A method for building and judging key evidence in automated safe operation

Abstract

The application discloses a kind of key evidence construction and research in automated safe operation in method of judging.Method includes: obtaining the multi-source network data of network to be evaluated;Based on a variety of detection engines, the features of multi-source network data are extracted, and the extracted features are standardized and aggregated to obtain key evidence containing fusion features;Each IP node in key evidence is extracted to obtain the evidence stream corresponding to each IP node;For each IP node, the evidence stream of the IP node is time window segmented to obtain multiple time windows;And multi-dimensional alarm detection is carried out on the evidence stream in each time window to obtain the alarm detection result of each time window;Risk calculation is carried out based on the alarm detection result of each time window to obtain the risk calculation result of the IP node;The risk calculation result of each IP node, the historical library and prompt word constructed in advance are input into LLM large model to obtain the comprehensive evaluation result of the network to be evaluated.The present application can automatically integrate multi-source data, improve the detection efficiency and accuracy of network threat.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, and in particular to a method for constructing and analyzing key evidence in automated security operations. Background Technology

[0002] Currently, cybersecurity threats are rapidly evolving towards greater complexity, organization, and automation. Cyberattacks have evolved from early single-point, random actions to multi-stage, persistent advanced persistent threats (APTs). Attackers utilize zero-day vulnerabilities, social engineering, and stealth techniques, making traditional defenses difficult to detect and respond to in a timely manner. Particularly in the areas of industrial control systems (ICS) and critical information infrastructure, a successful attack can lead to physical equipment damage, production stoppages, and even public safety incidents, with particularly severe consequences. Therefore, accurate identification of cyberattacks is crucial for cybersecurity.

[0003] However, because the various security data used to identify cyberattacks are scattered across different systems, these data points are often isolated from each other. Current cyberattack analysis technologies often rely on manual correlation, which is inefficient, error-prone, and fails to guarantee network security.

[0004] Therefore, there is an urgent need for a method for constructing and analyzing key evidence in automated security operations to solve the above problems. Summary of the Invention

[0005] This invention provides a method for constructing and evaluating key evidence in automated security operations, which can automatically integrate multi-source data to improve the efficiency and accuracy of network threat detection. The technical solution is as follows: On the one hand, a method for constructing and evaluating key evidence in automated security operations is provided, the method comprising: Acquire multi-source network data for the network to be evaluated; Feature extraction is performed on the multi-source network data based on multiple detection engines, and the extracted features are standardized and aggregated to obtain key evidence containing fused features. Extract each IP node from the key evidence to obtain the evidence stream corresponding to each IP node. The evidence stream includes security events and network activity data related to that node. For each IP node, the evidence stream of that IP node is divided into multiple time windows; multi-dimensional alarm detection is performed on the evidence stream within each time window to obtain the alarm detection results for each time window; risk calculation is performed based on the alarm detection results for each time window to obtain the risk calculation result for that IP node. The risk calculation results of each IP node, the pre-built historical database, and the prompt words are input into the LLM large model to obtain the comprehensive evaluation results of the network to be evaluated.

[0006] On the other hand, a device for constructing and analyzing key evidence in automated security operations is provided, the device comprising: The acquisition unit is used to acquire multi-source network data of the network to be evaluated. The aggregation unit is used to extract features from the multi-source network data based on multiple detection engines, and to standardize and aggregate the extracted features to obtain key evidence containing fused features. The node extraction unit is used to extract each IP node from the key evidence to obtain the evidence stream corresponding to each IP node. The evidence stream includes security events and network activity data related to the node. The risk calculation unit is used to divide the evidence stream of each IP node into multiple time windows; to perform multi-dimensional alarm detection on the evidence stream within each time window, and to obtain the alarm detection results of each time window; and to perform risk calculation based on the alarm detection results of each time window, so as to obtain the risk calculation result of the IP node. The evaluation unit is used to input the risk calculation results of each IP node, the pre-built historical database, and the prompt words into the LLM large model to obtain a comprehensive evaluation result of the network to be evaluated.

[0007] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing computer programs, and the processor for executing the computer programs stored in the memory to implement the steps of the above-described method for constructing and analyzing key evidence in automated security operations.

[0008] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the above-described method for constructing and analyzing key evidence in automated security operations.

[0009] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the above-described method for constructing and analyzing key evidence in automated security operations.

[0010] This invention provides a method for constructing and evaluating key evidence in automated security operations. When assessing network threats, this method first automatically fuses features from multi-source network data, enabling the data to correlate and form a complete chain of attack evidence. This process eliminates the need for manual data assembly, improving efficiency and accuracy. Second, using IP nodes as core entities, it integrates all relevant security events and network activity evidence to form a complete evidence stream. Time windows are used to segment the evidence stream, enabling temporal correlation and contextual accumulation of evidence, thereby improving the timeliness and accuracy of alarm detection results for each time window and ensuring the accuracy of risk calculations for each IP node. Finally, an LLM (Large-Scale Management) model is used for deep threat reasoning and pattern recognition, and real-time threat intelligence and historical knowledge bases are integrated for contextual enhancement, resulting in an accurate comprehensive assessment. Therefore, this application can automatically integrate multi-source data, improving the efficiency and accuracy of network threat detection. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of a method for constructing and evaluating key evidence in automated security operations, provided by an embodiment of the present invention. Figure 2 This is a schematic diagram of a multi-source data preprocessing process provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a key evidence construction and analysis architecture in automated security operations provided by an embodiment of the present invention; Figure 4 This is a structural diagram of a key evidence construction and analysis device in automated security operations provided by an embodiment of the present invention; Figure 5 This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0014] The specific implementation of the method in this application is described in detail below.

[0015] Please refer to Figure 1 This invention provides a method for constructing and evaluating key evidence in automated security operations, the method comprising: Step 100: Obtain multi-source network data of the network to be evaluated; Step 102: Based on multiple detection engines, feature extraction is performed on multi-source network data, and the extracted features are standardized and aggregated to obtain key evidence containing fused features. Step 104: Extract each IP node from the key evidence to obtain the evidence stream corresponding to each IP node. The evidence stream includes security events and network activity data related to that node. Step 106: For each IP node, the evidence stream of the IP node is divided into multiple time windows; multi-dimensional alarm detection is performed on the evidence stream within each time window to obtain the alarm detection results of each time window; risk calculation is performed based on the alarm detection results of each time window to obtain the risk calculation result of the IP node. Step 108: Input the risk calculation results of each IP node, the pre-built historical database, and the prompt words into the LLM large model to obtain the comprehensive evaluation results of the network to be evaluated.

[0016] In this embodiment, when conducting network threat assessment, firstly, by automatically fusing features from multi-source network data, the various network data can be correlated to form a complete chain of attack evidence. This process eliminates the need for manual data splicing, improving splicing efficiency and accuracy. Secondly, using IP nodes as core entities, all related security events and network activity evidence are integrated to form a complete evidence stream. The evidence stream is then segmented using time windows, enabling temporal correlation and contextual accumulation of evidence. This improves the timeliness and accuracy of alarm detection results for each time window, thereby ensuring the accuracy of risk calculation results for each IP node. Finally, a large-scale LLM model is used for deep threat reasoning and pattern recognition, and real-time threat intelligence and historical knowledge bases are integrated for contextual enhancement, resulting in an accurate comprehensive judgment. Therefore, this application can automatically integrate multi-source data, improving the efficiency and accuracy of network threat detection.

[0017] The following description Figure 1 The execution method for each step is shown.

[0018] First, for step 100, obtain multi-source network data of the network to be evaluated.

[0019] In this step, multi-source data includes various types of security data, such as network traffic, endpoint logs, industrial control protocols, and cloud security events. Specifically, multi-source network data includes at least the following two types of network data: Zeek raw logs, Suricata raw logs, Yara raw logs, Bro raw logs, Pcap offline files, and online traffic. Of course, users can also use data from other sources, and this application is not limited to this.

[0020] Regarding step 102, such as Figure 2 As shown, features are extracted from multi-source network data using multiple detection engines, and the extracted features are standardized and aggregated to obtain key evidence containing fused features, including: Based on the performance characteristics of each detection engine, corresponding features are extracted from network data from various sources. These corresponding features include at least one of the following: basic network 5-tuple, security semantic information, and flow statistics and context. The basic network 5-tuple includes timestamp, IP address, port, and protocol. Security semantic information includes alarm description, severity level, and classification. Flow statistics and context include traffic volume, connection status, and application protocol. The extracted features are formatted by IP / port, converted by timestamp, unified by protocol identifier, and cleaned by alarm name to obtain standardized features; The standardized features are aggregated to obtain key evidence containing fused features; the fused features in the key evidence include at least two of the following: basic connectivity features, security warning features, traffic statistics features, and application protocol features.

[0021] In this step, the detection engine can be Zeek, Suricata, Yara, or Bro, among others. When extracting features from network data from various sources, each detection engine works simultaneously and extracts corresponding features based on its own performance, achieving deep feature extraction and analysis of industrial network traffic. Specifically, for example... Figure 2 As shown, the system captures raw data packets from the underlying network driver layer and uses a bottom-up parsing order to deconstruct the protocol encapsulation structure layer by layer. The specific process is as follows: (1) Strip the link layer frame header and extract the source / destination MAC address, VLAN tag and physical interface identifier; (2) parse the network layer protocol (such as IP / IPv6) and extract the source / destination IP address, TTL, protocol type and fragmentation identifier; (3) restore the transport layer TCP or UDP header information and obtain the port number, sequence number, flag bit and session state parameters to support session reassembly and flow feature extraction; (4) combine the port number, payload byte distribution and feature code to identify various application layer protocols (including POP3, HTTP, FTP, SMB, DNS and industrial control exclusive protocols, such as Modbus / TCP, Profinet, OPC UA, etc.); (5) for the identified application layer protocols, further perform semantic-level fine-grained parsing to extract high-level semantic information such as instructions, function codes, data entities and transaction states, and finally form a multi-granularity feature system that combines the message layer, session layer and semantic layer to provide support for industrial anomaly detection, behavior analysis and security audit.

[0022] As shown in Table 1, this is an example of the key evidence finally formed in step 102. The key evidence finally formed includes the event type, description, and key fields / data structures (in addition to common fields).

[0023] Table 1 Examples of Key Evidence Regarding steps 104 and 106: In the two steps described above, the alarm detection dimensions include at least the following two: IP information detection, Yara virus detection, ML anomaly detection, threat intelligence matching detection, lateral movement detection, and data flow detection. Data flow detection includes long connection detection, short connection detection, DNS detection, software information detection, SSH login detection, SSL certificate detection, covert tunnel detection, and port scan detection. Each detection dimension corresponds to different detection content. Table 2 shows an example of a detection engine.

[0024] Table 2 Detection Engine Examples Furthermore, this step segments the evidence stream into one-hour time windows, accumulating and contextualizing multi-source evidence from the same IP address within each window. Simultaneously, a noise reduction mechanism is introduced, filtering irrelevant or low-confidence evidence alerts by comparing them with a predefined whitelist and known false alarm patterns, retaining only high-confidence alerts, thereby improving the signal-to-noise ratio for subsequent threat detection and analysis. Of course, users can also use other time window scales; this application does not impose specific limitations.

[0025] In addition, in this step, the alarm detection results for each time window include the number of alarms and the type of each alarm; Risk calculations are performed based on alarm detection results for each time window to obtain the risk calculation results for this IP node, including: S1, For each time window of this IP node, calculate the alarm threat value for each alarm in that time window. The calculation formula is as follows: In the formula, For the first j The first time window i The threat value of each alert, j =1,2,3……J, where J is the total number of time windows; i =1,2,3……I, where I is the total number of alarms; For the first j The first time window i The basic threat level for each alert; For the first j The first time window i The confidence level of an alarm.

[0026] In the above formula, the base threat level and confidence level of the alert are related to the alert type. The base threat level is predefined based on the alert type and the severity of each type. For example, when the alert type is remote code execution (CRITICAL), the base threat level is 1; when the alert type is lateral movement (HIGH), the base threat level is 0.8; when the alert type is port scanning (MEDIUM), the base threat level is 0.5; when the alert type is failed login (LOW), the base threat level is 0.2; and when the alert type is a regular log (INFO), the base threat level is 0. Of course, users can define the threat level for each situation according to their actual needs; this application does not impose specific limitations.

[0027] Furthermore, the confidence level is calculated differently depending on the type of alarm. For example: When the alarm type is DGA detection, the confidence level of the alarm is calculated using the following formula: Under this calculation method, the confidence level increases linearly with the increase of nxdomains, each B Each nxdomains increases the confidence level by 1 point.

[0028] When the alarm type is long-connection detection, the confidence level of the alarm is calculated using the following formula: Under this calculation method, the confidence level increases linearly with time.

[0029] In the formula, Bis the threshold for the number of non-existent domains; nxdomains is the number of non-existent domains; T is the connection duration in seconds; D is the baseline for continuous duration. When the continuous duration is D, the confidence level is 1. When the continuous duration is greater than D, the confidence level is greater than 1.

[0030] This application can adaptively adjust the confidence level based on behavioral characteristics, reducing false alarms while improving threat detection capabilities. It should be noted that users can determine the confidence level for other alarm types as needed; this application does not impose specific limitations.

[0031] S2 calculates the cumulative threat value for that time window based on the threat value of each alarm. The calculation formula is as follows: In the formula, For the first j The cumulative threat value over a time window; For the first j The first time window i The weight of each alarm; This represents the attenuation rate, such as 0.1. The warning age; The number of windows that triggered the alarm; This is the window time, such as 1 hour.

[0032] In the formula above, the alarm weight can be dynamically adjusted based on the alarm type and the freshness of the alarm. Freshness refers to the fact that the alarm is more recent than the current time; the fresher the alarm, the higher the freshness.

[0033] S3 calculates the overall threat score for the IP node based on the cumulative threat value for each time window. The calculation formula is as follows: In the formula, For the first n Comprehensive threat score for each IP node; For the first j The weight of each time window is determined by the time window weight; the weight of a time window decreases over time, meaning that the closer a time window is to the current moment, the higher its weight.

[0034] S4, calculate the reliability of the associated alarm sets for each time window of this IP node, using the following formula: In the formula, F represents the credibility of the associated alarm set; Indicates cumulative multiplication.

[0035] The above calculation formula is based on an independent event probability model, and multiple pieces of related evidence can improve the overall credibility.

[0036] S5. Based on the number of alarms corresponding to the IP node, the type of each alarm, and the time density factor of the alarms, calculate the anomaly score of the IP node. The calculation formula is as follows: Anomaly score = Σ(alarm type weight × number of alarms) × time density factor.

[0037] Among them, the time density factor reflects the frequency of evidence occurrence per unit of time.

[0038] S6 will combine the threat score, credibility score, and anomaly score as the risk calculation result for the IP node.

[0039] In the aforementioned calculation process, the system comprehensively evaluates alerts from four dimensions: timeliness, credibility, completeness, and relevance. Timeliness ensures the freshness and timely relevance of alerts through timestamps and time windows; credibility relies on confidence metrics and detection methodologies to guarantee the dependability between alerts; completeness utilizes rich contextual information of the attacking and victim entities (such as ASN, rDNS, and DNS resolution records) to construct a complete attack scenario; and relevance supports multi-evidence linkage and aggregation analysis through unique identifiers and associated fields. Based on this standardized key evidence and multi-dimensional evaluation system, the system can support several core applications: automating threat scoring and prioritization, assisting in attack chain reconstruction and causal analysis, promoting root cause analysis of security incidents, and empowering real-time risk situation awareness and assessment. Ultimately, this achieves an intelligent upgrade of the security operation process, significantly improving the automation level and decision-making efficiency of threat detection, analysis, and response.

[0040] Finally, for step 108, a history database needs to be built in advance and prompt words need to be designed. For example, Figure 3 As shown, the database includes normalized key characteristics from known networks, historical alert information, and risk calculation results. Clue words include the identity, task, and instructions of the LLM (Large Language Model). Thus, the Large Language Model (LLM) can perform deep threat reasoning and pattern recognition, and finally, by integrating real-time threat intelligence with historical knowledge bases for contextual enhancement, a comprehensive assessment can be formed.

[0041] The evaluation report output by the large model mainly includes the following six parts: (1) Summary: Overall threat level assessment, core impact scope and time frame description; (2) Attack behavior analysis: classification of attack techniques (TTPs), reconstruction of key attack paths and inference of tactical intent; (3) Recommendations for handling: List response measures by priority, such as immediate blocking, vulnerability patching and system hardening; (4) Core findings: Focus on describing high-confidence security events, such as malicious communication, abnormal scanning, and lateral movement behavior; (5) Evidence Chain Summary: Provides a structured summary and correlation analysis of key evidence; (6) Extended context: Covers related threat intelligence, compliance impact and historical relevant event references.

[0042] Furthermore, the evaluation report can be flexibly generated in versions with varying levels of detail, including summary, detailed, or in-depth technical analysis versions, to adapt to different application scenarios such as management decision-making, incident response, or audit archiving. This system automates the transformation from low-level incidents to advanced threat insights, improving the efficiency and accuracy of security operations.

[0043] To demonstrate the technical effectiveness of this application, the inventors analyzed network activity data from August 2025 using the method described in this application, and the resulting evaluation report is shown below: 1. Summary: Based on network activity data analysis in August 2025, this report identifies high-risk security threats: 57 blacklisted IP connections, 29 port scans, and 12 DNS anomalies were detected. Attackers are penetrating the system through C2 communication, port scanning, and DNS anomalies. It is recommended to take immediate isolation measures and strengthen defense strategies.

[0044] 2. Threat severity assessment, as shown in Table 3: Table 3 Threat Severity Assessment Results 3. Attack Pattern Analysis: C2 communication: Establishes a connection with the malicious server through blacklisted IPs (74.132.XX, 219.199.XX).

[0045] Port scanning: Probe for intranet services using UDP 137 (NetBIOS) and ICMP protocols.

[0046] DNS stealth channel: Performing unusual queries via a private IP address (fd2d:ab8c:X:X).

[0047] Lateral movement: Penetrating the internal network through ICMP communication between private IPs (192.168.XX).

[0048] 4. Priority Action Plan: As shown in Table 4: Table 4 Priority Action Plan 4.1 Isolate infected equipment (1) Immediately isolate all devices that connect to the blacklisted IPs (74.132.XX, 219.199.XX).

[0049] (2) Block abnormal communication paths between private IPs of 192.168.XX.

[0050] 4.2 Log and Traffic Analysis (1) Review the service logs of UDP 137 and ICMP protocols to confirm the vulnerability situation.

[0051] (2) Analyze the DNS query records of fd2d:ab8c:X:X to identify data leakage behavior.

[0052] 4.3 Defense Strategy Upgrade (1) Add the blacklisted IPs to the firewall blocking rules.

[0053] (2) Enable the DNS traffic monitoring system and set up private IP query alerts.

[0054] (3) Implement an intranet communication whitelist mechanism to restrict the scope of ICMP protocol use.

[0055] 5. Critical security findings C2 communication: 57 connections were made between the South Korean SoftBank (219.199.XX) and French 0range (2.8.XX) servers, involving command execution and data theft.

[0056] Internal network scan: 29 UDP 137 (NetBIOS) and ICMP protocol scans, targeting file sharing and network discovery services.

[0057] DNS covert channel: 12 unusual queries for fd2d:ab8c:X:X, suspected to be used for C2 command distribution.

[0058] Lateral movement: High-frequency ICMP communication between private IPs of 192.168.XX, averaging 5 requests per second.

[0059] As can be seen from the above embodiments, the method of this application can realize the automated transformation from low-level events to high-level threat insights, thereby improving the efficiency and accuracy of security operations.

[0060] like Figure 4 , Figure 5 As shown, this invention provides a device for constructing and analyzing key evidence in automated security operations. The device can be implemented through software, hardware, or a combination of both. From a hardware perspective, as... Figure 4 The diagram shown is a hardware architecture diagram of a computing device housing a key evidence construction and analysis device in automated security operations, as provided in an embodiment of the present invention. (Except for...) Figure 4In addition to the processor, memory, network interface, and non-volatile memory shown, the computing device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 5 As shown, a device in a logical sense is formed by the CPU of the computing device in which it is located reading the corresponding computer program from the non-volatile memory into the memory for execution.

[0061] Please refer to Figure 5 This invention provides a device for constructing and analyzing key evidence in automated security operations. The device includes: Acquisition unit 500 is used to acquire multi-source network data of the network to be evaluated; The aggregation unit 502 is used to extract features from multi-source network data based on multiple detection engines, and to standardize and aggregate the extracted features to obtain key evidence containing fused features. The node extraction unit 504 is used to extract each IP node from the key evidence and obtain the evidence stream corresponding to each IP node. The evidence stream includes security events and network activity data related to the node. The risk calculation unit 506 is used to divide the evidence stream of each IP node into multiple time windows for each IP node; and to perform multi-dimensional alarm detection on the evidence stream within each time window to obtain the alarm detection results of each time window; and to perform risk calculation based on the alarm detection results of each time window to obtain the risk calculation result of the IP node. Evaluation unit 508 is used to input the risk calculation results of each IP node, the pre-built historical database, and the prompt words into the LLM large model to obtain the comprehensive evaluation results of the network to be evaluated.

[0062] In some implementations, multi-source network data includes at least two types of network data: Zeek raw logs, Suricata raw logs, Yara raw logs, Bro raw logs, Pcap offline files, and online traffic.

[0063] In some implementations, the aggregation unit 502 is used to perform the following operations: Based on the performance characteristics of each detection engine, corresponding features are extracted from network data from various sources. These corresponding features include at least one of the following: basic network 5-tuple, security semantic information, and flow statistics and context. The basic network 5-tuple includes timestamp, IP address, port, and protocol. Security semantic information includes alarm description, severity level, and classification. Flow statistics and context include traffic volume, connection status, and application protocol. The extracted features are formatted by IP / port, converted by timestamp, unified by protocol identifier, and cleaned by alarm name to obtain standardized features; The standardized features are aggregated to obtain key evidence containing fused features; the fused features in the key evidence include at least two of the following: basic connectivity features, security warning features, traffic statistics features, and application protocol features.

[0064] In some implementations, the alarm detection dimensions include at least the following two detection dimensions: IP information detection, Yara virus detection, ML anomaly detection, threat intelligence matching detection, lateral movement detection, and data flow detection; among which, data flow detection includes long connection detection, short connection detection, DNS detection, software information detection, SSH login detection, SSL certificate detection, covert tunnel detection, and port scan detection.

[0065] In some implementations, the alarm detection results for each time window include the number of alarms and the type of each alarm; when the risk calculation unit 506 performs risk calculation based on the alarm detection results of each time window to obtain the risk calculation result for the IP node, it performs the following operations: For each time window of the IP node, the alarm threat value of each alarm in that time window is calculated; and the cumulative threat value of that time window is calculated based on the threat value of each alarm. The overall threat score for the IP node is calculated based on the cumulative threat value for each time window. Calculate the reliability of the associated alarm sets for each time window of the IP node; Based on the number of alarms corresponding to the IP node, the type of each alarm, and the time density factor of the alarm, calculate the anomaly score of the IP node; The risk calculation result for this IP node will be based on a comprehensive threat score, credibility score, and anomaly score.

[0066] In some implementations, the alarm threat value for each alarm is calculated using the following formula: In the formula, For the first j The first time window i The threat value of each alert, j =1,2,3……J, where J is the total number of time windows; i =1,2,3……I, where I is the total number of alarms; For the first j The first time window i The basic threat level for each alert; For the first j The first time window iThe confidence level of each alarm is determined. The alarm threat value for each alarm is calculated using the following formula: In the formula, For the first j The first time window i The threat value of each alert, j =1,2,3……J, where J is the total number of time windows; i =1,2,3……I, where I is the total number of alarms; For the first j The first time window i The basic threat level for each alert; For the first j The first time window i The confidence level of an alarm.

[0067] In some implementations, when the alarm type is DGA detection, the confidence level of the alarm is calculated using the following formula: When the alarm type is long-connection detection, the confidence level of the alarm is calculated using the following formula: In the formula, B is the threshold for the number of non-existent domains; nxdomains is the number of non-existent domains; T is the connection duration in seconds; D is the baseline for continuous duration. When the continuous duration is D, the confidence level is 1. When the continuous duration is greater than D, the confidence level is greater than 1.

[0068] It should be noted that the key evidence construction and analysis device for automated security operations provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the key evidence construction and analysis device for automated security operations provided in the above embodiments and the key evidence construction and analysis method embodiments for automated security operations belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0069] Embodiments of this application also provide a computer device, please refer to... Figure 5 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, at least one program, code set or instruction set being loaded and executed by the processor to implement the key evidence construction and analysis method in automated security operation provided by the above method embodiments.

[0070] The embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the key evidence construction and analysis method in automated security operation provided by the above-described method embodiments.

[0071] Embodiments of this application also provide a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium and executes the computer program, causing the computer device to perform the key evidence construction and analysis method in automated security operations as described in any of the above embodiments.

[0072] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.

[0073] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0074] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0075] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for constructing and analyzing key evidence in automated security operations, characterized in that, The method includes: Acquire multi-source network data for the network to be evaluated; Feature extraction is performed on the multi-source network data based on multiple detection engines, and the extracted features are standardized and aggregated to obtain key evidence containing fused features. Extract each IP node from the key evidence to obtain the evidence stream corresponding to each IP node. The evidence stream includes security events and network activity data related to that node. For each IP node, the evidence stream of that IP node is divided into multiple time windows; multi-dimensional alarm detection is performed on the evidence stream within each time window to obtain the alarm detection results for each time window; risk calculation is performed based on the alarm detection results for each time window to obtain the risk calculation result for that IP node. The risk calculation results of each IP node, the pre-built historical database, and the prompt words are input into the LLM large model to obtain the comprehensive evaluation results of the network to be evaluated. The alarm detection results for each time window include the number of alarms and the type of each alarm; The risk calculation based on the alarm detection results of each time window yields the risk calculation result for the IP node, including: For each time window of the IP node, the alarm threat value of each alarm in that time window is calculated; and the cumulative threat value of that time window is calculated based on the threat value of each alarm. The overall threat score for the IP node is calculated based on the cumulative threat value for each time window. Calculate the reliability of the associated alarm sets for each time window of the IP node; Based on the number of alarms corresponding to the IP node, the type of each alarm, and the time density factor of the alarm, the anomaly score of the IP node is calculated; the time density factor reflects the frequency of evidence occurrence per unit time. The comprehensive threat score, the credibility score, and the anomaly score are used as the risk calculation results for the IP node.

2. The method according to claim 1, characterized in that, The multi-source network data includes at least the following two types of network data: Zeek raw logs, Suricata raw logs, Yara raw logs, Bro raw logs, Pcap offline files, and online traffic.

3. The method according to claim 1, characterized in that, The process involves extracting features from the multi-source network data using multiple detection engines, and then standardizing and aggregating the extracted features to obtain key evidence containing fused features, including: Based on the performance characteristics of each detection engine, corresponding features are extracted from network data from various sources. These corresponding features include at least one of the following: basic network 5-tuple, security semantic information, and flow statistics and context. The basic network 5-tuple includes timestamp, IP address, port, and protocol. The security semantic information includes alarm description, severity level, and classification. The flow statistics and context include traffic volume, connection status, and application protocol. The extracted features are formatted by IP / port, converted by timestamp, unified by protocol identifier, and cleaned by alarm name to obtain standardized features; The standardized features are aggregated to obtain key evidence containing fused features; the fused features in the key evidence include at least two of the following: basic connectivity features, security warning features, traffic statistics features, and application protocol features.

4. The method according to claim 1, characterized in that, The alarm detection dimensions include at least the following two dimensions: IP information detection, Yara virus detection, ML anomaly detection, threat intelligence matching detection, lateral movement detection, and data flow detection; among which, data flow detection includes long connection detection, short connection detection, DNS detection, software information detection, SSH login detection, SSL certificate detection, covert tunnel detection, and port scan detection.

5. The method according to claim 1, characterized in that, The alarm threat value for each alarm is calculated using the following formula: In the formula, For the first j The first time window i The threat value of each alert, j =1,2,3……J, where J is the total number of time windows; i =1,2,3……I, where I is the total number of alarms; For the first j The first time window i The basic threat level for each alert; For the first j The first time window i The confidence level of an alarm.

6. The method according to claim 5, characterized in that, When the alarm type is DGA detection, the confidence level of the alarm is calculated using the following formula: When the alarm type is long-connection detection, the confidence level of the alarm is calculated using the following formula: In the formula, B The threshold for the number of non-existent domains; nxdomains is the number of non-existent domains; T is the connection duration in seconds; D is the baseline for continuous duration. When the continuous duration is D, the confidence level is 1. When the continuous duration is greater than D, the confidence level is greater than 1.

7. A device for constructing and analyzing key evidence in automated security operations, characterized in that, The apparatus for implementing the steps of any one of claims 1-6, wherein the apparatus comprises: The acquisition unit is used to acquire multi-source network data of the network to be evaluated. The aggregation unit is used to extract features from the multi-source network data based on multiple detection engines, and to standardize and aggregate the extracted features to obtain key evidence containing fused features. The node extraction unit is used to extract each IP node from the key evidence to obtain the evidence stream corresponding to each IP node. The evidence stream includes security events and network activity data related to the node. The risk calculation unit is used to divide the evidence stream of each IP node into multiple time windows; to perform multi-dimensional alarm detection on the evidence stream within each time window, and to obtain the alarm detection results of each time window; and to perform risk calculation based on the alarm detection results of each time window, so as to obtain the risk calculation result of the IP node. The evaluation unit is used to input the risk calculation results of each IP node, the pre-built historical database, and the prompt words into the LLM large model to obtain a comprehensive evaluation result of the network to be evaluated.

8. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-6.

Images