An alarm analysis method, apparatus and equipment

Abstract

This application discloses an alarm analysis method, apparatus, and device. The method includes: determining a target DAG matching the target alarm analysis scenario from a preset directed acyclic graph (DAG); the DAG includes multiple rule judgment nodes; the multiple rule judgment nodes include at least one natural language rule judgment node, each natural language rule judgment node being used to call a large language model to perform binary classification judgment on the input alarm data based on a preset prompt text; inputting the alarm data into the target DAG to generate a node hit trajectory of the alarm data; the node hit trajectory being used to record the rule judgment nodes triggered by the alarm data and the corresponding judgment results; and obtaining the alarm analysis result based on the node hit trajectory. This application can realize an automated, interpretable, and traceable alarm analysis process, improving the accuracy, interpretability, and ease of maintenance of alarm analysis.

Description

Technical Field

[0001] This application belongs to the field of network security, and in particular relates to an alarm analysis method, apparatus and equipment. Background Technology

[0002] With the rapid development of information technology, cybersecurity threats have become increasingly complex and diverse, and massive amounts of security alert information have become an important analytical object for cybersecurity operations.

[0003] While alarm analysis methods based on large language models, which have emerged in recent years, can, to some extent, parse potential attack intents within alarm texts using natural language processing, the diverse types of alarms and the complexity of their contextual information result in a lack of interpretability in the analysis results. This makes it difficult to trace the source of misjudgments and pinpoint the logical error, often requiring a complete re-tuning or retraining of the entire model. Therefore, current alarm analysis methods based on large language models have limitations in both accuracy and maintainability. Summary of the Invention

[0004] To address the aforementioned issues, this application provides an alarm analysis method, apparatus, and equipment that enables an automated, interpretable, and traceable alarm analysis process, thereby improving the accuracy, interpretability, and ease of maintenance of alarm analysis.

[0005] Firstly, this application provides an alarm analysis method, the method comprising:

[0006] Based on the scene feature information carried by the alarm data, the target alarm analysis scene corresponding to the alarm data is determined;

[0007] From a pre-defined directed acyclic graph (DAG), a target DAG matching the target alarm analysis scenario is determined. The DAG includes multiple rule-judgment nodes, which are connected by directed edges formed by pre-defined dependencies. Each rule-judgment node performs binary classification on the input alarm data and triggers the next rule-judgment node to be executed based on the judgment result. The multiple rule-judgment nodes include at least one natural language rule-judgment node, which is used to invoke a large language model based on a pre-defined prompt text to perform binary classification on the input alarm data.

[0008] The alarm data is input into the target DAG to generate the node hit trajectory of the alarm data; the node hit trajectory is used to record the rule judgment nodes triggered by the alarm data and the corresponding judgment results;

[0009] Based on the node hit trajectory, the alarm analysis results of the alarm data are obtained.

[0010] In this embodiment, the alarm analysis process is organized into a series of ordered and jumpable rule judgment nodes by using a DAG, thereby simulating the thinking logic of experts in various alarm analysis scenarios. At the same time, by recording the rule judgment nodes triggered by alarm data and the corresponding judgment results, a node hit trajectory recording the alarm analysis path is generated, which facilitates subsequent misjudgment and rule optimization, thereby improving the accuracy and interpretability of alarm analysis.

[0011] In one possible implementation, determining the target alarm analysis scenario corresponding to the alarm data based on the scenario feature information carried by the alarm data includes:

[0012] Extract at least one of the following pieces of information from the alarm data as the scene feature information: alarm type, protocol type, target port number, and feature string in the request path;

[0013] Based on the scene feature information, determine the attack type that needs to be identified for the alarm data;

[0014] Based on the alarm analysis scenarios associated with the attack type, the target alarm analysis scenario corresponding to the alarm data is determined.

[0015] In this embodiment, considering that different attack types (such as SQL injection, lateral movement detection, etc.) have different behavioral patterns and detection logics, a unified analysis process could easily lead to misjudgments or missed detections. Therefore, the alarm analysis scenario to which the alarm data belongs is located by extracting scenario feature information from the alarm data. Specifically, by using structured fields such as alarm type, protocol type, target port number, and feature strings in the request path as scenario criteria, an analysis strategy adapted to the alarm data can be determined from the analysis strategies corresponding to the DAGs preset for different alarm analysis scenarios, thereby improving the efficiency of alarm analysis.

[0016] In one possible implementation, the step of inputting the alarm data into the target DAG and generating the node hit trajectory of the alarm data includes:

[0017] Input the alarm data into the target DAG;

[0018] The starting rule judgment node in the target DAG is triggered to perform a binary classification judgment on the alarm data, and based on the judgment result, the next rule judgment node is triggered to perform a binary classification judgment on the alarm data, until no new rule judgment node can be triggered.

[0019] Based on the rule-based judgment nodes triggered by the alarm data and the corresponding judgment results, the node hit trajectory of the alarm data is generated.

[0020] In this embodiment, the execution mechanism of DAG is clarified. Through the dependency relationship between nodes and the transmission of binary classification judgment results, the alarm data is analyzed in a layer-by-layer manner. At the same time, the generated node hit trajectory fully records the judgment path, providing a data foundation for subsequent result interpretation, misjudgment tracing and rule optimization.

[0021] In one possible implementation, the plurality of rule-determining nodes further include at least one of the following:

[0022] The structured rule judgment node is configured with preset static matching rules, which are used to match and judge the structured fields of the alarm data to obtain a binary classification judgment result.

[0023] The lightweight model rule judgment node is equipped with a pre-trained machine learning classifier, which is used to classify the feature vectors of the alarm data to obtain a binary classification judgment result.

[0024] In this embodiment, by introducing structured rule judgment nodes and lightweight model rule judgment nodes to complement natural language rule judgment nodes, the DAG is integrated with multiple types of rule judgment nodes, improving the coverage of the analysis. Specifically, structured rule judgment nodes are suitable for detecting attacks with high confidence and fixed patterns, and have high execution efficiency; lightweight model rule judgment nodes are suitable for pattern recognition of medium complexity and have a certain generalization ability; and natural language rule judgment nodes are adept at handling semantically ambiguous and diverse novel attacks. The collaborative work of these three nodes ensures detection efficiency while improving the ability to identify unknown attacks.

[0025] In one possible implementation, the prompt text and the static matching rule are generated as follows:

[0026] Knowledge extraction is performed on the labeled historical alert samples and / or on the expert security knowledge information related to the historical alert samples to generate standardized semantic units containing conditional elements, behavioral tags, and intent descriptions; wherein, the conditional elements are used to describe the attack characteristics of the historical alert samples; the behavioral tags are used to identify the attack type of the historical alert samples; and the intent descriptions are used to describe the attack purpose of the historical alert samples.

[0027] Based on the standardized semantic units and preset rule templates, the static matching rules are generated;

[0028] The prompt text is generated based on the standardized semantic units and the preset prompt template.

[0029] In this application embodiment, a standardized and automated rule generation mechanism is provided. By semantically extracting and structurally expressing historical alarms and expert security knowledge, a standardized semantic unit that uniformly expresses attack characteristics, types and intentions is generated. Based on this, prompt text and static matching rules are automatically generated, which improves the efficiency, consistency and maintainability of rule generation and reduces the cost of manual writing.

[0030] In one possible implementation, obtaining the alarm analysis result based on the node hit trajectory includes:

[0031] The node hit trajectory is matched with a preset path semantic mapping table, which includes alarm analysis results corresponding to different node hit trajectories;

[0032] Based on the matching results, determine the alarm analysis results of the alarm data;

[0033] The alarm analysis results include at least one of attack intent category information and attack result status information; the attack intent category information is used to indicate the attack intent of the alarm data in the target alarm analysis scenario, including one of the following: unknown, non-attack, suspicious, and malicious; the attack result status information is used to indicate whether the attack behavior of the alarm data has achieved the expected goal, including one of the following: successful, failed, and unknown.

[0034] In this application embodiment, a node hit trajectory represents a specific analysis path. The path semantic mapping table is used to transform it into an understandable alarm analysis result, realizing the automatic conversion from the analysis process to the result output. At the same time, by supporting multi-dimensional label output of attack intent category information and attack result status information, richer security situation information is provided to meet the analysis needs in complex scenarios.

[0035] In one possible implementation, the method further includes:

[0036] The system receives the annotation information of the alarm data and determines whether the alarm analysis result is correct based on the annotation information; wherein, the annotation information includes attack intent category annotation information, attack result status annotation information, and misjudgment attribution information; the misjudgment attribution information is used to indicate the rule judgment node where a misjudgment occurred;

[0037] When the alarm analysis result is verified as a misjudgment, the target rule judgment node that caused the misjudgment is located in the node hit trajectory based on the misjudgment attribution information.

[0038] Based on a preset correction strategy, the target rule judgment node is corrected to obtain a candidate target DAG; the correction strategy includes at least one of the following: adjusting the prompt text, adjusting the static matching rule, replacing the machine learning classifier, adding or deleting rule judgment nodes, and modifying the connection relationship between rule judgment nodes;

[0039] The candidate DAG is verified using alarm data that has been confirmed as a false positive.

[0040] If the verification passes, the candidate target DAG is used to replace the target DAG;

[0041] If the verification fails, a new round of correction and verification process will be triggered.

[0042] In this application embodiment, a DAG optimization mechanism from misjudgment feedback to automatic correction is provided. The misjudgment node is located by misjudgment attribution information, and different types of misjudgments (such as ambiguous prompts) are flexibly dealt with based on preset correction strategies. At the same time, the verification mechanism of candidate DAGs ensures the safety of correction, prevents the introduction of new problems, helps to reduce system maintenance costs, and enables the system to have continuous optimization capabilities.

[0043] Secondly, this application provides an alarm analysis device, the device comprising:

[0044] The alarm analysis scenario determination module is used to determine the target alarm analysis scenario corresponding to the alarm data based on the scenario feature information carried by the alarm data.

[0045] A matching module is used to determine a target DAG that matches the target alarm analysis scenario from a preset directed acyclic graph (DAG). The DAG includes multiple rule-judgment nodes, which are connected by directed edges through preset dependencies. Each rule-judgment node performs binary classification on the input alarm data and triggers the next rule-judgment node to be executed based on the judgment result. The multiple rule-judgment nodes include at least one natural language rule-judgment node, which uses a large language model to perform binary classification on the input alarm data based on a preset prompt text.

[0046] The node hit trajectory generation module is used to input the alarm data into the target DAG and generate the node hit trajectory of the alarm data; the node hit trajectory is used to record the rule judgment node triggered by the alarm data and the corresponding judgment result;

[0047] The alarm analysis module is used to obtain the alarm analysis results of the alarm data based on the node hit trajectory.

[0048] Thirdly, embodiments of this application provide an apparatus including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform an alarm analysis method as described in any of the first aspects of this application.

[0049] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, enables a terminal device to perform the alarm analysis method as described in any of the claims provided in the first aspect of this application.

[0050] The technical effects brought about by the second to fourth aspects and any one of their implementation methods can be referred to the technical effects brought about by the corresponding implementation methods in the first aspect, and will not be repeated here.

[0051] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 A flowchart of an alarm analysis method provided in this application embodiment;

[0054] Figure 2 A schematic diagram of a DAG structure provided in an embodiment of this application;

[0055] Figure 3 A schematic diagram of an alarm analysis device provided in an embodiment of this application;

[0056] Figure 4 This is a schematic diagram of an alarm analysis device provided in an embodiment of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0058] The following explanations of some terms used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0059] (1) Directed Acyclic Graph (DAG): A graph structure consisting of nodes and directed edges, with no cyclic paths. In this application, a DAG represents an alarm analysis script customized for a specific alarm analysis scenario. By organizing nodes with different rule judgment execution logic into a DAG, the analytical thinking of security experts in "step-by-step investigation" can be simulated.

[0060] (2) Rule judgment node: The basic unit in DAG, used to perform binary classification judgment on alarm data, and jump to the next rule judgment node according to the judgment result (such as "yes / no", "hit / miss").

[0061] (3) Alarm data: refers to structured or semi-structured security event information generated by network security devices (such as firewalls, IDS, EDR, etc.), including fields such as alarm type, timestamp, source / destination IP, attack payload, etc.

[0062] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0063] The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the term encompasses the elements or objects listed following the term and their equivalents, without excluding other elements or objects. The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code capable of performing the functions associated with that element.

[0064] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0065] With the rapid development of information technology, cybersecurity threats have become increasingly complex and diverse, and massive amounts of security alert information have become an important analytical object for cybersecurity operations.

[0066] While alarm analysis methods based on large language models, which have emerged in recent years, can, to some extent, parse potential attack intents within alarm texts using natural language processing, the diverse types of alarms and the complexity of their contextual information result in a lack of interpretability in the analysis results. This makes it difficult to trace the source of misjudgments and pinpoint the logical error, often requiring a complete re-tuning or retraining of the entire model. Therefore, current alarm analysis methods based on large language models have limitations in both accuracy and maintainability.

[0067] In view of the above problems, this application provides an alarm analysis method, apparatus and device. This application organizes the alarm analysis process into a series of ordered and jumpable rule judgment nodes through DAG, thereby simulating the thinking logic of experts in various alarm analysis scenarios. At the same time, by recording the rule judgment nodes triggered by alarm data and the corresponding judgment results, a node hit trajectory recording the alarm analysis path is generated, which facilitates subsequent misjudgment and rule optimization, and improves the accuracy and interpretability of alarm analysis.

[0068] The specific embodiments of the present invention will now be described with reference to the accompanying drawings.

[0069] like Figure 1 The diagram shown is a flowchart of an alarm analysis method provided in an embodiment of this application. The method includes the following steps S101-S104.

[0070] Step S101: Based on the scene feature information carried by the alarm data, determine the target alarm analysis scene corresponding to the alarm data.

[0071] In some embodiments, this application preprocesses the received alarm data. Specifically, it performs operations such as protocol parsing, encoding / decoding, compression / reduction, garbled character removal, and structured transformation on the received raw alarm data to extract standardized fields, providing a unified input basis for subsequent DAG. Wherein:

[0072] Protocol parsing includes disassembling protocol headers such as TCP / IP, HTTP, and DNS, and extracting key fields;

[0073] Content restoration includes automatic recognition and decoding of Base64, URL encoding, etc., and also supports decompression of compression formats such as gzip and zlib;

[0074] Garbled text removal includes filtering out abnormal characters and invalid encodings to ensure the quality of subsequent parsing;

[0075] Structured transformation involves converting the raw data into a unified field format to facilitate subsequent rule-based node judgment.

[0076] For example, the HTTP request field in the original alarm data:

[0077] GET / login.php? id=1'+OR+'1'='1HTTP / 1.1

[0078] After preprocessing, it is converted to:

[0079] {"method":"GET","uri":" / login.php?id=1'+OR+'1'='1","protocol":"HTTP / 1.1"}

[0080] In this embodiment of the application, considering that different attack types (such as SQL injection, lateral movement detection, etc.) have different behavior patterns and detection logic, in order to implement differentiated alarm analysis strategies for different attack types, it is necessary to extract scene feature information from alarm data to determine the alarm analysis scene corresponding to the alarm data.

[0081] Optionally, step S101 above can be implemented using the following steps S101a-S101c:

[0082] Step S101a: Extract at least one of the following pieces of information from the alarm data as scene feature information: alarm type, protocol type, target port number, and feature string in the request path;

[0083] Step S101b: Based on scene feature information, determine the attack type that needs to be identified for the alarm data;

[0084] Step S101c: Based on the alarm analysis scenario associated with the attack type, determine the target alarm analysis scenario corresponding to the alarm data.

[0085] In this embodiment of the application, in order to determine the target alarm analysis scenario corresponding to the alarm data, a combination of scenario feature information corresponding to the alarm analysis scenario is preset, as well as the correspondence between attack type and alarm analysis scenario.

[0086] For example, the above correspondence is stored in the system knowledge base in the form of a mapping table, the structure of which is shown in Table 1 below:

[0087] Table 1 Alarm Analysis Scenario Mapping Table

[0088]

[0089] After extracting scenario feature information from the preprocessed alarm data, the system matches it against the aforementioned mapping table to determine the corresponding target alarm analysis scenario. For example, when an alarm meets the criteria of "protocol = HTTP, target port = 80, and URI contains union select", the system classifies it as an "SQL injection" attack and selects "Web application attack analysis scenario" as its target alarm analysis scenario.

[0090] Step S102: Determine the target DAG that matches the target alarm analysis scenario from the preset directed acyclic graph (DAG).

[0091] The aforementioned DAG includes multiple rule-judgment nodes, which form directed edges through preset dependency relationships. Each rule-judgment node is used to perform binary classification on the input alarm data and trigger the next rule-judgment node to be executed based on the judgment result.

[0092] In this embodiment, a directed acyclic graph (DAG) library is maintained, storing multiple DAGs designed by security experts based on their experience. Each DAG corresponds to an alarm analysis scenario and can output corresponding alarm analysis results for input alarm data. Each DAG consists of different rule-judgment nodes, and each rule-judgment node corresponds to a rule-judgment execution logic.

[0093] Therefore, after determining the target alarm analysis scenario corresponding to the alarm data, the alarm data can be input into the directed acyclic graph corresponding to the target alarm analysis scenario, and a series of rule judgment logics can be executed.

[0094] In this embodiment, the rule judgment node in the DAG includes at least one natural language rule judgment node. Each natural language rule judgment node is configured with a preset prompt text, which is used to call the large language model to perform binary classification judgment on the input alarm data based on the preset prompt text.

[0095] Specifically, the working mechanism of the natural language rule judgment node is to call the large language model API, input the alarm data and prompt text, and then the large language model analyzes the input content based on its semantic understanding capabilities and outputs the judgment result. For example, the prompt text may be: "Did this request attempt to bypass database authentication? Please answer yes or no.", or "The request message structure is complete, the content is clear, and it falls within the scope of normal business activities. It should not be considered an attack. Please answer yes or no."

[0096] Optionally, this application embodiment employs a token truncation determination mechanism, that is, after determining the binary classification result based on the token currently output by the large language model, text generation stops. Based on this, the determination result (hit / miss) of the large language model can be determined without waiting for the complete answer to be generated, which helps reduce computational overhead and improve alarm analysis efficiency.

[0097] In some embodiments, the rule-determining node in the DAG described above further includes at least one of the following:

[0098] The structured rule judgment node is configured with preset static matching rules, which are used to match and judge the structured fields of the alarm data to obtain a binary classification judgment result.

[0099] The lightweight model rule judgment node is equipped with a pre-trained machine learning classifier, which is used to classify the feature vectors of the alarm data to obtain a binary classification judgment result.

[0100] In this embodiment, the structured rule judgment node is a type of rule judgment node that matches and judges the structured fields of alarm data. Its rule judgment execution logic is implemented based on preset static matching rules, such as regular expressions, field comparisons, and logical expressions. This type of node has high execution efficiency and clear logic, and is suitable for the rapid identification of known attack patterns.

[0101] For example, a static matching rule could be:

[0102] "IF src_ip IN internal network segment AND dst_port = 445 THEN label = Lateral movement attempt".

[0103] In this embodiment, the lightweight model rule judgment node is a type of rule judgment node that performs binary classification on the feature vectors of alarm data. Its rule judgment execution logic is based on a lightweight machine learning model (such as XGBoost, logistic regression, etc.) pre-trained for a specific alarm analysis scenario. This type of model consumes few resources, has a fast inference speed, can handle complex patterns, and possesses a certain degree of generalization ability. It is suitable for achieving efficient judgment in specific domains or scenarios with high real-time requirements, and can perform probabilistic judgment on complex behavioral patterns. When alarm data arrives at this type of rule judgment node, the alarm data is first converted into a feature vector, then input into the machine learning model, and based on the model's output, a binary classification result is obtained.

[0104] In some embodiments, the prompt text used by the natural language rule judgment node and the static matching rule used by the structured rule judgment node are generated through the following steps S201-S203.

[0105] Step S201: Extract knowledge from the labeled historical alarm samples and / or the expert security knowledge information related to the historical alarm samples to generate standardized semantic units containing conditional elements, behavioral labels and intent descriptions.

[0106] Among them, the condition element is used to describe the attack characteristics of the historical alarm sample; the behavior tag is used to identify the attack type of the historical alarm sample; and the intent description is used to describe the attack purpose of the historical alarm sample.

[0107] In some embodiments, the expert security knowledge information related to the aforementioned historical alarm samples may include: network topology, asset list and host attributes; deployed security policies and access control rules; and the experience and analytical points accumulated by security experts.

[0108] Specifically, conditional elements are used to describe the specific attack characteristics in historical alert samples, such as a specific IP address range, port number, network protocol type, or HTTP request type. For example: ["Source IP is from an external network", "Destination port is 3389", "Access time is outside of working hours"].

[0109] Behavioral tags are used to identify the attack type corresponding to historical alert samples, such as SQL injection attacks and lateral movement attempts.

[0110] Intent description is a semantic summary of the attack purpose of historical alert samples. It is used to describe the attack attempt or security risk behind the historical alert samples, such as "attackers attempt to obtain sensitive information," "abnormal login attempts," and "privilege escalation attempts," etc. For example: "attackers attempt to bypass the SQL authentication mechanism to obtain sensitive database information."

[0111] For example, a historical alert sample regarding an SQL injection attack is as follows:

[0112] {

[0113] "alert_id":"A1001",

[0114] "type":"SQL Injection",

[0115] "source_ip":"192.168.10.15",

[0116] "destination_port":80,

[0117] "payload":"id=1'OR'1'='1",

[0118] "verified":true

[0119] }

[0120] After knowledge extraction in this step, the following standardized semantic units are generated:

[0121] {

[0122] "Conditional Elements":["Destination port is 80","Payload contains typical SQL injection characteristics ('OR'1'='1')"],

[0123] "Behavioral Tag": "SQL Injection Attack"

[0124] "Intent Determination": "The attacker is attempting to bypass the SQL authentication mechanism to obtain sensitive database information."

[0125] }

[0126] The standardized ternary semantic structure described above serves as the basis for the subsequent automatic generation of static matching rules and prompt text.

[0127] Step S202: Generate static matching rules based on standardized semantic units and preset rule templates.

[0128] Based on standardized semantic units and preset rule templates, the system automatically generates static matching rules for specific attack types. Specifically, a rule template for generating static matching rules is provided. This template is typically a framework containing logical judgment statements, and the specific content in the "condition element" list can be filled into the condition section of the template.

[0129] For example, a preset rule template is as follows:

[0130] IF {condition element 1} AND {condition element 2} THEN LABEL = {behavior label}

[0131] After filling in the conditional elements in the above example semantic unit, the following static matching rule can be automatically generated:

[0132] IF(dst_port==80)AND(payload CONTAINS"'OR'1'='1")THEN LABEL="SQL injection attack"

[0133] This rule can be configured and used in a structured rule decision node of a DAG.

[0134] Step S203: Generate prompt text based on standardized semantic units and preset prompt templates.

[0135] Based on standardized semantic units and preset prompt templates, prompt text for natural language rule judgment nodes can be generated. Specifically, a prompt template for generating prompt text is preset. By calling the large language model, prompt text containing a requirement for the large language model to perform binary classification is generated based on the template and standardized semantic units. "Conditional elements", "behavioral labels" and "intent descriptions" are embedded as contextual information to guide the large language model to make an accurate judgment.

[0136] For example, a preset prompt template is as follows:

[0137] "Please determine whether this network alert belongs to the {behavior label} behavior based on the following context. This behavior is usually intended to {describe intent}, and its characteristics may include: {list of conditional elements}. Please judge the following alert data based only on the above information: [ALERT_DATA]. Your answer can only be 'yes' or 'no'."

[0138] After filling in the content of the above example semantic unit, the following prompt text can be generated:

[0139] "Please determine whether this network alert constitutes an SQL injection attack based on the following context. This attack typically aims to bypass SQL authentication mechanisms and obtain sensitive database information. Its characteristics may include: a destination port of 80, and a payload containing typical SQL injection features ('OR'1' = '1'). Please determine the following alert data based solely on the above information: [ALERT_DATA]. Your answer can only be 'yes' or 'no'."

[0140] This prompt text can be configured into a natural language rule judgment node in the DAG. When this node is executed, the system will replace the [ALERT_DATA] position with the current alarm data.

[0141] In this application embodiment, a standardized and automated rule generation mechanism is provided. By semantically extracting and structurally expressing historical alarms and expert security knowledge, a standardized semantic unit that uniformly expresses attack characteristics, types and intentions is generated. Based on this, prompt text and static matching rules are automatically generated, which improves the efficiency, consistency and maintainability of rule generation and reduces the cost of manual writing.

[0142] In this embodiment, by introducing structured rule judgment nodes and lightweight model rule judgment nodes to complement natural language rule judgment nodes, the DAG is integrated with multiple types of rule judgment nodes, improving the coverage of the analysis. Specifically, structured rule judgment nodes are suitable for detecting attacks with high confidence and fixed patterns, and have high execution efficiency; lightweight model rule judgment nodes are suitable for pattern recognition of medium complexity and have a certain generalization ability; and natural language rule judgment nodes are adept at handling semantically ambiguous and diverse novel attacks. The collaborative work of these three nodes ensures detection efficiency while improving the ability to identify unknown attacks.

[0143] Step S103: Input the alarm data into the target DAG and generate the node hit trajectory of the alarm data.

[0144] In this embodiment, the node hit trajectory is used to record the rule judgment nodes triggered by the defendant's alarm data and the corresponding judgment results. A node hit trajectory represents a specific judgment path, which is composed of a series of rule judgment nodes dynamically triggered by the defendant's alarm data and their judgment results.

[0145] As a possible implementation method, the above step S103 is achieved through the following steps S103a-S103c:

[0146] Step S103a: Input the alarm data into the target DAG;

[0147] Step S103b: Trigger the initial rule judgment node in the target DAG to perform binary classification judgment on the alarm data, and based on the judgment result, trigger the next rule judgment node to perform binary classification judgment on the alarm data, until no new rule judgment node can be triggered.

[0148] Step S103c: Based on the rule judgment node triggered by the alarm data and the corresponding judgment result, generate the node hit trajectory of the alarm data.

[0149] In this embodiment of the application, the process of generating the node hit trajectory is a dynamic execution process of DAG. This dynamic execution process begins with the starting rule judgment node specified in the target DAG. The starting rule judgment node performs binary classification judgment on the input alarm data. Based on the judgment result ("hit" or "miss"), the corresponding exit path (directed edge) triggers the next rule judgment node.

[0150] For example, if node N1 is hit, the process jumps to N4; if it is not hit, it jumps to N2. During this process, alarm data is filtered and judged layer by layer until the judgment result no longer points to other rule judgment nodes, at which point the execution ends. This application records all the rule judgment nodes accessed during this process and their judgment results in sequence, thus generating a unique node hit trajectory. This node hit trajectory reproduces the analysis logic chain of this alarm data.

[0151] In this embodiment, the layer-by-layer detailed analysis of alarm data is achieved through the dependency relationship between nodes and the transmission of binary classification judgment results. At the same time, the generated node hit trajectory fully records the judgment path, providing a data foundation for subsequent result interpretation, misjudgment tracing and rule optimization.

[0152] Step S104: Based on the node hit trajectory, obtain the alarm analysis results of the alarm data.

[0153] As a possible implementation method, the above step S104 is achieved through the following steps S104a-S104b:

[0154] Step S104a: Match the node hit trajectory with the preset path semantic mapping table, which includes alarm analysis results corresponding to different node hit trajectories.

[0155] Step S104b: Determine the alarm analysis result of the alarm data based on the matching result.

[0156] In this embodiment of the application, the alarm analysis result includes at least one of attack intent category information and attack result status information.

[0157] Attack intent category information is used to indicate the attack intent of alarm data in the target alarm analysis scenario, including one of the following: unknown, non-attack, suspicious, and malicious.

[0158] Attack result status information is used to indicate whether the attack behavior of the alarm data has achieved the expected goal, including one of the following: success, failure, unknown.

[0159] In this embodiment of the application, in order to determine the alarm analysis result corresponding to the node hit trajectory, a correspondence between the node hit trajectory attack type and the alarm analysis result is preset, so that the alarm analysis result corresponding to the node hit trajectory can be determined.

[0160] For example, this correspondence is stored in the system knowledge base in the form of a mapping table, the structure of which is shown in Table 2 below:

[0161] Table 2 Path Semantic Mapping Table

[0162] N1=yes→N2=yes→N3=yes malicious success N1=yes→N2=no suspicious fail N1=no non-attack unknown

[0163] In Table 2, N1, N2, and N3 are all identifiers of the rule judgment nodes; "N1 = yes" means that the binary classification judgment result of the alarm data at node N1 is "yes"; "N2 = no" means that the binary classification judgment result of the alarm data at node N2 is "no".

[0164] In this embodiment, the node hit trajectory is transformed into an understandable alarm analysis result through the path semantic mapping table, realizing the automated conversion from the judgment process to the result output. At the same time, by supporting multi-dimensional label output of attack intent category information and attack result status information, richer security situation information is provided to meet the judgment needs in complex scenarios.

[0165] In some embodiments, terminal nodes representing alarm analysis results can also be added to the DAG, so that the alarm analysis results can be determined based on the terminal nodes reached by the node hit trajectory.

[0166] For example, such as Figure 2 The diagram shown is a schematic of a DAG structure provided in an embodiment of this application, used for "SQL injection detection" alarm analysis scenarios.

[0167] Figure 2 In the code, the rule-judgment nodes include N1, N2, N3, and N4:

[0168] N1, a structured rule judgment node, is used to determine whether the payload contains the typical SQL statement pattern 'OR'1'='1' based on pre-configured static matching rules.

[0169] N2, the natural language rule judgment node, is used to call the large language model to determine whether "the request semantically attempts to bypass database verification";

[0170] N3, a lightweight model rule judgment node, is used to determine whether the similarity between the payload and the SQL injection sample is higher than the threshold based on the pre-trained XGBoost prediction model.

[0171] N4, a structured rule judgment node, is used to determine "whether to access sensitive fields (such as password, token, etc.)" based on pre-configured static matching rules.

[0172] Figure 2 In the process, the terminal nodes include M1, M2, and M3:

[0173] M1 indicates that the attack intent category is "non-attack";

[0174] M2 represents an attack intent category of "attack" and an attack result status of "success".

[0175] M3 indicates that the attack intent category is "attack" and the attack result status is "failure".

[0176] In some embodiments, the alarm analysis method described above further includes the following steps S105-S108.

[0177] Step S105: Receive the annotation information of the alarm data, and determine whether the alarm analysis result is correct based on the annotation information.

[0178] The annotation information includes attack intent category annotation information, attack result status annotation information, and misjudgment attribution information; the misjudgment attribution information is used to indicate the rule judgment node where a misjudgment occurred.

[0179] For example, the above-mentioned annotation information may be manually reviewed or provided by an external system. This information includes the actual attack intent category, the status of the attack result, and key misjudgment attribution information (i.e., which rule judgment node is considered to have made an incorrect judgment).

[0180] Step S106: When the alarm analysis result is verified as a misjudgment, the target rule judgment node that caused the misjudgment is located in the node hit trajectory based on the misjudgment attribution information.

[0181] Step S107: Based on the preset correction strategy, the target rule judgment node is corrected to obtain the candidate target DAG.

[0182] In this embodiment of the application, when the alarm analysis result is confirmed as a misjudgment, an automatic correction process will be triggered to continuously optimize the alarm judgment capability. The correction strategy includes at least one of the following: adjusting the prompt text, adjusting the static matching rules, replacing the machine learning classifier, adding or deleting rule judgment nodes, and modifying the connection relationship between rule judgment nodes.

[0183] For example, a large language model is invoked to analyze the causes of misjudgments, generate structured repair suggestions, and execute corresponding correction strategies based on these suggestions. Specifically, after locating the target rule judgment node that caused the misjudgment in the node hit trajectory based on the misjudgment attribution information, the following contextual information is extracted to construct a unified analysis input:

[0184] Raw alarm data;

[0185] The node hit trajectory includes the execution path of the target DAG and the judgment results of each rule judgment node;

[0186] The target rule determines the type of the node, the corresponding static matching rule, prompt text, or the machine learning classifier used.

[0187] Alarm analysis results;

[0188] A pre-defined standard prompt template is used to guide the large language model in root cause analysis and the generation of repair suggestions.

[0189] Subsequently, the large language model is invoked, taking the aforementioned context as input, and outputting structured repair suggestions.

[0190] In this embodiment of the application, a correction strategy is determined and a corresponding DAG structure modification operation is performed by parsing structured repair suggestions. For example, the DAG structure modification operation may include:

[0191] Replace prompt text: If it is a natural language rule judgment node and the policy is replace_prompt, then update its prompt text;

[0192] Adjust static matching rules: If a node is judged by a structured rule and the strategy is update_rule, then replace it with the new static matching rule;

[0193] Replace the machine learning classifier: If it is a lightweight model rule-based decision node and the policy is replace_model, then replace it with a new machine learning classifier;

[0194] Add / delete rule-based node determination: Insert or delete structured rule-based nodes at specified locations based on repair suggestions, and reconnect the dependencies between the previous and current nodes;

[0195] Modify node connection relationships: Adjust the direction of directed edges according to the repair suggestions to realize the change of jump logic.

[0196] All the above modifications generate a new DAG structure in a differentiated manner, which is denoted as the candidate target DAG. At the same time, the operation type, nodes involved, original and new configurations, and LLM suggestion source information are recorded in the system log to support subsequent auditing and backtracking.

[0197] Step S108: Verify the candidate DAG using the alarm data that has been verified as a false positive; if the verification passes, replace the target DAG with the candidate target DAG; if the verification fails, trigger a new round of correction and verification process.

[0198] In this embodiment of the application, after generating the candidate DAG, it enters the automatic verification and iterative update stage, and performs two rounds of independent verification to ensure that no new misjudgments are introduced while fixing the problem.

[0199] In the first round, the system verifies the misjudged samples: using the original alarm data that was identified as misjudged, the candidate DAG is re-inputted and alarm analysis is performed. If the alarm analysis results are consistent with the annotation information, the first round of verification is considered successful; if there is still a discrepancy, the repair is considered to have failed. Based on the new feedback, the system calls the large language model again to generate the next round of repair suggestions, forming an iterative repair loop.

[0200] The second round involves training sample sampling and verification: a batch of samples is randomly selected from the historically labeled training sample set, and alarm analysis is performed using the candidate DAG. Precision, recall, and other metrics are statistically analyzed and compared with the performance of the original target DAG. If the performance remains the same or improves, and no new misclassifications occur, the candidate script is considered stable and reliable; if the performance declines or new misclassifications occur, the overall risk is considered to have increased, and the deployment process is automatically terminated.

[0201] The system allows a maximum of N rounds of repair attempts by default (e.g., N=3). If multiple rounds of double-round verification fail, the misjudged case is automatically marked as "not automatically repairable" and transferred to the manual review queue for further analysis by security experts.

[0202] If the candidate DAG successfully passes both rounds of verification, the system performs the following operations:

[0203] The candidate DAG is officially launched and marked as the effective version for the current alarm analysis scenario;

[0204] The original target DAG is automatically archived, preserving the complete structure and configuration, and supports one-click rollback;

[0205] Update version control records, including version number, update time, triggering reason, fix suggestions for large language models, verification results, and other metadata.

[0206] In this application embodiment, a DAG optimization mechanism from misjudgment feedback to automatic correction is provided. The misjudgment node is located by misjudgment attribution information, and different types of misjudgments (such as ambiguous prompts) are flexibly dealt with based on preset correction strategies. At the same time, the verification mechanism of candidate DAGs ensures the safety of correction, prevents the introduction of new problems, helps to reduce system maintenance costs, and enables the system to have continuous optimization capabilities.

[0207] In some embodiments, in order to achieve efficient invocation and flexible management of the rules corresponding to the rule judgment nodes, this application centrally manages the natural language rule judgment nodes, structured rule judgment nodes and lightweight model rule judgment nodes to form a standardized rule judgment node library.

[0208] In the rule-based decision node library, tags are associated with each rule-based decision node, including the following basic tags:

[0209] rule_id: A unique identifier for rules, used to distinguish and invoke them;

[0210] rule_type: Rule type (structured, natural language, lightweight model);

[0211] condition: The rule trigger condition or description, which supports logical expressions and natural language text;

[0212] evaluation_method: Evaluation method (e.g., logical judgment, LLM-token determination, model prediction);

[0213] label: The behavior label or threat type corresponding to the rule;

[0214] source: rule origin (expert experience, automatic generation, model training);

[0215] priority: rule priority;

[0216] version: Rule version information, supporting rule iteration and rollback.

[0217] Optionally, the rule judgment node library supports dynamic version management, allowing the addition, modification, and deletion of rules corresponding to the rule judgment node to take effect online, ensuring the timeliness and security of rule updates.

[0218] Optionally, the rule judgment node library supports grouping and classifying the rules corresponding to the rule judgment nodes according to attributes such as rule application scenario, risk level, and triggering conditions, which facilitates quick invocation and adjustment for specific business or threat scenarios.

[0219] Optionally, the rule judgment node library supports rule invocation and log tracking. It can record the invocation log of each rule execution corresponding to the rule judgment node, including rule hit status, input parameters, execution results and timestamps, and support subsequent auditing, analysis and misjudgment.

[0220] Based on the same inventive concept, embodiments of this application also provide an alarm analysis device, such as... Figure 3 The diagram shown is a schematic of an alarm analysis device provided in an embodiment of this application. The device includes:

[0221] The alarm analysis scenario determination module 301 is used to determine the target alarm analysis scenario corresponding to the alarm data based on the scenario feature information carried by the alarm data.

[0222] The matching module 302 is used to determine a target DAG that matches the target alarm analysis scenario from a preset directed acyclic graph (DAG); wherein the DAG includes multiple rule judgment nodes, and the multiple rule judgment nodes form directed edges through preset dependency relationships; each rule judgment node is used to perform binary classification judgment on the input alarm data, and trigger the next rule judgment node to be executed according to the judgment result; the multiple rule judgment nodes include at least one natural language rule judgment node, and each natural language rule judgment node is used to call a large language model to perform binary classification judgment on the input alarm data based on a preset prompt text;

[0223] The node hit trajectory generation module 303 is used to input the alarm data into the target DAG and generate the node hit trajectory of the alarm data; the node hit trajectory is used to record the rule judgment node triggered by the alarm data and the corresponding judgment result;

[0224] The alarm analysis module 304 is used to obtain the alarm analysis results of the alarm data based on the node hit trajectory.

[0225] As a feasible implementation method, the alarm analysis scenario determination module 301 is specifically used for:

[0226] Extract at least one of the following pieces of information from the alarm data as the scene feature information: alarm type, protocol type, target port number, and feature string in the request path;

[0227] Based on the scene feature information, determine the attack type that needs to be identified for the alarm data;

[0228] Based on the alarm analysis scenarios associated with the attack type, the target alarm analysis scenario corresponding to the alarm data is determined.

[0229] As a feasible implementation method, the node hit trajectory generation module 303 is specifically used for:

[0230] Input the alarm data into the target DAG;

[0231] The starting rule judgment node in the target DAG is triggered to perform a binary classification judgment on the alarm data, and based on the judgment result, the next rule judgment node is triggered to perform a binary classification judgment on the alarm data, until no new rule judgment node can be triggered.

[0232] Based on the rule-based judgment nodes triggered by the alarm data and the corresponding judgment results, the node hit trajectory of the alarm data is generated.

[0233] As a possible implementation method, the plurality of rule-judgment nodes further include at least one of the following:

[0234] The structured rule judgment node is configured with preset static matching rules, which are used to match and judge the structured fields of the alarm data to obtain a binary classification judgment result.

[0235] The lightweight model rule judgment node is equipped with a pre-trained machine learning classifier, which is used to classify the feature vectors of the alarm data to obtain a binary classification judgment result.

[0236] As a possible implementation, the device further includes a rule generation module, used to generate the prompt text and the static matching rules in the following manner:

[0237] Knowledge extraction is performed on the labeled historical alert samples and / or on the expert security knowledge information related to the historical alert samples to generate standardized semantic units containing conditional elements, behavioral tags, and intent descriptions; wherein, the conditional elements are used to describe the attack characteristics of the historical alert samples; the behavioral tags are used to identify the attack type of the historical alert samples; and the intent descriptions are used to describe the attack purpose of the historical alert samples.

[0238] Based on the standardized semantic units and preset rule templates, the static matching rules are generated;

[0239] The prompt text is generated based on the standardized semantic units and the preset prompt template.

[0240] As one feasible implementation method, the alarm analysis module 304 is specifically used for:

[0241] The node hit trajectory is matched with a preset path semantic mapping table, which includes alarm analysis results corresponding to different node hit trajectories;

[0242] Based on the matching results, determine the alarm analysis results of the alarm data;

[0243] The alarm analysis results include at least one of attack intent category information and attack result status information; the attack intent category information is used to indicate the attack intent of the alarm data in the target alarm analysis scenario, including one of the following: unknown, non-attack, suspicious, and malicious; the attack result status information is used to indicate whether the attack behavior of the alarm data has achieved the expected goal, including one of the following: successful, failed, and unknown.

[0244] As a possible implementation, the device further includes an optimization module, used to receive annotation information of the alarm data, and determine whether the alarm analysis result is correct based on the annotation information; wherein, the annotation information includes attack intent category annotation information, attack result status annotation information, and misjudgment attribution information; the misjudgment attribution information is used to indicate the rule judgment node where a misjudgment occurred;

[0245] When the alarm analysis result is verified as a misjudgment, the target rule judgment node that caused the misjudgment is located in the node hit trajectory based on the misjudgment attribution information.

[0246] Based on a preset correction strategy, the target rule judgment node is corrected to obtain a candidate target DAG; the correction strategy includes at least one of the following: adjusting the prompt text, adjusting the static matching rule, replacing the machine learning classifier, adding or deleting rule judgment nodes, and modifying the connection relationship between rule judgment nodes;

[0247] The candidate DAG is verified using alarm data that has been confirmed as a false positive.

[0248] If the verification passes, the candidate target DAG is used to replace the target DAG;

[0249] If the verification fails, a new round of correction and verification process will be triggered.

[0250] Based on the same inventive concept, this application also provides an alarm analysis device 400, such as... Figure 4 As shown, it includes at least one processor 402; and a memory 401 communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the above-described alarm analysis method.

[0251] Memory 401 is used to store programs. Specifically, the program may include program code, which includes computer operation instructions. Memory 401 may be volatile memory, such as random-access memory (RAM); it may also be non-volatile memory, such as flash memory, hard disk drive (HDD), or solid-state drive (SSD); or it may be any one or a combination of the above-mentioned volatile and non-volatile memory types.

[0252] Processor 402 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. It can also be a hardware chip. The aforementioned hardware chip can be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0253] This invention also provides a computer-readable storage medium including instructions that, when run on a computer, cause the computer to execute the alarm analysis method provided in the above embodiments.

[0254] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described device and module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0255] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, apparatuses, or modules, and may be electrical, mechanical, or other forms.

[0256] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0257] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0258] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0259] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0260] The technical solutions provided in this application have been described in detail above. Specific examples have been used in this application to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0261] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0262] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0263] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0264] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0265] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An alarm analysis method, characterized in that, include: Based on the scene feature information carried by the alarm data, the target alarm analysis scene corresponding to the alarm data is determined; From a pre-defined directed acyclic graph (DAG), a target DAG matching the target alarm analysis scenario is determined. The DAG includes multiple rule-judgment nodes, which are connected by directed edges formed by pre-defined dependencies. Each rule-judgment node performs binary classification on the input alarm data and triggers the next rule-judgment node to be executed based on the judgment result. The multiple rule-judgment nodes include at least one natural language rule-judgment node, which is used to invoke a large language model based on a pre-defined prompt text to perform binary classification on the input alarm data. The alarm data is input into the target DAG to generate the node hit trajectory of the alarm data; the node hit trajectory is used to record the rule judgment nodes triggered by the alarm data and the corresponding judgment results; Based on the node hit trajectory, the alarm analysis results of the alarm data are obtained.

2. The method according to claim 1, characterized in that, The step of determining the target alarm analysis scenario corresponding to the alarm data based on the scenario feature information carried by the alarm data includes: Extract at least one of the following pieces of information from the alarm data as the scene feature information: alarm type, protocol type, target port number, and feature string in the request path; Based on the scene feature information, determine the attack type that needs to be identified for the alarm data; Based on the alarm analysis scenarios associated with the attack type, the target alarm analysis scenario corresponding to the alarm data is determined.

3. The method according to claim 2, characterized in that, The step of inputting the alarm data into the target DAG and generating the node hit trajectory of the alarm data includes: Input the alarm data into the target DAG; The starting rule judgment node in the target DAG is triggered to perform a binary classification judgment on the alarm data, and based on the judgment result, the next rule judgment node is triggered to perform a binary classification judgment on the alarm data, until no new rule judgment node can be triggered. Based on the rule-based judgment nodes triggered by the alarm data and the corresponding judgment results, the node hit trajectory of the alarm data is generated.

4. The method according to claim 1, characterized in that, The plurality of rule-judgment nodes also include at least one of the following: The structured rule judgment node is configured with preset static matching rules, which are used to match and judge the structured fields of the alarm data to obtain a binary classification judgment result. The lightweight model rule judgment node is equipped with a pre-trained machine learning classifier, which is used to classify the feature vectors of the alarm data to obtain a binary classification judgment result.

5. The method according to claim 4, characterized in that, The prompt text and the static matching rules are generated in the following manner: Knowledge extraction is performed on the labeled historical alert samples and / or on the expert security knowledge information related to the historical alert samples to generate standardized semantic units containing conditional elements, behavioral tags, and intent descriptions; wherein, the conditional elements are used to describe the attack characteristics of the historical alert samples; the behavioral tags are used to identify the attack type of the historical alert samples; and the intent descriptions are used to describe the attack purpose of the historical alert samples. Based on the standardized semantic units and preset rule templates, the static matching rules are generated; The prompt text is generated based on the standardized semantic units and the preset prompt template.

6. The method according to claim 1, characterized in that, The alarm analysis results obtained based on the node hit trajectory include: The node hit trajectory is matched with a preset path semantic mapping table, which includes alarm analysis results corresponding to different node hit trajectories; Based on the matching results, determine the alarm analysis results of the alarm data; The alarm analysis results include at least one of attack intent category information and attack result status information; the attack intent category information is used to indicate the attack intent of the alarm data in the target alarm analysis scenario, including one of the following: unknown, non-attack, suspicious, and malicious; the attack result status information is used to indicate whether the attack behavior of the alarm data has achieved the expected goal, including one of the following: successful, failed, and unknown.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: The system receives the annotation information of the alarm data and determines whether the alarm analysis result is correct based on the annotation information; wherein, the annotation information includes attack intent category annotation information, attack result status annotation information, and misjudgment attribution information; the misjudgment attribution information is used to indicate the rule judgment node where a misjudgment occurred; When the alarm analysis result is verified as a misjudgment, the target rule judgment node that caused the misjudgment is located in the node hit trajectory based on the misjudgment attribution information. Based on a preset correction strategy, the target rule judgment node is corrected to obtain a candidate target DAG; the correction strategy includes at least one of the following: adjusting the prompt text, adjusting the static matching rule, replacing the machine learning classifier, adding or deleting rule judgment nodes, and modifying the connection relationship between rule judgment nodes; The candidate DAG is validated using alarm data that has been verified as a false positive. If the verification passes, the candidate target DAG is used to replace the target DAG; If the verification fails, a new round of correction and verification process will be triggered.

8. An alarm analysis device, characterized in that, include: The alarm analysis scenario determination module is used to determine the target alarm analysis scenario corresponding to the alarm data based on the scenario feature information carried by the alarm data. A matching module is used to determine a target DAG that matches the target alarm analysis scenario from a preset directed acyclic graph (DAG). The DAG includes multiple rule-judgment nodes, which are connected by directed edges through preset dependencies. Each rule-judgment node performs binary classification on the input alarm data and triggers the next rule-judgment node to be executed based on the judgment result. The multiple rule-judgment nodes include at least one natural language rule-judgment node, which uses a large language model to perform binary classification on the input alarm data based on a preset prompt text. The node hit trajectory generation module is used to input the alarm data into the target DAG and generate the node hit trajectory of the alarm data; the node hit trajectory is used to record the rule judgment node triggered by the alarm data and the corresponding judgment result; The alarm analysis module is used to obtain the alarm analysis results of the alarm data based on the node hit trajectory.

9. An alarm analysis device, characterized in that, The method includes at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the alarm analysis method as described in any one of claims 1-7.

Images