Semantic-driven intelligent query method, system and equipment based on security event library and medium

Abstract

The invention discloses a semantic-driven intelligent query method, system and device based on a security event library and a medium, and the method comprises the steps: improving the query accuracy through deep semantic understanding and cross-modal correlation analysis; potential threat association difficult to recognize can be found through multi-modal semantic association and threat graph construction; the query habit and professional domain knowledge of the user can be automatically learned in combination with a query optimization mechanism driven by reinforcement learning, personalized customization of a query strategy is realized, the manual adjustment frequency is reduced, and the man-machine cooperation efficiency is improved; on the whole, based on a dynamic optimization mechanism of a plug-in architecture and a large vertical model, the system can quickly adapt to changes of a network security environment of a power system, the response speed to novel threats is increased, and the adaptability of the system is enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power safety, and in particular to a semantic-driven intelligent query method, system, device and medium based on a security event library. BACKGROUND

[0002] With the increasing complexity and diversity of network security threats, power systems as critical infrastructure face severe security challenges. Traditional network security event query systems mainly rely on keyword matching and rule engines, which have the following significant defects:

[0003] Insufficient semantic understanding, unable to accurately capture the deep semantics of query statements, resulting in a large number of false positives and false negatives; lack of context awareness, difficult to handle context-dependent relationships in multi-round dialogues, unable to achieve progressive query optimization, when analyzing complex attack chains, users need to repeatedly adjust query conditions, low efficiency; weak dynamic updating ability, facing new network security events such as adversarial sample attacks based on large models, the rule library of traditional systems updates slowly, unable to respond to threat changes in time; insufficient cross-modal correlation, the security event library contains multi-modal data such as logs, traffic data, and vulnerability reports, traditional systems lack effective cross-modal semantic correlation mechanisms, making it difficult to form a complete threat map.

[0004] Currently, although some security analysis tools based on large language models (such as SecGPT) have been applied to the network security field, these tools have obvious deficiencies in deep integration with security event libraries, especially in the context of semantic-driven intelligent query, there is no systematic solution. Existing technical solutions either focus only on the processing of single-modal data or lack professional optimization for the vertical field of power system network security, unable to meet the needs of power systems for high reliability and high real-time security queries. SUMMARY

[0005] In view of the above existing problems, the present application is proposed.

[0006] Therefore, the present application provides a semantic-driven intelligent query method and system based on a security event library to solve the problems that current query methods cannot accurately capture the deep semantics of query statements, resulting in a large number of false positives and false negatives; difficult to handle multi-round query dialogues, unable to achieve progressive query optimization, low efficiency, and weak dynamic updating ability.

[0007] To solve the above technical problems, the present application provides the following technical solutions:

[0008] In a first aspect, the present application provides a semantic-driven intelligent query method based on a security event library,

[0009] It comprises: acquiring multi-source heterogeneous security event data in a power system network;

[0010] Based on a pre-trained power network security vertical large model, the user query statement is subjected to deep semantic analysis, and a user semantic representation is generated in combination with the security event data;

[0011] An initial retrieval result is generated by establishing a dynamically updated semantic index through a hybrid index architecture.

[0012] The multi-source heterogeneous security event data is preprocessed to generate semantic features of the security event data, and the semantic correlation between different modal data is obtained through the semantic features, and a cross-modal threat graph is constructed.

[0013] In combination with the user semantic representation, the initial retrieval result and the threat graph, the matching weight of the semantic features in the query process is dynamically adjusted based on the interaction feedback with the user and by using reinforcement learning to generate a query result.

[0014] The query result is subjected to semantic aggregation and visual presentation, and threat impact analysis and defense suggestions are generated.

[0015] As a preferred scheme of the semantic-driven intelligent query method based on a security event library, the pre-trained power network security vertical large model comprises:

[0016] The model is trained by fusing a general network security knowledge base, attack and defense data specific to the power system and historical security event cases.

[0017] An adversarial training mechanism is introduced in the training process to improve the attack resistance of the model.

[0018] As a preferred scheme of the semantic-driven intelligent query method based on a security event library, the initial retrieval result is generated by establishing a dynamically updated semantic index through a hybrid index architecture, comprising:

[0019] The hybrid index architecture comprises a semantic vector index of BERT and a keyword inverted index.

[0020] An incremental learning algorithm is constructed, and when new security event data is entered into the database, the semantic vector index and the keyword inverted index are automatically updated.

[0021] The security event data that exceeds a preset time period is subjected to index optimization, and invalid index items are deleted.

[0022] The semantic vector index and the keyword inverted index of BERT are given different dynamic weights to adjust the collaborative retrieval of the two.

[0023] As a preferred scheme of the semantic-driven intelligent query method based on a security event library, wherein: the multi-source heterogeneous security event data is preprocessed to generate semantic features of the security event data, the semantic correlation between different modal data is obtained through the semantic features, and a cross-modal threat graph is constructed, including:

[0024] The multi-source heterogeneous security event data is uniformly semantically annotated, and key semantic features are extracted;

[0025] The semantic features of different modalities are converted into a unified semantic representation space for calculating semantic correlation strength;

[0026] The security event data is mapped into a point in a high-dimensional semantic vector space for use as a graph node;

[0027] Based on the graph node and the semantic correlation strength, a graph neural network model is used to generate a cross-modal threat graph.

[0028] As a preferred scheme of the semantic-driven intelligent query method based on a security event library, wherein: the user semantic representation, the initial retrieval result and the threat graph are combined, the query strategy is dynamically adjusted based on user interaction feedback and reinforcement learning, the matching weight of the semantic feature in the query process is optimized, and the query result is generated, including:

[0029] A user interaction model is constructed, a user query history database is constructed to record user query data, and the professional field preference and query habit of the user are captured;

[0030] A reinforcement learning framework is constructed, the current user semantic representation, the user historical query feature and the feature vector of the initial retrieval result are set as the state space, adjusting the semantic matching threshold, changing the mixed index weight and selecting different retrieval strategies are set as the action space, and the corresponding reward function is set; the deep DQN algorithm is used in combination with experience replay and target network.

[0031] As a preferred scheme of the semantic-driven intelligent query method based on a security event library, wherein: based on user interaction feedback and reinforcement learning, the query strategy is dynamically adjusted, the matching weight of the semantic feature in the query process is optimized, and the query result is generated, further including:

[0032] According to the current state of the user semantic representation and the initial retrieval result, the optimal query optimization action is selected by using the DQN algorithm;

[0033] Adjust the retrieval parameters, re-execute the retrieval, and obtain new retrieval results;

[0034] According to the feedback of the user interaction model, a reward value is calculated, a state-action-reward-next state transition record is stored in an experience replay buffer, the experience replay buffer is periodically sampled for model training, network parameters of the DQN are updated, and a query result is generated.

[0035] As a preferred scheme of the semantic-driven intelligent query method based on a security event library, the method comprises the following steps of:

[0036] A defense strategy knowledge base is established, which contains standard disposal processes and best practice cases for various security events;

[0037] According to the semantic features of the query result, the defense strategy in the knowledge base is matched, and defense suggestions are generated in combination with the specific environment of the power system, the defense suggestions including technical measures and management measures.

[0038] In a second aspect, the application provides a semantic-driven intelligent query system based on a security event library, comprising:

[0039] A multi-source heterogeneous security event acquisition module is configured to acquire multi-source heterogeneous security event data in a power system network;

[0040] A dynamic semantic understanding module is configured to perform deep semantic analysis on a user query statement based on a pre-trained power network security vertical large model in combination with security event data to generate a user semantic representation;

[0041] An adaptive event library index construction module is configured to establish a dynamically updated semantic index through a hybrid index architecture to generate an initial retrieval result;

[0042] A multi-modal semantic correlation module is configured to preprocess multi-source heterogeneous security event data to generate semantic features of the security event data, obtain semantic correlations between different modal data through the semantic features, and construct a cross-modal threat graph;

[0043] A reinforcement learning-driven query optimization module is configured to combine the user semantic representation, the initial retrieval result, and the threat graph, dynamically adjust a query strategy based on interaction feedback with the user, optimize matching weights of semantic features in the query process, and generate a query result;

[0044] An intelligent result generation module is configured to semantically aggregate and visually present the query result, and generate threat impact analysis and defense suggestions.

[0045] In a third aspect, the application provides a computer device, comprising:

[0046] a memory and a processor;

[0047] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions, which realize the steps of the method for semantic-driven intelligent query based on a security event library.

[0048] In a fourth aspect, the present application provides a computer readable storage medium storing computer executable instructions, which realize the steps of the method for semantic-driven intelligent query based on a security event library when executed by a processor.

[0049] Compared with the prior art, the present application has the following beneficial effects: the present application improves the query accuracy rate compared with traditional keyword retrieval through deep semantic understanding and cross-modal correlation analysis, and has obvious advantages in processing complex semantic queries; the present application can achieve sub-second response to TB-level security event libraries and improve response efficiency by using a hybrid index architecture and parallel computing technology; at the same time, potential threat correlations that are difficult to identify can be found through multi-modal semantic correlation and threat graph construction; the query strategy can be customized individually to reduce the number of manual adjustments and improve human-machine collaboration efficiency by combining a reinforcement learning-driven query optimization mechanism to automatically learn the user's query habits and professional knowledge; overall, based on the dynamic optimization mechanism of the plug-in architecture and the vertical large model, the system can quickly adapt to changes in the power system network security environment, improve the response speed to new threats, and enhance the adaptability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0051] Figure 1 The overall flowchart of the method for semantic-driven intelligent query based on a security event library according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings in the specification. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0053] Embodiment 1, refer to Figure 1For an embodiment of the application, a semantic-driven intelligent query method based on a security event library is provided, comprising:

[0054] S100: acquiring multi-source heterogeneous security event data in a power system network;

[0055] S200: based on a pre-trained power network security vertical large model, combining the security event data, performing deep semantic analysis on a user query statement to generate a user semantic representation;

[0056] S300: establishing a dynamically updated semantic index through a hybrid index architecture to generate an initial retrieval result;

[0057] S400: preprocessing the multi-source heterogeneous security event data to generate semantic features of the security event data, obtaining semantic associations between different modal data through the semantic features, and constructing a cross-modal threat graph;

[0058] S500: combining the user semantic representation, the initial retrieval result, and the threat graph, based on interaction feedback with the user and using reinforcement learning to dynamically adjust a query strategy, optimizing matching weights of semantic features in the query process, and generating a query result;

[0059] S600: performing semantic aggregation and visual presentation on the query result, and generating threat impact analysis and defense suggestions.

[0060] To address the above-mentioned existing problems, the application uses steps S100-S600 to perform deep semantic understanding and cross-modal association analysis, which improves query accuracy compared to traditional keyword retrieval, uses a hybrid index architecture and parallel computing technology to improve response efficiency, enhances threat detection capabilities through multi-modal semantic association and threat graph construction, and a reinforcement learning-driven query optimization mechanism can automatically learn user query habits and professional knowledge to improve human-computer collaboration efficiency; meanwhile, the overall method is based on a plug-in architecture and a dynamic optimization mechanism of a vertical large model, which can enhance system adaptability.

[0061] Embodiment 2, refer to Figure 1 For an embodiment of the application, based on the above embodiment, a semantic-driven intelligent query method based on a security event library is provided.

[0062] In the present application embodiment, in step S100, multi-source heterogeneous security event data in a power system network is acquired;

[0063] Specifically, the multi-source heterogeneous security event data can include log data, traffic data, vulnerability reports, attack samples, and the like.

[0064] In an optional embodiment, a distributed collection architecture can be adopted, and collection agents can be deployed at key nodes of the power system, such as substations, dispatching centers, and data centers, to realize real-time collection of multi-source heterogeneous security event data. Among them, the collection of log data can be realized through a standardized log collection protocol, such as Syslog, JSON log collection network equipment, security equipment, and host system log data, and a custom log analysis plug-in can be supported to process non-standard format logs. The collection of traffic data can be realized through high-performance packet capture technology, such as DPDK combined with NetFlow, sFlow, and other traffic statistics technology, to obtain macroscopic features and microscopic behavior data of network traffic. The collection of vulnerability reports can be realized through API interface connection with internal vulnerability management systems and external threat intelligence platforms such as CVE, NVD, etc., to obtain real-time vulnerability information and threat intelligence. The collection of attack samples can be realized through the deployment of sample capture modules in honeypot systems and intrusion detection systems to automatically collect and store various attack samples, including malicious codes and attack payloads.

[0065] In another optional embodiment, based on the data collected in the above embodiment, the data can be first subjected to preliminary cleaning and format standardization processing to remove noise data and duplicate records, and then transmitted to the data processing layer through a message queue such as Kafka to ensure the stability of data collection in a high-concurrency scenario.

[0066] In the embodiment of the present application, the pre-trained power grid security vertical large model in step S200 includes the following steps A1-A2:

[0067] A1: trained by fusing general network security knowledge base, power system specific attack and defense data, and historical security event cases;

[0068] In an optional embodiment, the power grid security vertical large model can select the Qwen2.5-Instruct series model as the basic architecture, which has excellent performance in natural language understanding and generation tasks.

[0069] Specifically, the general network security knowledge base includes laws and regulations, academic papers, industry standards, etc., which are used to build a basic security knowledge system; the power system specific attack and defense data includes attack cases, defense strategies, and system architecture information specific to the power industry, such as the security features of SCADA systems and power-specific protocols (IEC60870-5, etc.); the historical security event cases can include power system security event data in the past 5 years, such as event description, impact range, and disposal process, to form a professional corpus.

[0070] A2: an adversarial training mechanism is introduced in the training process to improve the anti-attack ability of the model.

[0071] Specifically, based on the deep reinforcement learning framework described below, the semantic deception attacks of attackers, such as synonym replacement and semantic confusion, can be simulated, and the anti-interference ability of the large model can be trained to improve the robustness of semantic understanding.

[0072] In the embodiment of the present application, in step S200, the user query statement is subjected to deep semantic parsing in combination with the security event data to generate a user semantic representation;

[0073] Specifically, the semantic parsing process includes entity recognition, relationship extraction, and context modeling.

[0074] In an optional embodiment, entity recognition can use named entity recognition (NER) technology to identify security entities in the query statement, such as vulnerability types (SQL injection), attack tools (Metasploit), asset types (SCADA system), etc. Relationship extraction can construct a query semantic graph by analyzing the semantic relationship between entities, such as "attack on...", "vulnerability caused by...", etc. Context modeling can maintain the context semantic representation of the dialogue history through the memory mechanism of the Transformer architecture for multi-round dialogue queries to achieve coherent semantic understanding.

[0075] In another optional embodiment, based on the above embodiment, a large model optimization step can be added, mainly by establishing evaluation criteria for power system network security vertical large models, including semantic understanding accuracy, professional term recognition rate, context coherence, etc. Feedback data from security analysts and new security event cases are collected regularly to continuously fine-tune the model, ensuring that the model performance improves over time.

[0076] In the embodiment of the present application, in step S300, a dynamically updated semantic index is established through a hybrid index architecture to generate initial retrieval results, including the following steps B1-B4:

[0077] B1: The hybrid index architecture includes a BERT semantic vector index and a keyword inverted index.

[0078] Specifically, the BERT semantic vector index mainly uses a pre-trained large model to convert each security event record into a high-dimensional semantic vector (such as a 768-dimensional BERT vector) to capture the deep semantic features of the event.

[0079] In an optional embodiment, the FAISS (Facebook AI Similarity Search) library can also be used to build an efficient vector index to support fast semantic similarity search. The hierarchical clustering algorithm is used to organize the vector space, which reduces the search complexity and ensures the retrieval efficiency of large-scale data.

[0080] Specifically, the keyword inverted index establishes a traditional inverted index for keywords in the security event record, such as an IP address, a port number, and a vulnerability number, for quickly locating events containing a specific keyword.

[0081] In another optional embodiment, a compression technique can also be used to reduce the storage space of the inverted index and improve the retrieval speed.

[0082] B2: Construct an incremental learning algorithm to automatically update the semantic vector index and the keyword inverted index when new security event data is stored in the database to ensure the real-time nature of the index;

[0083] B3: Index optimization is performed on security event data that exceeds a preset time period, and invalid index items are deleted to release system resources.

[0084] B4: The semantic vector index and the keyword inverted index of BERT are given different dynamic weights to adjust the collaborative retrieval of the two.

[0085] In an optional embodiment, the weights of the semantic index and the keyword index can be automatically adjusted according to the query type in B4. For a complex semantic query, such as "find all supply chain attack events that may affect the power dispatching system", the weight of the semantic index is increased; for an explicit keyword query, such as "find attack events related to IP 192.168.1.100", the keyword index is focused on.

[0086] In another optional embodiment, based on the above embodiment, B4 can also continuously optimize the weight distribution strategy based on the reinforcement learning algorithm constructed in the present application, automatically adjust the parameters of the mixed retrieval based on historical query data and query result feedback, and improve the retrieval effect.

[0087] In the embodiments of the present application, the semantic features of the security event data are generated by preprocessing the multi-source heterogeneous security event data in step S400, the semantic association between different modal data is obtained through the semantic features, and a cross-modal threat graph is constructed, including the following steps C1-C4:

[0088] C1: Uniform semantic annotation is performed on the multi-source heterogeneous security event data, and key semantic features are extracted;

[0089] Specifically, uniform semantic annotation can be performed on different modal data such as log data, traffic data, vulnerability reports, and attack samples to extract key semantic features. For example, the abnormal behavior pattern in the traffic data, such as high-frequency port scanning, is semantically aligned with the alarm events in the log data.

[0090] C2: Convert semantic features of different modalities into a unified semantic representation space for calculating semantic correlation strength;

[0091] Specifically, feature fusion technology is used to convert features of different modalities into a unified semantic representation space, facilitating subsequent correlation analysis.

[0092] C3: Map security event data into a point in a high-dimensional semantic vector space, for use as a graph node;

[0093] Specifically, security events, assets, vulnerabilities, and attackers can be used as graph nodes, and semantic correlations between them, such as attacks, exploits, and impacts, can be used as graph edges.

[0094] C4: Based on graph nodes and semantic correlation strength, generate a cross-modality threat graph using a graph neural network model.

[0095] Specifically, the feature vector of each node is composed of a semantic vector generated by a large model and structured features extracted manually, such as asset importance level and vulnerability severity.

[0096] The weight of the edge is determined by the semantic correlation strength, which is determined by calculating the semantic similarity of the source node and the target node and the domain knowledge rules.

[0097] It should be noted that S400 can realize cross-modality correlation analysis, and can mine the potential correlation between different modal data by using the message passing mechanism of GNN. For example, starting from the abnormal communication pattern in the traffic data, it is associated with the authentication failure event in the log data, and then associated with the related vulnerable points in the vulnerability report, forming a complete attack chain analysis. At the same time, the time sequence relationship of the security event can be considered by introducing the time sequence analysis dimension, and a dynamic threat graph can be constructed to support attack path prediction and traceability analysis.

[0098] In an optional implementation, S400 can also update the threat graph. When new security event data is stored, the threat graph is automatically updated, new nodes and edges are added, and the embedding representation of related nodes is recalculated.

[0099] In another optional implementation, S400 can also perform reasoning on the threat graph. Using graph reasoning algorithms such as PageRank and HITS, key nodes and important correlation paths in the threat graph can be identified to assist security analysts in discovering potential security threats and attack trends.

[0100] In the embodiment of the present application, in step S500, the user semantic representation, the initial retrieval result and the threat graph are combined, the query strategy is dynamically adjusted based on the user interaction feedback and reinforcement learning is used, the matching weight of the semantic feature in the query process is optimized, and the query result is generated, including the following steps D1-D2:

[0101] D1: A user interaction model is constructed, the user query history database is constructed to record the user query data, and the professional field preference and query habit of the user are captured;

[0102] Specifically, the user query data can include: query statement, query time, clicked result item, stay time and other interaction data.

[0103] In an optional embodiment, the attention mechanism can be used to model the user query history.

[0104] D2: A reinforcement learning framework is constructed, the current user semantic representation, the user historical query feature and the feature vector of the initial retrieval result are set as the state space, the adjustment of the semantic matching threshold, the change of the mixed index weight and the selection of different retrieval strategies are set as the action space, and the corresponding reward function is set; the deep DQN algorithm is used in combination with experience replay and target network.

[0105] In an optional embodiment, the retrieval strategy can be exact match, fuzzy match, etc.

[0106] In another optional embodiment, the reward function can be set to be multi-dimensional, and the query accuracy, such as recall rate and precision rate, the user satisfaction, such as click-through rate and result relevance score, and the retrieval efficiency, such as response time, are comprehensively considered.

[0107] In the embodiment of the present application, in step S500, the query strategy is dynamically adjusted based on the user interaction feedback and reinforcement learning, the matching weight of the semantic feature in the query process is optimized, and the query result is generated, further including the following steps D3-D5:

[0108] D3: According to the current state of the user semantic representation and the initial retrieval result, the optimal query optimization action is selected by using the DQN algorithm;

[0109] D4: The retrieval parameters are adjusted, the retrieval is re-executed, and the new retrieval result is obtained;

[0110] D5: According to the feedback of the user interaction model, the reward value is calculated, the state-action-reward-next state transition record is stored in the experience replay buffer, the model is trained by regularly sampling from the experience replay buffer, the network parameters of the DQN are updated, and the query result is generated.

[0111] Specifically, the feedback of the user interaction model can include whether to click, whether to adjust the query condition;

[0112] In an optional implementation, the user's historical query data and professional background can be used to generate personalized query strategies for different users, such as security analysts, operation and maintenance engineers, and management, based on the above implementation in S500.

[0113] In another optional implementation, the above implementation in S500 can provide more query suggestions and guidance for novice users, and support more flexible advanced query options for expert users to meet the needs of different users.

[0114] In the embodiments of the present application, the query results are semantically aggregated and visually presented in step S600. The search results can be semantically clustered to aggregate similar security events into a group, reducing result redundancy. For example, different time SQL injection attack events of the same type are aggregated together, and common features and impacts are labeled.

[0115] In addition, an abstract generation technique is used to generate a concise semantic abstract for each aggregated group to help users quickly grasp the core information of the event. The abstract generation is based on the natural language generation capability of a large model, combined with the key features and context information of the event.

[0116] Specifically, the visual presentation can be designed to have multiple dimensions, including:

[0117] Threat map visualization, which displays security events and their associated relationships in the search results in a graphical manner, supports interactive exploration and filtering.

[0118] Timeline visualization, which displays the development process of security events in chronological order, helps users understand the evolution of attack chains.

[0119] Statistical analysis visualization, which provides statistical analysis charts of various security events, such as vulnerability type distribution and attack source region distribution.

[0120] Support for custom visualization templates, users can adjust the layout and display content of the visualization as needed.

[0121] In the embodiments of the present application, threat impact analysis and defense suggestions are generated in step S600, including:

[0122] Establish a defense strategy knowledge base containing standard handling procedures and best practice cases for various security events;

[0123] Specifically, a hybrid mode of "template + large model generation" can be used to generate a security analysis report: the structured template contains the basic framework and professional terms of the report, ensuring the standardization and professionalism of the report. The above-mentioned pre-trained large model is used to generate the text content of the report, including event description, impact analysis, and treatment suggestions. The model generates natural and fluent analysis text according to the semantic features and context information of the search results. And support the combination of automatic generation and manual editing of the report, security analysts can further modify and improve the generated report.

[0124] According to the semantic features of the query results, match the defense strategies in the knowledge base, and generate defense suggestions combined with the specific environment of the power system. The defense suggestions include technical measures and management measures.

[0125] Specifically, the defense suggestions can be generated by establishing a defense strategy knowledge base, which contains standard treatment processes and best practices for various security events. According to the semantic features of the search results, match the defense strategies in the knowledge base, and generate personalized defense suggestions combined with the specific environment of the power system, such as asset importance and network topology. The defense suggestions include technical measures such as patch installation, policy adjustment and management measures such as security training and process optimization, thereby forming a complete security solution.

[0126] In summary, the present application realizes an efficient and intelligent security event query system through the organic combination of multi-source heterogeneous data acquisition, deep semantic understanding, adaptive index construction, multi-modal correlation analysis, reinforcement learning optimization and intelligent result generation. It is optimized for the characteristics of the power system network security, which can significantly improve the search efficiency and analysis depth of security events, and provides strong support for the safe operation of the power system.

[0127] Embodiment 3, this embodiment takes a typical power system network security event query scenario as an example to illustrate the complete workflow of the method:

[0128] S100: Obtain multi-source heterogeneous security event data in the power system network:

[0129] Real-time collection of network flow data, device logs and vulnerability reports of a provincial power dispatching center. For example, a group of abnormal SCADA system communication flow is captured, and the firewall log records multiple connection attempts from unknown IP.

[0130] S200: Based on the pre-trained power network security vertical large model, combined with security event data, the user query statement is analyzed in depth to generate user semantic representation;

[0131] Security analysts found that the dispatch center system was running abnormally, and through the system interface input query statement: "find all suspicious attack events against SCADA system in the past 24 hours, especially records related to abnormal traffic".

[0132] The dynamic semantic understanding module parses the query statement:

[0133] 1) Identify entities: SCADA system, abnormal traffic, attack events.

[0134] 2) Extract relationships: "attack against", "related to".

[0135] 3) Context modeling: Since it is a single round query, the context is empty, but the module will remember the semantic features of the current query.

[0136] The large model converts the query statement into a 768-dimensional semantic vector, represented as Q = [q1, q2,..., q768].

[0137] S300: Through the hybrid index architecture, a dynamically updated semantic index is established, and the initial retrieval results are generated:

[0138] The adaptive event library index construction module queries the semantic vector index and the keyword inverted index at the same time;

[0139] 1) Semantic vector index: Find the top 1000 security event records with the highest semantic similarity to the query vector Q, and use cosine distance for similarity calculation.

[0140] 2) Keyword inverted index: Find event records containing keywords such as "SCADA", "abnormal traffic", etc.

[0141] The hybrid retrieval strategy automatically adjusts the weight according to the query type. This time the query is complex, the semantic index weight is 70%, and the keyword index weight is 30%.

[0142] S400: Preprocess the multi-source heterogeneous security event data to generate the semantic features of the security event data, and obtain the semantic association between different modal data through the semantic features to construct a cross-modal threat graph:

[0143] 1) The multi-modal semantic association engine performs cross-modal association on the traffic data, log data, and vulnerability reports in the retrieval results:

[0144] It is found that the abnormal traffic comes from IP 192.168.1.50, which has multiple scanning records against SCADA system ports in the firewall log;

[0145] The unpatched remote code execution vulnerability (CVE-2025-1234) mentioned in the vulnerability report is associated with the SCADA system.

[0146] 2) Construct a threat map to show the correlation between attack source IP, target assets, exploited vulnerabilities, and abnormal traffic.

[0147] S500: Based on user interaction feedback and using reinforcement learning, dynamically adjust the query strategy, optimize the matching weight of semantic features in the query process, and generate query results:

[0148] 1) The reinforcement learning-driven query optimization module automatically adjusts the query strategy based on the initial search results and the user's possible needs:

[0149] Discover that the current results lack specific information about attack impact, decide to expand the search scope, and add "attack impact" as an additional query condition;

[0150] Adjust the semantic matching threshold to lower the similarity requirement to obtain more relevant events.

[0151] 2) Perform secondary search to obtain more comprehensive search results.

[0152] S600: Semantically aggregate and visually present the query results, and generate threat impact analysis and defense recommendations.

[0153] The intelligent result generation module processes the search results:

[0154] 1) Semantic aggregation: aggregate similar attack events into a group, such as "port scanning attacks targeting SCADA systems".

[0155] 2) Visual presentation: highlight the attack path in the threat map and use a timeline to show the order of attack events.

[0156] 3) Report generation: generate a brief security analysis report indicating that the possible purpose of the attack is to gain system control by exploiting unpatched vulnerabilities, and recommend immediately installing relevant patches and strengthening border protection.

[0157] Finally, after the security analyst reviews the results, if they believe that the analysis report accurately reflects the current security situation, they click the "Confirm" button. The reinforcement learning module records this interaction data, updates the reward function, and optimizes future query strategies.

[0158] To meet the special needs of power system network security, the large model is optimized as follows: train it by fusing general network security knowledge base, power system-specific attack and defense data, and historical security event cases;

[0159] The adversarial training mechanism is introduced in the training process to improve the model's resistance to attacks.

[0160] Exemplary domain data augmentation:

[0161] 1) Collect security data specific to power systems, including:

[0162] Security vulnerabilities and attack cases of power industrial control systems (such as SCADA, EMS);

[0163] Security features and attack vectors of power-specific communication protocols (such as IEC60870-5, DNP3);

[0164] Power industry security standards and specifications (such as "Provisions for the Security Protection of Power Monitoring Systems").

[0165] 2) Integrate these data into the pre-training and fine-tuning process of the large model to improve the model's understanding of power domain security issues.

[0166] Combined with security assessment indicators, establish an evaluation index system for large models specifically for power system network security, including:

[0167] Professional term recognition accuracy: test the model's ability to recognize power-specific security terms (such as "power secondary system" and "security partition");

[0168] Protocol semantic understanding rate: evaluate the model's understanding of power-specific protocol security-related semantics;

[0169] Attack scenario restoration degree: examine the model's accuracy in analyzing specific attack scenarios of the power system (such as power outage attacks and data tampering).

[0170] Periodically evaluate and optimize the model according to these indicators to ensure that the model's performance meets the security requirements of the power system.

[0171] As for the strengthening of the adversarial ability, special adversarial training scenarios can be designed for the advanced persistent threats (APT) that the power system may face: simulate supply chain attacks against power industrial control systems to train the model to identify hidden attack paths; construct semantic deception attacks against power-specific protocols to improve the model's anti-interference ability. Through continuous adversarial training, the model has stronger security event analysis and threat prediction capabilities, and can cope with the special security challenges faced by the power system.

[0172] Embodiment 4, the above is a schematic scheme of a semantic-driven intelligent query method based on a security event library. It should be noted that the technical scheme of the semantic-driven intelligent query system based on the security event library belongs to the same concept as the technical scheme of the semantic-driven intelligent query method based on the security event library described above. The technical scheme of the semantic-driven intelligent query system based on the security event library in this embodiment is not described in detail. Please refer to the description of the technical scheme of the semantic-driven intelligent query method based on the security event library.

[0173] The embodiment also provides another semantic-driven intelligent query system based on a security event library, which comprises:

[0174] A multi-source heterogeneous security event collection module is configured to acquire multi-source heterogeneous security event data in a power system network.

[0175] A dynamic semantic understanding module is configured to perform deep semantic analysis on a user query statement based on a pre-trained power network security vertical large model in combination with the security event data, and generate a user semantic representation.

[0176] An adaptive event library index construction module is configured to establish a dynamically updated semantic index through a hybrid index architecture, and generate an initial retrieval result.

[0177] A multi-modal semantic correlation module is configured to preprocess the multi-source heterogeneous security event data to generate semantic features of the security event data, obtain semantic correlations between different modal data through the semantic features, and construct a cross-modal threat graph.

[0178] A query optimization module driven by reinforcement learning is configured to combine the user semantic representation, the initial retrieval result and the threat graph, dynamically adjust a query strategy based on interaction feedback with the user and reinforcement learning, optimize matching weights of semantic features in the query process, and generate a query result.

[0179] An intelligent result generation module is configured to perform semantic aggregation and visual presentation on the query result, and generate threat impact analysis and defense suggestions.

[0180] In combination with the inference capability of the generative large model and the execution capability of the security device, the above method and system can realize intelligent security event blocking. The specific technical path is as follows:

[0181] 1. Block strategy semantic generation. When the dynamic semantic understanding module identifies a high-risk security event (such as a zero-day vulnerability attack on a critical power device), the pre-trained power network security vertical large model generates a structured blocking strategy based on historical disposal cases in the security event library. The strategy content includes:

[0182] 1) Block object: Attack source IP, malicious domain name, abnormal process ID, etc. Precise positioning through entity recognition technology.

[0183] 2) Block range: dynamically determine according to the influence range of the attack, such as blocking access to only a specific network segment, or temporarily isolating the affected production area.

[0184] 3) Blocking time: combined with the severity of the attack and the business continuity requirements, generate a blocking rule with a time parameter (such as temporary blocking for 24 hours, and then automatically assess whether to extend).

[0185] 4) Alternative: When the main blocking strategy may affect normal business, the large model will generate alternative strategies (such as traffic mirror analysis instead of complete blocking) for security analysts to choose.

[0186] 2. Multi-device adaptation of blocking strategies, intelligent plug-in mechanism converts semantic blocking strategies into device executable configuration instructions according to the capability characteristics of the target security device. For example:

[0187] 1) For firewall devices: convert blocking strategies into ACL access control rules and deliver them through the Netconf protocol.

[0188] 2) For IPS devices: generate feature signature rules and transmit them through the IDMEF protocol.

[0189] 3) For terminal management systems: generate terminal policies such as process blocking and network port restriction, and execute them through terminal management protocols (such as WS-Management).

[0190] During the conversion process, the system automatically verifies device compatibility. If the target device does not support a certain blocking function, the system will automatically adjust the strategy and prompt the security analyst.

[0191] 3. Semantic evaluation of blocking effect: After the execution of the blocking strategy, the system continuously monitors the changes in related security events through the multi-modal semantic association engine to evaluate the blocking effect. The evaluation dimensions include:

[0192] 1) Attack behavior suppression rate: calculate the suppression effect by comparing the number of attack events before and after blocking.

[0193] 2) Business impact: analyze the impact of the blocking strategy on normal business traffic and determine whether there is false blocking through semantic analysis.

[0194] 3) Threat propagation blocking rate: track the subsequent development of the attack path in the threat graph to determine whether the blocking has successfully cut off the threat propagation chain.

[0195] The evaluation results will be fed back to the reinforcement learning module as an important basis for optimizing the blocking strategy generation model, forming a "detection-blocking-evaluation-optimization" closed loop.

[0196] 4. Adaptive blocking strategy evolution, the system continuously learns new attack patterns and blocking effect data to optimize the blocking strategy generation model. When a new attack is discovered, such as a semantic confusion attack generated using a large model, security analysts can use an interactive labeling tool to perform semantic labeling on the attack case. These labeled data will be injected into the fine-tuning process of the large model, allowing the model to quickly master the blocking semantic features of new attacks. At the same time, the system will automatically update the blocking strategy templates in the security event library, enabling continuous evolution of blocking capabilities.

[0197] For current advanced attacks using generative large models, such as semantic deception and adversarial sample generation, the above method and system can implement a multi-level adversarial defense mechanism:

[0198] 1. Large model adversarial sample detection: Integrate an adversarial sample detection sub-module into the dynamic semantic understanding module, using the following techniques to identify malicious semantic inputs:

[0199] 1) Abnormal semantic pattern detection: Train a generative large model to learn the semantic distribution of normal and safe queries, and establish a semantic anomaly detection model. When the semantic vector of the received query statement deviates from the normal distribution by more than 3 standard deviations, an alarm is triggered. For example, identify queries that contain an abnormal combination of "legal" and "attack" semantic features, such as "how to legally bypass the security protection of the power system".

[0200] 2) Gradient masking technology: Add gradient perturbation during large model inference to make gradient attacks on adversarial samples ineffective. Specifically, add random noise to the output of each layer of the model, and adjust the noise intensity dynamically based on the adversarial risk level.

[0201] 3) Multi-model cross-validation: Deploy multiple large models with different architectures, such as GPT-based models and BERT-based models for collaborative inference. When the semantic understanding results of each model differ by more than a pre-set threshold, it is determined to be a possible adversarial attack.

[0202] 2. Semantic deception defense mechanism, to prevent attackers from using semantic ambiguity to perform deceptive queries, the system implements the following defense measures:

[0203] 1) Semantic disambiguation enhancement: Introduce an electric power domain knowledge graph in the entity recognition phase to disambiguate potentially ambiguous security terms. For example, "injection" in the electric power domain may refer to "data injection" or "attack injection", and the system determines the correct semantics by associating the context (such as the presence of keywords such as "attack" and "vulnerability") through the knowledge graph.

[0204] 2) Context consistency check: For multi-round dialogue queries, maintain a semantic chain of dialogue history, check the semantic consistency of the current query with the historical context. When a semantic jump or contradiction is found (such as the previous round of query normal operation, the next round suddenly queries the attack method), the user is required to perform secondary identity verification.

[0205] 3) Traceability semantic labeling: Add traceability semantic labeling to each security event record, including data source, collection time, credibility evaluation, etc. When semantic analysis, prefer to use high-credibility data sources for event records, and reduce the impact of untrusted data.

[0206] 3. Attack and defense knowledge base construction, based on the historical attack and defense data in the security event library, a dynamically updated attack and defense knowledge base is constructed, which contains:

[0207] 1) Attack method semantic feature library: Collect and organize the semantic features of various attack methods using large models, such as phishing email semantic templates, malicious query keyword combination patterns.

[0208] 2) Defense strategy semantic library: Store the semantic representation of defense strategies against different attack methods, and realize the rapid calling of defense strategies through the intelligent plug-in mechanism.

[0209] 3) Antagonistic case library: Record typical attack and defense cases, including attack semantic features, defense process and results, for large model antagonistic training.

[0210] The knowledge base is organized through a graph neural network, supporting fast retrieval and correlation analysis based on semantics, providing knowledge support for defense against confrontation.

[0211] 4. Reinforcement learning driven dynamic defense, modeling the attack and defense process as a reinforcement learning problem, constructing a defense decision-making agent:

[0212] 1) State space: including the semantic features of the current attack, the defense measures taken, the system security state, etc.

[0213] 2) Action space: including adjusting the semantic detection threshold, enabling specific defense modules, updating the confrontation knowledge base, etc.

[0214] 3) Reward function: design a reward mechanism based on successful defense times, system resource consumption, business impact, etc.

[0215] The agent is trained through interaction with the simulated attack environment, continuously optimizing the defense strategy and improving the adaptive defense capability against new antagonistic attacks. In practical applications, the agent regularly conducts antagonistic exercises with attack models from external security research institutions to continuously improve defense levels.

[0216] The power network security vertical large model of the above method and system realizes continuous optimization based on the security event library through the following process:

[0217] 1. Construction and maintenance of security event library:

[0218] 1) Multi-source data fusion: Integrate internal security logs of power enterprises (such as firewall logs, intrusion detection logs), external threat intelligence (such as CVE vulnerability library, threat intelligence platform data), and historical security event reports to form a structured security event library. Entity alignment technology is used in the data fusion process to ensure semantic consistency of data from different sources, such as unifying different expressions of "SQL injection" into standard terminology.

[0219] 2) Event semantic annotation: Key events in the event library are annotated by security experts in the power industry, including event type, attack method, impact range, and disposal measures. The annotation process uses a semi-automatic method, first generating preliminary annotation results by a large model, and then correcting them by experts to improve annotation efficiency.

[0220] 3) Dynamic update mechanism: The event library is updated at an hourly level, with new data including the latest power system security events, new attack method records, and industry best practices to ensure the timeliness of the information in the library.

[0221] 2. Large model pre-training and fine-tuning strategy:

[0222] 1) Pre-training phase: Adopt a hierarchical pre-training strategy of "general security knowledge + power field data". First, pre-train on a general network security corpus to build a basic security knowledge system; then perform domain adaptation pre-training on a security event library specific to the power system to learn security semantic features specific to the power field, such as attack patterns of power industrial control systems and security terms of power-specific protocols.

[0223] 2) Fine-tuning phase: Design multi-task fine-tuning for specific application scenarios:

[0224] Semantic understanding task: Train the model to accurately understand the semantics of security query statements, including entity recognition, relationship extraction, and intent classification;

[0225] Event generation task: Train the model to generate a standard event description based on the semantic features of the security event, for automatic archiving of the event library;

[0226] Strategy generation task: Train the model to generate a reasonable disposal strategy based on the semantic features of the event to assist security analysts in decision-making.

[0227] 3) Adversarial training: Introduce adversarial samples during fine-tuning to simulate semantic attacks by attackers and enhance the robustness of the model. For example, construct malicious query samples containing semantic confusion and keyword replacement, and train the model to identify such attacks.

[0228] 3. Evaluation criteria and model optimization:

[0229] 1) Establish a dedicated evaluation index system for large power network security vertical models:

[0230] Professional term accuracy (PTA): The ability of the test model to recognize and understand professional terms specific to power security, such as "power secondary system security partition" and "forward physical isolation device". The understanding accuracy of such terms should not be less than 95%;

[0231] Event correlation accuracy (ECA): Evaluate the model's ability to identify semantic correlations between security events, such as determining the correlation between "a vulnerability exploit" and "subsequent data theft" events. The accuracy should not be less than 90%;

[0232] Strategy generation rationality (SPR): Security experts score the rationality of the disposal strategies generated by the model, with an average score of 4 or above (out of 5).

[0233] 2) Model optimization process: Regularly (monthly) evaluate the model using the latest security event library data. If a certain indicator is below the threshold, start targeted optimization training. Optimization training uses incremental learning, only fine-tuning relevant layers of the model to avoid disrupting existing knowledge systems. At the same time, collect feedback data from security analysts in actual use (such as query cases where the model misunderstood), as an important basis for model optimization.

[0234] 4. Knowledge distillation and lightweight deployment:

[0235] 1) To achieve lightweight deployment of large models on edge security devices, use knowledge distillation technology to compress large vertical models pre-trained into lightweight models:

[0236] Teacher model: Large vertical model pre-trained based on security event library, with strong semantic understanding ability;

[0237] Student model: Lightweight model with simplified structure, such as reduced number of layers in the Transformer architecture;

[0238] Distillation process: Train the student model to mimic the teacher model's reasoning process on the security event library, retaining core semantic understanding while reducing model parameters by more than 80%, meeting the computational power limitations of edge devices.

[0239] 2) Model update on edge devices: Adopting a federated learning framework, each edge node fine-tunes the model using local security event data, periodically aggregates fine-tuned parameters to the center model, and the center model distributes the updated model to edge nodes, realizing the collaborative evolution of model capabilities while protecting local data privacy.

[0240] The above method and system expand the realization of professional security report generation and question and answer consulting functions based on semantic-driven intelligent query capabilities:

[0241] 1. Intelligent security report generation technology:

[0242] 1) Report template semantic modeling: Analyze the structure and semantic characteristics of common security reports in the power industry (such as safety situation monthly reports, event analysis special reports, risk assessment reports), and build a multi-level report template semantic model. The template includes:

[0243] Structured framework: Define the chapter structure and data index items of the report;

[0244] Semantic filling rules: Specify the semantic source and generation logic of each chapter content, such as the "attack trend analysis" chapter needs to be based on the time series semantic features of the queried event data to generate;

[0245] Professional term constraints: Define the power safety professional terms that must be used in the report and their correct usage.

[0246] 2) Data to semantic conversion: Convert the queried security event data into natural language description semantics through large models. For example, "12 port scanning events against SCADA systems occurred on June 1, 2025" is converted to "This month, monitoring shows that port probing activities against power monitoring systems increased by 23% compared to the same period last month, with SCADA systems becoming the main target, and attack source IP showing a decentralized feature."

[0247] 3) Report semantic aggregation and optimization: Aggregate the semantic content of each chapter to ensure the semantic coherence and logical consistency of the overall report. For example, in the "security recommendations" chapter, specific recommendations will be generated based on the semantic conclusions of the "event analysis" chapter to avoid disconnection between recommendations and analysis. At the same time, the large model will automatically optimize language expression to make the report comply with the professional document specifications of the power industry.

[0248] 4) Visual semantic association: Semantically associate key data in the report with threat graphs and embed interactive visualization components (such as attack path graphs and risk heat maps) in the report. Users can trigger semantic queries of related security events by clicking on the visualization elements, enabling in-depth exploration of report content.

[0249] 2. Network security field question and answer consulting system:

[0250] 1) Question and Answer Semantic Understanding Module: Utilize multi-round dialogue semantic modeling technology to accurately understand user's safety consultation questions. For complex questions (such as "How to defend against supply chain attacks on power Internet of Things devices"), the system will decompose into multiple sub-questions, gradually guide the user to supplement necessary information, and form a complete semantic understanding. For example, first confirm the type of Internet of Things device, deployment scenario, then analyze the possible supply chain attack path, and finally generate defense recommendations.

[0251] 2) Answer Semantic Generation Module: Based on the knowledge in the security event library and the relevant event data queried, generate structured answers. The answer contains:

[0252] Question Analysis: Explain the core semantics and key points of the question in natural language;

[0253] Knowledge Reference: Reference relevant cases or best practices in the security event library to enhance the credibility of the answer, such as "According to the similar event handling records of a certain province power company in 2024 (event ID: 20240915), the following measures are recommended... ";

[0254] Operation Suggestions: Convert abstract defense strategies into specific operation steps, with clear semantics and operability.

[0255] 3) Real-time Interaction Optimization: Learn user's question and answer habits and professional level through reinforcement learning mechanism, dynamically adjust the detail and professional depth of the answer. For novice users, provide more popular explanations and examples; for professional security analysts, provide more technical details and data support. At the same time, the system records the semantic context of historical question and answer sessions, supports cross-session knowledge continuation, such as when the user queries "previous mentioned vulnerability patch installation steps", the system can associate with relevant content in the historical dialogue.

[0256] 3. Semantic-driven intelligent query expansion application:

[0257] 1) Security Training Assistance: Based on the semantic generation capability of the security event library and large model, generate scenario-based security training cases. For example, according to the semantic characteristics of historical attack events, generate training question and answer for simulated attack scenarios, help employees improve safety awareness and emergency response ability.

[0258] 2) Compliance Audit Support: Convert power industry safety compliance requirements (such as EPSP 2.0, power monitoring system protection regulations) into semantic rules, and perform semantic matching with data in the security event library to automatically generate compliance audit reports, pointing out the semantic basis and rectification suggestions for non-compliance items.

[0259] 3) Threat intelligence generation: semantic clustering and trend analysis on data in the security event library, generating exclusive threat intelligence reports for the power industry, including semantic features of new attack methods, semantic distribution of security events in the industry, semantic prediction of potential threats, etc., to support strategic security decision-making.

[0260] To ensure the performance of the system in large-scale deployment in the power system, the following optimizations are made and verified through actual scenarios:

[0261] 1. Distributed architecture performance optimization:

[0262] 1) Index distributed storage: divide the adaptive event library index into multiple shards and distribute them on different index servers, achieving load balancing through consistent hashing algorithm. In a 10-node cluster environment, support more than 100,000 semantic query requests per second.

[0263] 2) Large model parallel inference: use a combination of model parallelism and data parallelism to distribute different layers of large models across different GPU nodes, while processing query requests in batches. In a server with 8 A100 GPUs, a single node can support more than 500 complex semantic queries per second.

[0264] 3) Streaming semantic processing: use a streaming semantic processing architecture for real-time security event data collection, and use the Apache Flink framework to implement real-time semantics for events.

[0265] Embodiment 5, in order to realize the network security device management technology based on large model plug-in, the system of the present application can adopt the implementation of plug-in architecture, the specific implementation is as follows:

[0266] 1. Plug-in interface specification:

[0267] Define a unified plug-in interface standard, including data input / output format, function call protocol, security authentication mechanism, etc. Plug-ins interact with system core modules through standardized interfaces to ensure compatibility and scalability.

[0268] 2. Plug-in management engine:

[0269] Design a plug-in management engine responsible for plug-in registration, loading, unloading, and state monitoring. Support hot plug functionality, allowing dynamic addition or removal of plug-ins without restarting the system.

[0270] 3. Integration of third-party security tools:

[0271] Integrate third-party security tools through plug-in mechanism, such as vulnerability scanners, intrusion detection systems, security information and event management (SIEM) systems, etc. For example, integrate Nmap-GPT plug-in to achieve intelligent port scanning result analysis, or integrate BurpGPT plug-in to assist web application security testing.

[0272] 4. Customized function extension:

[0273] Provide plug-in development kit (SDK) to allow users to develop custom plug-ins according to their own needs. For example, power enterprises can develop security event analysis plug-ins for specific power protocols (such as IEC61850) to enhance the system's support capabilities in specialized fields.

[0274] The deployment of the system in the power network strictly follows the "Provisions for the Security Protection of Electric Power Monitoring Systems", and adopts a layered and partitioned deployment architecture to realize intelligent linkage with security devices such as firewalls, intrusion prevention systems (IPS), web application firewalls (WAF), etc. The specific deployment steps can be as follows:

[0275] 1) Core layer deployment: Hang the core server of the system, including the semantic understanding server, index server and graph database server, next to the core switch of the power dispatching data center to form the core node of security event analysis. This layer interacts with the electric power monitoring system (EMS) and energy management system (SCADA) through a dedicated secure data exchange platform, and the interaction process is encrypted using the national SM4 algorithm to ensure data transmission security.

[0276] 2) Boundary layer integration: Deploy intelligent plug-in agents at the Internet exit boundary to realize two-way linkage with boundary security devices (such as next-generation firewalls NGFW, DDoS protection devices) through standardized plug-in interfaces. When the system detects external attack events, it automatically issues access control policies to the firewall through intelligent plug-ins to realize real-time blocking of attack sources. For example, when detecting a SQL injection attack on the power trading platform, the system will generate blocking rules containing attack features (such as specific SQL statement patterns) and push them to the WAF in real time through the plug-in interface to achieve millisecond-level response to attacks.

[0277] 3) Terminal layer linkage: Deploy lightweight semantic agent plug-ins on important production control terminals (such as dispatcher workstations, protection device management terminals) to collect terminal logs and perform real-time semantic analysis. When abnormal behavior (such as unauthorized configuration modification, abnormal process startup) is found, the plug-in will upload the semantic features of the abnormal event to the core layer system, and simultaneously execute preliminary isolation measures (such as closing abnormal processes, limiting network access) on the terminal side according to preset policies.

[0278] 4) Cross-device linkage strategy: based on the threat graph constructed by the multi-modal semantic association engine, the system supports cross-security device linkage defense. For example, when the traffic analysis device detects abnormal communication traffic, the system automatically associates the access log of the firewall and the security log of the terminal, and if it is confirmed to be a malicious attack, the traffic filtering strategy is started on the traffic cleaning device, the access control rules are updated on the firewall, and the behavior monitoring strategy is deployed on the terminal, forming a three-dimensional defense system. The generation of linkage strategy is based on the dynamic optimization of reinforcement learning module, which continuously adjusts the response priority and strategy combination of each device through historical linkage effect data to improve linkage efficiency.

[0279] Through the above plug-in architecture design, the system can flexibly adapt to the security needs of different power systems, quickly integrate new security technologies and tools, and maintain the advanced nature and practicality of the technology.

[0280] The embodiment also provides a computer device suitable for a case of semantic-driven intelligent query based on a security event library, including a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the method for implementing semantic-driven intelligent query based on a security event library as proposed in the above embodiment.

[0281] The embodiment also provides a storage medium having a computer program stored thereon, and the program is executed by a processor to realize the method for implementing semantic-driven intelligent query based on a security event library as proposed in the above embodiment.

[0282] The storage medium proposed in the embodiment and the method for implementing semantic-driven intelligent query based on a security event library proposed in the above embodiment belong to the same inventive concept, and the technical details not described in detail in the embodiment can be referred to the above embodiment, and the embodiment and the above embodiment have the same beneficial effects.

[0283] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary general hardware, and of course can also be realized by hardware. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH memory, a hard disk, or an optical disc, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods of various embodiments of the present application.

[0284] It should be noted that the above examples are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced, without departing from the spirit and scope of the technical solutions of the present application, which should be covered in the scope of the claims of the present application.

Claims

1. A method for semantic-driven intelligent query based on security event repository, characterized in that, The application relates to a method for query optimization of power system security events, comprising the following steps: acquiring multi-source heterogeneous security event data in a power system network; based on a pre-trained power network security vertical large model, combining security event data, performing deep semantic analysis on a user query statement to generate a user semantic representation; establishing a dynamically updated semantic index through a hybrid index architecture to generate an initial retrieval result; preprocessing the multi-source heterogeneous security event data to generate semantic features of the security event data, obtaining semantic correlations between different modal data through the semantic features, and constructing a cross-modal threat graph; combining the user semantic representation, the initial retrieval result and the threat graph, dynamically adjusting a query strategy based on interaction feedback with the user and using reinforcement learning to optimize matching weights of semantic features in the query process to generate a query result; performing semantic aggregation and visual presentation on the query result, and generating threat impact analysis and defense suggestions.

2. The method of claim 1, wherein the method is based on a security event library. The pre-trained power network security vertical large model comprises the following steps: training through fusion of a general network security knowledge base, attack and defense data specific to the power system and historical security event cases; introducing an adversarial training mechanism in the training process to improve the attack resistance of the model.

3. The semantic driven intelligent query method based on security event library of claim 2, wherein, The dynamically updated semantic index is established through the hybrid index architecture to generate the initial retrieval result, comprising the following steps: the hybrid index architecture comprises a semantic vector index and a keyword inverted index of BERT; an incremental learning algorithm is constructed, and when new security event data is stored in the database, the semantic vector index and the keyword inverted index are automatically updated; index optimization is performed on security event data that exceeds a preset time period, and invalid index items are deleted; by assigning different dynamic weights to the semantic vector index and the keyword inverted index of BERT, the collaborative retrieval of the two is adjusted and realized.

4. The method of claim 3, wherein the method is based on a security event library. The semantic features of the security event data are generated by preprocessing the multi-source heterogeneous security event data, the semantic correlations between different modal data are obtained through the semantic features, and a cross-modal threat graph is constructed, comprising the following steps: performing unified semantic labeling on the multi-source heterogeneous security event data to extract key semantic features; converting semantic features of different modalities into a unified semantic representation space for calculating semantic correlation strength; mapping the security event data into points in a high-dimensional semantic vector space for use as graph nodes; based on the graph nodes and the semantic correlation strength, a graph neural network model is used to generate a cross-modal threat graph.

5. The semantic driven intelligent query method based on security event library of claim 4, wherein, The query result is generated by combining the user semantic representation, the initial retrieval result and the threat graph, dynamically adjusting the query strategy based on interaction feedback with the user and using reinforcement learning to optimize matching weights of semantic features in the query process, comprising the following steps: a user interaction model is constructed, a user query history database is constructed to record user query data, and professional field preferences and query habits of the user are captured; a reinforcement learning framework is constructed, the current user semantic representation, user historical query features and feature vectors of the initial retrieval result are set as a state space, adjusting a semantic matching threshold, changing a hybrid index weight and selecting different retrieval strategies are set as an action space, and a corresponding reward function is set; a deep DQN algorithm is used in combination with experience replay and a target network.

6. The method of claim 5, wherein the method is based on a security event library. The query strategy is dynamically adjusted based on the user interaction feedback and reinforcement learning, the matching weight of the semantic features in the query process is optimized, and the query result is generated. According to the current state of the user semantic representation and the initial retrieval result, the DQN algorithm is used to select the optimal query optimization action. Adjust the retrieval parameters and re-execute the retrieval to obtain new retrieval results. According to the feedback of the user interaction model, the reward value is calculated, the state-action-reward-next state transition record is stored in the experience replay buffer, and the model is trained by regularly sampling from the experience replay buffer, the network parameters of the DQN are updated, and the query result is generated.

7. The semantic driven intelligent query method based on security event library of claim 6, wherein, Generate threat impact analysis and defense suggestions, including: Establish a defense strategy knowledge base containing standard disposal processes and best practice cases for various security events; According to the semantic features of the query result, match the defense strategy in the knowledge base, and generate defense suggestions combining with the specific environment of the power system, the defense suggestions include technical measures and management measures.

8. A semantic-driven intelligent query system based on a security event library, applying the method according to any one of claims 1 to 7, characterized in that, It includes: A multi-source heterogeneous security event collection module is used to obtain multi-source heterogeneous security event data in the power system network. A dynamic semantic understanding module is used to perform deep semantic analysis on user query statements based on a pre-trained power network security vertical large model and security event data to generate user semantic representations. An adaptive event library index construction module is used to establish a dynamically updated semantic index through a hybrid index architecture to generate initial retrieval results. A multi-modal semantic association module is used to preprocess multi-source heterogeneous security event data to generate semantic features of the security event data, and obtain semantic associations between different modal data through the semantic features to construct a cross-modal threat graph. A reinforcement learning driven query optimization module is used to combine user semantic representations, initial retrieval results and threat graphs, dynamically adjust query strategies based on user interaction feedback and reinforcement learning, optimize matching weights of semantic features in the query process, and generate query results. An intelligent result generation module is used to perform semantic aggregation and visual presentation of the query results, and generate threat impact analysis and defense suggestions.

9. A computer device, comprising: It includes: A memory and a processor; The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions, which realize the steps of the semantic driven intelligent query method based on the security event library in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores computer executable instructions, which realize the steps of the semantic driven intelligent query method based on the security event library in any one of claims 1 to 7.

Images