative coordination agent aggregates objects and mines dependencies in the original investigation object queue, scheduling task dependencies and constructing operation dependency chains through a directed acyclic graph. This process helps clarify the complex relationships between investigation objects, define the task execution order, and improve the systematicness and coherence of the investigation work. The graph modeling agent traverses the investigation object queue, accurately locates target objects with high risk levels and propagation behavior characteristics, and generates an attack path graph based on the operation dependency chain. This visual graph can intuitively display the attack propagation path and key nodes, helping security personnel quickly understand the full picture of the attack and providing strong support for formulating response strategies. The report generation agent automatically generates log analysis reports based on the attack path graph, saving time and effort in manually writing reports and improving the efficiency and accuracy of report generation.

[0015] Optionally, the survey task generating agent is further used for:

[0016] The built-in attack pattern feature library is called to match the attack type corresponding to the attack technology tag. The target template in the predefined task template library is mapped according to the attack type. The execution target is determined according to the target template. The time range is determined according to the attack occurrence time window and the operation pattern of the target component. The task priority is determined according to the potential harm of the attack and the historical occurrence rate. The basic task is constructed according to the execution target, the time range and the task priority.

[0017] The basic asset sensitivity weight of the target asset involved in the judgment conclusion is calculated based on the asset value, business impact coefficient and data sensitivity level. The instruction type of the disposal suggestion field is converted into a weight enhancement coefficient. The asset sensitivity weight is calculated based on the weight enhancement coefficient and the basic asset sensitivity weight. If the asset sensitivity weight exceeds the second preset threshold, an additional task is generated. The additional task includes configuration file review, permission review and related component tracing.

[0018] The task priorities of the basic task and the additional task are recalculated based on task urgency, asset sensitivity weight, and probe real-time load.

[0019] By employing the aforementioned technical solutions and calling the built-in attack pattern feature library to match attack technology tags with corresponding attack types, attacks can be quickly and accurately classified. This provides a clear direction for subsequent task generation, ensuring that appropriate investigative measures are taken for different types of attacks, avoiding blind operations, and improving the targeting of task execution. Target templates in a predefined task template library are mapped according to attack types to determine execution targets. This template-based mapping method utilizes a predefined, mature task framework, reducing the complexity and time cost of task generation. Determining the time range based on the attack occurrence time window and the operational patterns of target components allows for precise targeting of the investigation time interval. This helps concentrate resources on in-depth analysis during critical time periods, avoiding wasting effort during irrelevant time periods and improving investigation efficiency. Task priorities are determined based on the potential harm of the attack and its historical occurrence rate, ensuring that high-harm, high-occurrence attacks are handled first. The basic asset sensitivity weight of the target asset is calculated based on asset value, business impact coefficient, and data sensitivity level. The instruction type in the disposal suggestion field is converted into a weight enhancement coefficient, and the final asset sensitivity weight is calculated. This multi-dimensional comprehensive calculation method fully considers various important factors of the asset, accurately assessing the asset's importance and sensitivity, and providing a reliable basis for generating additional tasks. The task priorities of basic and additional tasks are recalculated based on task urgency, asset sensitivity weight, and real-time probe load. This dynamic adjustment mechanism, which comprehensively considers multiple factors, can adapt to the current state of the system in real time, ensuring that urgent and important tasks are prioritized when resources are limited.

[0020] Optionally, the survey task generating agent is further used for:

[0021] Collect multi-dimensional context information when an alarm occurs, and convert the multi-dimensional context information into a context object. The multi-dimensional context information includes network environment information, system configuration information, user behavior information, and historical alarm information.

[0022] Perform association analysis on the context objects to determine the relationships between information in different dimensions and form association analysis results;

[0023] Context association tasks are generated based on the association analysis results. These context association tasks include network traffic analysis tasks and system vulnerability inspection tasks generated based on the network environment information and the system configuration information, as well as user abnormal operation behavior investigation tasks generated based on the user behavior information.

[0024] The priority of the context association task is determined based on the urgency of the association analysis results;

[0025] The context-associated task is added to the task set consisting of the basic task and the additional task to form an initial task set;

[0026] The investigation task chain is generated by sorting the tasks in the task set according to their priority.

[0027] By employing the aforementioned technical solution, multi-dimensional contextual information, including network environment information, system configuration information, user behavior information, and historical alarm information, is collected at the time of alarm occurrence and converted into context objects. This comprehensive information collection method ensures that investigation task generation is based on rich background knowledge, avoiding task omissions or inaccuracies due to missing information. Correlation analysis is performed on the context objects to determine the connections between information of different dimensions, thereby generating context-related tasks, such as network traffic analysis tasks, system vulnerability inspection tasks, and user abnormal operation behavior investigation tasks. This task generation method based on correlation analysis can deeply mine the potential relationships behind the data, generating highly targeted tasks for specific security risk points, improving the efficiency and effectiveness of the investigation. Context-related tasks, together with basic tasks and supplementary tasks, constitute the initial task set, and are generated into an investigation task chain based on priority. This design ensures that the tasks are no longer isolated but form an organic whole with a clear logical order and correlation. During the execution of the task chain, different tasks can share contextual information and investigation results, avoiding duplication of effort and information silos. The priority of context-related tasks is determined based on the urgency of the correlation analysis results, and they are then sorted together with basic tasks and supplementary tasks to generate the investigation task chain. This prioritization mechanism ensures that system resources are allocated preferentially to the most urgent and important tasks, avoiding resource waste and idleness. During actual execution, the system can dynamically adjust task priorities based on real-time conditions. By generating comprehensive and accurate investigation task chains, the system can conduct in-depth and detailed investigations of alert events, promptly identifying potential security threats and vulnerabilities. The investigation task generation agent can dynamically generate task chains based on multi-dimensional contextual information and correlation analysis results, enabling the system to adapt to different security scenarios and attack patterns.

[0028] Optionally, the survey task generating agent is further used for:

[0029] Monitor vulnerability feature data pushed by external threat intelligence sources, calculate the correlation confidence between the attack technology tag and the vulnerability feature in the vulnerability feature data, and when the correlation confidence exceeds a third preset threshold, execute vulnerability detection tasks and exploit trace tracing tasks.

[0030] When a vulnerability detection task confirms the existence of a vulnerability, the attack tracing progress completion rate is increased by a first increment value. When an attack entry point is discovered using a trace tracing task, the attack tracing progress completion rate is increased by a second increment value.

[0031] The attack tracing progress completion rate is monitored in real time. When the attack tracing progress completion rate is greater than the fourth preset threshold, the attack source tracking task and impact assessment task are scheduled. When the attack tracing progress completion rate is less than the fifth preset threshold, the full log backtracking task and system configuration review task are inserted.

[0032] By employing the aforementioned technical solution, vulnerability signature data pushed by external threat intelligence sources is monitored, and the correlation confidence between attack technique tags and vulnerability signatures is calculated. When the correlation confidence exceeds a third preset threshold, vulnerability detection and exploitation trace tracing tasks are automatically executed. This mechanism can promptly capture potential vulnerability information related to the current attack, accurately trigger targeted investigation tasks, avoid blindly executing a large number of unnecessary tasks, and greatly improve the efficiency and accuracy of threat response. When the vulnerability detection task confirms the existence of a vulnerability, the attack tracing progress completion rate is increased by a first increment; when the exploitation trace tracing task discovers the attack entry point, a second increment is increased. This dynamic adjustment of the tracing progress completion rate can reflect the progress of attack tracing work in real time, providing an accurate basis for scheduling subsequent tasks. Different tasks contribute differently to tracing; by setting different increment values, the importance of each task can be more reasonably assessed. When the attack tracing progress completion rate is less than a fifth preset threshold, a full log backtracking task and a system configuration review task are inserted. This design takes into account that in some cases, conventional attribution tasks may not be able to obtain sufficient information. By inserting full log backtesting and system configuration review tasks, in-depth investigations can be conducted from a broader range of data sources and system levels, supplementing key information and ensuring the completeness and accuracy of attack attribution. The system monitors the attack attribution progress completion rate in real time and schedules corresponding tasks based on different thresholds. When the attack attribution progress completion rate is greater than the fourth preset threshold, it indicates that the attribution work has made some progress. At this point, scheduling attack source tracing and impact assessment tasks allows system resources to be concentrated on higher-level attribution and analysis work, improving resource utilization efficiency. When the attack attribution progress completion rate is less than the fifth preset threshold, inserting full log backtesting and system configuration review tasks allows for timely adjustment of task direction and reasonable allocation of resources when the attribution work encounters bottlenecks, ensuring that the attribution work can continue to progress.

[0033] Optionally, the graph modeling agent is also used for:

[0034] The attack event is divided into multiple phases, including the reconnaissance phase, penetration phase, lateral movement phase, data collection phase, and data leakage phase.

[0035] The target node of the target stage is determined by the breadth-first search algorithm. The hierarchical graph of the target stage is constructed based on the target node and the associated node. The behavioral links between different stages are constructed through the association between nodes. The target stage is any one of the multiple stages, and the target node is any one of the nodes of the target stage.

[0036] An initial attack path graph is constructed based on the behavioral links and the hierarchical graph. The transfer frequency between nodes is statistically analyzed based on historical attack data. The transfer probability is generated by combining the transfer frequency with real-time threat intelligence. The transfer probability is then used to assign probability values ​​to each edge in the initial attack path graph to generate the attack path graph.

[0037] By adopting the above technical solutions, attack events are divided into multiple stages, including reconnaissance, penetration, lateral movement, data collection, and data leakage. This clear stage division helps security personnel grasp the overall attack process and development trend from a macro perspective. A breadth-first search algorithm is used to determine the associated nodes of the target nodes in each stage, and a hierarchical graph of the target stage is constructed. The hierarchical graph clearly shows the hierarchical relationships and associated structures between nodes within the target stage, helping security personnel understand the attacker's specific operational steps and execution paths at that stage. Behavioral links can show the transitions and connections between different stages of the attack event, revealing the attacker's overall strategy and tactics. An initial attack path graph is constructed based on the behavioral links and the hierarchical graph, providing a basic framework for attack path prediction. The initial attack path graph integrates behavioral information and node relationships at different stages of the attack event, intuitively showing the paths the attacker might take. Based on historical attack data, the frequency of node transitions is statistically analyzed, and transition probabilities are generated by combining real-time threat intelligence. Probability values ​​are assigned to each edge of the initial attack path graph, thus generating the attack path graph. The transition probability reflects the likelihood of an attacker shifting between different nodes, taking into account both historical attack patterns and the current security threat landscape. By incorporating transition probabilities, the attack path graph can more accurately predict the paths attackers are most likely to take, providing more targeted guidance for security defense. As cybersecurity threats continue to evolve and new attack methods emerge, the attack path graph can be dynamically updated based on real-time threat intelligence and new attack data. When a new attack pattern or vulnerability is detected, the system can promptly adjust the nodes and edges in the attack path graph and recalculate the transition probabilities, ensuring the graph remains consistent with the current security threat landscape.

[0038] Optionally, the graph modeling agent is also used for:

[0039] The attack complexity coefficient is determined based on the technical difficulty required for the attack behavior in the aforementioned behavioral chain; the attack success rate coefficient is determined based on the ratio of the number of successful attacks in the past to the total number of attacks; and the attack destructiveness coefficient is determined based on the amount of data loss and the system downtime.

[0040] The basic weights of the edges are determined based on the attack complexity coefficient, the attack success rate coefficient, and the attack destructive coefficient.

[0041] The attack frequency factor is determined based on the number of attack behaviors per unit time. The attack intent is determined based on the target and attack method of the attack behavior and is mapped to the attack intent factor. The attack asset factor is determined based on the importance of the asset targeted by the attack behavior. The weights of the edges are obtained by weighted summation of the base weights, the attack frequency factor, the attack intent factor, and the attack asset factor. The initial attack path graph is constructed based on the weights.

[0042] By employing the above technical solutions, the attack complexity coefficient is determined by analyzing the technical difficulty required for attack behaviors in the behavioral chain, enabling an accurate assessment of the attack's difficulty from a technical perspective. The attack success rate coefficient is determined based on the ratio of historical successful attacks to the total number of attacks, extracting data from actual attack events to objectively reflect the attacker's probability of successfully executing a certain attack. The attack destructiveness coefficient is determined based on data loss and system downtime, measuring the damage caused by the attack from two key aspects: data and system operation. Data is one of the core assets of an enterprise; data loss directly reflects the threat level of an attack to data security, while system downtime reflects the impact of the attack on business continuity. Considering both factors comprehensively allows for a more complete assessment of the attack's destructiveness, providing important reference for subsequent risk assessment and emergency response. Combining the attack complexity coefficient, attack success rate coefficient, and attack destructiveness coefficient to determine the basic weights of each edge comprehensively considers multiple important factors such as the attack's technical difficulty, success probability, and destructiveness. This comprehensive calculation method avoids the one-sidedness of single-factor assessments and can more accurately reflect the potential risks of each edge along the attack path. The attack frequency factor is determined based on the number of attack behaviors per unit time, reflecting the real-time activity level of attacks. High-frequency attacks may indicate that attackers are actively attempting to breach defenses or have found effective attack methods. Analyzing the targets and methods of attack behavior to determine attack intent and mapping it to attack intent factors allows for a deeper understanding of the attacker's motives and objectives. Determining the attack asset factor based on the importance of the assets targeted in the attack emphasizes the protection of critical assets. Weighted summation of the base weight, attack frequency factor, attack intent factor, and attack asset factor yields the edge weights, and an initial attack path graph is constructed based on these weights. This comprehensive weighting method fully considers multiple key factors of the attack path, more accurately reflecting the actual risk level of the attack path.

[0043] Optionally, the collaborative coordinating agent is further used for:

[0044] In response to receiving a new alarm event, the target parameters of the new alarm event are obtained, including alarm threat value, asset importance factor and attack behavior variability;

[0045] The event priority index is obtained by weighting the target parameters, and it is determined whether the event priority index exceeds a sixth preset threshold.

[0046] When the event priority index exceeds the sixth preset threshold, locate the associated subgraph, which contains nodes and edges related to the new alarm event;

[0047] The associated subgraph is reconstructed based on the new alarm event, and the weights of the edges in the reconstructed associated subgraph are recalculated.

[0048] By adopting the above technical solution, and obtaining the target parameters of new alarm events through weighted calculation to obtain the event priority index, the importance and urgency of each alarm event can be quickly quantified. Determining whether the event priority index exceeds a sixth preset threshold allows for the rapid filtering of truly critical alarm events requiring focused attention and handling, significantly improving the efficiency and targeting of alarm processing. Once a new alarm event is determined to be high priority, the associated subgraph containing nodes and edges related to that event is located. This step quickly integrates scattered alarm information into a specific associated subgraph, enabling security personnel to view all information related to the alarm within a relatively centralized scope. The selection of target parameters is scientific and reasonable. The alarm threat value reflects the direct threat level of the attack behavior itself to system security; the asset importance factor considers the criticality of the attacked asset in the business; different assets have vastly different importance, and attacks on important assets often have more severe consequences; the attack behavior variability reflects the innovation and unpredictability of attack methods, and attacks with high variability may be more difficult to defend against. By weighting these three parameters, the risk level of new alert events can be comprehensively assessed from multiple perspectives, providing a more accurate and reliable basis for security decisions. Reconstructing the correlation subgraph based on new alert events and recalculating edge weights allows for dynamic updates to the structure and information of the correlation subgraph. The cybersecurity threat environment is constantly changing and evolving, with new attack methods and vulnerabilities constantly emerging. The collaborative and coordinating agent can promptly perceive and adapt to these changes by acquiring target parameters of new alert events in real time, dynamically locating correlation subgraphs, reconstructing the graph, and recalculating edge weights. When attack behavior mutates or new attack patterns emerge, the system can quickly adjust its handling of alert events and correlation analysis results, maintaining an effective response capability to new threats and improving the system's adaptability and flexibility.

[0049] A second aspect of this application provides a security log analysis method based on an AI large model, applied to a system as described in any of the foregoing claims, the method comprising:

[0050] In response to receiving an original alarm event, the original alarm event is converted into an alarm message object;

[0051] Extract the original alarm text and alarm classification tags from the alarm message object, retrieve additional related information from the private domain knowledge base based on the alarm classification tags, fuse the additional related information with the original alarm text to generate enhanced alarm text, perform chain reasoning on the enhanced alarm text through a preset large language model, and generate a judgment conclusion by combining preset multi-dimensional factors.

[0052] Extract the disposal suggestion field and attack technology tag from the judgment conclusion, generate basic tasks by matching the attack technology tag with a predefined task template library, generate additional tasks by the disposal suggestion field and asset sensitivity weight, adjust the priority of the basic tasks and the additional tasks according to the real-time probe load, and generate an investigation task chain according to the priority.

[0053] Invoke the data probe to execute the tasks in the investigation task chain and obtain the response. Parse the response according to the probe type and mark the risk level to generate the investigation results. Generate the original investigation object queue based on the investigation results.

[0054] The original survey object queue is aggregated and dependency mining is performed to generate a new survey object queue. The task dependency order is scheduled and an operation dependency chain is constructed through a directed acyclic graph.

[0055] Traverse the queue of survey objects to identify target objects with a risk level exceeding the first preset threshold and containing propagation behavior characteristics. Based on the operation dependency relationship chain, generate an attack path graph through a hierarchical graph construction algorithm.

[0056] A log analysis report is generated based on the attack path map.

[0057] A third aspect of this application provides an electronic device including a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, and both the user interface and the network interface are used to communicate with other devices. The processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method described above.

[0058] A fourth aspect of this application provides a computer-readable storage medium storing instructions that, when executed, perform the method described above.

[0059] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0060] 1. The received raw alarm events are converted into alarm message objects, which realizes standardized processing of raw alarm events from different sources and with different formats, enabling subsequent processing modules to operate with a unified data format, thereby improving the system's compatibility and scalability.

[0061] 2. Utilize a pre-defined large language model to perform chain-like reasoning on the enhanced alarm text, and combine it with pre-defined multi-dimensional factors to generate judgment conclusions. The chain-like reasoning capability of the large language model can simulate the analysis process of human experts, conduct in-depth analysis of alarm events from multiple perspectives, improve the accuracy and reliability of judgment, and reduce the possibility of misjudgment and omission;

[0062] 3. Based on the handling suggestion fields and attack technology tags in the analysis conclusion, basic tasks are generated from a predefined task template library, and supplementary tasks are generated by combining the handling suggestion fields and asset sensitivity weights. This method of generating tasks based on different information can generate personalized investigation tasks according to specific security events and asset conditions, improving the targeting and effectiveness of investigations; the priority of basic and supplementary tasks is adjusted according to real-time probe load, and investigation task chains are generated according to priority. This dynamic adjustment mechanism can ensure that the system prioritizes important and urgent tasks when resources are limited, improving resource utilization and task execution efficiency;

[0063] 4. The system invokes data probes to execute tasks in the investigation task chain and obtains responses. It then parses the responses according to probe type and labels them with risk levels to generate investigation results. Interaction with data probes allows for the rapid acquisition of necessary security data, and targeted parsing based on probe type improves the efficiency of data acquisition and processing. The system generates an original queue of investigation subjects based on the investigation results, providing an ordered data foundation for subsequent collaborative coordination and graph modeling, facilitating further analysis and processing of the investigation subjects.

[0064] 5. By performing object aggregation and dependency mining on the original investigation object queue to generate a new investigation object queue, potential connections between investigation objects can be discovered, providing important information for a comprehensive understanding of the propagation path and scope of impact of security incidents; by scheduling task dependency order through a directed acyclic graph and constructing an operation dependency chain, the execution order and dependency relationship between each task are clarified, ensuring that investigation tasks can be executed in a reasonable order, avoiding inaccurate investigation results or omission of important information due to improper task execution order;

[0065] 6. By traversing the queue of investigated targets and identifying those with risk levels exceeding the first preset threshold and exhibiting propagation behavior characteristics, the system can accurately identify key risk points in security incidents, providing key targets for subsequent attack path analysis. Based on the operational dependency chain, an attack path graph is generated using a hierarchical graph construction algorithm. The attack path graph visually displays the attacker's intrusion path and attack methods, helping security personnel quickly understand the full picture of a security incident and formulate effective response strategies.

[0066] 7. The system generates log analysis reports based on attack path graphs, automating report generation. It automatically organizes and analyzes relevant information from security incidents, generating well-structured and comprehensive reports, reducing the workload and time cost of manual report writing. The generated log analysis reports provide security managers with detailed security incident analysis results and decision-making support, helping them to understand the system's security status in a timely manner, take appropriate preventative and response measures, and improve the company's security protection capabilities. Attached Figure Description

[0067] Figure 1 This is a schematic diagram of the architecture of a security log analysis system based on an AI large model disclosed in an embodiment of this application;

[0068] Figure 2 This is a flowchart illustrating a security log analysis method based on an AI large model disclosed in an embodiment of this application;

[0069] Figure 3 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application.

[0070] Explanation of reference numerals in the attached figures: 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. Detailed Implementation

[0071] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0072] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0073] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0074] This embodiment discloses a security log analysis system based on an AI large model. Figure 1 This is a schematic diagram of the architecture of a security log analysis system based on an AI large model disclosed in an embodiment of this application, such as... Figure 1 As shown, the system includes:

[0075] An alarm monitoring agent is used to respond to a received original alarm event and convert the original alarm event into an alarm message object;

[0076] An expert intelligent agent is used to extract the original alarm text and alarm classification tags from the alarm message object, retrieve additional related information from the private domain knowledge base based on the alarm classification tags, fuse the additional related information with the original alarm text to generate enhanced alarm text, perform chain reasoning on the enhanced alarm text through a preset large language model, and generate an analysis conclusion by combining preset multi-dimensional factors.

[0077] An investigation task generation agent is used to extract the disposal suggestion field and attack technology tag from the judgment conclusion, generate a basic task by matching the attack technology tag with a predefined task template library, generate an additional task by the disposal suggestion field and asset sensitivity weight, adjust the priority of the basic task and the additional task according to the real-time probe load, and generate an investigation task chain according to the priority.

[0078] A data survey agent is used to call data probes to execute tasks in the survey task chain and obtain responses, parse the responses according to probe type and mark risk levels to generate survey results, and generate an original survey object queue based on the survey results.

[0079] A collaborative and coordinating intelligent agent is used to perform object aggregation and dependency mining on the original survey object queue to generate a new survey object queue, and to schedule the task dependency order and construct the operation dependency chain through a directed acyclic graph.

[0080] A graph modeling agent is used to traverse the survey object queue, determine target objects whose risk level exceeds a first preset threshold and contain propagation behavior characteristics, and generate an attack path graph based on the operation dependency relationship chain through a hierarchical graph construction algorithm.

[0081] A report-generating agent is used to generate a log analysis report based on the attack path graph.

[0082] The alarm monitoring agent is responsible for the initial data collection and preliminary processing of the security log analysis process. It maintains real-time monitoring of alarm events from various security-related systems. Upon receiving raw alarm events from systems such as EDR (Endpoint Detection Response), HIDS (Host Intrusion Detection System), and WAF (Web Application Firewall), it quickly responds and transforms these diverse raw alarm events into a unified structured alarm message object. The judgment expert agent is the core judgment component in the entire analysis process. After receiving the structured alarm message object from the alarm monitoring agent, it first extracts the raw alarm text and alarm classification tags. Based on the alarm classification tags, it retrieves relevant supplementary information from a private knowledge base and merges this supplementary information with the raw alarm text to form enhanced alarm text. Through a pre-set large language model, it performs chain-like reasoning on the enhanced alarm text, simulating the analytical thinking process of human experts, and combines this with pre-set multi-dimensional factors (such as historical attack patterns and system vulnerability information) to ultimately generate a comprehensive and accurate judgment conclusion. The investigation task generation agent, based on the assessment conclusions generated by the expert agent, is responsible for transforming abstract assessment suggestions into concrete, executable investigation tasks. It extracts the disposal suggestion field and attack technology tags from the assessment conclusions, and generates basic tasks by matching these tags against a predefined task template library. These basic tasks are standardized investigation steps targeting common attack techniques. Simultaneously, it generates additional tasks by combining the disposal suggestion field and asset sensitivity weights to meet personalized investigation needs in different scenarios. Considering the rational utilization of system resources, the priority of basic and additional tasks is adjusted according to the real-time probe load, ultimately generating an investigation task chain according to priority to ensure the orderly and efficient execution of investigation tasks. The data investigation agent is the executor of the actual investigation tasks. It receives the investigation task chain from the investigation task generation agent and automatically calls the corresponding data probes (such as system process probes) to execute the tasks according to the task requirements. After obtaining the responses from the data probes, it parses the responses according to the probe type and marks the risk level to generate structured investigation results. These investigation results are organized into a queue of raw investigation objects, providing basic data for subsequent collaborative coordination and graph modeling. The collaborative coordinating agent plays a coordinating and optimizing role throughout the analysis process. It further processes the initial queue of survey objects generated by the data survey agent, integrating related survey objects through object aggregation and dependency mining to generate a more logical and interconnected queue. Simultaneously, it utilizes a directed acyclic graph (DAG) to schedule task dependencies, constructing a chain of operational dependencies and clarifying the execution order and dependencies between tasks. Furthermore, it can dynamically manage the survey object queue, automatically generating extended survey tasks when new suspicious objects (such as Java processes or laterally moved hosts) are discovered. The graph modeling agent is responsible for visualizing and deeply analyzing the information acquired during the survey process.It traverses the queue of survey targets generated by the coordinating agent, filtering out target objects with risk levels exceeding a first preset threshold and containing propagation behavior characteristics. Based on the operational dependency chain, it uses a hierarchical graph construction algorithm to present these target objects and their relationships in the form of a graph, generating an attack path graph. This graph can intuitively display the attacker's intrusion path, attack methods, and the propagation process of the attack in the system, providing security personnel with comprehensive attack situation awareness. The report generation agent is the final output of the entire security log analysis process. Based on the attack path graph generated by the graph modeling agent, it summarizes the entire investigation results and generates a structured report. The report content supports multiple output formats, such as Markdown reports, JSON / HTML API returns, and PDF archives, facilitating use and sharing in different scenarios.

[0083] Optionally, the survey task generating agent is further used for:

[0084] The built-in attack pattern feature library is called to match the attack type corresponding to the attack technology tag. The target template in the predefined task template library is mapped according to the attack type. The execution target is determined according to the target template. The time range is determined according to the attack occurrence time window and the operation pattern of the target component. The task priority is determined according to the potential harm of the attack and the historical occurrence rate. The basic task is constructed according to the execution target, the time range and the task priority.

[0085] The basic asset sensitivity weight of the target asset involved in the judgment conclusion is calculated based on the asset value, business impact coefficient and data sensitivity level. The instruction type of the disposal suggestion field is converted into a weight enhancement coefficient. The asset sensitivity weight is calculated based on the weight enhancement coefficient and the basic asset sensitivity weight. If the asset sensitivity weight exceeds the second preset threshold, an additional task is generated. The additional task includes configuration file review, permission review and related component tracing.

[0086] The task priorities of the basic task and the additional task are recalculated based on task urgency, asset sensitivity weight, and probe real-time load.

[0087] The investigation task generation agent uses a built-in attack pattern feature library to intelligently match attack technology tags in the analysis conclusions. When a specific attack type (such as SQL injection) is identified, the system automatically calls the corresponding rules in the predefined task template library to generate a basic task sequence. Specifically, it sets clear objectives based on the core characteristics of the attack pattern (e.g., the objective of checking database access logs is to find abnormal query statements); it dynamically sets the task execution time range by combining the attack occurrence time window and the normal operating patterns of the target component (e.g., peak database access periods); and it comprehensively calculates task priorities based on the potential harm of the attack (e.g., data leakage risk) and historical occurrence rate (e.g., high-frequency attack types). For example, an SQL injection attack triggers a database log inspection task, targeting abnormal queries, with the time range limited to one hour before and after the attack, and the priority set to high. The investigation task generation agent evaluates asset value (data value, business impact coefficient, sensitivity level) from multiple dimensions and calculates the sensitivity weight of the basic assets. Specifically, the instruction type of the disposal suggestion field (such as "deep analysis") is quantified into a numerical coefficient (0.1-1.0) to dynamically improve asset sensitivity assessment. When the asset sensitivity weight exceeds the threshold, a deep detection task is automatically generated. For example, configuration file review: checking the integrity of key configuration files (such as database parameter settings); permission review: auditing the history of user access permission changes; related component tracing: tracing the associated risks of dependent libraries or service chains. For example, the core database server (sensitivity weight 0.95) triggers database configuration review and detailed permission investigation tasks. The investigation task generation agent integrates three types of key parameters in real time, dynamically adjusting task priority and task urgency: judging the urgency level based on attack technology tags (such as setting 0-day vulnerability exploitation to the highest urgency). Asset sensitivity weight: inherited from the asset importance assessment results (such as core system weight 0.9). Probe real-time load: monitoring the resource utilization of data probes (such as reducing the weight of non-critical tasks when CPU > 80%). Dynamic decision-making logic: When the overall system load exceeds the limit, suspend low-priority tasks (such as log backups with a weight < 0.4) and prioritize the execution of tasks related to highly sensitive assets (such as database audits with a weight > 0.7).

[0088] Optionally, the survey task generating agent is further used for:

[0089] Collect multi-dimensional context information when an alarm occurs, and convert the multi-dimensional context information into a context object. The multi-dimensional context information includes network environment information, system configuration information, user behavior information, and historical alarm information.

[0090] Perform association analysis on the context objects to determine the relationships between information in different dimensions and form association analysis results;

[0091] Context association tasks are generated based on the association analysis results. These context association tasks include network traffic analysis tasks and system vulnerability inspection tasks generated based on the network environment information and the system configuration information, as well as user abnormal operation behavior investigation tasks generated based on the user behavior information.

[0092] The priority of the context association task is determined based on the urgency of the association analysis results;

[0093] The context-associated task is added to the task set consisting of the basic task and the additional task to form an initial task set;

[0094] The investigation task chain is generated by sorting the tasks in the task set according to their priority.

[0095] When an alert occurs, the investigation task generation agent comprehensively collects four types of core contextual information: network environment information, system configuration information, user behavior information, and historical alert information. Network environment information: Real-time capture of network topology, traffic fluctuation characteristics, and abnormal connection patterns to construct a spatial view of the current attack surface. System configuration information: Precisely extracts the operating system version, application patch status, and container image hash value of affected servers to locate potential vulnerabilities. User behavior information: Tracks user login session trajectories, permission change history, and operation frequency time-series data to identify abnormal behavior characteristics. Historical alert information: Retrieves root cause analysis conclusions and handling records of similar alerts, providing historical handling experience for reference. All dimensional data is encapsulated into standardized context objects, preserving original data relationships and timestamp attributes to ensure the integrity of subsequent analysis. The investigation task generation agent performs deep data fusion through a correlation analysis engine. Implicit relationship mining: Cross-analyzes the temporal overlap between network traffic fluctuations and abnormal user operations (e.g., high-frequency access during non-working hours); correlates system configuration vulnerabilities with attack method patterns in historical alerts (e.g., recurrence of the same vulnerability exploitation characteristics). Threat Scenario Construction: When an abnormal network access (traffic surge of 300%) by a user account is detected during a specific time period (e.g., 2 AM), and an unpatched vulnerability (CVE-2024-1234) exists on the associated server, the system automatically marks it as a "potential internal penetration path." Based on the correlation analysis results, three types of specialized tasks are generated: network traffic analysis tasks, system vulnerability inspection tasks, and user anomaly operation investigation tasks. The goal of the network traffic analysis task is to deeply analyze the source and propagation path of abnormal traffic. The triggering condition is a sudden change in network topology + abnormal traffic fluctuations, such as tracing the inbound / outbound connection chain of a specific IP. The goal of the system vulnerability inspection task is to verify the exploitability of unpatched vulnerabilities. The triggering condition is system version vulnerability matching + historical attack records, such as scanning the Apache service for the Log4j2 vulnerability. The goal of the user anomaly operation investigation task is to audit the behavior trajectory of high-risk users. The triggering condition is operations during unusual time periods + abnormal permission changes, such as checking the user's sudo command execution records. Each task carries associated context markers (such as vulnerability CVE number, user ID) to ensure execution accuracy. The investigation task generation agent dynamically sets priorities based on the risk level of the correlation analysis results: in critical scenarios (such as signs of zero-day vulnerability exploitation), it is immediately inserted at the head of the task chain with a latency tolerance of <1 second; in high-risk scenarios (such as abnormal access to the core database), the priority is raised to the highest level, and resources are scheduled in parallel; in medium-to-low-risk scenarios (such as routine port scanning), tasks are executed in the order of task dependencies. Context-related tasks are merged with basic and supplementary tasks, preserving the logical dependencies between tasks (such as vulnerability scanning followed by permission review), and generating an executable sequence with priority markers.

[0096] Optionally, the survey task generating agent is further used for:

[0097] Monitor vulnerability feature data pushed by external threat intelligence sources, calculate the correlation confidence between the attack technology tag and the vulnerability feature in the vulnerability feature data, and when the correlation confidence exceeds a third preset threshold, execute vulnerability detection tasks and exploit trace tracing tasks.

[0098] When a vulnerability detection task confirms the existence of a vulnerability, the attack tracing progress completion rate is increased by a first increment value. When an attack entry point is discovered using a trace tracing task, the attack tracing progress completion rate is increased by a second increment value.

[0099] The attack tracing progress completion rate is monitored in real time. When the attack tracing progress completion rate is greater than the fourth preset threshold, the attack source tracking task and impact assessment task are scheduled. When the attack tracing progress completion rate is less than the fifth preset threshold, the full log backtracking task and system configuration review task are inserted.

[0100] The investigation task generates an intelligent agent that monitors external threat intelligence sources (such as CVE databases and security vendor announcements) in real time and performs intelligent correlation analysis on the pushed vulnerability feature data. It quantifies the correlation confidence by comparing the matching degree between attack technique tags and vulnerability features (such as code signature similarity and attack pattern overlap). When the confidence exceeds a preset threshold, it indicates that the current alert is highly likely to involve a new type of threat, immediately triggering an emergency response. It automatically executes vulnerability detection tasks (scanning the system for unpatched vulnerabilities) and trace-based attribution tasks (analyzing attack traces such as process trees and registry modifications). For example, if the Log4j2 vulnerability feature matching confidence reaches 92%, it immediately scans all Java services and traces malicious log injection. The system establishes the attack attribution progress completion rate (PR) as a core decision indicator. When the vulnerability detection task confirms the existence of a vulnerability, the PR increases by a first increment (e.g., +15%), reflecting the vulnerability risk being realized; when trace-based attribution locates the attack entry point (e.g., Webshell path), the PR increases by a second increment (e.g., +20%), marking a key breakthrough. The PR value continuously maps the overall investigation progress, providing data support for task chain optimization. High-progress acceleration strategy (PR > fourth preset threshold): Schedule attack source tracing tasks to trace back to the C2 server and attacker infrastructure; initiate impact assessment tasks to analyze the scope of data breaches and the extent of system damage; when PR > 80%, focus on finishing work to avoid resource dispersion. Low-progress enhancement strategy (PR < fifth preset threshold): Insert a full log backtesting task to search for hidden clues in all related logs within 90 days; execute system configuration review tasks to comprehensively verify file hashes, permission settings, and service dependencies; when PR < 30%, expand the scope of the investigation to overcome analysis bottlenecks.

[0101] Optionally, the graph modeling agent is also used for:

[0102] The attack event is divided into multiple phases, including the reconnaissance phase, penetration phase, lateral movement phase, data collection phase, and data leakage phase.

[0103] The target node of the target stage is determined by the breadth-first search algorithm. The hierarchical graph of the target stage is constructed based on the target node and the associated node. The behavioral links between different stages are constructed through the association between nodes. The target stage is any one of the multiple stages, and the target node is any one of the nodes of the target stage.

[0104] An initial attack path graph is constructed based on the behavioral links and the hierarchical graph. The transfer frequency between nodes is statistically analyzed based on historical attack data. The transfer probability is generated by combining the transfer frequency with real-time threat intelligence. The transfer probability is then used to assign probability values ​​to each edge in the initial attack path graph to generate the attack path graph.

[0105] The graph modeling agent divides attack behavior into five logical phases, forming a hierarchical analysis framework: Reconnaissance phase, where attackers probe the target system for weaknesses; Penetration phase, where attackers exploit vulnerabilities to breach defenses; Lateral movement phase, where attackers spread and control the attack within the internal network; Data collection phase, where attackers steal sensitive information; and Data leakage phase, where attackers leak stolen data. This phased layering decouples the complex attack chain into independently analyzable modules, significantly improving tracing efficiency. Within any attack phase, the graph modeling agent executes the BFS algorithm starting from the initial alert node: Target node association expansion: In the reconnaissance phase, it expands from scanned events to probed hosts, open ports, service versions, and other asset nodes; in the penetration phase, it expands from vulnerable nodes to exploited processes, file write behaviors, and other operational nodes; Cross-phase behavior link construction: It analyzes node correlations to establish inter-phase connections (e.g., vulnerable nodes discovered in the reconnaissance phase → attack behaviors in the penetration phase). After constructing an initial graph based on behavioral links, the agent performs probabilistic enhancements: statistical analysis of transition frequencies: extracting transition patterns between nodes from historical attack data (e.g., penetration → lateral movement probability 82%); real-time threat intelligence fusion: dynamically adjusting the probability baseline by combining new vulnerability intelligence (e.g., 0-day vulnerabilities increase probability by 15%); and a probability weighting mechanism: assigning a transition probability value to each edge (e.g., Web vulnerability exploitation → database attack probability 0.85%). The transition probability value represents the likelihood of an attacker transitioning from one node to another, i.e., the transition probability on the attack path. By analyzing historical attack data and security intelligence, statistically analyzing the transition probability patterns of different types of attack behaviors, and combining this with the specific characteristics of the current attack event, using probabilistic graphical model algorithms such as Bayesian networks, the transition probabilities in the attack path graph are dynamically calculated and updated.

[0106] Optionally, the graph modeling agent is also used for:

[0107] The attack complexity coefficient is determined based on the technical difficulty required for the attack behavior in the aforementioned behavioral chain; the attack success rate coefficient is determined based on the ratio of the number of successful attacks in the past to the total number of attacks; and the attack destructiveness coefficient is determined based on the amount of data loss and the system downtime.

[0108] The basic weights of the edges are determined based on the attack complexity coefficient, the attack success rate coefficient, and the attack destructive coefficient.

[0109] The attack frequency factor is determined based on the number of attack behaviors per unit time. The attack intent is determined based on the target and attack method of the attack behavior and is mapped to the attack intent factor. The attack asset factor is determined based on the importance of the asset targeted by the attack behavior. The weights of the edges are obtained by weighted summation of the base weights, the attack frequency factor, the attack intent factor, and the attack asset factor. The initial attack path graph is constructed based on the weights.

[0110] The graph modeling agent quantifies the model using a three-layer core feature quantification model to calculate the basic weights of edges. The attack complexity coefficient is dynamically assigned based on the technical difficulty required for the attack: for high-tech attacks such as zero-day exploits, the coefficient approaches 1.0; for conventional attacks such as known vulnerability exploits, the coefficient ranges from [0.3, 0.6], for example, bypassing ransomware encryption algorithms. The attack success rate coefficient is calculated based on historical attack data statistics: success rate = number of successful attacks / total number of attacks × 100%. For example, a high-level spear-phishing attack has a 92% success rate, resulting in a coefficient of 0.92. The attack destructiveness coefficient is quantified by combining potential losses: data loss (e.g., number of database records) and system downtime (e.g., number of hours of business interruption). For core data theft events, the coefficient is 0.98. Basic weight synthesis: the three coefficients are weighted and fused to generate a basic weight (e.g., complexity 0.2 + success rate 0.85 + destructiveness 0.9 → basic weight 0.82), representing the inherent threat intensity of the attack relationship. The graph modeling agent introduces three types of dynamic factors to correct the base weights. The attack frequency factor is used to count the frequency of an attack within a unit of time. For example, a high-frequency attack (>50 times per day) has a value of 1.0, while a low-frequency attack (<5 times per month) has a value of 0.3. The attack intent factor is used to analyze the threat level mapping between attack targets and methods. For example, data theft has a value of 0.9, system damage has a value of 0.7, and scanning / probing has a value of 0.3. The attack asset factor is used to inherit the output of the asset importance assessment model. For example, the attack asset factor for a core database server is 0.95, and the attack asset factor for an office terminal is 0.2. By weighted summation and fusion of the base weights and the three factors (e.g., weight = 0.4 × base weight + 0.2 × frequency factor + 0.2 × intent factor + 0.2 × asset factor), an accurate edge threat value is generated. The final weight depth affects the graph generation strategy: high-weight edges are strengthened and focused (weight > 0.75), key attack paths are displayed in bold red, and three layers of related nodes are automatically expanded (e.g., vulnerability → process → external IP); low-weight edges are weakened (weight < 0.35), secondary paths are displayed in gray, and non-critical node subtrees are collapsed; the graph is dynamically optimized in a closed loop, new evidence input triggers real-time weight updates, and weight changes drive local graph reconstruction.

[0111] Optionally, the collaborative coordinating agent is further used for:

[0112] In response to receiving a new alarm event, the target parameters of the new alarm event are obtained, including alarm threat value, asset importance factor and attack behavior variability;

[0113] The event priority index is obtained by weighting the target parameters, and it is determined whether the event priority index exceeds a sixth preset threshold.

[0114] When the event priority index exceeds the sixth preset threshold, locate the associated subgraph, which contains nodes and edges related to the new alarm event;

[0115] The associated subgraph is reconstructed based on the new alarm event, and the weights of the edges in the reconstructed associated subgraph are recalculated.

[0116] Upon receiving a new alert event, the collaborative intelligent agent extracts three core target parameters in real time: alert threat value, asset importance factor, and attack behavior variability. The alert threat value quantifies the severity of the event (e.g., a threat value of 0.92 for malicious access to a core database), and is dynamically assigned a value based on the attack's impact range (single point of attack → 0.6, lateral propagation → 0.9). The asset importance factor inherits data from the asset assessment model (core business server → 0.95, test terminal → 0.2). Attack behavior variability detects characteristics of new attack methods (e.g., unknown vulnerability exploitation patterns → variability 0.88). An event priority index is synthesized using a weighted algorithm: Priority Index = 0.5 × Alert Threat Value + 0.3 × Asset Importance Factor + 0.2 × Attack Behavior Variation. Threshold determination logic: If the priority index > 0.85 (sixth preset threshold), it is determined to be a highest priority event, triggering a real-time response protocol (average latency < 50ms). Based on the alert parameters, the associated scope is automatically defined: asset nodes (intruded servers), behavior nodes (malicious file writing, abnormal processes), and relationship edges (file-process call chains). Dynamic reconstruction technology is used for node updates, edge relationship correction, and topology optimization. Node updates refresh vulnerability status and process tree relationships; edge relationship correction disconnects invalid connections (such as attack chains for patched vulnerabilities); and topology optimization adds new attack paths (such as adding lateral movement edges in mutation attacks). After subgraph reconstruction, all related edges (such as file writing → process creation) trigger weight recalculation. Weight calculation factors include: attack complexity (difficulty of exploiting new vulnerabilities), asset importance (value of the current intrusion target), and real-time behavioral risk (such as the activity level of encryption behavior). Graph enhancement effects: high-weight edges (>0.8) are automatically highlighted in red and alerts are pushed; low-weight edges (<0.3) are grayed out and folded to reduce interference.

[0117] To achieve efficient communication and information sharing among various intelligent agents, this application employs a communication protocol combining message queues and RESTful APIs. Message queues are used for asynchronous communication, ensuring that agents can reliably and in real-time transmit various messages such as alarm information, analysis results, and investigation tasks. For example, after capturing an alarm message, the alarm monitoring agent sends a structured alarm message object to the analysis expert agent via a Kafka message queue. The RESTful API, on the other hand, is used for synchronous communication, primarily applicable to scenarios where agents need to immediately obtain specific information or perform instant interactions. For instance, when the analysis expert agent needs to invoke a security knowledge graph or specific services provided by other agents, it uses the RESTful API to make requests and responses. This combination of communication protocols ensures both the real-time and reliable nature of message transmission while meeting the communication needs of different scenarios, thus improving the overall communication efficiency of the system.

[0118] Regarding task allocation, this application employs a dynamic task allocation algorithm based on priority and load balancing. After the expert agent generates a chain of investigation tasks, the tasks are allocated to the task-generating agent based on factors such as task priority, estimated execution time, and resource requirements. The task-generating agent further allocates tasks to suitable data investigation agents based on the current load of each data investigation agent, combined with the characteristics and relevance of the tasks. Simultaneously, the system monitors the load of each agent in real time and dynamically adjusts the task allocation strategy to ensure maximum resource utilization of the entire system and avoid situations where some agents are overloaded while others are idle.

[0119] When analyzing and handling complex security incidents, the various agents follow a collaborative decision-making process. First, the alarm monitoring agent, upon capturing an alarm, makes a preliminary judgment on its type and severity and transmits this information to the analysis expert agent. The analysis expert agent, based on its LLM model and security knowledge graph, makes a preliminary assessment of the alarm's authenticity and generates preliminary analysis results and an investigation task chain. During task execution, the data investigation agent provides real-time feedback of its findings to the coordination agent. Based on these results and analysis conclusions, the coordination agent dynamically adjusts the priority and execution order of the investigation task chain and notifies the graph modeling module to update the attack path graph. The graph modeling module, based on the latest graph information, provides the analysis expert agent with more comprehensive and accurate attribution relationships and attack path information, assisting in further optimizing the analysis results and subsequent investigation tasks. This entire collaborative decision-making process is a closed-loop, dynamically iterative process. Through close collaboration and information sharing among the agents, efficient and accurate analysis and handling of complex security incidents are achieved.

[0120] This embodiment also discloses a security log analysis method based on an AI large model. Figure 2 This is a schematic diagram of a security log analysis method based on an AI large model disclosed in an embodiment of this application, applied to the system described in the above embodiment, such as... Figure 2 As shown, the method includes:

[0121] S201. In response to receiving an original alarm event, the original alarm event is converted into an alarm message object;

[0122] S202. Extract the original alarm text and alarm classification tag from the alarm message object, retrieve additional related information from the private domain knowledge base according to the alarm classification tag, merge the additional related information with the original alarm text to generate an enhanced alarm text, perform chain reasoning on the enhanced alarm text through a preset large language model, and generate a judgment conclusion by combining preset multi-dimensional factors.

[0123] S203. Extract the disposal suggestion field and attack technology tag from the judgment conclusion, generate a basic task by matching the attack technology tag with a predefined task template library, generate an additional task by matching the disposal suggestion field and asset sensitivity weight, adjust the priority of the basic task and the additional task according to the real-time probe load, and generate an investigation task chain according to the priority.

[0124] S204. Call the data probe to execute the task in the investigation task chain and obtain the response. Parse the response according to the probe type and mark the risk level to generate the investigation results. Generate the original investigation object queue according to the investigation results.

[0125] S205. Perform object aggregation and dependency mining on the original survey object queue to generate a new survey object queue, and schedule the task dependency order and construct the operation dependency chain through a directed acyclic graph.

[0126] S206. Traverse the queue of the investigated objects, determine the target objects whose risk level exceeds the first preset threshold and contain propagation behavior characteristics, and generate an attack path graph based on the operation dependency relationship chain using a hierarchical graph construction algorithm.

[0127] S207. Generate a log analysis report based on the attack path map.

[0128] Optionally, the steps of generating a basic task based on the attack technique tag matching a predefined task template library, generating an additional task based on the handling suggestion field and asset sensitivity weight, and adjusting the priority of the basic task and the additional task based on the real-time probe load include:

[0129] The built-in attack pattern feature library is called to match the attack type corresponding to the attack technology tag. The target template in the predefined task template library is mapped according to the attack type. The execution target is determined according to the target template. The time range is determined according to the attack occurrence time window and the operation pattern of the target component. The task priority is determined according to the potential harm of the attack and the historical occurrence rate. The basic task is constructed according to the execution target, the time range and the task priority.

[0130] The basic asset sensitivity weight of the target asset involved in the judgment conclusion is calculated based on the asset value, business impact coefficient and data sensitivity level. The instruction type of the disposal suggestion field is converted into a weight enhancement coefficient. The asset sensitivity weight is calculated based on the weight enhancement coefficient and the basic asset sensitivity weight. If the asset sensitivity weight exceeds the second preset threshold, an additional task is generated. The additional task includes configuration file review, permission review and related component tracing.

[0131] The task priorities of the basic task and the additional task are recalculated based on task urgency, asset sensitivity weight, and probe real-time load.

[0132] Optionally, generating the survey task chain according to the priority includes:

[0133] Collect multi-dimensional context information when an alarm occurs, and convert the multi-dimensional context information into a context object. The multi-dimensional context information includes network environment information, system configuration information, user behavior information, and historical alarm information.

[0134] Perform association analysis on the context objects to determine the relationships between information in different dimensions and form association analysis results;

[0135] Context association tasks are generated based on the association analysis results. These context association tasks include network traffic analysis tasks and system vulnerability inspection tasks generated based on the network environment information and the system configuration information, as well as user abnormal operation behavior investigation tasks generated based on the user behavior information.

[0136] The priority of the context association task is determined based on the urgency of the association analysis results;

[0137] The context-associated task is added to the task set consisting of the basic task and the additional task to form an initial task set;

[0138] The investigation task chain is generated by sorting the tasks in the task set according to their priority.

[0139] Optionally, generating the survey task chain according to the priority includes:

[0140] Monitor vulnerability feature data pushed by external threat intelligence sources, calculate the correlation confidence between the attack technology tag and the vulnerability feature in the vulnerability feature data, and when the correlation confidence exceeds a third preset threshold, execute vulnerability detection tasks and exploit trace tracing tasks.

[0141] When a vulnerability detection task confirms the existence of a vulnerability, the attack tracing progress completion rate is increased by a first increment value. When an attack entry point is discovered using a trace tracing task, the attack tracing progress completion rate is increased by a second increment value.

[0142] The attack tracing progress completion rate is monitored in real time. When the attack tracing progress completion rate is greater than the fourth preset threshold, the attack source tracking task and impact assessment task are scheduled. When the attack tracing progress completion rate is less than the fifth preset threshold, the full log backtracking task and system configuration review task are inserted.

[0143] Optionally, generating the attack path graph using the hierarchical graph construction algorithm includes:

[0144] The attack event is divided into multiple phases, including the reconnaissance phase, penetration phase, lateral movement phase, data collection phase, and data leakage phase.

[0145] The target node of the target stage is determined by the breadth-first search algorithm. The hierarchical graph of the target stage is constructed based on the target node and the associated node. The behavioral links between different stages are constructed through the association between nodes. The target stage is any one of the multiple stages, and the target node is any one of the nodes of the target stage.

[0146] An initial attack path graph is constructed based on the behavioral links and the hierarchical graph. The transfer frequency between nodes is statistically analyzed based on historical attack data. The transfer probability is generated by combining the transfer frequency with real-time threat intelligence. The transfer probability is then used to assign probability values ​​to each edge in the initial attack path graph to generate the attack path graph.

[0147] Optionally, constructing the initial attack path graph based on the behavioral links and the hierarchical graph includes:

[0148] The attack complexity coefficient is determined based on the technical difficulty required for the attack behavior in the aforementioned behavioral chain; the attack success rate coefficient is determined based on the ratio of the number of successful attacks in the past to the total number of attacks; and the attack destructiveness coefficient is determined based on the amount of data loss and the system downtime.

[0149] The basic weights of the edges are determined based on the attack complexity coefficient, the attack success rate coefficient, and the attack destructive coefficient.

[0150] The attack frequency factor is determined based on the number of attack behaviors per unit time. The attack intent is determined based on the target and attack method of the attack behavior and is mapped to the attack intent factor. The attack asset factor is determined based on the importance of the asset targeted by the attack behavior. The weights of the edges are obtained by weighted summation of the base weights, the attack frequency factor, the attack intent factor, and the attack asset factor. The initial attack path graph is constructed based on the weights.

[0151] Optionally, the method further includes:

[0152] In response to receiving a new alarm event, the target parameters of the new alarm event are obtained, including alarm threat value, asset importance factor and attack behavior variability;

[0153] The event priority index is obtained by weighting the target parameters, and it is determined whether the event priority index exceeds a sixth preset threshold.

[0154] When the event priority index exceeds the sixth preset threshold, locate the associated subgraph, which contains nodes and edges related to the new alarm event;

[0155] The associated subgraph is reconstructed based on the new alarm event, and the weights of the edges in the reconstructed associated subgraph are recalculated.

[0156] It should be noted that the methods and system embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the system embodiments, which will not be repeated here.

[0157] This embodiment also discloses an electronic device, as shown in the reference. Figure 3 The electronic device may include: at least one processor 301, at least one communication bus 302, user interface 303, network interface 304, and at least one memory 305.

[0158] The communication bus 302 is used to enable communication between these components.

[0159] The user interface 303 may include a display screen and a camera. Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0160] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0161] The processor 301 may include one or more processing cores. The processor 301 connects to various parts of the server using various interfaces and lines, and performs various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and by calling data stored in the memory 305.

[0162] exist Figure 3 In the electronic device shown, the user interface 303 is mainly used to provide an input interface for the user and to obtain the user input data; while the processor 301 can be used to call an application stored in the memory 305 that is a security log analysis method based on an AI large model. When executed by one or more processors 301, the electronic device executes one or more methods as described in the above embodiments.

[0163] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of other embodiments of this disclosure upon considering the disclosure in this specification. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described in this disclosure.

Claims

1. A security log analysis system based on an AI large model, characterized in that, The system includes: An alarm monitoring agent is used to respond to a received original alarm event and convert the original alarm event into an alarm message object; An expert intelligent agent is used to extract the original alarm text and alarm classification tags from the alarm message object, retrieve additional related information from the private domain knowledge base based on the alarm classification tags, fuse the additional related information with the original alarm text to generate enhanced alarm text, perform chain reasoning on the enhanced alarm text through a preset large language model, and generate an analysis conclusion by combining preset multi-dimensional factors. An investigation task generation agent is used to extract the disposal suggestion field and attack technology tag from the judgment conclusion, generate a basic task by matching the attack technology tag with a predefined task template library, generate an additional task by the disposal suggestion field and asset sensitivity weight, adjust the priority of the basic task and the additional task according to the real-time probe load, and generate an investigation task chain according to the priority. A data survey agent is used to call data probes to execute tasks in the survey task chain and obtain responses, parse the responses according to probe type and mark risk levels to generate survey results, and generate an original survey object queue based on the survey results. A collaborative and coordinating intelligent agent is used to perform object aggregation and dependency mining on the original survey object queue to generate a new survey object queue, and to schedule the task dependency order and construct the operation dependency chain through a directed acyclic graph. A graph modeling agent is used to traverse the survey object queue, determine target objects whose risk level exceeds a first preset threshold and contain propagation behavior characteristics, and generate an attack path graph based on the operation dependency relationship chain through a hierarchical graph construction algorithm. A report-generating agent is used to generate a log analysis report based on the attack path graph.

2. The security log analysis system based on AI large model according to claim 1, characterized in that, The intelligent agent generated by the survey task is also used for: The built-in attack pattern feature library is called to match the attack type corresponding to the attack technology tag. The target template in the predefined task template library is mapped according to the attack type. The execution target is determined according to the target template. The time range is determined according to the attack occurrence time window and the operation pattern of the target component. The task priority is determined according to the potential harm of the attack and the historical occurrence rate. The basic task is constructed according to the execution target, the time range and the task priority. The basic asset sensitivity weight of the target asset involved in the judgment conclusion is calculated based on the asset value, business impact coefficient and data sensitivity level. The instruction type of the disposal suggestion field is converted into a weight enhancement coefficient. The asset sensitivity weight is calculated based on the weight enhancement coefficient and the basic asset sensitivity weight. If the asset sensitivity weight exceeds the second preset threshold, the additional task is generated. The additional task includes configuration file review, permission review and related component tracing. The task priorities of the basic task and the additional task are recalculated based on task urgency, asset sensitivity weight, and probe real-time load.

3. The security log analysis system based on AI large model according to claim 2, characterized in that, The intelligent agent generated by the survey task is also used for: Collect multi-dimensional context information when an alarm occurs, and convert the multi-dimensional context information into a context object. The multi-dimensional context information includes network environment information, system configuration information, user behavior information, and historical alarm information. Perform association analysis on the context objects to determine the relationships between information in different dimensions and form association analysis results; Context association tasks are generated based on the association analysis results. These context association tasks include network traffic analysis tasks and system vulnerability inspection tasks generated based on the network environment information and the system configuration information, as well as user abnormal operation behavior investigation tasks generated based on the user behavior information. The priority of the context association task is determined based on the urgency of the association analysis results; The context-associated task is added to the task set consisting of the basic task and the additional task to form an initial task set; The investigation task chain is generated by sorting the tasks in the task set according to their priority.

4. The security log analysis system based on an AI large model according to claim 3, characterized in that, The intelligent agent generated by the survey task is also used for: Monitor vulnerability feature data pushed by external threat intelligence sources, calculate the correlation confidence between the attack technology tag and the vulnerability feature in the vulnerability feature data, and when the correlation confidence exceeds a third preset threshold, execute vulnerability detection tasks and exploit trace tracing tasks. When a vulnerability detection task confirms the existence of a vulnerability, the attack tracing progress completion rate is increased by a first increment value. When an attack entry point is discovered using a trace tracing task, the attack tracing progress completion rate is increased by a second increment value. The attack tracing progress completion rate is monitored in real time. When the attack tracing progress completion rate is greater than the fourth preset threshold, the attack source tracking task and impact assessment task are scheduled. When the attack tracing progress completion rate is less than the fifth preset threshold, the full log backtracking task and system configuration review task are inserted.

5. The security log analysis system based on an AI large model according to claim 1, characterized in that, The graph modeling agent is also used for: The attack event is divided into multiple phases, including the reconnaissance phase, penetration phase, lateral movement phase, data collection phase, and data leakage phase. The target node of the target stage is determined by the breadth-first search algorithm. The hierarchical graph of the target stage is constructed based on the target node and the associated node. The behavioral links between different stages are constructed through the association between nodes. The target stage is any one of the multiple stages, and the target node is any one of the nodes of the target stage. An initial attack path graph is constructed based on the behavioral links and the hierarchical graph. The transfer frequency between nodes is statistically analyzed based on historical attack data. The transfer probability is generated by combining the transfer frequency with real-time threat intelligence. The transfer probability is used to assign probability values ​​to each edge in the initial attack path graph to generate the attack path graph.

6. The security log analysis system based on an AI large model according to claim 5, characterized in that, The graph modeling agent is also used for: The attack complexity coefficient is determined based on the technical difficulty required for the attack behavior in the aforementioned behavioral chain; the attack success rate coefficient is determined based on the ratio of the number of successful attacks in the past to the total number of attacks; and the attack destructiveness coefficient is determined based on the amount of data loss and the system downtime. The basic weights of the edges are determined based on the attack complexity coefficient, the attack success rate coefficient, and the attack destructive coefficient. The attack frequency factor is determined based on the number of attack behaviors per unit time. The attack intent is determined based on the target and attack method of the attack behavior and is mapped to the attack intent factor. The attack asset factor is determined based on the importance of the asset targeted by the attack behavior. The weights of the edges are obtained by weighted summation of the base weights, the attack frequency factor, the attack intent factor, and the attack asset factor. The initial attack path graph is constructed based on the weights.

7. The security log analysis system based on an AI large model according to claim 6, characterized in that, The collaborative and coordinating intelligent agent is also used for: In response to receiving a new alarm event, the target parameters of the new alarm event are obtained, including alarm threat value, asset importance factor and attack behavior variability; The event priority index is obtained by weighting the target parameters, and it is determined whether the event priority index exceeds a sixth preset threshold. When the event priority index exceeds the sixth preset threshold, locate the associated subgraph, which contains nodes and edges related to the new alarm event; The associated subgraph is reconstructed based on the new alarm event, and the weights of the edges in the reconstructed associated subgraph are recalculated.

8. A security log analysis method based on an AI large model, characterized in that, Applied to the system as described in any one of claims 1-7, the method includes: In response to receiving an original alarm event, the original alarm event is converted into an alarm message object; Extract the original alarm text and alarm classification tags from the alarm message object, retrieve additional related information from the private domain knowledge base based on the alarm classification tags, fuse the additional related information with the original alarm text to generate enhanced alarm text, perform chain reasoning on the enhanced alarm text through a preset large language model, and generate a judgment conclusion by combining preset multi-dimensional factors. Extract the disposal suggestion field and attack technology tag from the judgment conclusion, generate basic tasks by matching the attack technology tag with a predefined task template library, generate additional tasks by the disposal suggestion field and asset sensitivity weight, adjust the priority of the basic tasks and the additional tasks according to the real-time probe load, and generate an investigation task chain according to the priority. Invoke the data probe to execute the tasks in the investigation task chain and obtain the response. Parse the response according to the probe type and mark the risk level to generate the investigation results. Generate the original investigation object queue based on the investigation results. The original survey object queue is aggregated and dependency mining is performed to generate a new survey object queue. The task dependency order is scheduled and an operation dependency chain is constructed through a directed acyclic graph. Traverse the queue of survey objects to identify target objects with a risk level exceeding the first preset threshold and containing propagation behavior characteristics. Based on the operation dependency relationship chain, generate an attack path graph through a hierarchical graph construction algorithm. A log analysis report is generated based on the attack path map.

9. An electronic device, characterized in that, The device includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions. The user interface and the network interface are both used to communicate with other devices. The processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in claim 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed, perform the method as described in claim 8.

Images