Network attack processing control method, system and electronic device

Abstract

The application provides a network attack processing control method and system and electronic equipment, and relates to the field of network attack processing. The method can be responsible for semantic reasoning through LLM, realize semantic situation awareness, automatically restore attack causal chains from unstructured text, realize scene recovery from alarm accumulation, and the like. In addition, the method can realize strategy generation and final execution through SOAR, realize dynamic response of execution, and can be optimized in real time through setting of a reward function, so that the processing effect during network attack is greatly improved.

Description

Technical Field

[0001] This invention relates to the field of network attack handling, and in particular to a network attack handling control method, system, and electronic device. Background Technology

[0002] As cyberattacks become increasingly intelligent and automated, traditional SOAR (Security Orchestration, Automation, and Response) systems based on rule matching and human scripts are gradually becoming unable to cope with increasingly complex adversarial scenarios. Traditional solutions mainly suffer from the following problems:

[0003] Rule rigidity and delayed response: Current SOAR systems rely primarily on rules predefined by security experts, lacking context-adaptive capabilities. Faced with constantly evolving attack methods (such as APT attacks and multi-stage chain attacks), their update cycles are long and response delays are high.

[0004] Weak semantic understanding and causal reasoning: When processing security alerts, malware analysis, endpoint logs, or threat intelligence texts, most systems still rely on keyword-level semantic analysis, failing to logically deduce the attack intent and stages. For example, a system might identify "abnormal login" and "file access" events, but struggle to infer that they belong to the same attack process.

[0005] Data heterogeneity and context fragmentation: Security data encompasses various types, including network traffic, endpoint behavior, threat intelligence, and user logs. Existing systems still face bottlenecks in the semantic fusion and unified representation of cross-modal data, resulting in severe information silos and making it difficult to fully reconstruct attack chains.

[0006] The response process is opaque and lacks interpretability: The lack of a clear logical description in the execution of automated responses makes it difficult for security experts to verify the credibility of the system's decisions and the traceability of audits.

[0007] Lack of self-evolution and autonomous learning capabilities: The system is unable to optimize model parameters and response decisions based on historical results, relies on manual tuning in the long term, and is difficult to achieve closed-loop intelligence.

[0008] In recent years, LLM (Large Language Model) has shown outstanding performance in natural language reasoning and knowledge retrieval, but its application in high-security applications is still limited by computational overhead, real-time performance, and interpretability. Currently, there is no architecture that can achieve "semantic understanding + programmatic response + self-learning closed loop" in industrial environments, resulting in poor performance in handling network attacks. Summary of the Invention

[0009] In view of this, the purpose of this invention is to provide a network attack handling and control method, system, and electronic device. This method can use LLM to handle semantic reasoning, realize semantic situational awareness, automatically reconstruct the causal chain of attacks from unstructured text, and realize scene reconstruction from alarm accumulation. In addition, this method can use SOAR to realize policy generation and final execution, realize dynamic response of execution, and can be optimized in real time by setting reward function, thereby significantly improving the handling effect during network attacks.

[0010] In a first aspect, embodiments of the present invention provide a network attack handling and control method, the method comprising:

[0011] Preprocessing steps: Real-time acquisition of network data to be identified; determination of security events in the network data using the structural parameters corresponding to the network data; and determination of preprocessed data corresponding to the network data to be identified based on the semantic labels of the security events.

[0012] Semantic reasoning steps: Based on semantic tags, determine the attack phase data, attack intent data, and target entity data corresponding to the security event in the preprocessed data, and use the attack phase data, attack intent data, and target entity data to determine the semantic result corresponding to the security event;

[0013] Threat graph construction steps: Calculate the semantic similarity between each security event based on the semantic results, and construct the threat graph corresponding to the security events based on the semantic similarity;

[0014] Strategy generation steps: Determine the attack handling strategies corresponding to security events through semantic results and threat graphs;

[0015] Results acquisition steps: After isolating security events using attack handling strategies, the isolation results of security events are summarized based on structural parameters to obtain the network attack summary results corresponding to the network data to be identified.

[0016] Optional preprocessing steps include:

[0017] Based on the target source devices of network attacks, probe devices, host terminal devices, and intelligence center devices can be identified.

[0018] Real-time acquisition of network data to be identified is achieved using probe devices, host terminal devices, and intelligence center devices.

[0019] Determine the structural parameters based on the structural attributes of the network data to be identified, and determine the data parsing strategy corresponding to the structural parameters;

[0020] After using a data parsing strategy to parse the network data to be identified, the security events contained in the network data and their corresponding semantic tags are obtained.

[0021] The event stream message data corresponding to the network to be identified is obtained through semantic tags, and the preprocessed data corresponding to the network to be identified is determined based on the event stream message data.

[0022] Optional semantic reasoning steps include:

[0023] Based on the security events identified by the preprocessed data, the attack phase data is determined from one or more of the above-mentioned phases: reconnaissance, initial access, lateral movement, penetration, and persistence.

[0024] Based on the log data and intelligence data corresponding to the security events identified by the preprocessed data, attack intent data is determined.

[0025] Based on the security event identified by the preprocessed data, determine the target entity data corresponding to the attack source IP, attack source port, target IP, target port, protocol, session token, file address name, user account, or one or more of the above entity data.

[0026] Semantic tags are used to determine the semantic relationships between attack phase data, attack intent data, and target entity data.

[0027] Semantic relationships are used to determine the semantic cue words corresponding to security events, and a pre-defined LLM model is used to obtain the semantic results corresponding to the security events under the semantic cue words.

[0028] Optional map construction steps include:

[0029] Obtain keywords corresponding to security events based on semantic results;

[0030] By utilizing the importance parameters of keywords in security incidents, an association vector is constructed for any two security incidents, and the semantic similarity between security incidents is determined based on the association vector.

[0031] Obtain the time interval between two security events, and use the time interval and its corresponding decay coefficient to obtain the edge weights corresponding to semantic similarity;

[0032] Threat graphs for security events are constructed based on semantic similarity and their corresponding edge weights.

[0033] Optionally, the step of obtaining the time interval between two security events and using the time interval and its corresponding decay coefficient to obtain the edge weights corresponding to semantic similarity includes:

[0034] According to the first security incident Second security incident ;

[0035] The first security event was determined based on a unified timeline. With the second security incident The time interval between And determine the decay coefficient corresponding to the time interval. ;

[0036] Obtaining the first security event With the second security incident semantic similarity between Among them, semantic similarity ; First security incident The corresponding TF-IDF vector; For the second security incident The corresponding TF-IDF vector;

[0037] Utilizing time intervals and its corresponding decay coefficient Calculate and obtain the edge weights corresponding to semantic similarity. Among them, the right of the border .

[0038] Optional, the policy generation step includes:

[0039] Utilize semantic results and threat graphs to obtain the handling results and execution logs corresponding to security incidents;

[0040] Based on the handling results and execution logs, determine the detection accuracy, response speed, and false alarm rate corresponding to the security incident;

[0041] A reward function is constructed based on detection accuracy, response speed, and false alarm rate to correspond to security events.

[0042] The reward function is used to determine the attack handling strategy corresponding to the security incident.

[0043] Optionally, the step of constructing the reward function corresponding to the security event based on the detection accuracy, response speed, and false alarm rate includes:

[0044] Determine the detection accuracy corresponding to the security incident Response speed value and detection false alarm rate The corresponding first weight Second weight and the third weight ;in, ;

[0045] Based on detection accuracy Response speed value False alarm rate and its corresponding first weight Second weight and the third weight Construct a reward function corresponding to a security event; where the reward function... .

[0046] Optionally, prior to the result acquisition step, the method may also include a feedback control step, including:

[0047] The semantic update strategy for security events is determined based on the success rate and false alarm rate of the security events, and the semantic update strategy is used to update the semantic results.

[0048] The weight update strategy corresponding to the reward function is determined based on the historical performance data corresponding to the security incident, and the reward function is updated using the weight update strategy.

[0049] Secondly, the present invention provides a network attack handling and control system, the system comprising:

[0050] Preprocessing module: used to acquire network data to be identified in real time, use the structural parameters corresponding to the network data to be identified to determine the security events in the network data to be identified, and determine the preprocessed data corresponding to the network data to be identified based on the semantic tags of the security events.

[0051] Semantic reasoning module: used to determine the attack phase data, attack intent data, and target entity data corresponding to security events in preprocessed data based on semantic tags, and to determine the semantic results corresponding to security events using the attack phase data, attack intent data, and target entity data;

[0052] The threat graph construction module is used to calculate the semantic similarity between each security event based on the semantic results, and to construct the threat graph corresponding to the security events based on the semantic similarity.

[0053] Policy generation module: used to determine the attack handling strategy corresponding to the security incident based on semantic results and threat graph;

[0054] The result acquisition module is used to summarize the results of the isolation of security events based on structural parameters after the security events are isolated using the attack handling strategy, so as to obtain the summary results of network attacks corresponding to the network data to be identified.

[0055] Thirdly, embodiments of the present invention also provide an electronic device, which includes a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the steps of the network attack handling and control method provided in the first aspect.

[0056] Fourthly, embodiments of the present invention also provide a storage medium storing computer-executable instructions, which, when invoked and executed by a processor, cause the processor to implement the steps of the network attack handling and control method provided in the first aspect.

[0057] This invention provides a network attack handling and control method, system, and electronic device. In the process of handling network attacks, the method first acquires network data to be identified in real time, determines security events within the network data using structural parameters corresponding to the network data, and determines preprocessed data corresponding to the network data based on the semantic tags of the security events. Then, based on the semantic tags, it determines attack phase data, attack intent data, and target entity data corresponding to the security events in the preprocessed data, and uses these data to determine the semantic results corresponding to the security events. Subsequently, it calculates the semantic similarity between each security event based on the semantic results, and constructs a threat graph corresponding to the security events based on the semantic similarity. Then, it determines the attack handling strategy corresponding to the security events through the semantic results and the threat graph. Finally, after isolating the security events using the attack handling strategy, it summarizes the isolation results based on the structural parameters to obtain a summary result of network attacks corresponding to the network data to be identified. This method can use LLM to handle semantic reasoning and achieve semantic situational awareness. It can automatically reconstruct the causal chain of attacks from unstructured text and realize the reconstruction of the scene from the accumulation of alarms. In addition, this method can realize policy generation and final execution through SOAR, realize dynamic response of execution, and optimize in real time by setting reward function, thereby significantly improving the processing effect during network attacks.

[0058] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0059] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0060] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0061] Figure 1 A flowchart of a network attack handling and control method provided in an embodiment of the present invention;

[0062] Figure 2 This is a flowchart of the preprocessing step S101 in a network attack handling and control method provided in an embodiment of the present invention;

[0063] Figure 3 This is a flowchart of the semantic reasoning step S102 in a network attack handling and control method provided in an embodiment of the present invention;

[0064] Figure 4 This is a flowchart of the graph construction step S103 in a network attack handling and control method provided in an embodiment of the present invention;

[0065] Figure 5 A flowchart of step S403 in a network attack handling and control method provided in an embodiment of the present invention;

[0066] Figure 6 This is a flowchart of the policy generation step S104 in a network attack handling and control method provided in an embodiment of the present invention;

[0067] Figure 7 A flowchart of step S603 in a network attack handling and control method provided in an embodiment of the present invention;

[0068] Figure 8 This is a flowchart of the feedback control step in a network attack handling and control method provided in an embodiment of the present invention;

[0069] Figure 9 This is a schematic diagram of the structure of a network attack processing and control system provided in an embodiment of the present invention;

[0070] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0071] icon:

[0072] 910 - Preprocessing module; 920 - Semantic reasoning module; 930 - Graph construction module; 940 - Policy generation module; 950 - Result acquisition module;

[0073] 101 - Processor; 102 - Memory; 103 - Bus; 104 - Communication interface. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0075] To facilitate understanding of this embodiment, a network attack handling and control method disclosed in this embodiment of the invention will first be described, such as... Figure 1 As shown, the method includes:

[0076] Preprocessing step S101: Real-time acquisition of network data to be identified, determination of security events in the network data to be identified using the structural parameters corresponding to the network data to be identified, and determination of preprocessed data corresponding to the network data to be identified based on the semantic labels of the security events.

[0077] The core objective of this step is to extract useful information from massive amounts of heterogeneous network data, providing standardized input for subsequent semantic reasoning. First, the system collects multi-source network data in real time, covering a full range of security data, including network traffic data, terminal behavior logs, threat intelligence text, and user operation records. Then, based on the inherent structural parameters of the network data (such as data format specifications, field meaning definitions, and data source characteristics), the system accurately identifies and extracts security events through data cleaning, deduplication, and format standardization. For example, it locates events with security risk attributes, such as "abnormal IP login" and "sensitive file tampering," from terminal logs. Finally, based on a pre-defined semantic tagging system (covering event type, risk level, and involved assets), the extracted security events are assigned unique semantic tags, forming structured and parsable pre-processed data, effectively eliminating the clutter and ambiguity of the original data.

[0078] Semantic reasoning step S102: Based on semantic tags, determine the attack stage data, attack intent data, and target entity data corresponding to the security event in the preprocessed data, and use the attack stage data, attack intent data, and target entity data to determine the semantic result corresponding to the security event.

[0079] This step is crucial for achieving "from alarm accumulation to scenario reconstruction," with LLM leading the deep semantic reasoning. Based on the semantic tags of security events in the preprocessed data, LLM calls upon its built-in threat knowledge base and reasoning model to accurately extract the core elements corresponding to each security event: First, attack phase data, determining which stage of the attack chain the event is in (reconnaissance, penetration, implantation, control, or destruction); second, attack intent data, analyzing the attack targets behind the event, such as stealing core data, paralyzing business systems, or implanting malware; and third, target entity data, identifying the network assets involved in the event, including terminal devices, servers, databases, and user accounts. Through comprehensive analysis and logical deduction of these three types of data, LLM ultimately outputs semantic results containing the core attributes of the event, related clues, and risk assessments, breaking the limitation of traditional systems that can only identify isolated events.

[0080] Threat graph construction step S103: Calculate the semantic similarity between each security event based on the semantic results, and construct the threat graph corresponding to the security events based on the semantic similarity.

[0081] This step aims to construct a visualized threat map through event correlation analysis, providing a complete representation of attack scenarios. First, based on the semantic results output from the semantic reasoning step, the semantic similarity between different security events is calculated. Specifically, this can be achieved from the perspective of attack intent... Figure 1 The attack is quantitatively evaluated based on dimensions such as consistency, target entity relevance, and attack phase continuity. For example, if "abnormal login" and "sensitive file download" point to the same server and are closely linked in time, their semantic similarity is high. Subsequently, security events with semantic similarity reaching a threshold are correlated and aggregated to visually represent the causal, temporal, and dependency relationships between events in a graph format, forming a threat graph covering multiple events and all phases. Through this graph, security personnel can clearly see the complete path of an attack from initiation to execution, solving the problem of broken attack chains caused by the "information silos" of traditional systems.

[0082] Strategy generation step S104: Determine the attack handling strategy corresponding to the security event through semantic results and threat graph.

[0083] This step can be led by the SOAR system, realizing the transformation from semantic analysis to execution strategy. The SOAR system combines the semantic reasoning results with the attack posture presented by the threat graph, and calls upon its built-in security policy library and automated response templates to formulate precise attack handling strategies for different attack scenarios. Strategy formulation fully considers the attack phase (e.g., focusing on blocking information leakage during the reconnaissance phase, and focusing on business isolation during the damage phase), the importance of the target entity (e.g., prioritizing high-strength protection for core databases), and the attack intent (e.g., focusing on data encryption and source tracing for data theft attacks). The handling strategy not only includes specific actions (e.g., blocking abnormal IP connections, isolating infected terminals, and cleaning malicious files), but also clearly defines the execution order and priority of these actions, ensuring a scientific and efficient response.

[0084] Result acquisition step S105: After isolating the security event using the attack handling strategy, the isolation processing results of the security event are summarized based on the structural parameters to obtain the network attack summary results corresponding to the network data to be identified.

[0085] This step is the final stage of attack handling and provides data support for system self-optimization. First, the SOAR system, based on the generated attack handling strategy, performs automated isolation processing on the security incident, such as cutting off the network connection of infected terminals and restricting the operational permissions of abnormal accounts. After processing, the system performs multi-dimensional summary analysis of the isolation processing effectiveness based on the original structural parameters of the network data to be identified, including indicators such as threat blocking success rate, business impact scope, residual risks and vulnerabilities, and processing time. Finally, a network attack summary result covering "attack details - handling process - processing result" is generated. This result provides security personnel with audit and traceability evidence and serves as feedback data input to the system's self-learning module, supporting subsequent optimization of response strategies.

[0086] Optionally, preprocessing step S101, such as Figure 2 As shown, it includes:

[0087] Step S201: Identify probe devices, host terminal devices, and intelligence center devices based on the target source devices of the network attack.

[0088] This step uses "the target source device of the network attack" as the core positioning criterion to accurately identify three types of key data collection devices. Probe devices are mainly deployed at critical network nodes to capture network layer traffic and transmitted data; host terminal devices cover servers, workstations, etc., that may become attack targets, used to record their own operational status, operational behavior, and local logs; intelligence center devices connect to external threat intelligence platforms and internal security databases, providing auxiliary information such as known attack characteristics and malicious IP databases. By clearly defining these three types of devices, a clear scope and subject are defined for subsequent data collection.

[0089] Step S202: Use probe equipment, host terminal equipment and intelligence center equipment to acquire network data to be identified in real time.

[0090] After identifying the core data collection devices, a multi-device collaborative mechanism is activated, with probe devices, host terminal devices, and intelligence center devices simultaneously conducting real-time data collection. Probe devices continuously monitor data packets in the network link, host terminal devices report their login behavior, file operations, process execution, and other data in real time, and intelligence center devices update and push the latest threat intelligence in real time. This multi-source parallel collection mode ensures the comprehensiveness and timeliness of the network data to be identified, avoiding the impact of missing or delayed data on subsequent analysis.

[0091] Step S203: Determine the structural parameters based on the structural attributes corresponding to the network data to be identified, and determine the data parsing strategy corresponding to the structural parameters.

[0092] Because the collected network data to be identified comes from diverse sources, its structural attributes vary significantly (e.g., network traffic data is in binary stream format, log data is in text format, and threat intelligence data is in structured JSON format). This step first extracts the corresponding structural attributes (including data format, field definitions, encoding methods, data length, etc.) for each type of network data to be identified, and determines specific structural parameters based on these attributes. Subsequently, based on the characteristics of the structural parameters, a suitable data parsing strategy is matched; for example, a character segmentation parsing strategy is used for text logs, and a protocol parsing strategy is used for binary traffic data to ensure the accuracy of subsequent data parsing.

[0093] Step S204: After parsing the network data to be identified using a data parsing strategy, obtain the security events contained in the network data to be identified and their corresponding semantic tags.

[0094] Using the data parsing strategy determined in step S203, the network data to be identified is systematically analyzed. Through parsing, events with security risk associations, i.e., security events, are filtered and extracted from the messy raw data, such as "multiple login attempts from unknown IPs," "unauthorized database access requests," and "file download behavior matching malicious characteristics." Simultaneously, based on a pre-defined semantic tagging system, and combining the characteristics of security events such as type, risk level, and involved objects, a unique semantic tag is assigned to each security event, achieving standardized identification of security events.

[0095] Step S205: Obtain the event stream message data corresponding to the network to be identified through semantic tags, and determine the preprocessed data corresponding to the network to be identified based on the event stream message data.

[0096] Using semantic tags as indexes, scattered security events are aggregated according to time sequence and relationships to form structured event stream message data. This data not only contains detailed information about individual security events but also reflects the temporal logic and potential connections between events. Finally, the event stream message data undergoes optimization processes such as format standardization and redundancy removal to form preprocessed data that meets the input requirements of subsequent semantic reasoning steps, laying a solid foundation for in-depth analysis of attack trends.

[0097] Optionally, semantic reasoning step S102, such as Figure 3 As shown, it includes:

[0098] Step S301: Determine the attack phase data based on one or more of the following phases of data: reconnaissance, initial access, lateral movement, penetration, and persistence, as determined by the preprocessed data.

[0099] This step analyzes security events within the preprocessed data, focusing on typical stages of the entire network attack lifecycle to precisely define the stage range of the attack. Combining the behavioral characteristics and technical features of the security events, it matches core stages in the attack chain such as reconnaissance, initial access, lateral movement, penetration, and persistence. For example, "port scanning" corresponds to the reconnaissance stage, "exploiting vulnerabilities to gain server privileges" corresponds to the penetration stage, and "creating backdoor accounts" corresponds to the persistence stage. By identifying one or more stage characteristics involved in a security event, the attack stage data corresponding to that event is ultimately determined, providing a temporal basis for tracing the attack path.

[0100] Step S302: Determine the attack intent data based on the log data and intelligence data corresponding to the security events determined by the preprocessed data.

[0101] Determining attack intent requires cross-validation of multi-source data. This step achieves accurate reasoning by integrating two types of key data: first, log data corresponding to security events, including operation behavior records, command execution traces, resource access logs, etc., which directly reflect the specific operations of the attack; second, associated intelligence data, covering external reference information such as the behavioral patterns of known attack groups, the attack targets of malicious programs, and typical uses of vulnerability exploits. By reconstructing the behavior of log data and matching the features of intelligence data, the attack intent of the security event is comprehensively judged to form clear attack intent data, such as "stealing core business data" or "paralyzing core service nodes."

[0102] Step S303: Determine the target entity data based on one or more of the following entity data corresponding to the security event determined by the preprocessing data: attack source IP, attack source port, target IP, target port, protocol, session token, file address name, user account.

[0103] Target entity data is crucial for locating attack-related objects. This step precisely extracts various entity elements involved in the attack chain from security events in the pre-processed data. Specifically, this includes the attack source IP and port at the attack initiation end, the target IP, target port, and protocol type at the attack execution end, as well as session tokens supporting the attack, the address and name of malicious files, and hijacked or exploited user accounts. By aggregating this entity data (which may include one or more types), a "attack source-target-carrier" entity network involving the attack is constructed, forming complete target entity data.

[0104] Step S304: Determine the semantic relationships between attack phase data, attack intent data, and target entity data based on semantic tags.

[0105] To achieve a systematic analysis of attack logic, this step uses the semantic tags of security events as a link to establish semantic relationships among attack phase data, attack intent data, and target entity data. For example, if the semantic tag points to "database attack," the correspondence between "penetration phase" (attack phase data) and "data theft" (attack intent data) can be clearly defined. At the same time, it associates "attack source IP 192.168.1.100" and "target IP 10.0.0.5 (database server)" (target entity data) to form the semantic relationship of "a certain IP carried out data theft against the database server during the penetration phase," providing a logical framework for subsequent LLM inference.

[0106] Step S305: Determine the semantic prompt words corresponding to the security event using semantic relations, and obtain the semantic results corresponding to the security event under the semantic prompt words using a preset LLM model.

[0107] This step is the output stage of semantic reasoning. First, based on the semantic relationships determined in step S304, the scattered element information is transformed into semantic cue words that conform to the understanding habits of the LLM model. The cue words must clearly cover the attack stage, attack intent, involved entities, and the logical relationship between the three. Then, the semantic cue words are input into a preset LLM model (such as a large language model fine-tuned for the security domain). The model uses its built-in threat knowledge base and logical reasoning capabilities to conduct in-depth analysis of security events, and finally outputs semantic results including attack scenario reconstruction, risk level assessment, and prediction of related events, providing core basis for subsequent threat graph construction.

[0108] In real-world scenarios, the LLM model in the semantic reasoning steps described above is enhanced with security domain knowledge and employs the RAG (Retrieval-augmented Generation) mechanism. This allows the MITRE ATT&CK knowledge base to be used as an external database, dynamically retrieving relevant tactical entries during reasoning and injecting them into the LLM prompts. This guides the LLM output to conform to the ATT&CK framework's stage labels. Ultimately, the adaptive prompt template guides the model to achieve the following four types of tasks:

[0109] 1. Entity extraction and role labeling: Automatically identify key elements such as attack source IP, attack source port, target IP, target port, protocol, session token, file address name, and user account;

[0110] 2. Attack Phase Identification: Infer the phase of the event (reconnaissance, initial access, lateral movement, penetration, persistence, etc.) based on the MITREATT&CK tactical and technical knowledge base.

[0111] 3. Semantic causal reasoning: Integrating logs and intelligence texts to achieve logical reasoning and contextual coherence modeling of attack intent;

[0112] 4. Interpretable Results Generation: Output natural language reports to explain the reasons and basis for judgments and inferences, improving the transparency of human-computer collaboration.

[0113] Optionally, the map construction step S103, such as Figure 4 As shown, it includes:

[0114] Step S401: Obtain the keywords corresponding to the security event based on the semantic results.

[0115] This step uses the semantic results output by semantic reasoning as the core data source to accurately extract key keywords of security events. These keywords are high-level summaries of the core attributes of security events, covering dimensions such as attack phase (e.g., "penetration," "lateral movement"), attack intent (e.g., "data theft," "system damage"), target entities (e.g., specific IP addresses, server names, user accounts), and key behaviors (e.g., "abnormal login," "file tampering"). By extracting keywords, the structured semantic results are transformed into core feature elements that facilitate correlation calculations, laying the foundation for subsequent similarity analysis between events.

[0116] Step S402: Construct association vectors for any two security events using the importance parameters of keywords in security events, and determine the semantic similarity between security events based on the association vectors.

[0117] To quantitatively assess the correlation between security events, this step first assigns an importance parameter to each keyword. This parameter is set based on the keyword's ability to represent event attributes; for example, the importance parameter for key entities such as "attack source IP" and "core database" is higher than that for auxiliary information such as "operation time." Then, taking any two security events as an analysis pair, the importance parameters corresponding to their respective keywords are used as dimension values ​​to construct a correlation vector between the two events. Finally, the matching degree between the two correlation vectors is calculated using vector similarity algorithms (such as cosine similarity, Euclidean distance, etc.). This matching result is the semantic similarity between the two security events; a higher value indicates a stronger correlation between the events.

[0118] Step S403: Obtain the time interval between two security events, and use the time interval and its corresponding decay coefficient to obtain the edge weights corresponding to semantic similarity.

[0119] The correlation between cyberattack events weakens over time. This step introduces a time dimension to optimize the correlation assessment results. First, the time interval between the two security events to be analyzed is obtained, clarifying their chronological relationship and the length of the interval. Then, based on a preset decay coefficient rule (generally, the longer the time interval, the larger the decay coefficient), the time interval is calculated with the corresponding decay coefficient to obtain a time decay factor. Finally, this factor is multiplied by the semantic similarity calculated in step S402 to obtain the final edge weight. The edge weight reflects both the semantic correlation of the events and the temporal correlation, making the correlation assessment more consistent with actual attack scenarios.

[0120] Step S404: Construct a threat graph corresponding to security events based on semantic similarity and their corresponding edge weights.

[0121] This step is the final stage of threat graph construction. Using security events as base nodes and edge weights corresponding to the semantic similarity between events as connecting links, a threat graph is constructed. In the graph, each node represents an independent security event, and node attributes include core information such as event keywords and semantic results. The lines connecting nodes represent event relationships, and the edge weights of the lines visually reflect the strength of the relationship. In this way, scattered security events are aggregated according to their relationships, forming a threat graph that clearly displays attack paths, event sequence, and relationship strength, providing a visual basis for subsequent attack response strategy formulation.

[0122] Optionally, step S403 involves obtaining the time interval between two security events and using the time interval and its corresponding decay coefficient to obtain the edge weights corresponding to semantic similarity. Figure 5 As shown, it includes:

[0123] Step S501: Based on the first security event Second security incident ;

[0124] Step S502: Determine the first security event based on a unified timeline With the second security incident The time interval between And determine the decay coefficient corresponding to the time interval. ;

[0125] Step S503: Obtain the first security event With the second security incident semantic similarity between Among them, semantic similarity ; First security incident The corresponding TF-IDF vector; For the second security incident The corresponding TF-IDF vector;

[0126] Step S504: Utilize time intervals and its corresponding decay coefficient Calculate and obtain the edge weights corresponding to semantic similarity. Among them, the right of the border .

[0127] Specifically, the semantic results generated by LLM are input into the graph modeling engine, and the event association weights (i.e., edge weights) are calculated using the following expression. ,in, Let i be the TF-IDF vector corresponding to event i. Let n represent the importance of keyword n ​​in event i. Here, each security event (such as a login, file access, attack alert) is treated as a document. Then, the TF-IDF value of keywords in the document (such as IP, behavior type, exception code) is calculated to form a vector.

[0128] Calculate the similarity between event i and event j: ;in, Let represent the cosine similarity between event i and event j in the semantic space; when When the value approaches 1, it indicates that the descriptions, behavioral patterns, or attack intentions of the two events are highly similar; when... When the value approaches 0, it indicates that the two events are almost unrelated.

[0129] The relevance of attack events decreases over time; the intensity of this decay can be controlled using an exponential function. .

[0130] in, The edge weights are time-decay weights; The interval between two events on the timeline; The time decay coefficient represents the strength of the influence of the time interval between events on the similarity. The larger the value, the more significant the effect of the time interval.

[0131] when When unchanged, When it approaches 0, Approaching 1, and Approaching; when When it is very large, Approaching 0, The number of events decreases dramatically. Therefore, events that are close in time and semantically similar form strong connections. This allows the threat map constructed by the system to highlight highly correlated paths of "attacks in the same phase or ongoing," while naturally downplaying historical events and isolated events.

[0132] The functions described above enable the construction of time-sensitive threat maps through a dynamic edge weight adjustment mechanism, displaying attack evolution paths and core nodes in real time.

[0133] Optionally, the strategy generation step S104, such as Figure 6 As shown, it includes:

[0134] Step S601: Use semantic results and threat graphs to obtain the handling results and execution logs corresponding to security events.

[0135] This step uses semantic results and threat graphs as core data sources to mine key reference information corresponding to security incidents, including handling results and execution logs. Semantic results provide core attributes such as the attack stage, intent, and involved entities, while the threat graph presents the correlation strength and temporal sequence between the incident and other security incidents. Based on this data, on the one hand, historical handling results of similar attack incidents can be traced (e.g., successful blocking cases, reasons for handling failures), and on the other hand, execution logs from historical handling processes can be extracted (e.g., response actions taken, operation sequence, resource call records), providing fundamental data support for subsequent evaluation metric calculations.

[0136] Step S602: Determine the detection accuracy, response speed, and false alarm rate corresponding to the security event based on the handling results and execution log.

[0137] To objectively evaluate the effectiveness and efficiency of attack response, this step extracts three core quantitative indicators based on the response results and execution logs obtained in step S601. First, the detection accuracy rate, calculated by the ratio of "the number of correctly identified attack events" to "the total number of detected events," reflects the precision of attack event identification. Second, the response speed rate, based on the time interval from "the discovery of a security event to the execution of the first response action," reflects the timeliness of the response. Third, the false alarm rate, determined by the ratio of "the number of normal events mistakenly identified as attacks" to "the total number of events detected as attacks," measures the reliability of the response strategy. These three indicators construct an evaluation system for response effectiveness from the three dimensions of "accuracy, speed, and stability."

[0138] Step S603: Construct a reward function for the security event based on the detection accuracy, response speed, and false alarm rate.

[0139] This step uses the three core metrics identified in step S602 as variables to construct a reward function specific to security events, guiding the handling strategy iteratively towards the optimal direction. The reward function is designed according to the principle of "rewarding the good and penalizing the bad," assigning reasonable weights to each metric (e.g., in core business scenarios, the weight of response speed can be higher than other metrics). The higher the detection accuracy, the better the response speed (shorter the time), and the lower the false positive rate, the higher the reward value output by the function. Simultaneously, the function dynamically adjusts the metric coefficients based on the severity of the attack event (e.g., attacks targeting core databases have higher weights), ensuring that the reward mechanism matches actual security needs and providing quantitative guidance for strategy optimization.

[0140] Step S604: Use the reward function to determine the attack handling strategy corresponding to the security event.

[0141] This step is the core output of strategy generation, filtering and determining the optimal attack response strategy through quantitative feedback from the reward function. First, multiple candidate response strategies are constructed based on semantic results and threat graphs (e.g., for events related to "abnormal login + file theft," candidate strategies could include "blocking IP + isolating terminals" or "freezing accounts + auditing file operations"). Then, each candidate strategy is substituted into the reward function to calculate its corresponding reward value. Finally, the candidate strategy with the highest reward value is selected as the final attack response strategy. This strategy considers the effectiveness of historical response experience while ensuring its advantages in accuracy, timeliness, and reliability through quantitative indicators, enabling efficient response to attack events.

[0142] Optionally, step S603, which constructs the reward function corresponding to the security event based on the detection accuracy, response speed, and false alarm rate, is as follows: Figure 7 As shown, it includes:

[0143] Step S701: Determine the detection accuracy corresponding to the security event. Response speed value and detection false alarm rate The corresponding first weight Second weight and the third weight ;in, ;

[0144] Step S702: Based on detection accuracy Response speed value False alarm rate and its corresponding first weight Second weight and the third weight Construct a reward function corresponding to a security event; where the reward function... .

[0145] During the execution of the strategy generation step, it is necessary to receive LLM inference conclusions and threat graph structure information, and to send back the handling results and execution logs through the REST API interface. Finally, combined with the response history database, the best handling strategy is generated through a self-optimization mechanism based on the reward function.

[0146] reward function ;in, To improve detection accuracy, To normalize the response speed, For false alarm rate, , , For experience weight, and , , The value range is [0, 1]. A higher R value indicates a better outcome. The policy priority is dynamically adjusted based on the R value, and the optimal action sequence is selected or reconstructed from a predefined script library, covering operations such as IP blocking, host isolation, credential revocation, and log tracing. All action execution logs are returned to the relevant database to provide samples for subsequent learning.

[0147] Optionally, before the result retrieval step, such as Figure 8 As shown, the method further includes a feedback control step, comprising:

[0148] Step S801: Determine the semantic update strategy corresponding to the security event based on the success rate and false alarm rate, and update the semantic results using the semantic update strategy.

[0149] This step primarily optimizes LLM suggestion keywords, automatically optimizing suggestion keyword generation templates or updating RAG to enhance search weight based on feedback success rate and false positive rate.

[0150] Step S802: Determine the weight update strategy corresponding to the reward function based on the historical performance data corresponding to the security event, and update the reward function using the weight update strategy.

[0151] This step mainly involves updating the SOAR policy weights, with the reward function R serving as an optimization signal to drive the adjustment of policy network parameters, so that the behavioral criteria continue to evolve based on historical performance.

[0152] As can be seen from the above network attack handling and control method, this method constructs a security domain knowledge graph and contextual prompt word template based on the threat semantic reasoning engine of LLM. LLM performs semantic understanding on logs, intelligence, and alarms, extracts attack stages, attack intentions, and target entities, and realizes the reconstruction of event semantic chains. It can automatically restore the attack causal chain from unstructured text, realizing the transformation from "alarm accumulation" to "scenario restoration".

[0153] This method utilizes a reward function-driven SOAR dynamic policy generation layer, introduces a reward function into the policy execution layer, and optimizes behavior through the reward function R derived from the response results. This enables the SOAR system to continuously learn from historical performance, transforming the disposal strategy from manual maintenance to intelligent optimization.

[0154] This method can explain the adaptive threat graph construction mechanism. By fusing LLM inference results with heterogeneous security logs, it constructs a multi-layer threat graph using the cosine similarity function and displays the relevance of events through edge weights, thereby realizing the dynamic correlation and visual interpretation of threat information and providing security managers with a personalized analysis path.

[0155] This method implements a closed-loop dual-agent architecture of LLM and SOAR. LLM acts as the cognitive layer, responsible for understanding and reasoning, while SOAR acts as the execution layer, responsible for action and feedback. The success rate and false alarm rate information provided by SOAR are fed back to LLM for prompt word optimization and retrieval fine-tuning, forming a cognitive-action-feedback closed loop. Ultimately, it achieves adaptive evolution throughout the entire process and can continuously improve accuracy and efficiency in long-term operation.

[0156] Corresponding to the above embodiments of network attack handling and control methods, this invention also provides a network attack handling and control system, such as... Figure 9 As shown, the system includes:

[0157] Preprocessing module 910: used to acquire network data to be identified in real time, use the structural parameters corresponding to the network data to be identified to determine the security events in the network data to be identified, and determine the preprocessed data corresponding to the network data to be identified based on the semantic tags of the security events.

[0158] Semantic reasoning module 920: used to determine the attack phase data, attack intent data and target entity data corresponding to security events in preprocessed data based on semantic tags, and to determine the semantic results corresponding to security events using the attack phase data, attack intent data and target entity data;

[0159] Graph Construction Module 930: Used to calculate the semantic similarity between each security event based on the semantic results, and to construct the threat graph corresponding to the security events based on the semantic similarity;

[0160] Policy generation module 940: used to determine the attack handling strategy corresponding to the security event through semantic results and threat graph;

[0161] Result Acquisition Module 950: After isolating security events using attack handling strategies, it summarizes the isolation results of security events based on structural parameters to obtain the network attack summary results corresponding to the network data to be identified.

[0162] As can be seen from the above network attack processing and control system, the system can use LLM to handle semantic reasoning and realize semantic situational awareness. It can automatically reconstruct the causal chain of attacks from unstructured text and realize scene restoration from alarm accumulation. In addition, the system can use SOAR to realize policy generation and final execution, realize dynamic response of execution, and optimize in real time by setting reward function, thereby significantly improving the processing effect during network attacks.

[0163] The network attack handling and control system provided in this embodiment of the invention has the same implementation principle and technical effects as the aforementioned network attack handling and control method embodiment. For the sake of brevity, any parts not mentioned in the system embodiment can be referred to the corresponding content in the aforementioned network attack handling and control method embodiment.

[0164] This embodiment also provides an electronic device, the structural schematic diagram of which is shown below. Figure 10 As shown, the device includes a processor 101 and a memory 102; wherein, the memory 102 is used to store one or more computer instructions, which are executed by the processor to implement the steps of the network attack handling and control method described above.

[0165] Figure 10 The electronic device shown also includes a bus 103 and a communication interface 104, with the processor 101, communication interface 104 and memory 102 connected via the bus 103.

[0166] The memory 102 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. The bus 103 may be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 10 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0167] The communication interface 104 is used to connect to at least one user terminal and other network units through a network interface, and to send encapsulated IPv4 packets or IPv4 packets to the user terminal through the network interface.

[0168] Processor 101 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 101 or by instructions in software form. The processor 101 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 102. The processor 101 reads the information in memory 102 and, in conjunction with its hardware, completes the steps of the method described in the foregoing embodiments.

[0169] This invention also provides a storage medium storing a computer program, which, when executed by a processor, performs the steps of the network attack handling and control method described in the foregoing embodiments.

[0170] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, devices, and methods can be implemented in other ways. The system embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0171] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0172] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0173] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, electronic device, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0174] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A network attack handling and control method, characterized in that, The method includes: Preprocessing steps: Real-time acquisition of network data to be identified, determination of security events in the network data to be identified using the structural parameters corresponding to the network data to be identified, and determination of preprocessed data corresponding to the network data to be identified based on the semantic tags of the security events; Semantic reasoning steps: Based on the semantic tags, determine the attack phase data, attack intent data, and target entity data corresponding to the security event in the preprocessed data; and use the attack phase data, the attack intent data, and the target entity data to determine the semantic result corresponding to the security event. Threat graph construction steps: Obtain keywords corresponding to the security events based on the semantic results; construct association vectors corresponding to any two security events using the importance parameters corresponding to the keywords in the security events, and determine the semantic similarity between the security events based on the association vectors; obtain the time interval between the two security events, and obtain the edge weights corresponding to the semantic similarity using the time interval and its corresponding decay coefficient; construct the threat graph corresponding to the security events based on the semantic similarity and its corresponding edge weights. Strategy generation step: Determine the attack handling strategy corresponding to the security event based on the semantic results and the threat graph; Result acquisition steps: After isolating the security event using the attack handling strategy, the isolation processing results of the security event are summarized based on the structural parameters to obtain the network attack summary results corresponding to the network data to be identified. The semantic reasoning steps include: The attack phase data is determined based on one or more phases of reconnaissance, initial access, lateral movement, penetration, and persistence corresponding to the security event identified by the preprocessed data. The attack intent data is determined based on the log data and intelligence data corresponding to the security event determined by the preprocessed data; The target entity data is determined based on one or more of the following entity data corresponding to the security event: attack source IP, attack source port, target IP, target port, protocol, session token, file address name, and user account, as determined by the preprocessed data: Based on the semantic tags, determine the semantic relationships corresponding to the attack phase data, the attack intent data, and the target entity data; The semantic relationships are used to determine the semantic cue words corresponding to the security event, and a preset LLM model is used to obtain the semantic results corresponding to the security event under the semantic cue words; The steps of obtaining the time interval between two security events and obtaining the edge weights corresponding to the semantic similarity using the time interval and its corresponding decay coefficient include: According to the first security incident Second security incident ; The first security event is determined based on a unified timeline. With the second security event The time interval between And determine the decay coefficient corresponding to the time interval. ; Obtain the first security event With the second security event The semantic similarity between ; wherein, the semantic similarity ; For the first security event The corresponding TF-IDF vector; For the second security event The corresponding TF-IDF vector; Using the time interval and its corresponding decay coefficient Calculate and obtain the edge weights corresponding to the semantic similarity. Wherein, the edge weight .

2. The network attack handling and control method according to claim 1, characterized in that, The preprocessing step includes: Based on the target source devices of network attacks, probe devices, host terminal devices, and intelligence center devices can be identified. The probe device, the host terminal device, and the intelligence center device are used to acquire the network data to be identified in real time. The structural parameters are determined based on the structural attributes corresponding to the network data to be identified, and the data parsing strategy corresponding to the structural parameters is determined accordingly. After parsing the network data to be identified using the data parsing strategy, the security events contained in the network data to be identified and their corresponding semantic tags are obtained; The event stream message data corresponding to the network to be identified is obtained through the semantic tags, and the preprocessed data corresponding to the network to be identified is determined based on the event stream message data.

3. The network attack handling and control method according to claim 1, characterized in that, The strategy generation step includes: The semantic results and the threat graph are used to obtain the handling results and execution logs corresponding to the security events; Based on the handling results and the execution log, determine the detection accuracy, response speed, and false alarm rate corresponding to the security event; Construct a reward function corresponding to the security event based on the detection accuracy, the response speed value, and the false alarm rate; The attack handling strategy corresponding to the security event is determined using the reward function.

4. The network attack handling and control method according to claim 3, characterized in that, The steps of constructing the reward function corresponding to the security event based on the detection accuracy, the response speed value, and the false alarm rate include: Determine the detection accuracy corresponding to the security event. Response speed value and detection false alarm rate The corresponding first weight Second weight and the third weight ;in, ; Based on the detection accuracy The response speed value The false alarm rate of the detection and its corresponding first weight The second weight and the third weight Construct the reward function corresponding to the security event; wherein the reward function .

5. The network attack handling and control method according to claim 4, characterized in that, Prior to the result acquisition step, the method further includes a feedback control step, comprising: Based on the detection accuracy and false alarm rate corresponding to the security event, a semantic update strategy is determined for the security event, and the semantic result is updated using the semantic update strategy. The weight update strategy corresponding to the reward function is determined based on the historical performance data corresponding to the security event, and the reward function is updated using the weight update strategy.

6. A network attack handling and control system, characterized in that, The system includes: Preprocessing module: used to acquire network data to be identified in real time, determine security events in the network data to be identified using the structural parameters corresponding to the network data to be identified, and determine the preprocessed data corresponding to the network data to be identified based on the semantic tags of the security events; Semantic reasoning module: used to determine the attack stage data, attack intent data and target entity data corresponding to the security event in the preprocessed data based on the semantic tags, and to determine the semantic result corresponding to the security event using the attack stage data, the attack intent data and the target entity data; The graph construction module is used to: obtain keywords corresponding to the security events based on the semantic results; construct association vectors corresponding to any two security events using the importance parameters corresponding to the keywords in the security events, and determine the semantic similarity between the security events based on the association vectors; obtain the time interval between two security events, and obtain the edge weights corresponding to the semantic similarity using the time interval and its corresponding decay coefficient; and construct the threat graph corresponding to the security events based on the semantic similarity and its corresponding edge weights. Strategy generation module: used to determine the attack handling strategy corresponding to the security event based on the semantic results and the threat graph; Result acquisition module: After isolating the security event using the attack handling strategy, it summarizes the isolation results of the security event based on the structural parameters to obtain the network attack summary results corresponding to the network data to be identified. The semantic reasoning module is further configured to: determine the attack stage data based on one or more stage data (reconnaissance, initial access, lateral movement, penetration, persistence) corresponding to the security event determined by the preprocessed data; determine the attack intent data based on the log data and intelligence data corresponding to the security event determined by the preprocessed data; determine the target entity data based on one or more entity data (attack source IP, attack source port, target IP, target port, protocol, session token, file address name, user account) corresponding to the security event determined by the preprocessed data; determine the semantic relationship between the attack stage data, the attack intent data, and the target entity data based on the semantic tags; determine the semantic prompt words corresponding to the security event using the semantic relationship; and obtain the semantic results corresponding to the security event under the semantic prompt words using a preset LLM model. In the process of obtaining the time interval between two security events and using the time interval and its corresponding decay coefficient to obtain the edge weights corresponding to the semantic similarity, the graph construction module is further configured to: based on the first security event Second security incident The first security event is determined based on a unified timeline. With the second security event The time interval between And determine the decay coefficient corresponding to the time interval. ; Obtain the first security event With the second security event The semantic similarity between ; wherein, the semantic similarity ; For the first security event The corresponding TF-IDF vector; For the second security event The corresponding TF-IDF vector; using the time interval and its corresponding decay coefficient Calculate and obtain the edge weights corresponding to the semantic similarity. Wherein, the edge weight .

7. An electronic device, characterized in that, The electronic device includes a processor and a memory, the memory storing computer-executable instructions that can be executed by the processor, the processor executing the computer-executable instructions to implement the steps of the network attack handling and control method according to any one of claims 1 to 5.

Images