Network security event handling method and system based on knowledge consistency verification

Abstract

The application relates to a network security event handling method and system based on knowledge consistency verification, and belongs to the technical field of event handling. The method comprises the following steps: acquiring network security events of various target security devices, extracting original attack payloads, abstracting the original attack payloads into PoC attack feature vectors, and performing retrieval matching in a preset RAG knowledge base to return retrieval matching results; calling an MCP server to perform knowledge consistency verification on the retrieval matching results to obtain verification results; based on the verification results and the network security events, generating atomized handling semantics through an LLM reasoning engine; structurally packaging and contextually verifying the atomized handling semantics to generate a security handling context object; mapping the security handling context object into calling instructions of various target security devices; and enabling the various target security devices to execute actions based on the corresponding calling instructions, so that the decision basis of automatic security response is always based on the latest, reliable and compliant knowledge, and the response efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of incident handling technology, and specifically to a method and system for handling network security incidents based on knowledge consistency verification. Background Technology

[0002] Timely and accurate handling of cybersecurity incidents is a core element in ensuring the secure and stable operation of information systems. Faced with increasingly complex and automated cyberattacks, traditional methods relying on manual analysis and judgment are insufficient to cope with massive alerts and rapidly changing threats. Automated security operations and response technologies have emerged to address this need, with the core objective of improving the speed, consistency, and traceability of incident response, effectively shortening threat exposure time, and controlling the scope of attack impact.

[0003] Currently, intelligent security assistance systems based on large language models have become a research and application hotspot in this field. They generally adopt an architecture combination of large language models, intelligent agents, and RAG knowledge retrieval. The large language model is responsible for analyzing security logs and alarm information and generating natural language handling suggestions. The intelligent agent is responsible for calling tools to perform specific operations. The retrieval enhancement generation module provides external knowledge base support for model reasoning. In this way, through natural language interaction and knowledge enhancement, the level of intelligence of security analysis and the efficiency of automated response are improved.

[0004] However, the non-deterministic nature of large language model outputs and the ambiguity of natural language in existing technologies pose security risks when directly applied to automated execution, and they lack reliable structured verification and contextual security validation mechanisms. Furthermore, the slow updating of knowledge within the model, coupled with the fact that existing retrieval enhancement generation technologies primarily focus on knowledge retrieval itself and lack proactive verification and control over the timeliness and consistency of knowledge, can easily lead to misjudgments based on outdated or contradictory information. In addition, the inconsistent interface standards of heterogeneous security devices and the lack of a unified semantic abstraction layer make it difficult to standardize automated response actions across platforms and vendors. Summary of the Invention

[0005] In view of the shortcomings of the existing technologies, the purpose of this invention is to provide a network security incident handling method and system based on knowledge consistency verification, so as to solve the technical problems of existing technology model output lacking a reliable structured security verification mechanism, external knowledge retrieval lacking timeliness and consistency control, and lack of a unified semantic abstraction layer among heterogeneous devices, which leads to security risks, decision lag and insufficient standardization in automated response.

[0006] This invention provides a method for handling network security incidents based on knowledge consistency verification, comprising the following steps:

[0007] Security incident acquisition steps: Acquire network security incidents of various target security devices;

[0008] Knowledge retrieval and matching steps: Extract the original attack payload from the network security incident, abstract the original attack payload into a PoC attack feature vector, and perform retrieval and matching in the preset RAG knowledge base based on the PoC attack feature vector through vector similarity, return the knowledge entry with the highest similarity, and obtain the retrieval and matching results;

[0009] Knowledge consistency verification steps: The MCP server is invoked to perform knowledge consistency verification on the retrieval matching results. Based on the knowledge identifier in the knowledge entry, the RAG knowledge base is queried to obtain all knowledge entries with a valid status under the knowledge identifier and their corresponding version numbers. From all knowledge entries, the latest version number is determined according to the update order of their version numbers. If the version number of the knowledge entry is consistent with the latest version number, there is no conflict in processing logic between the knowledge entry and all knowledge entries, and the knowledge entry conforms to the preset security constraint policy, then the verification result is successful; otherwise, the verification result is unsuccessful. Based on the verification result and the network security event, atomic processing semantics are generated through the LLM inference engine.

[0010] Action execution steps: The atomic disposal semantics are structured and contextually verified by the MCP server to generate a security disposal context object. The security disposal context object is mapped to the invocation instructions of various target security devices. The various target security devices execute actions based on the corresponding invocation instructions.

[0011] By vectorizing the attack payloads in cybersecurity incidents and retrieving and matching them with the RAG knowledge base, initial knowledge basis is obtained. Then, the MCP server is introduced to perform mandatory knowledge consistency verification on the retrieval and matching results. This verification process confirms the timeliness of knowledge entries by comparing their version numbers, analyzes their consistency with similar knowledge to eliminate logical conflicts, and performs compliance filtering according to security policies, thereby ensuring that the knowledge base input into the LLM inference engine is up-to-date, reliable, and secure.

[0012] Based on this, the atomic processing semantics generated by the LLM inference engine are then structured and contextually verified by the MCP server, and finally transformed into device call instructions that can be securely issued. This fundamentally solves the problem of unreliable and uncontrollable automated responses caused by the LLM inference engine directly referencing outdated, contradictory or non-compliant knowledge in existing technologies. It achieves the goal of improving the automation level of secure responses while ensuring the reliability, security and auditability of its decision-making process.

[0013] In some embodiments of the present invention, the security event acquisition step specifically includes:

[0014] Receive raw security event logs from various target security devices through WebHook or timed fetching mechanisms;

[0015] The original security event logs are parsed to extract the attack source IP, destination IP, and attack payload, thus obtaining key security fields.

[0016] The key security fields are converted into a unified structured data format to obtain the network security event.

[0017] The use of both WebHook and timed retrieval mechanisms to receive raw security event logs ensures the real-time nature and flexibility of event collection, while the standardized extraction of key fields such as attack source IP, destination IP, and attack payload eliminates the interference of differences in raw data format on downstream processes.

[0018] By standardizing the input data, a stable and consistent input interface is provided for the knowledge retrieval and intelligent judgment modules. This is an important prerequisite for the entire system to perform accurate analysis and decision-making, and avoids a chain of errors caused by data quality issues.

[0019] In some embodiments of the present invention, the knowledge retrieval and matching step specifically includes:

[0020] Acquire multi-source security knowledge; wherein, the multi-source security knowledge includes vulnerability intelligence, security vendor announcements, attack behavior characteristics, PoC samples and handling rules;

[0021] The multi-source security knowledge is organized into multiple initial knowledge entries, and the initial knowledge entries are vectorized.

[0022] Each vectorized initial knowledge entry is added with a knowledge identifier, version number, update time, source information, and credibility tag before being stored to construct the RAG knowledge base.

[0023] By attaching metadata such as version number, source information, and credibility tags to each knowledge entry in the RAG knowledge base, knowledge is given a manageable lifecycle and assessable quality attributes.

[0024] Vectorizing knowledge entries enables rapid retrieval based on semantic similarity, improves the accuracy of knowledge retrieval, and provides essential metadata support for subsequent timeliness verification, authority comparison, and consistency arbitration of knowledge, transforming knowledge from static information into dynamic objects that can be precisely verified.

[0025] In some embodiments of the present invention, the knowledge consistency verification step further includes:

[0026] If there are multiple knowledge entries, the MCP server calculates a comprehensive score based on the update time, source information, and credibility tags of all knowledge entries using a consistency verification algorithm.

[0027] The optimal entry is selected from all knowledge entries based on the comprehensive score. If the knowledge entry is the optimal entry, then there is no logical conflict between the knowledge entry and all knowledge entries.

[0028] Otherwise, there is a logical conflict in the processing of the knowledge entry and all the knowledge entries.

[0029] By introducing a comprehensive scoring algorithm based on update time, source information, and credibility tags to arbitrate the optimal item, an objective quantitative basis is provided for determining and handling logical conflicts.

[0030] When faced with multiple candidates under the same knowledge identifier, the system can automatically evaluate the overall quality of each entry based on preset priority rules, thereby identifying the optimal solution in the current context. This eliminates the ambiguity and inconsistency that may arise when manual or simple rules are used to process complex, multi-source knowledge, ensuring that the system always tends to adopt the most reliable and appropriate basis for handling in automated decision-making, thus improving the scientific nature and authority of the response.

[0031] In some embodiments of the present invention, the knowledge consistency verification step further includes:

[0032] If the verification result is successful, the verified knowledge item, combined with the network security event, is input into the LLM inference engine to generate the atomic disposal semantics.

[0033] If the verification result is unverified, the processing flow of the unverified knowledge item will be blocked through the MCP server, and the network security event will be marked as requiring re-search and matching.

[0034] By directly using the results of knowledge consistency verification as the control switch for process flow, it is clearly stipulated that LLM reasoning to generate disposal semantics can only be initiated when the verification is passed; otherwise, the process will be blocked and the event will be marked as needing to be re-evaluated. This effectively prevents the system from reasoning and executing based on invalid or doubtful knowledge, ensuring the safety bottom line of automated response and enabling the entire disposal process to have inherent fault tolerance and self-correction capabilities.

[0035] In some embodiments of the present invention, the action execution step further includes:

[0036] The security policy constraints in the MCP server are used to perform security checks on the invocation command, and the security-checked invocation command is sent to the corresponding target security device.

[0037] The target security device receives the invocation command and performs an action based on the invocation command.

[0038] By setting up a security checkpoint before the final device command is issued, a final security confirmation step is added to the automated execution action. Even if the processing semantics have been generated and encapsulated for verification, this step still requires the MCP server to perform a final review of the specific call command according to the security policy. This can capture and intercept new risks caused by dynamic policy updates or subtle changes in context, significantly enhancing the system's operational security and policy compliance in complex and dynamic environments.

[0039] In some embodiments of the present invention, the atomic disposal semantics include the attack source IP, the destination IP, the threat type, the disposal action corresponding to the disposal suggestion, the identifiers of various target security devices, and the version number corresponding to the knowledge entry.

[0040] By clarifying the semantics of atomized disposals, the output format of the LLM inference engine is standardized, enabling the LLM output to be transformed from free natural language into standardized data objects that can be unambiguously parsed by machines, thereby improving the efficiency and accuracy of downstream module processing. Furthermore, by using the version number corresponding to the knowledge item, each generated disposal action can be directly linked to the specific knowledge basis it depends on, achieving precise traceability and responsibility positioning for automated decision-making and enhancing the interpretability of the response.

[0041] In some embodiments of the present invention, the method further includes:

[0042] Log auditing steps: Obtain the execution result of the target security device, and record it in combination with the network security event, the retrieval matching result, the verification result, the atomic processing semantics, the security processing context object and the calling instruction to generate an audit log.

[0043] By requiring the recording of information across the entire chain, from cybersecurity incidents, knowledge used, decision-making processes to execution results, a complete, coherent, and traceable chain of audit evidence is generated.

[0044] By using a logging method that covers the entire lifecycle, the system meets the stringent requirements for security compliance and provides comprehensive and reliable raw data for post-incident attack tracing, response effectiveness evaluation, system problem diagnosis, and operational process optimization. This makes the entire automated handling process transparent and auditable, greatly improving the system's credibility and maintainability.

[0045] Some embodiments of the present invention further provide a network security incident handling system based on knowledge consistency verification, including: a security incident acquisition module, an LLM inference engine, a RAG knowledge retrieval module, an MCP server, and a target security device;

[0046] The security event acquisition module is used to acquire network security events of various target security devices.

[0047] The LLM inference engine is connected to the security event acquisition module and is used to receive the network security event and extract the original attack payload from the network security event.

[0048] The RAG knowledge retrieval module is connected to the LLM inference engine and the MCP server. It is used to receive the original attack payload and abstract the original attack payload into a PoC attack feature vector. Based on the PoC attack feature vector, it performs a search and matching in a preset RAG knowledge base and sends the search and matching results to the MCP server.

[0049] The MCP server is connected to the RAG knowledge retrieval module and the LLM inference engine. It is used to receive the retrieval matching results and perform knowledge consistency verification on the retrieval matching results to obtain the verification results. The verification results and the network security event are then sent to the LLM inference engine.

[0050] The LLM inference engine is also used to generate atomic processing semantics based on the verification result and the network security event, and send the atomic processing semantics to the MCP server;

[0051] The MCP server is also used to perform structured encapsulation and context verification of the atomic processing semantics, generate a security processing context object, and map the security processing context object to the invocation instructions of the target security device;

[0052] The action execution module is connected to the MCP server and the target security device, and is used to receive the invocation command and control the target security device to execute actions based on the corresponding invocation command.

[0053] By integrating a security event acquisition module, a RAG knowledge retrieval module, an LLM inference engine, an MCP server, and an action execution module, and organizing them according to the prescribed connection relationships and data flow, the aforementioned security handling mechanism is realized at both the physical and logical levels.

[0054] By clearly defining the core control role of the MCP server and the independent responsibilities of the action execution module, the security concepts of knowledge pre-verification and pre-execution control are solidified into the system design, providing a concrete and deployable hardware and software solution for efficient, reliable, and secure automated network security response. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 A flowchart illustrating a network security incident handling method based on knowledge consistency verification, provided as an embodiment of the present invention;

[0057] Figure 2 This is a structural diagram of a network security incident handling system based on knowledge consistency verification, provided as an embodiment of the present invention. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0059] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. Furthermore, it should be understood that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or apparatus.

[0060] As the application of large language models in security operations and incident response continues to develop, their capabilities in log analysis, threat intelligence summarization, automated handling suggestion generation, and auxiliary script / scenario generation have been verified by numerous studies and industry reports.

[0061] Currently, large language models are typically used to perform natural language analysis on logs, threat intelligence, or alert information to generate security action suggestions or operation scripts, and then execute the response through security orchestration and automation systems.

[0062] In some implementations, the system improves processing efficiency and security through templated output, manual approval, or policy constraints.

[0063] Existing technologies generally employ a combination of large language models, intelligent agents, and RAG knowledge retrieval. Specifically, the LLM inference engine generates atomic operation semantics, the intelligent agent is responsible for calling tools to execute them, and the RAG knowledge retrieval module provides external knowledge support, which can improve the efficiency of security incident analysis and response to a certain extent.

[0064] Among them, the Large Language Model (LLM) refers to an artificial intelligence model with super language understanding and generation capabilities obtained by training on massive amounts of text data. Its core is a parameterized statistical model that can predict the next word or generate continuous text based on the input text sequence.

[0065] An LLM inference engine is a complete software system or module built with a large language model as the core computing unit to complete specific complex inference tasks.

[0066] The LLM inference engine not only includes the large language model itself, but also integrates a series of technologies such as task scheduling, prompt engineering, context management, tool invocation (and output parsing), transforming the original LLM capabilities into specialized tools that can solve practical problems.

[0067] However, the above methods mainly focus on semantic generation and task execution links, and still have shortcomings in context security control, knowledge consistency verification, and semantic alignment across multiple devices.

[0068] First, the inference results of large language models are usually output in the form of natural language, which has probabilistic and non-deterministic problems. Directly using its results for automatic processing may lead to security risks such as instruction ambiguity, loss of context, or unauthorized execution.

[0069] While existing solutions incorporate methods such as templates and manual approval, they still lack structured verification and context-safety verification mechanisms for model outputs, making it difficult to form a provably secure closed loop.

[0070] Secondly, the knowledge within the large language model is fixed in the model parameters, with a long update cycle, making it unable to quickly respond to the dynamic changes in security threats. Although the RAG knowledge retrieval mechanism can retrieve external knowledge sources, existing methods are mainly used to enhance the accuracy of reasoning rather than to verify or synchronously control the knowledge state.

[0071] Insufficient coverage, credibility, and version management of external information can easily lead to models referencing outdated vulnerability information or invalid Proof-of-Concept (POC) in event response, resulting in knowledge lag and security risks.

[0072] Furthermore, the lack of standardized interfaces for various security devices such as firewalls, IDS / IPS, EDR, and gateways makes it difficult to directly map the output of large language models or intelligent agents to the execution interfaces of different vendors or platforms, resulting in difficulties in standardizing automated responses and poor portability.

[0073] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0074] The technical solution of the present invention will be described in detail below with reference to specific embodiments and accompanying drawings.

[0075] like Figure 1 As shown, this invention provides a method for handling network security incidents based on knowledge consistency verification, comprising the following steps:

[0076] Security event acquisition step S1: Acquire network security events of various target security devices;

[0077] In some embodiments, the security event acquisition step S1 specifically includes:

[0078] Receive raw security event logs from various target security devices through WebHook or timed fetching mechanisms;

[0079] The original security event logs are parsed to extract the attack source IP, destination IP, and attack payload, thus obtaining key security fields.

[0080] By converting key security fields into a unified structured data format, network security events can be obtained.

[0081] The use of both WebHook and timed retrieval mechanisms to receive raw security event logs ensures the real-time nature and flexibility of event collection, while the standardized extraction of key fields such as attack source IP, destination IP, and attack payload eliminates the interference of differences in raw data format on downstream processes.

[0082] By standardizing the input data, a stable and consistent input interface is provided for the knowledge retrieval and intelligent judgment modules. This is an important prerequisite for the entire system to perform accurate analysis and decision-making, and avoids a chain of errors caused by data quality issues.

[0083] Furthermore, various target security devices include firewalls, intrusion detection / prevention systems (IDS / IPS), endpoint detection and response systems (EDR), and log auditing platforms;

[0084] In the current network security operation environment, a large number of heterogeneous security devices generate logs and event information with different formats and standards. Directly inputting this raw data into a large language model for analysis will severely restrict the accuracy and automation efficiency of the analysis due to the data disorder and semantic ambiguity.

[0085] To address the aforementioned issues, a front-end data intermediary and standardized processing layer is constructed. This layer can shield the differences in data formats and interfaces among various underlying target security devices. By simultaneously supporting both proactive reporting via WebHook and passive retrieval via scheduled tasks, it ensures that security events can be collected and aggregated in real time, thereby guaranteeing the integrity and timeliness of the data source.

[0086] After collecting the raw security event logs of various target security devices, a dedicated parsing module is invoked to accurately extract the attack source IP, destination IP, and attack payload from the logs of different vendors according to predefined rules, as key security fields.

[0087] Key security fields are mapped and converted into a unified structured data format to obtain network security events; for example, adopting or extending the industry-standard ECS logs.

[0088] Through the above process, unstructured, dialect-style raw logs are translated into universal language data that can be understood unambiguously by both machines and AI models, providing a high-quality and standardized input foundation for subsequent intelligent analysis.

[0089] Upon receiving a network security incident, it supplies the information to the upstream LLM inference engine through a unified device abstraction layer interface, providing the LLM inference engine with security device information in a consistent format and receiving a single-format processing intent from the LLM inference engine, thereby reducing the complexity of interaction between the LLM inference engine and security devices.

[0090] Knowledge retrieval and matching step S2: Extract the original attack payload from the network security incident, abstract the original attack payload into a PoC attack feature vector, and perform retrieval and matching in the preset RAG knowledge base based on the PoC attack feature vector through vector similarity, return the knowledge entry with the highest similarity, and obtain the retrieval and matching result;

[0091] Furthermore, the LLM inference engine calls the attack payload abstraction function in the RAG knowledge retrieval module to extract the original attack payload from the network security incident, such as extracting the HTTP request header and request body;

[0092] By leveraging the characteristics of large language models, we can abstract them into PoC attack feature vectors to prepare for the next step of RAG knowledge retrieval.

[0093] In some embodiments, the knowledge retrieval matching step S2 specifically includes:

[0094] Acquire security knowledge from multiple sources, including vulnerability intelligence, security vendor announcements, attack behavior characteristics, PoC samples, and handling rules.

[0095] Multi-source security knowledge is organized into multiple initial knowledge entries, and the initial knowledge entries are vectorized.

[0096] Each vectorized initial knowledge entry is added with a knowledge identifier, version number, update time, source information, and credibility tag before being stored to build the RAG knowledge base.

[0097] By attaching metadata such as version number, source information, and credibility tags to each knowledge entry in the RAG knowledge base, knowledge is given a manageable lifecycle and assessable quality attributes.

[0098] Vectorizing knowledge entries enables rapid retrieval based on semantic similarity, improves the accuracy of knowledge retrieval, and provides essential metadata support for subsequent timeliness verification, authority comparison, and consistency arbitration of knowledge, transforming knowledge from static information into dynamic objects that can be precisely verified.

[0099] Furthermore, we collect security knowledge from multiple sources, including CVE / CNVD vulnerability intelligence, security vendor announcements, attack behavior characteristics, PoC samples, and handling rules.

[0100] For example, when an automated system makes a misjudgment due to incomplete rules in the RAG knowledge base, the manual intervention to add it to the whitelist is not a one-time temporary patch, but is systematically recorded as a formal version update of the RAG knowledge base. This update will cause the relevant handling rules to generate new knowledge entries with higher version numbers.

[0101] Through a strict version control mechanism, the system ensures that all subsequent automated assessments of similar scenarios will prioritize and automatically reference this knowledge version that represents the latest and most accurate understanding. This allows an empirical correction by a human expert to be permanently and structurally transformed into an improvement in the system's own cognitive capabilities, thereby preventing the recurrence of the same misjudgment and enabling the system to continuously optimize and learn in a real operating environment.

[0102] Multi-source security knowledge is organized into multiple initial knowledge entries, and the initial knowledge entries are vectorized.

[0103] Each vectorized initial knowledge entry is added with a knowledge identifier, version number, update time, source information, and credibility tag before being stored to build the RAG knowledge base;

[0104] The constructed RAG knowledge base supports incremental update and variable update mechanisms; incremental updates are used to add new vulnerabilities or fix information; variable updates are used to revise existing PoC samples or attack behavior characteristics, ensuring that the RAG knowledge base can respond quickly to changes in external threats.

[0105] The version number serves as the sole benchmark for tracking knowledge evolution and directly supports the core verification function of the MCP server. By comparing the knowledge version referenced by the LLM inference engine with the latest version in the RAG knowledge base, it determines whether the knowledge is outdated, thereby ensuring the reliability of decision-making basis in terms of timeliness.

[0106] Source information can include the organization to which the source information belongs and the time when the source information was generated. This enables the LLM inference engine to proactively consider the authority and timeliness of the information when generating suggestions, and the MCP server to verify the rationality of the knowledge cited in the suggestions.

[0107] By guiding or mandating verification, we ensure that the decision-making process tends to adopt knowledge sources with higher credibility, thereby improving the overall quality and credibility of automated decision-making at the source and forming a complete and credible chain from knowledge entry and version management to application verification.

[0108] Knowledge Consistency Verification Step S3: Call the MCP server to perform knowledge consistency verification on the retrieval matching results. Based on the knowledge identifier in the knowledge entry, query the RAG knowledge base to obtain all knowledge entries with a valid status under the knowledge identifier and their corresponding version numbers. From all knowledge entries, determine the latest version number according to the update order of their version numbers. If the version number of the knowledge entry is consistent with the latest version number, there is no conflict in the processing logic between the knowledge entry and all knowledge entries, and the knowledge entry conforms to the preset security constraint policy, then the verification result is successful; otherwise, the verification result is unsuccessful. Based on the verification result and the network security event, generate atomic processing semantics through the LLM inference engine.

[0109] Among them, the MCP (Model Context Protocol) server serves as an intermediary layer between the LLM inference engine and various target security devices, enabling secure and reliable interaction between the large language model and various target security devices.

[0110] By stipulating that knowledge consistency verification must pass three checks in sequence—version latestness, logical non-conflict, and security policy compliance—a clear and strict verification standard is set for the MCP server.

[0111] By actively querying all valid versions of knowledge entries to determine their timeliness, and proactively identifying and arbitrating logical contradictions between multiple versions, and finally filtering through security policies, the system systematically covers core risk points such as outdated knowledge, contradictory information, and unauthorized operations. This transforms the judgment of knowledge reliability from subjective experience into an objective and repeatable technical process.

[0112] In some embodiments, the knowledge consistency verification step S3 further includes:

[0113] If there are multiple knowledge entries, the MCP server calculates a comprehensive score based on the update time, source information, and credibility tags of all knowledge entries using a consistency check algorithm.

[0114] The optimal entry is selected from all knowledge entries based on the comprehensive score. If a knowledge entry is the optimal entry, there is no logical conflict in the processing of the knowledge entry with any other knowledge entry.

[0115] Otherwise, there will be a conflict in the disposal logic between the knowledge entry and all knowledge entries.

[0116] By introducing a comprehensive scoring algorithm based on update time, source information, and credibility tags to arbitrate the optimal item, an objective quantitative basis is provided for determining and handling logical conflicts.

[0117] When faced with multiple candidates under the same knowledge identifier, the system can automatically evaluate the overall quality of each entry based on preset priority rules, thereby identifying the optimal solution in the current context. This eliminates the ambiguity and inconsistency that may arise when manual or simple rules are used to process complex, multi-source knowledge, ensuring that the system always tends to adopt the most reliable and appropriate basis for handling in automated decision-making, thus improving the scientific nature and authority of the response.

[0118] In some embodiments, the knowledge consistency verification step S3 further includes:

[0119] If the verification result is successful, the verified knowledge items will be combined with the network security incident and input into the LLM inference engine to generate atomic disposal semantics.

[0120] If the verification result is unsuccessful, the processing flow for the unverified knowledge item will be blocked through the MCP server, and the cybersecurity incident will be marked as requiring a re-search and matching.

[0121] By directly using the results of knowledge consistency verification as the control switch for process flow, it is clearly stipulated that LLM reasoning to generate disposal semantics can only be initiated when the verification is passed; otherwise, the process will be blocked and the event will be marked as needing to be re-evaluated. This effectively prevents the system from reasoning and executing based on invalid or doubtful knowledge, ensuring the safety bottom line of automated response and enabling the entire disposal process to have inherent fault tolerance and self-correction capabilities.

[0122] Furthermore, based on the PoC attack feature vector, the RAG knowledge base is searched and matched using vector similarity, and the knowledge entry with the highest similarity is returned;

[0123] Among them, the knowledge items with the highest similarity include the threat type, handling recommendations, and version number corresponding to the current attack payload;

[0124] During the process of obtaining the search and matching results, the knowledge entries, their knowledge identifiers, and the version numbers they reference are output together.

[0125] First, ensure that the knowledge entries cited are the latest and most valid versions under their corresponding topics to eliminate the risk of decision-making due to information lag;

[0126] When multiple PoC samples or announcements from different security vendors exist for the same vulnerability or attack type, the MCP server will arbitrate using its built-in consistency check algorithm. It will comprehensively consider source information, trustworthiness tags, and update time, calculate source priority, trustworthiness, and timestamp, obtain a comprehensive score, and automatically select the optimal solution in the current context to resolve information conflicts and ensure the authority of the judgment benchmark.

[0127] At the same time, the MCP server will force the operation to be executed to be matched and verified against the predefined security constraint policy, and block any instructions that violate the security red line, thereby building the last line of security defense.

[0128] If any of the above verifications fails, such as knowledge expiration, non-arbitrable conflict, or violation of security constraint policies, the MCP server will immediately block the current processing procedure.

[0129] The system will automatically mark associated security events as requiring re-search and matching, and trigger a new round of knowledge retrieval and generation processes to obtain handling suggestions based on the latest knowledge;

[0130] At the same time, the specific reasons for the verification failure, the version number of the referenced knowledge item, and the details of the conflict will be fully recorded, forming a traceable audit trail to serve post-event review and system optimization. The entire mechanism ensures that the automated response is always based on the latest, consistent, and compliant knowledge foundation through a closed loop of proactive verification and automatic correction.

[0131] Furthermore, knowledge entries and cybersecurity events that have passed knowledge consistency verification are input into the LLM inference engine, and deep reasoning is performed on this basis to generate atomic processing semantics, thereby completely avoiding the inherent ambiguity of natural language description;

[0132] For example, when handling reverse shell security incidents, there may be situations where the attacker's IP and the reverse connection IP are different. The system will use the reverse shell as a query vector to retrieve solutions containing the update timestamp from the RAG knowledge base. When generating the handling semantics, the LLM inference engine will generate structured atomic handling semantics based on the attacker's IP and the reverse connection IP respectively.

[0133] For actions involving blocking IP addresses, the corresponding unified structured semantics of the output are {"action":"block","object":"ip","target":"1.1.1.1"};

[0134] For actions involving blocking URLs, the corresponding unified structured semantic representation of the action is {"action":"block","object":"url","target":" / backup.zip"};

[0135] This structured output fundamentally eliminates semantic ambiguity, providing a unique and clear instruction benchmark for subsequent automated verification and device execution, and is a key conversion step for achieving a reliable automated closed loop.

[0136] In addition, to ensure the sufficiency and accuracy of reasoning, when faced with knowledge blind spots or complex attack scenarios, the LLM inference engine has the ability to actively call external tools such as the RAG knowledge retrieval module to obtain necessary auxiliary information.

[0137] Action execution step S4: The MCP server performs structured encapsulation and context verification of the atomic disposal semantics, generates a security disposal context object, maps the security disposal context object to the invocation instructions of various target security devices, and various target security devices execute actions based on the corresponding invocation instructions.

[0138] In some embodiments, atomic disposal semantics include attack source IP, destination IP, threat type, disposal action corresponding to disposal recommendation, identifiers of various target security devices, and version number corresponding to knowledge entries.

[0139] By clarifying the semantics of atomized disposals, the output format of the LLM inference engine is standardized, enabling the LLM output to be transformed from free natural language into standardized data objects that can be unambiguously parsed by machines, thereby improving the efficiency and accuracy of downstream module processing. Furthermore, by using the version number corresponding to the knowledge item, each generated disposal action can be directly linked to the specific knowledge basis it depends on, achieving precise traceability and responsibility positioning for automated decision-making and enhancing the interpretability of the response.

[0140] In some embodiments, action execution step S4 further includes:

[0141] The security policy constraints in the MCP server are used to perform security checks on the calling instructions, and the security-checked calling instructions are then sent to the corresponding target security device.

[0142] The target security device receives the call instruction and executes the action based on the call instruction.

[0143] By setting up a security checkpoint before the final device command is issued, a final security confirmation step is added to the automated execution action. Even if the processing semantics have been generated and encapsulated for verification, this step still requires the MCP server to perform a final review of the specific call command according to the security policy. This can capture and intercept new risks caused by dynamic policy updates or subtle changes in context, significantly enhancing the system's operational security and policy compliance in complex and dynamic environments.

[0144] Furthermore, the MCP server receives the atomic processing semantics output by the LLM inference engine and performs deep structured encapsulation and context verification on it, thereby generating a Security Processing Context Object (SCO) containing complete decision-making basis and execution parameters.

[0145] During this process, the operation to be executed is subject to mandatory compliance verification based on predefined security constraint policies, and an operation signature is attached. This provides dual protection for the security of issued commands from both logical and permission levels, preventing the execution of dangerous or unauthorized instructions.

[0146] In order to build an immutable audit chain, the design strongly associates each issued command with the original LLM inference engine's processing intent, the triggered security event, and the RAG knowledge base snapshot referenced, thus achieving accurate traceability of the entire process from event perception to device action.

[0147] Through the device unification abstraction layer built into the MCP server, the rigorously verified and standardized security handling context objects (SCOs) are intelligently mapped and adapted to the interfaces of specific security devices from different manufacturers and models. This shields the heterogeneity of the underlying devices, enabling the same security policy to be executed seamlessly on multiple target security devices such as firewalls, IPS, and EDR, thereby truly achieving cross-platform and cross-vendor automated response capabilities.

[0148] The above-mentioned network security incident handling method vectorizes the attack payloads in network security incidents and retrieves and matches them with the RAG knowledge base to obtain initial knowledge basis. Then, the MCP server is introduced to perform mandatory knowledge consistency verification on the retrieval and matching results. This verification process confirms the timeliness of knowledge entries by comparing their version numbers, analyzes their consistency with similar knowledge to eliminate logical conflicts, and performs compliance filtering according to security policies, thereby ensuring that the knowledge base input into the LLM inference engine is up-to-date, reliable, and secure.

[0149] Based on this, the atomic processing semantics generated by the LLM inference engine are then structured and contextually verified by the MCP server, and finally transformed into device call instructions that can be securely issued. This fundamentally solves the problem of unreliable and uncontrollable automated responses caused by the LLM inference engine directly referencing outdated, contradictory or non-compliant knowledge in existing technologies. It achieves the goal of improving the automation level of secure responses while ensuring the reliability, security and auditability of its decision-making process.

[0150] Furthermore, the atomic processing semantics are structurally encapsulated and contextually verified by the MCP server to generate a secure processing context object, which contains explicit atomic operations, such as {"action":"block","object":"ip","target":"1.1.1.1"};

[0151] The MCP server maintains a device adaptation library through a unified device abstraction layer; by parsing the security handling context object, it understands that a block operation needs to be executed, and the object type is IP.

[0152] Based on the context of the network security incident, determine which target security devices(s) will perform the action; for example, select a firewall.

[0153] Load the corresponding device adapter based on the manufacturer and model of the target security device;

[0154] The corresponding device adapter can translate the instructions in the above atomic operations into API call formats and parameters specific to the target security device;

[0155] For example, based on the atomic processing semantics {"action":"block","object":"ip", "target":"1.1.1.1"}, it is mapped to the firewall device;

[0156] The device adapter translates this into a series of specific API call instructions. First, it calls the POST / api / address-objects interface to create an address object named "block_1.1.1.1" with an IP value of "1.1.1.1". Then, it calls the POST / api / security-rules interface to create or update a security policy rule, referencing the address object and setting the action to "deny", thereby achieving permanent or time-based traffic blocking of the IP address on the firewall.

[0157] If endpoint isolation operations are required, the call command will be mapped to an EDR platform, such as CrowdStrike;

[0158] At this point, the device adapter will generate a call to the POST / devices / entities / actions / v1 interface, set the "action" parameter to "contain", and specify the unique identifier of the target host in the "device_ids" parameter;

[0159] After the command is issued, the EDR agent will implement strict network isolation measures on the corresponding terminal to cut off network communication between the host and the suspected attack source in order to curb the lateral spread of the threat within the intranet.

[0160] In some embodiments, the network security incident handling method further includes:

[0161] Log auditing steps: Obtain the execution results of the target security device, and record them in conjunction with network security events, the search matching results, verification results, atomic processing semantics, security processing context objects, and invocation instructions to generate audit logs.

[0162] By requiring the recording of information across the entire chain, from cybersecurity incidents, knowledge used, decision-making processes to execution results, a complete, coherent, and traceable chain of audit evidence is generated.

[0163] By using a logging method that covers the entire lifecycle, the system meets the stringent requirements for security compliance and provides comprehensive and reliable raw data for post-incident attack tracing, response effectiveness evaluation, system problem diagnosis, and operational process optimization. This makes the entire automated handling process transparent and auditable, greatly improving the system's credibility and maintainability.

[0164] Furthermore, by constructing a continuous audit trail mechanism, the complete capture and correlation recording of all key information and status throughout the entire lifecycle of decision-making and execution enables the reliability and compliance of automated responses;

[0165] The record includes the complete thought process and decision-making basis from the initial network security incident and original attack payload, to the knowledge entries and their versions cited by the RAG knowledge retrieval module, to the handling suggestions generated by the LLM inference engine, and finally to the call instructions verified and issued by the MCP server and the operation results on the target security device.

[0166] By strongly linking and structurally storing the decision metadata, context information, and execution logs scattered across various modules, the system forms an immutable and interconnected chain of evidence. This ensures that every automated response can be accurately traced and reviewed afterward, and provides a solid data foundation for verifying the rationality of the system's behavior and its compliance with internal and external security and compliance requirements.

[0167] like Figure 2As shown, this embodiment of the invention also provides a network security incident handling system based on knowledge consistency verification, including: a security incident acquisition module, an LLM inference engine, a RAG knowledge retrieval module, an MCP server, and a target security device;

[0168] The security event acquisition module is used to acquire network security events of various target security devices.

[0169] The LLM inference engine, which connects to the security event acquisition module, is used to receive network security events and extract the raw attack payloads from them.

[0170] The RAG knowledge retrieval module, which is connected to the LLM inference engine and the MCP server, is used to receive the original attack payload and abstract the original attack payload into a PoC attack feature vector; based on the PoC attack feature vector, it performs a search and matching in the preset RAG knowledge base and sends the search and matching results to the MCP server.

[0171] The MCP server, which is connected to the RAG knowledge retrieval module and the LLM inference engine, is used to receive retrieval matching results and perform knowledge consistency verification on the retrieval matching results, obtain the verification results, and send the verification results and network security events to the LLM inference engine.

[0172] The LLM inference engine is also used to generate atomic processing semantics based on verification results and cybersecurity events, and send the atomic processing semantics to the MCP server;

[0173] The MCP server is also used to perform structured encapsulation and context verification of atomic processing semantics, generate security processing context objects, and map the security processing context objects to the invocation instructions of the target security device.

[0174] The action execution module, which connects to the MCP server and the target security device, is used to receive invocation instructions and control the target security device to execute actions based on the corresponding invocation instructions.

[0175] Furthermore, the network security incident handling system also includes a scheduling engine, which is connected to the security incident acquisition module, LLM inference engine, RAG knowledge retrieval module, MCP server, and target security device.

[0176] As the core process controller of the system, the scheduling engine responds to the arrival of network security events or is triggered by active polling, and calls the security event acquisition module to start the workflow.

[0177] After the security event acquisition module completes the event structuring, the LLM inference engine is scheduled to extract the raw attack payload, and then the RAG knowledge retrieval module is scheduled to perform raw attack payload abstraction and knowledge retrieval.

[0178] After the RAG knowledge retrieval module returns the retrieval results, the MCP server is scheduled to perform knowledge consistency verification.

[0179] After the knowledge consistency verification is completed and passed by the MCP server, the LLM inference engine is scheduled to perform inference based on the verified knowledge items and network security event data.

[0180] After the LLM inference engine generates atomic processing semantics, the scheduling MCP server performs semantic encapsulation, verification, and scheduling instruction generation.

[0181] After the MCP server generates the operation instructions, it schedules the target security device to execute the response action.

[0182] By integrating a security event acquisition module, a RAG knowledge retrieval module, an LLM inference engine, an MCP server, an action execution module, and a target security device, and organizing them according to the prescribed connection relationships and data flow, the aforementioned security handling mechanism is realized at both the physical and logical levels.

[0183] By clearly defining the core control role of the MCP server and the independent responsibilities of the action execution module, the security concepts of knowledge pre-verification and pre-execution control are solidified into the system design, providing a concrete and deployable hardware and software solution for efficient, reliable, and secure automated network security response.

[0184] It should be noted that the above is a reference method and system for handling network security incidents based on knowledge consistency verification, and the present invention is not limited thereto.

[0185] The embodiments of the present invention realize the construction of an automated closed loop from event perception, intelligent judgment to security execution by introducing an MCP server with knowledge consistency verification and security arbitration capabilities between the LLM and security devices. This achieves efficient, reliable and auditable automated network security event response, and solves the technical problems of existing technology model output lacking a reliable structured security verification mechanism, external knowledge retrieval lacking timeliness and consistency control, and lacking a unified semantic abstraction layer between heterogeneous devices, which lead to security risks, decision lag and insufficient standardization in automated response.

[0186] Finally, it should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0187] The above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them; although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications can still be made to the specific implementation of the present invention or equivalent substitutions can be made to some technical features without departing from the spirit of the technical solutions of the present invention, and all such modifications and substitutions should be covered within the scope of the technical solutions claimed in the present invention.

Claims

1. A method for handling network security incidents based on knowledge consistency verification, characterized in that, Includes the following steps: Security incident acquisition steps: Acquire network security incidents of various target security devices; Knowledge retrieval and matching steps: Extract the original attack payload from the network security incident, abstract the original attack payload into a PoC attack feature vector, and perform retrieval and matching in the preset RAG knowledge base based on the PoC attack feature vector through vector similarity, return the knowledge entry with the highest similarity, and obtain the retrieval and matching results; Knowledge consistency verification steps: Call the MCP server to perform knowledge consistency verification on the search matching results. Based on the knowledge identifier in the knowledge entry, query the RAG knowledge base to obtain all knowledge entries with a valid status under the knowledge identifier and their corresponding version numbers. From all knowledge entries, determine the latest version number according to the update order of their version numbers. If the version number of the knowledge entry is consistent with the latest version number, there is no logical conflict between the knowledge entry and all knowledge entries, and the knowledge entry conforms to the preset security constraint policy, then the verification result is successful; otherwise, the verification result is unsuccessful. Based on the verification results and the cybersecurity incident, atomic disposal semantics are generated using the LLM inference engine; Action execution steps: The atomic disposal semantics are structured and contextually verified by the MCP server to generate a security disposal context object. The security disposal context object is mapped to the invocation instructions of various target security devices. The various target security devices execute actions based on the corresponding invocation instructions.

2. The network security incident handling method based on knowledge consistency verification according to claim 1, characterized in that, The specific steps for obtaining the security event are as follows: Receive raw security event logs from various target security devices through WebHook or timed fetching mechanisms; The original security event logs are parsed to extract the attack source IP, destination IP, and attack payload, thus obtaining key security fields. The key security fields are converted into a unified structured data format to obtain the network security event.

3. The network security incident handling method based on knowledge consistency verification according to claim 1, characterized in that, The knowledge retrieval and matching steps are as follows: Acquire multi-source security knowledge; wherein, the multi-source security knowledge includes vulnerability intelligence, security vendor announcements, attack behavior characteristics, PoC samples and handling rules; The multi-source security knowledge is organized into multiple initial knowledge entries, and the initial knowledge entries are vectorized. Each vectorized initial knowledge entry is added with a knowledge identifier, version number, update time, source information, and credibility tag before being stored to construct the RAG knowledge base.

4. The network security incident handling method based on knowledge consistency verification according to claim 1, characterized in that, The knowledge consistency verification step also includes: If there are multiple knowledge entries, the MCP server calculates a comprehensive score based on the update time, source information, and credibility tags of all knowledge entries using a consistency verification algorithm. The optimal entry is selected from all knowledge entries based on the comprehensive score. If the knowledge entry is the optimal entry, then there is no logical conflict between the knowledge entry and all knowledge entries. Otherwise, there is a logical conflict in the processing of the knowledge entry and all the knowledge entries.

5. The network security incident handling method based on knowledge consistency verification according to claim 1, characterized in that, The knowledge consistency verification step also includes: If the verification result is successful, the verified knowledge item, combined with the network security event, is input into the LLM inference engine to generate the atomic disposal semantics. If the verification result is unverified, the processing flow of the unverified knowledge item will be blocked through the MCP server, and the network security event will be marked as requiring re-search and matching.

6. The network security incident handling method based on knowledge consistency verification according to claim 1, characterized in that, The action execution steps also include: The security policy constraints in the MCP server are used to perform security checks on the invocation command, and the security-checked invocation command is sent to the corresponding target security device. The target security device receives the invocation command and performs an action based on the invocation command.

7. The network security incident handling method based on knowledge consistency verification according to claim 2, characterized in that, The atomic processing semantics include the attack source IP, destination IP, threat type, processing action corresponding to the processing suggestion, identifiers of various target security devices, and version number corresponding to the knowledge entry.

8. The network security incident handling method based on knowledge consistency verification according to any one of claims 1 to 7, characterized in that, The method further includes: Log auditing steps: Obtain the execution result of the target security device, and record it in combination with the network security event, the retrieval matching result, the verification result, the atomic processing semantics, the security processing context object and the calling instruction to generate an audit log.

9. A network security incident handling system based on knowledge consistency verification, characterized in that, include: Security event acquisition module, LLM inference engine, RAG knowledge retrieval module, MCP server, and target security device; The security event acquisition module is used to acquire network security events of various target security devices. The LLM inference engine is connected to the security event acquisition module and is used to receive the network security event and extract the original attack payload from the network security event. The RAG knowledge retrieval module is connected to the LLM inference engine and the MCP server. It is used to receive the original attack payload and abstract the original attack payload into a PoC attack feature vector. Based on the PoC attack feature vector, it performs a search and matching in a preset RAG knowledge base and sends the search and matching results to the MCP server. The MCP server is connected to the RAG knowledge retrieval module and the LLM inference engine. It is used to receive the retrieval matching results and perform knowledge consistency verification on the retrieval matching results to obtain the verification results. The verification results and the network security event are then sent to the LLM inference engine. The LLM inference engine is also used to generate atomic processing semantics based on the verification result and the network security event, and send the atomic processing semantics to the MCP server; The MCP server is also used to perform structured encapsulation and context verification of the atomic processing semantics, generate a security processing context object, and map the security processing context object to the invocation instructions of the target security device; An action execution module, which is connected to the MCP server and the target security device, is used to receive the invocation command and control the target security device to execute actions based on the corresponding invocation command.

Images