A method and system for root cause analysis of security incidents based on interactive question-and-answer

Abstract

This application discloses a method and system for root cause analysis of security incidents based on interactive question-and-answer, relating to the field of network security technology. By constructing a structured security incident knowledge graph (SE-KG), it effectively organizes multi-source heterogeneous data, solving the problem of chaotic data association in traditional solutions. A dynamic questioning mechanism is designed to address implicit information not covered by the SE-KG, filling the gap in existing technologies that cannot supplement unstructured implicit information and overcoming the reasoning bottleneck caused by incomplete evidence chains. Question-and-answer supplementary evidence drives probabilistic reasoning to iteratively update root cause confidence. Combined with human feedback to verify the root cause and reverse-optimize the model and knowledge graph, this approach not only eliminates the over-reliance on the experience of operations personnel in human-led solutions and reduces the false positive rate, but also compensates for the poor adaptability of static association and traditional probabilistic reasoning solutions, significantly improving the accuracy and efficiency of root cause analysis.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method and system for root cause analysis of security incidents based on interactive question-and-answer. Background Technology

[0002] With the deepening of digital transformation, network systems have become core infrastructures in key sectors such as finance, energy, and government affairs, but the security threats they face are also becoming increasingly complex. As a crucial link in "post-incident handling and pre-incident prevention," the core objective of root cause tracing of security incidents is to locate the root cause of an incident from massive amounts of alarm logs, traffic data, and asset information, rather than merely addressing surface phenomena. However, the current system environment exhibits three major characteristics: heterogeneous multi-source data, dynamic implicit information, and complex causal relationships. Traditional tracing methods are no longer sufficient to meet the needs for accurate and efficient tracing, necessitating the construction of a new tracing technology system that integrates dynamic information supplementation and intelligent reasoning.

[0003] Currently, research and application in the field of root cause analysis for security incidents mainly focus on three types of solutions: Manually-led log analysis solutions: These solutions rely on security operations personnel (SOC analysts) manually filtering logs and correlating alarm data to determine the root cause based on experience. For example, Zhang et al., in their 2022 paper on human-assisted cybersecurity incident classification, pointed out that while this method can achieve 60%-70% accuracy in small network environments, it struggles to handle high-frequency events in large-scale networks. Static association solutions based on knowledge graphs: These solutions construct static knowledge graphs to achieve data association by predefining entities and relationships in the security domain. Model-based solutions based on probabilistic reasoning: These solutions quantify the probabilistic relationship between root causes and evidence using models such as Bayesian networks and Markov chains. For instance, Li et al., in 2023, proposed training a Bayesian network based on historical event data and updating the root cause probability through log evidence. However, the evidence input for this model relies on pre-collected structured data and cannot obtain unstructured implicit information through dynamic interaction, leading to a sharp drop in reasoning accuracy when the evidence chain is incomplete.

[0004] While existing technologies provide fundamental support for security incident tracing, manual analysis relies entirely on the experience of operations and maintenance personnel, and is prone to root cause misjudgments due to differences in experience. Knowledge graph-based solutions can only correlate pre-collected structured data and cannot dynamically supplement implicit information. Probabilistic reasoning-based solutions lack interactive information supplementation mechanisms; when core evidence is missing, the model cannot proactively confirm potential clues with the user, leading to an inability to determine high-confidence root causes. In summary, existing technologies still face problems of low efficiency, high misjudgment rates, and poor adaptability in security incident tracing. Summary of the Invention

[0005] In order to solve the above-mentioned technical problems, this application proposes the following technical solution:

[0006] In a first aspect, embodiments of this application provide a security incident root cause analysis method based on interactive question-and-answer, including:

[0007] Acquire multi-source data and eliminate data noise to construct a structured SE-KG (Security Event Knowledge Graph).

[0008] For implicit information that cannot be covered in the SE-KG, user feedback is obtained through dynamic questioning to supplement key evidence and update the knowledge graph;

[0009] Driven by evidence supplemented by question and answer, the root cause confidence is iteratively updated through probabilistic reasoning to screen out root cause candidates with high probability and strong correlation.

[0010] Verify the authenticity of the selected root causes, and then optimize the model parameters and the SE-KG in reverse to improve the accuracy of subsequent source tracing.

[0011] In one possible implementation, the acquisition of multi-source data and elimination of data noise, and the construction of a structured security event knowledge graph (SE-KG) include:

[0012] Collect multi-source data from the target system, including: log data, asset data, traffic data, configuration data, and historical data;

[0013] The missing and outlier values ​​in the multi-source data are processed, and the processed multi-source data is then standardized.

[0014] SE-KG is constructed based on standardized multi-source data to quantify the degree of entity association in the data.

[0015] In one possible implementation, the process of handling missing and outlier values ​​in the multi-source data, and standardizing the processed multi-source data, includes:

[0016] Missing values ​​in the multi-source data are imputed using the mean of similar data:

[0017]

[0018] in: The fill value for the j-th feature of the i-th data point. Let be the global mean of the j-th feature. The number of samples similar to the i-th data point. These are the original feature values ​​of similar samples. Let be the cosine similarity between samples i and m;

[0019] The mean of the data within the window is calculated in real time using sliding window technology. and standard deviation When data satisfy or The time is marked as an exception;

[0020] Then, the features are mapped to the [0,1] interval using Min-Max normalization:

[0021]

[0022] in: For the j-th feature of the i-th data sample, the final result after standardization is... Let j be the original value of the j-th feature of the i-th data sample. This represents the global minimum value of the j-th feature. This represents the global maximum value of the j-th feature.

[0023] In one possible implementation, the step of constructing an SE-KG based on standardized multi-source data to quantify the degree of entity association in the data includes:

[0024] Define the entities and relationships in the standardized multi-source data. The entities include: event entities, asset entities, action entities, and attribute entities. The relationships include attribution relationships, triggering relationships, and dependency relationships.

[0025] The improved Jaccard coefficient is used to quantify the correlation between entities:

[0026]

[0027] in: Let A be the set of directly related entities of entity A. The set of directly related entities of entity B. For smoothing coefficients, This represents the degree of association between entities; a higher value indicates a stronger association. For intersection operators, For union operators, The base symbol represents the cardinality of a set, that is, the number of entities contained in the set.

[0028] In one possible implementation, the step of obtaining user feedback through dynamic questioning to supplement key evidence and update the knowledge graph for implicit information not covered in the SE-KG includes:

[0029] A set of suspicious points is generated based on the SE-KG. ,in Potential points of doubt awaiting verification;

[0030] The initial confidence level of the suspicion is calculated by weighting the correlation strength and event credibility:

[0031]

[0032] in: Suspicious The initial confidence level, To the point of doubt A collection of related event entities. Points of doubt With event entities The strength of the correlation between them For event entities Credibility;

[0033] The system comprehensively considers the confidence level of doubt, information gain, and user response cost to filter high-priority questions and generate dynamic questions, including:

[0034]

[0035] in: For questions priority, For questions The corresponding points of doubt, For questions The overall confidence level of the doubts corresponding to the doubts. For questions Information gain , Let R be the initial entropy of the root cause set. Given a question q, the conditional probability of a user's answer r. Given the conditional entropy of the question q and the answer r; Answering questions for users The cost, the Based on the time and complexity required to answer the question , and They are respectively , and Weighting coefficients;

[0036] New evidence is extracted by analyzing user feedback, and the SE-KG entity association strength and doubt confidence are updated respectively, thus realizing the fusion of implicit information and existing data.

[0037] In one possible implementation, the step of parsing user feedback to extract new evidence, updating the SE-KG entity association strength and the confidence level of suspicion respectively, and achieving the fusion of implicit information and existing data includes:

[0038] Perform semantic analysis on user feedback r to extract new evidence. ;

[0039] The Incorporate the SE-KG, update the correlation strength S(A,B), and adjust the confidence level of the doubt. :

[0040]

[0041]

[0042] in: For entity A and entity B, incorporating new evidence Updated association strength The original association strength between entities A and B. The correlation strength update coefficient is used to control... The magnitude of the update to the correlation strength; This is an indicator function for supporting evidence, used to make judgments. Does it support the association between entities A and B? If the association between entities A and B is supported, then The value is 1. If the association between entities A and B is not supported, then The value is 0; For the i-th point of doubt In integration The confidence level after the update For the i-th point of doubt The original confidence level, This is the confidence adjustment factor, used to control... The adjustment range for the confidence level of doubt. This indicates the extraction of the sign of the variable within the parentheses to determine the relationship between new evidence and points of doubt; Indicates quantification and The correlation.

[0043] In one possible implementation, the step of using question-and-answer supplementary evidence as a driving force to iteratively update root cause confidence through probabilistic inference and filter out high-probability and strongly correlated root cause candidates includes:

[0044] Constructing a root cause candidate set ,in As the root cause;

[0045] Based on SE-KG association strength and historical event probabilities, initialize the root cause prior probability:

[0046]

[0047] in: The i-th root cause in the root cause candidate set The initial prior probability, The normalization coefficient is... Representing event entity e and root cause The strength of the association, Weights are based on historical data. In similar events The historical probability of occurrence;

[0048] After each round of question and answer, the root cause posterior probability is updated using the likelihood probability of the new evidence:

[0049]

[0050] in: In order to obtain evidence from the first t rounds of question and answer Under these conditions, root cause The posterior probability in round t, For the root cause Given that the evidence from the previous t-1 rounds is valid, the evidence from the t-th round... The probability of occurrence To combine the evidence from the first t-1 rounds, the root cause The probability of credibility, This indicates that, given the evidence from the previous t-1 rounds, the evidence from the t-th round... The probability of occurrence;

[0051] The root causes are sorted in descending order of the posterior probability. A preset number of root causes are selected from high to low to form a root cause set. The correlation integrity of the root causes in the root cause set is calculated. Root causes with correlation integrity less than a preset value are removed to avoid misjudgment of isolated clues.

[0052] In one possible implementation, the step of arranging root causes in descending order of posterior probability, selecting a preset number of root causes from high to low to form a root cause set, calculating the association integrity of the root causes in the root cause set, and removing root causes with association integrity less than a preset value to avoid misjudgment of isolated clues includes:

[0053]

[0054] in: Indicates root cause Association integrity metrics, quantifying root causes The percentage of evidence strongly related to all other evidence; The collection of evidence already obtained. This indicates the total amount of evidence obtained. express yes One of the pieces of evidence, For filtering condition operators, express Satisfy correlation strength , This is the criterion for determining a strong association.

[0055] In one possible implementation, the verification of the authenticity of the selected root causes, and the reverse optimization of the model parameters and the SE-KG to improve the accuracy of subsequent source tracing, include:

[0056] Generate specific validation plans for high-probability root causes and calculate validation accuracy based on the validation results:

[0057]

[0058] in: To verify the accuracy of root cause analysis, A pre-defined root cause set is used to rank the root causes within the candidate root cause set based on probability. root cause The verification results The root cause after the t-th round of question and answer The posterior probability;

[0059] If the verification accuracy is less than the preset probability, the weight coefficient of the question-answering priority and the smoothing coefficient of the SE-KG association strength calculation are adjusted.

[0060] Validated root causes, related evidence, and user feedback are added to the SE-KG historical case library. The association strength of historical cases is weighted with the current association strength, and the entity association strength is updated incrementally to achieve long-term optimization of the knowledge graph.

[0061] In one possible implementation, the step of weighting the historical case association strength with the current association strength and incrementally updating the entity association strength to achieve long-term optimization of the knowledge graph includes:

[0062]

[0063] in: This represents the final association strength between entities A and B after the incremental update. This is a collection of historical cases containing entities A and B. for Number of cases The strength of the association between A and B in the case. right The association strengths of entities A and B in all historical cases within the set are summed to calculate the average of the historical association strengths. The correlation strength of the current event The weighting coefficients, This represents the weighting percentage of the average association strength of historical cases.

[0064] Secondly, embodiments of this application provide a method for root cause analysis of security incidents based on interactive question-and-answer, including:

[0065] The module is used to acquire multi-source data and eliminate data noise to build a structured security event knowledge graph (SE-KG).

[0066] The dynamic update module is used to obtain user feedback through dynamic questioning to supplement key evidence and update the knowledge graph for implicit information that cannot be covered in the SE-KG.

[0067] The iterative reasoning module is used to update the root cause confidence through probabilistic reasoning, driven by evidence supplemented by question and answer, and to filter out root cause candidates with high probability and strong correlation.

[0068] The optimization module is used to verify the authenticity of the selected root causes and to optimize the model parameters and the SE-KG in reverse to improve the accuracy of subsequent source tracing.

[0069] In this embodiment, a structured security event knowledge graph (SE-KG) is constructed to effectively organize multi-source heterogeneous data, solving the problem of chaotic data association in traditional solutions. A dynamic questioning mechanism is designed to address implicit information not covered by the SE-KG, filling the gap in existing technologies that cannot supplement unstructured implicit information and overcoming the reasoning bottleneck caused by incomplete evidence chains. Question-and-answer supplementary evidence drives probabilistic reasoning to iteratively update root cause confidence. Combined with human feedback to verify root causes and reverse-optimize the model and knowledge graph, this approach not only eliminates the over-reliance on the experience of operations personnel in human-led solutions and reduces the false positive rate, but also compensates for the poor adaptability of static association and traditional probabilistic reasoning solutions, significantly improving the accuracy and efficiency of root cause tracing. Attached Figure Description

[0070] Figure 1 A flowchart illustrating a security incident root cause analysis method based on interactive question-and-answer format provided in this application embodiment;

[0071] Figure 2 This is a timing diagram of SE-KG dynamic updates provided in an embodiment of this application;

[0072] Figure 3 This is a schematic diagram of a security incident root cause analysis system based on interactive question answering, provided as an embodiment of this application. Detailed Implementation

[0073] The present solution will now be described in conjunction with the accompanying drawings and specific embodiments.

[0074] See Figure 1 The security incident root cause analysis method based on interactive question-and-answer provided in this embodiment includes:

[0075] S101: Acquire multi-source data and eliminate data noise to construct a structured security event knowledge graph (SE-KG).

[0076] The multi-source data acquired in this embodiment mainly includes five types of core system data: Log data: system logs (syslog), application logs (such as web server logs), and security device logs (firewall / IDS alarms); Asset data: host IP / port, software version, and asset ownership; Traffic data: TCP / UDP sessions and abnormal traffic characteristics (such as port scans and DDoS traffic); Configuration data: system configuration files, permission settings, and firewall rules; Historical data: root cause records and handling solutions for similar security events.

[0077] After acquiring the aforementioned multi-source data, missing and outlier values ​​are identified, and the processed multi-source data is standardized. Specifically, in this embodiment, missing values ​​in the multi-source data are filled using the mean of similar data.

[0078]

[0079] in: The fill value for the j-th feature of the i-th data point. Let be the global mean of the j-th feature. The number of samples similar to the i-th data point. These are the original feature values ​​of similar samples. Let be the cosine similarity between samples i and m.

[0080] Outlier detection: using an improved method The criteria are used to identify anomalies in time-series data (such as log generation frequency, system response time, etc.). Traditional The criterion assumes that the data follows a normal distribution, but actual security incident data often exhibits long-tail characteristics. Therefore, this embodiment introduces a dynamic weighting mechanism to optimize the judgment process. Specifically, a sliding window technique is used to calculate the mean of the data within the window in real time. and standard deviation When data satisfy or The time is marked as an exception.

[0081] Then, the features are mapped to the [0,1] interval using Min-Max normalization:

[0082]

[0083] in: For the j-th feature of the i-th data sample, the final result after standardization is... Let j be the original value of the j-th feature of the i-th data sample. This represents the global minimum value of the j-th feature. This represents the global maximum value of the j-th feature.

[0084] The Security Incident Knowledge Graph (SE-KG) is the core data foundation for interactive root cause analysis. Its construction process includes three key stages: data collection, ontology modeling, and knowledge extraction and graph fusion. First, it collects heterogeneous data from multiple sources, such as log parsing, traffic monitoring, and vulnerability scanning, integrating security-related data like firewall alerts, intrusion detection records, and system logs. Second, it designs a security domain ontology model based on OWL or Schema.org standards, defining core concepts such as attack types, asset types, and vulnerability levels, and their relationships, constructing a knowledge network of "attacker-attack tool-attack target-attack path." Finally, it utilizes Named Entity Recognition (NER) and relation extraction techniques to convert unstructured data into triples, eliminates data conflicts through attribute alignment algorithms, and forms a dynamically updated knowledge graph.

[0085] To improve attribution efficiency, SE-KG needs to focus on characterizing three core relationships: 1) Causal relationships, such as "vulnerability exploitation leads to privilege escalation." 2) Temporal relationships, constructing attack chain sequences through event timestamps. 3) Impact relationships, quantifying the scope of a security event's impact on business systems. Graph databases (such as Neo4j) are used to store graph data, and graph embedding technologies (such as TransE) are used to vectorize entities and relationships, providing efficient data support for subsequent interactive reasoning.

[0086] Entity definition: including "event entities" (such as intrusion events, failure events), "asset entities" (hosts, ports, software), "action entities" (access, modification, transmission), and "attribute entities" (IP, version, permissions).

[0087] Relationship definitions include “ownership relationship” (host-port), “trigger relationship” (access action-intrusion event), and “dependency relationship” (software-system configuration).

[0088] Association strength calculation: The improved Jaccard coefficient is used to quantify the association degree between entities.

[0089]

[0090] in: For entity A, there is a set of entities directly associated with it. For entity B, directly associate with the set of entities. For smoothing coefficients, This represents the degree of association between entities; a higher value indicates a stronger association. For intersection operators, For union operators, The base symbol represents the cardinality of a set, that is, the number of entities contained in the set.

[0091] S102, For implicit information that cannot be covered in the SE-KG, obtain user feedback through dynamic questioning, supplement key evidence and update the knowledge graph.

[0092] join Figure 2 In this embodiment, the question-and-answer initialization first generates a set of doubts based on the SE-KG. ,in These are potential points of suspicion to be verified. For example: whether there were temporary permission changes, or whether the abnormal traffic originated from internal IPs. The initial confidence level of these points is calculated using a weighted average of correlation strength and event credibility.

[0093]

[0094] in: Suspicious The initial confidence level, To the point of doubt A collection of related event entities. Points of doubt With event entities The strength of the correlation between them For event entities Credibility.

[0095] After question-and-answer initialization, dynamic question generation is performed. The overall confidence level of doubt, information gain, and user response cost are defined. These factors are used to filter high-priority questions and generate dynamic questions, including:

[0096]

[0097] in: For questions priority, For questions The corresponding points of doubt, For questions The overall confidence level of the doubts corresponding to the doubts. For questions Information gain , Let R be the initial entropy of the root cause set. Given a question q, the conditional probability of a user's answer r. Given the conditional entropy of the question q and the answer r; Answering questions for users The cost, the Based on the time and complexity required to answer the question , and They are respectively , and The weighting coefficients.

[0098] Finally, feedback analysis and fusion are performed. User feedback is analyzed to extract new evidence, and the SE-KG entity association strength and doubt confidence are updated accordingly. This achieves the fusion of implicit information with existing data, specifically including:

[0099] Perform semantic analysis on user feedback r to extract new evidence. , will the Incorporate the SE-KG, update the correlation strength S(A,B), and adjust the confidence level of the doubt. :

[0100]

[0101]

[0102] in: For entity A and entity B, incorporating new evidence Updated association strength The original association strength between entities A and B. The correlation strength update coefficient is used to control... The magnitude of the update to the correlation strength; This is an indicator function for supporting evidence, used to make judgments. Does it support the association between entities A and B? If the association between entities A and B is supported, then The value is 1. If the association between entities A and B is not supported, then The value is 0; For the i-th point of doubt In integration The confidence level after the update For the i-th point of doubt The original confidence level, This is the confidence adjustment factor, used to control... The adjustment range for the confidence level of doubt. This indicates the extraction of the sign of the variable within the parentheses to determine the relationship between new evidence and points of doubt; Indicates quantification and The correlation.

[0103] S103, driven by evidence supplemented by question and answer, iteratively updates the root cause confidence through probabilistic reasoning to screen out root cause candidates with high probability and strong correlation.

[0104] To implement root cause reasoning, the reasoning model is initialized, and a root cause candidate set is constructed. ,in As the root cause. Based on SE-KG association strength and historical event probabilities, initialize the root cause prior probability:

[0105]

[0106] in: The i-th root cause in the root cause candidate set The initial prior probability, The normalization coefficient is... Representing event entity e and root cause The strength of the association, Weights are based on historical data. In similar events The probability of its occurrence in history.

[0107] Then, a multi-round question-and-answer driven confidence update is performed, and the root cause posterior probability is updated with the likelihood probability of the new evidence after each round of question-and-answer:

[0108]

[0109] in: In order to obtain evidence from the first t rounds of question and answer Under these conditions, root cause The posterior probability in round t, For the root cause Given that the evidence from the previous t-1 rounds is valid, the evidence from the t-th round... The probability of occurrence To combine the evidence from the first t-1 rounds, the root cause The probability of credibility, This indicates that, given the evidence from the previous t-1 rounds, the evidence from the t-th round... The probability of occurrence.

[0110] Questions and updates will cease when one of the following termination conditions is met: 1. Existence 1. High-confidence root cause; 2. After 3 consecutive rounds of questioning, all The confidence level converges; 3. The number of question-and-answer rounds reaches the upper limit. Finally, the root cause candidate set is sorted and filtered. The root causes are arranged in descending order according to the posterior probability. A preset number of root causes are selected from high to low to form a root cause set. The association integrity of the root causes in the root cause set is calculated. Root causes with association integrity less than a preset value are removed to avoid misjudgment of isolated clues.

[0111]

[0112] in: Indicates root cause Association integrity metrics, quantifying root causes The percentage of evidence strongly related to all other evidence; The collection of evidence already obtained. This indicates the total amount of evidence obtained. express yes One of the pieces of evidence, For filtering condition operators, express Satisfy correlation strength , This is the criterion for determining a strong association.

[0113] S104, verify the authenticity of the selected root causes, and reverse-optimize the model parameters and the SE-KG to improve the accuracy of subsequent source tracing.

[0114] Generate root cause validation schemes for high-probability root causes: for each root cause in the high-probability range Output verification steps, such as "Check the SQL logs of the target host for injection statements" and "Verify whether the permission configuration is consistent with..."

[0115] "Consistent description". Receive the verification results and calculate the verification accuracy based on the results:

[0116]

[0117] in: To verify the accuracy of root cause analysis, A pre-defined root cause set is used to rank the root causes within the candidate root cause set based on probability. root cause The verification results The root cause after the t-th round of question and answer The posterior probability.

[0118] If the verification accuracy is less than the preset probability, the weighting coefficient of the question-answering priority and the smoothing coefficient of the SE-KG association strength calculation are adjusted. Specifically,

[0119] When the root cause verification accuracy If the criteria are not met, the three weighting coefficients for calculating the priority of questions during the interactive Q&A phase will be adjusted in reverse to optimize the efficiency of high-value question selection:

[0120]

[0121]

[0122]

[0123] in: , and These are the more refined weighting coefficients. , and These are the original weight coefficients before the update. , and A fixed adjustment step size is used, and the weights are ranked according to their importance, where the confidence level of doubt > information gain > response cost. The larger the step size, the higher the sensitivity of the corresponding weight adjustment.

[0124] Simultaneously optimize the smoothness coefficient of SE-KG association strength calculation To avoid the anomaly of a denominator of 0 in the correlation strength calculation and improve the calculation accuracy, the formula is as follows:

[0125]

[0126] in: The updated smoothing coefficients, The original smoothing coefficients before the update. This serves as a baseline constant for the optimization coefficients, forming the foundation of the optimization coefficients and ensuring that the smoothing coefficients do not change due to... The fluctuations may suddenly change, ensuring the stability of parameter adjustments. Even if... (Source tracing completely failed), the optimization coefficient was set to 0.9, and the smoothing coefficient was only moderately reduced rather than drastically changed to avoid abnormalities in the correlation strength calculation. To verify accuracy Weighting coefficients. Used for quantization. The degree of influence on the optimization coefficients directly links the reliability of the traceability results to parameter adjustments: The higher the value (the more reliable the traceability), the closer the optimization coefficient is to 1, and the smaller the adjustment range of the smoothing coefficient. The lower the value (the greater the source deviation), the smaller the optimization coefficient and the greater the adjustment range of the smoothing coefficient, thereby accurately correcting the deviation in the correlation strength calculation.

[0127] Validated root causes, related evidence, and user feedback are added to the SE-KG historical case library. The association strength of historical cases is weighted with the current association strength, and the entity association strength is incrementally updated to achieve long-term optimization of the knowledge graph, including:

[0128]

[0129] in: This represents the final association strength between entities A and B after the incremental update. This is a collection of historical cases containing entities A and B. for Number of cases The strength of the association between A and B in the case. right The association strengths of entities A and B in all historical cases within the set are summed to calculate the average of the historical association strengths. The correlation strength of the current event The weighting coefficients, This represents the weighting percentage of the average association strength of historical cases.

[0130] Corresponding to the interactive question-and-answer-based security incident root cause analysis method provided in the above embodiments, this application also provides an embodiment of an interactive question-and-answer-based security incident root cause analysis system.

[0131] See Figure 3 The security incident root cause analysis system 20 based on interactive question-and-answer provided in this embodiment includes:

[0132] Module 201 is used to acquire multi-source data and eliminate data noise to build a structured security event knowledge graph (SE-KG).

[0133] The dynamic update module 202 is used to obtain user feedback through dynamic questioning for implicit information that cannot be covered in the SE-KG, supplement key evidence and update the knowledge graph.

[0134] The iterative reasoning module 203 is used to filter out high-probability and strongly correlated root cause candidates by iteratively updating the root cause confidence through probabilistic reasoning, driven by evidence supplemented by question and answer.

[0135] The optimization module 204 is used to verify the authenticity of the selected root causes and to optimize the model parameters and the SE-KG in reverse to improve the accuracy of subsequent source tracing.

[0136] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, or the existence of B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0137] The above description is merely a specific embodiment of this application. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. The protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for root cause analysis of security incidents based on interactive question-and-answer, characterized in that, include: Acquire multi-source data and eliminate data noise to construct a structured security event knowledge graph (SE-KG). For implicit information not covered in the SE-KG, user feedback is obtained through dynamic questioning to supplement key evidence and update the knowledge graph, including: A set of suspicious points is generated based on the SE-KG. ,in Potential points of doubt awaiting verification; The initial confidence level of the suspicion is calculated by weighting the correlation strength and event credibility: in: Suspicious The initial confidence level, To the point of doubt A collection of related event entities. Points of doubt With event entities The strength of the correlation between them For event entities Credibility; The system comprehensively considers the confidence level of doubt, information gain, and user response cost to filter high-priority questions and generate dynamic questions, including: in: For questions priority, For questions The corresponding points of doubt, For questions The overall confidence level of the doubts corresponding to the doubts. For questions Information gain , Let R be the initial entropy of the root cause set. Given a question q, the conditional probability of a user's answer r. Given the conditional entropy of the question q and the answer r; Answering questions for users The cost, the Based on the time and complexity required to answer the question , and They are respectively , and Weighting coefficients; Analyze user feedback to extract new evidence, and update the SE-KG entity association strength and doubt confidence respectively to achieve the fusion of implicit information and existing data; The process of analyzing user feedback to extract new evidence, updating the SE-KG entity association strength and doubt confidence respectively, and achieving the fusion of implicit information with existing data includes: Perform semantic analysis on user feedback r to extract new evidence. ; The Incorporate the SE-KG, update the correlation strength S(A,B), and adjust the confidence level of the doubt. : in: For entity A and entity B, incorporating new evidence Updated association strength The original association strength between entities A and B. The correlation strength update coefficient is used to control... The magnitude of the update to the correlation strength; This is an indicator function for supporting evidence, used to make judgments. Does it support the association between entities A and B? If the association between entities A and B is supported, then The value is 1. If the association between entities A and B is not supported, then The value is 0; For the i-th point of doubt In integration The confidence level after the update For the i-th point of doubt The original confidence level, This is the confidence adjustment factor, used to control... The adjustment range for the confidence level of doubt. This indicates extracting the sign of the variable within the parentheses to determine the relationship between new evidence and points of doubt; Indicates quantification and The correlation; Driven by evidence supplemented by question and answer, the root cause confidence is iteratively updated through probabilistic reasoning to screen out root cause candidates with high probability and strong correlation. Verify the authenticity of the selected root causes, and then optimize the model parameters and the SE-KG in reverse to improve the accuracy of subsequent source tracing.

2. The method for root cause analysis of security incidents based on interactive question-and-answer as described in claim 1, characterized in that, The process of acquiring multi-source data, eliminating data noise, and constructing a structured security event knowledge graph (SE-KG) includes: Collect multi-source data from the target system, including: log data, asset data, traffic data, configuration data, and historical data; The missing and outlier values ​​in the multi-source data are processed, and the processed multi-source data is then standardized. SE-KG is constructed based on standardized multi-source data to quantify the degree of entity association in the data.

3. The root cause analysis method for security incidents based on interactive question-and-answer as described in claim 2, characterized in that, The process of processing missing and outlier values ​​in the multi-source data, and standardizing the processed multi-source data, includes: Missing values ​​in the multi-source data are imputed using the mean of similar data: in: The fill value for the j-th feature of the i-th data point. Let j be the global mean of the j-th feature. The number of samples similar to the i-th data point. These are the original feature values ​​of similar samples. Let be the cosine similarity between samples i and m; The mean of the data within the window is calculated in real time using sliding window technology. and standard deviation When data satisfy or The time is marked as an exception; Then, the features are mapped to the [0,1] interval using Min-Max normalization: in: For the j-th feature of the i-th data sample, the final result after standardization is... Let j be the original value of the j-th feature of the i-th data sample. This represents the global minimum value of the j-th feature. This represents the global maximum value of the j-th feature.

4. The security incident root cause analysis method based on interactive question-and-answer as described in claim 3, characterized in that, The step of constructing an SE-KG based on standardized multi-source data to quantify the degree of entity association in the data includes: Define the entities and relationships in the standardized multi-source data. The entities include: event entities, asset entities, action entities, and attribute entities. The relationships include attribution relationships, triggering relationships, and dependency relationships. The improved Jaccard coefficient is used to quantify the correlation between entities: in: For entity A, there is a set of entities directly associated with it. For entity B, directly associate with the set of entities. For smoothing coefficients, This represents the degree of association between entities; a higher value indicates a stronger association. The intersection operator. For union operators, The base symbol represents the cardinality of a set, that is, the number of entities contained in the set.

5. The method for root cause analysis of security incidents based on interactive question-and-answer as described in claim 1, characterized in that, The method, driven by supplementary evidence from question-and-answer sessions, iteratively updates root cause confidence through probabilistic reasoning to filter out high-probability and strongly correlated root cause candidates, including: Constructing a root cause candidate set ,in As the root cause; Based on SE-KG association strength and historical event probabilities, initialize the root cause prior probability: in: The i-th root cause in the root cause candidate set The initial prior probability, The normalization coefficient is... Represents the event entity e and the root cause. The strength of the association, Weights are assigned to historical data. In similar events The historical probability of occurrence; After each round of question and answer, the root cause posterior probability is updated using the likelihood probability of the new evidence: in: In order to obtain evidence from the first t rounds of question and answer Under these conditions, root cause The posterior probability in round t, For the root cause Given that the evidence from the previous t-1 rounds is valid, the evidence from the t-th round... The probability of occurrence To combine the evidence from the first t-1 rounds, the root cause The probability of credibility, This indicates that, given the evidence from the previous t-1 rounds, the evidence from the t-th round... The probability of occurrence; The root causes are sorted in descending order of the posterior probability. A preset number of root causes are selected from the highest to the lowest order to form a root cause set. The correlation integrity of the root causes in the root cause set is calculated. Root causes with correlation integrity less than a preset value are removed to avoid misjudgment of isolated clues.

6. The security incident root cause analysis method based on interactive question-and-answer as described in claim 5, characterized in that, The step of sorting root causes in descending order of posterior probability, selecting a preset number of root causes from high to low to form a root cause set, calculating the association integrity of the root causes in the root cause set, and removing root causes with association integrity less than a preset value to avoid misjudgment of isolated clues includes: in: Indicates root cause Association integrity metrics, quantifying root causes The percentage of evidence strongly related to all other evidence; The collection of evidence already obtained. This indicates the total amount of evidence obtained. express yes One of the pieces of evidence, For filtering condition operators, express Satisfy correlation strength , This is the criterion for determining a strong association.

7. The security incident root cause analysis method based on interactive question-and-answer as described in claim 6, characterized in that, The process of verifying the authenticity of the identified root causes and then optimizing the model parameters and the SE-KG algorithm to improve the accuracy of subsequent source tracing includes: Generate specific validation plans for high-probability root causes and calculate validation accuracy based on the validation results: in: To verify the accuracy of root cause analysis, A pre-defined root cause set is used to rank the root causes within the candidate root cause set based on probability. root cause The verification results The root cause after the t-th round of question and answer The posterior probability; If the verification accuracy is less than the preset probability, the weight coefficient of the question-answering priority and the smoothing coefficient of the SE-KG association strength calculation are adjusted. Validated root causes, related evidence, and user feedback are added to the SE-KG historical case library. The association strength of historical cases is weighted with the current association strength, and the entity association strength is updated incrementally to achieve long-term optimization of the knowledge graph.

8. The security incident root cause analysis method based on interactive question-and-answer as described in claim 7, characterized in that, The method of weighting the association strength of historical cases with the current association strength and incrementally updating the entity association strength to achieve long-term optimization of the knowledge graph includes: in: This represents the final association strength between entities A and B after the incremental update. This is a collection of historical cases containing entities A and B. for Number of cases The strength of the association between A and B in the case. right The association strengths of entities A and B in all historical cases within the set are summed to calculate the average of the historical association strengths. The correlation strength of the current event The weighting coefficients, This represents the weighting percentage of the average association strength of historical cases.

Images