Network security alarm tracing method and device, equipment and storage medium

Abstract

The invention discloses a network security alarm tracing method and device, equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: obtaining a target network security event for a target asset, and screening a target security alarm from the target network security event based on a first preset prompt word and calling a pre-training model; based on the second preset prompt word and calling a pre-training model, extracting each alarm entity from the target security alarm, and based on the third preset prompt word, calling the pre-training model to carry out investigation and traceability operation so as to obtain an investigation result of each alarm entity; if the survey result comprises an associated new security alarm, taking the new security alarm as a target security alarm, and then skipping to the step of extracting each alarm entity from the target security alarm until a preset survey ending condition is met; and generating a survey traceability graph based on the survey result and the alarm entity, and calling the pre-training model to generate a survey traceability report based on the fourth preset prompt word and the survey traceability graph.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security alarm tracing method, apparatus, device, and storage medium. Background Technology

[0002] In the field of cybersecurity, systems such as Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) generate massive amounts of security alerts every day. To effectively address complex attacks such as advanced persistent threats, security operations personnel typically need to aggregate multiple related security alerts into a higher-dimensional security event and trace the attack path to reconstruct the complete attack chain, identifying the attack entry point, lateral movement path, and ultimate impact scope.

[0003] Currently, source tracing mainly relies on predefined rule matching or manual analysis. However, when faced with massive amounts of alert data, alert fatigue often occurs. On the one hand, predefined rules are rigid and difficult to adapt to the semantic association requirements of new and variant attacks, easily leading to missed or false alarms. On the other hand, alert entity extraction relies on fixed field parsing, lacking flexible semantic understanding capabilities, resulting in low accuracy of entity association. At the same time, the source tracing process requires repeated manual intervention to filter valid alerts, associate entities, and expand the source tracing chain, which is not only inefficient but also makes it difficult to form a closed-loop source tracing process. It cannot automatically generate complete attack paths and interpretable reports, seriously affecting the timeliness and comprehensiveness of security response.

[0004] Therefore, the aforementioned technical problems urgently need to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a network security alarm tracing method, apparatus, device, and storage medium, which can achieve automated intelligent tracing based on preset prompt words and pre-trained models, reducing manual intervention and greatly improving tracing efficiency. The specific solution is as follows:

[0006] The first aspect of this application provides a method for tracing the source of network security alerts, including:

[0007] The system acquires target cybersecurity events for a target asset, and filters target security alerts from these events based on a first preset prompt word and a pre-trained model; the target cybersecurity event is a set consisting of several security alerts.

[0008] Based on the second preset prompt word and calling the pre-trained model, each alarm entity is extracted from the target security alarm, and based on the third preset prompt word, the pre-trained model is called to perform investigation and tracing operations to obtain the investigation results of each alarm entity respectively.

[0009] If the investigation results include new security alarms associated with the corresponding alarm entities, then the new security alarms are taken as target security alarms, and then the process jumps to the step of extracting each alarm entity from the target security alarm until the preset end investigation conditions are met.

[0010] Based on the investigation results and the alarm entity, an investigation source map is generated, and based on the fourth preset prompt word and the investigation source map, the pre-trained model is invoked to generate an investigation source report.

[0011] Optionally, the step of filtering target security alerts from the target network security events based on a first preset prompt word and by calling a pre-trained model includes:

[0012] A first preset prompt word is constructed based on the target network security event, preset context information, and a first output format; wherein, the preset context information includes host asset information and customer preference information;

[0013] The first preset prompt word is input into the pre-trained model to filter out the target security alert from all security alerts in the target network security event using the pre-trained model, and the target security alert is output according to the first output format.

[0014] Optionally, the step of extracting each alarm entity from the target security alarm based on the second preset prompt word and by calling the pre-trained model includes:

[0015] A second preset prompt word is constructed based on a preset entity type, the original data corresponding to the target security alarm, and a second output format; wherein, the preset entity type includes IP address, domain name, file, process, command line, and payload, and the original data is at least one of data packet content, process chain information, and alarm description text;

[0016] The second preset prompt word is input into the pre-trained model to extract each alarm entity from the target security alarm according to the preset entity type, and each alarm entity is output according to the second output format.

[0017] Optionally, the step of calling the pre-trained model based on the third preset prompt word to perform the investigation and tracing operation to obtain the investigation results of each alarm entity includes:

[0018] A third preset prompt word is generated based on each alarm entity and the preset investigation plan;

[0019] The third preset prompt word is input into the pre-trained model, and the pre-trained model is used to plan the investigation task for each alarm entity based on the investigation plan generation instruction to obtain the target investigation plan; wherein the target investigation plan includes at least one investigation step;

[0020] The pre-trained model is used to convert the at least one survey step into at least one database query statement, and the at least one database query statement is executed to obtain query results;

[0021] The query results are analyzed using the pre-trained model to output investigation results for each alarm entity.

[0022] Optionally, the step of analyzing the query results using the pre-trained model to output investigation results for each alarm entity includes:

[0023] The prompt words constructed based on each alarm entity, the target investigation plan, and the query results are input into the pre-trained model to output investigation results about each alarm entity using the pre-trained model; wherein, the investigation results include at least first investigation information for characterizing whether the query results are reasonable and second investigation information for characterizing whether there are any related new security alarms.

[0024] Optionally, the preset conditions for ending the investigation include:

[0025] If any alarm entity does not generate any new associated security alarms within a consecutive target number of times, the investigation of that alarm entity is terminated.

[0026] And / or, if the current survey results already contain key target information for constructing the source map, then the survey is terminated;

[0027] And / or, if the amount of information in the current survey results has reached the preset information threshold, the survey will end;

[0028] And / or, if the current cumulative survey duration has exceeded the preset duration threshold, the survey will end.

[0029] Optionally, generating an investigation source map based on the investigation results and the alarm entity includes:

[0030] Extract the relationships between the alarm entities from all the investigation results;

[0031] An initial source graph is constructed using the aforementioned relationships as edges and all alarm entities as nodes; the initial source graph is constructed based on a hash table and an adjacency table.

[0032] The initial source map is optimized to generate an investigation source map.

[0033] Optionally, the process of optimizing the initial source map includes:

[0034] If there are at least two edges between any two nodes, then merge the at least two edges into one edge;

[0035] And / or, if there are free nodes in the initial source graph, then delete the free nodes;

[0036] And / or, hide nodes in the initial source map that are unrelated to the target alarm type;

[0037] And / or, when multiple sibling nodes point to the same target node, hide sibling nodes that are not related to the current attack path.

[0038] Optionally, the step of generating an investigation source tracing report by calling the pre-trained model based on the fourth preset prompt word and the investigation source tracing map includes:

[0039] A fourth preset prompt word is constructed based on the aforementioned investigation source map and preset report content;

[0040] The fourth preset prompt word is input into the pre-trained model so that the pre-trained model can generate and output an investigation and tracing report based on the preset report content; wherein, the preset report content includes basic information about the security incident, security alarm correlation, attack path timeline, list of affected assets, attack method analysis, handling suggestions and remediation suggestions.

[0041] A second aspect of this application provides a network security alarm tracing device, comprising:

[0042] The alarm filtering module is used to acquire target cybersecurity events for the target asset, and filter target security alarms from the target cybersecurity events based on a first preset prompt word and by calling a pre-trained model; the target cybersecurity event is a set consisting of several security alarms;

[0043] The investigation and tracing module is used to extract each alarm entity from the target security alarm based on the second preset prompt word and by calling the pre-trained model, and to perform investigation and tracing operations based on the third preset prompt word and by calling the pre-trained model to obtain the investigation results of each alarm entity respectively.

[0044] The associated alarm investigation module is used to, if the investigation results include a new security alarm associated with the corresponding alarm entity, take the new security alarm as the target security alarm, and then jump to the step of extracting each alarm entity from the target security alarm until the preset end investigation conditions are met;

[0045] The report generation module is used to generate an investigation source map based on the investigation results and the alarm entity, and to call the pre-trained model to generate an investigation source report based on the fourth preset prompt word and the investigation source map.

[0046] A third aspect of this application provides an electronic device including a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the aforementioned network security alarm tracing method.

[0047] A fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the aforementioned network security alarm tracing method.

[0048] As can be seen, this application obtains target cybersecurity events for target assets, filters target security alerts from the target cybersecurity events based on a first preset prompt word and calls a pre-trained model; the target cybersecurity event is a set of several security alerts; based on a second preset prompt word and calling the pre-trained model, each alert entity is extracted from the target security alerts, and based on a third preset prompt word, the pre-trained model is called to perform investigation and tracing operations to obtain the investigation results of each alert entity; if the investigation results include a new security alert associated with the corresponding alert entity, the new security alert is taken as the target security alert, and then the process jumps to the step of extracting each alert entity from the target security alert until the preset end-of-investigation condition is met; an investigation and tracing diagram is generated based on the investigation results and the alert entities, and an investigation and tracing report is generated by calling the pre-trained model based on a fourth preset prompt word and the investigation and tracing diagram.

[0049] Beneficial Effects: In this application, a pre-trained model is first guided by a first preset prompt word to filter target security alerts, rather than relying on fixed rules. This filters out invalid and low-risk alerts, avoiding wasting resources on meaningless tracing tasks and significantly reducing the impact of alert fatigue on tracing efficiency. Then, with the help of a second preset prompt word, the pre-trained model can flexibly extract various alert entities, breaking through the limitations of traditional fixed field parsing and improving the generalization of entity extraction. Simultaneously, for each alert entity, a third preset prompt word drives the tracing operation, utilizing the model's semantic understanding capabilities to uncover hidden relationships between entities. This effectively adapts to the association requirements of new attacks and cross-domain attacks, solving the problems of missed and false positives in entity association in existing technologies. When a new security alert appears in the investigation results, it is automatically included in the target security alert, and the entity extraction and tracing steps are repeated until the termination condition is met, ensuring that no attack path is missed. This automated process greatly reduces manual intervention, solving the pain points of low efficiency and narrow coverage in existing technologies, and achieving end-to-end complete reconstruction of the attack path. Finally, based on the investigation results and alert entities, this application generates a structured investigation and tracing diagram, which intuitively presents the relationship between the entities in the attack chain; then, the pre-trained model is driven by the fourth preset prompt word to generate a tracing report, ensuring that the report content is comprehensive and logically clear, solving the problem that existing technologies are difficult to generate interpretable tracing results, and supporting rapid and accurate security response decisions. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0051] Figure 1 This application discloses a flowchart of a network security alarm tracing method.

[0052] Figure 2 This application discloses a flowchart of an investigation and tracing process.

[0053] Figure 3 This is a schematic diagram of the structure of a network security alarm tracing device disclosed in this application;

[0054] Figure 4 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] In existing technologies, source tracing mainly relies on predefined rule matching or manual judgment. However, when faced with massive amounts of alarm data, alarm fatigue often occurs. On the one hand, predefined rules are rigid and difficult to adapt to the semantic association requirements of new and variant attacks, easily leading to missed or false alarms. On the other hand, alarm entity extraction relies on fixed field parsing, lacking flexible semantic understanding capabilities, resulting in low accuracy of entity association. Simultaneously, the source tracing process requires repeated manual intervention to filter valid alarms, associate entities, and expand the source tracing chain, which is not only inefficient but also makes it difficult to form a closed-loop source tracing process, failing to automatically generate complete attack paths and interpretable reports, severely impacting the timeliness and comprehensiveness of security responses. Therefore, this application discloses a network security alarm source tracing method, apparatus, device, and storage medium, which can achieve automated intelligent source tracing based on preset prompt words and pre-trained models, reducing manual intervention and greatly improving source tracing efficiency.

[0057] Figure 1 This is a flowchart illustrating a network security alarm tracing method provided in an embodiment of this application. See also... Figure 1 As shown, this network security alarm tracing method includes:

[0058] Step S11: Obtain target cybersecurity events for the target asset, and filter target security alerts from the target cybersecurity events based on the first preset prompt word and by calling the pre-trained model; the target cybersecurity event is a set consisting of several security alerts.

[0059] In this embodiment, it should first be noted that a security event is a collection of security alerts. A security event occurring on a specific asset typically indicates that the asset has been attacked, exhibited abnormal behavior, or is a potential threat, requiring response and handling. Security events are the core analytical unit in security operations, used to assess the scope of impact, attack paths, and response priorities. A security alert, on the other hand, is a collection of events similar to security logs or detection rule triggers. It is generated by security devices or systems based on preset rules or other methods, used to alert to potential security threats or abnormal behavior. A single security alert typically corresponds to a single detection point, and multiple related security alerts can be aggregated into a single security event.

[0060] In this embodiment, after acquiring a target cybersecurity event for a target asset, the pre-trained model is first guided by a first preset prompt word to filter out target security alerts, rather than relying on fixed rules. This filters out invalid and low-risk alerts, avoiding wasting resources on meaningless tracing tasks and significantly reducing the impact of alert fatigue on tracing efficiency. It is understood that this embodiment introduces the Large Model Prompt Project into the cybersecurity alert tracing scheme. The Large Model Prompt Project refers to a technical methodology system for pre-trained Large Language Models (LLMs) that designs, optimizes, and structures input prompt words (i.e., prompts) to guide the model to generate high-quality outputs that meet specific task requirements. Its core lies in precisely controlling model behavior through strategies such as semantic guidance, context construction, example injection, and thought chains, thereby improving its reasoning accuracy, interpretability, and controllability in complex tasks.

[0061] In a specific implementation, the step of filtering target security alerts from the target network security event based on a first preset prompt word and calling a pre-trained model includes: constructing a first preset prompt word based on the target network security event, preset context information, and a first output format; wherein, the preset context information includes host asset information and customer preference information; inputting the first preset prompt word into the pre-trained model to filter target security alerts from all security alerts in the target network security event using the pre-trained model, and outputting the target security alerts according to the first output format. That is, the first preset prompt word is specifically constructed based on the original target network security event, preset context information, and the first output format. The preset context information specifically includes host asset information and customer preference information. Host asset information can include host IP, asset ID, operating system, asset name, asset group, remarks, etc. Customer preference information includes some standard fields and some manual remarks, which mainly reflect the customer's level of concern for different types of events. For example, customers are more concerned about data breaches and external intrusions than internal network viruses. In addition, it can also include the customer's industry, internal network topology diagram, etc. The first output format is used to specify the output format of the model, so that it is output according to a unified predefined format to facilitate subsequent analysis.

[0062] Furthermore, in this embodiment, the pre-constructed first preset prompt words are input into the pre-trained model for comprehensive analysis. This allows the model to filter out target security alerts—that is, key security alerts requiring attention—from all security alerts in the target network security event, avoiding invalid or unimportant security alerts that would otherwise be included in ineffective investigation tasks. The target security alerts are then output according to the first output format. For example, if a PC host experiences a security incident, and the customer is not concerned about internal network viruses, security alerts may include frp (an open-source reverse proxy tool) external connections and the presence of adware on the host. In this case, priority will be given to selecting key alerts related to frp external connections for subsequent analysis.

[0063] The following is a simplified general example of a first preset prompt word disclosed in this embodiment:

[0064] "The following are the details of a cybersecurity incident. Based on the provided information (alarm details, host asset information, customer preference information), please analyze the key security alerts in the cybersecurity incident."

[0065] #Selection Logic: 1. Prioritize event types that customers are primarily concerned with. 2. Prioritize alarms with high threat severity.

[0066] #Related data:

[0067] #Output format:

[0068] You need to analyze all the provided information step by step, select the alarm ID according to the selection logic, and output it in the following format.

[0069] <answer>

[0070] <alertid> The alerts in the event are separated by commas (,).< / alertid>

[0071] < / answer> ".

[0072] It should be noted that this example can be considered a general template, and the relevant data sections need to be filled in according to the specific content of the cybersecurity incident, which is omitted in this example.

[0073] For example, the following security alerts were aggregated in a single target cybersecurity incident:

[0074] Alert A: A webshell upload was detected on the web server (IP: 192.168.1.10);

[0075] Alert B: Adware detected on the web server (IP: 192.168.1.10);

[0076] Alert C: An abnormal data query was detected on the database server (IP: 192.168.1.20);

[0077] Among them, customer preference information is: customers are concerned about data breaches and external intrusions;

[0078] Therefore, based on the above, a first preset warning word is constructed and input into a pre-trained model. The pre-trained model determines the following based on customer concerns (external intrusion, data leakage): Alarm A (Webshell) is a clear attack entry point; Alarm C (abnormal data query) is a potential attack target, and the two are highly correlated; while Alarm B (adware) is an internal security issue and does not fit the current high-risk event scenario. Therefore, the final target security alarms selected by the system are Alarm A and Alarm C, while Alarm B is filtered out. This ensures that subsequent analysis resources are focused on high-value threats.

[0079] Step S12: Based on the second preset prompt word and calling the pre-trained model, extract each alarm entity from the target security alarm, and based on the third preset prompt word, call the pre-trained model to perform investigation and tracing operations to obtain the investigation results of each alarm entity.

[0080] In this embodiment, it should first be noted that entities are key observable objects or elements in security alerts, such as files, source / destination IP addresses, host IP addresses, domains, malicious payloads, user accounts, and processes detected in the alert. This application needs to accurately extract structured entities from the target security alert as the basic elements for subsequent correlation and tracing.

[0081] Specifically, this application utilizes a second preset prompt word to enable the pre-trained model to flexibly extract various alarm entities, overcoming the limitations of traditional fixed-field parsing and improving the generalization of entity extraction. Simultaneously, for each alarm entity, a third preset prompt word drives the source tracing operation to obtain the investigation results for each alarm entity. That is, by leveraging the model's semantic understanding capabilities to uncover hidden relationships between entities, it effectively adapts to the association requirements of new types of attacks and cross-domain attacks, solving the problems of false negatives and false negatives in existing entity association techniques.

[0082] In a specific implementation, the step of extracting each alarm entity from the target security alarm based on the second preset prompt word and calling the pre-trained model includes: constructing the second preset prompt word based on the preset entity type, the original data corresponding to the target security alarm, and the second output format; wherein, the preset entity type includes IP address, domain name, file, process, command line, and payload, and the original data is at least one of data packet content, process chain information, and alarm description text; inputting the second preset prompt word into the pre-trained model to extract each alarm entity from the target security alarm according to the preset entity type using the pre-trained model, and outputting each alarm entity according to the second output format.

[0083] It is understood that the first preset prompt is constructed based on the preset entity type, the original data corresponding to the target security alarm, and the second output format. That is, this embodiment needs to limit the entity type to ensure that the extracted entities are types that the system can recognize and process. This ensures generalization while avoiding the occurrence of incomprehensible unknown entities that could lead to subsequent association analysis failures. Specifically, the preset entity types include IP addresses, domain names, files, processes, command lines, and payloads. Furthermore, considering the diverse sources of security alarms, whose original data can be data packet content, process chain information, alarm description text, etc., this embodiment does not limit the entity extraction method; it can be based on data packet extraction, process chain extraction, alarm description text extraction, etc. Additionally, the second output format is used to constrain all extraction results to be output according to a unified predefined format. Further, the second preset prompt is input into the pre-trained model to extract entities from the target security alarm according to the preset entity type, thereby extracting each alarm entity. Then, each alarm entity is output according to the second output format.

[0084] The following is a simplified general example of a second preset prompt word disclosed in this embodiment, specifically based on extracting file entities from data packets:

[0085] "The following is the content of a security alert data packet, including request headers, request body, response headers, and response body. Please extract any filenames that may exist in the data packet, including the file paths."

[0086] # Request header:

[0087] # Output Format

[0088] You need to analyze the message content step by step, extract the required information, and finally output the following content in the following format: file name, file path, extraction method, location, and related relationships.

[0089] <answer>

[0090] <result> Was the extraction successful (Yes / No)? If no, no other field information needs to be output.< / result>

[0091] <filename> The extracted filenames do not include any path information.< / filename>

[0092] <filepath> The extracted file path should match the filename if no path exists.< / filepath>

[0093] < / answer> ".

[0094] It should be noted that this example can be considered a general template. The request headers need to be filled in according to the specific data packet content, and are omitted in this example.

[0095] In a specific implementation, the step of calling the pre-trained model based on a third preset prompt word to perform investigation and tracing operations to obtain investigation results for each alarm entity includes: constructing a third preset prompt word based on each alarm entity and a preset investigation plan generation instruction; inputting the third preset prompt word into the pre-trained model to use the pre-trained model to plan investigation tasks for each alarm entity based on the investigation plan generation instruction to obtain a target investigation plan; wherein the target investigation plan includes at least one investigation step; using the pre-trained model to convert the at least one investigation step into at least one database query statement, and executing the at least one database query statement to obtain query results; and using the pre-trained model to analyze the query results to output investigation results for each alarm entity.

[0096] It is understood that this embodiment will perform investigation and tracing operations based on the extracted alarm entities. The investigation targets are all security alarms, security logs, and audit logs. The investigation method is to combine a third preset prompt word and relevant information, and use a pre-trained model to perform automated investigation operations. This embodiment will investigate each alarm entity separately. First, a third preset prompt word will be constructed based on each alarm entity and a preset investigation plan generation instruction. Then, the third preset prompt word will be input into the pre-trained model to use the pre-trained model to plan the investigation task for each alarm entity based on the investigation plan generation instruction, so as to obtain a target investigation plan including at least one investigation step.

[0097] The following is a simplified general example of a third preset prompt word disclosed in this embodiment:

[0098] "The following is entity information in an investigation tracing diagram. Please generate a target investigation plan based on the provided relevant information (entity-related alarm information, investigateable databases, and field information)."

[0099] # Entity Information:

[0100] # Entity-related alarm information:

[0101] # Database and field information can be investigated:

[0102] # Output Format

[0103] You need to analyze all the provided information step by step, extract the required information, and finally output the following content in the specified format:

[0104] <answer>

[0105] <investigation_plan> The overall investigation plan will likely be detailed, without requiring specific investigation logic.< / investigation_plan>

[0106] <step1> The specific investigation steps are listed as step 1, step 2, etc. For example: Investigate the network security logs for any uploads of shell.jsp with the destination IP address being: xxxx.< / step1>

[0107] <step2> slightly< / step2>

[0108] < / answer> ".

[0109] It should be noted that this example can be considered a general template. The entity information, entity-related alarm information, surveyable database, and field information need to be filled in according to the specific entity content, and are omitted in this example.

[0110] For example, taking the aforementioned alarm A as an example, assuming the extracted alarm entity is the file shell.jsp; the pre-trained model then generates a target investigation plan based on shell.jsp, which specifically includes the following investigation steps.

[0111] Step 1: Query the process execution logs after shell.jsp on 192.168.1.10 is accessed;

[0112] Step 2: Query suspicious outbound network connections originating from 192.168.1.10.

[0113] Furthermore, the pre-trained model is used to convert the investigation steps into corresponding database query statements, i.e., SQL (Structured Query Language) statements, and the SQL statements are executed using the MCP service to obtain the corresponding query results. The pre-trained model is then used to analyze the query results to output the final investigation results for each alarm entity.

[0114] Specifically, the step of analyzing the query results using the pre-trained model to output investigation results for each alarm entity includes: inputting prompts constructed based on each alarm entity, the target investigation plan, and the query results into the pre-trained model to output investigation results for each alarm entity using the pre-trained model; wherein the investigation results include at least first investigation information for characterizing whether the query results are reasonable and second investigation information for characterizing whether there are any related new security alarms.

[0115] In other words, after obtaining the query results, this embodiment also needs to use prompt words and a pre-trained model to analyze the results. First, corresponding prompt words are constructed based on each alarm entity, the target investigation plan, and the query results. Then, these prompt words are input into the pre-trained model to output the investigation results for each alarm entity. The investigation results include whether the query results are reasonable and whether there are any related new security alarms.

[0116] The following is a general example of a simplified prompt word disclosed in this embodiment:

[0117] "The following are the specific results of the investigation steps. Please analyze whether the results of this query are reasonable based on the relevant information (entity information, entity-related alarm information, investigation steps, query results). If they are not reasonable, please give the reasons. If they are reasonable, please output the information according to the format."

[0118] # Entity Information:

[0119] # Entity-related alarm information:

[0120] # Investigation steps:

[0121] # Query results:

[0122] # Output Format

[0123] You need to analyze all the provided information step by step, extract the required information, and finally output the following content in the specified format:

[0124] <answer>

[0125] <result> Is the query reasonable (yes / enough)?< / result>

[0126] <unreasonable_reasons> The reasons for the unreasonableness of the investigation should include the analysis process, the reasons for the analysis, and suggestions for improvement, in order to conduct a reinvestigation.< / unreasonable_reasons>

[0127] <alert1>

[0128] <id> There is exactly one new UUID that triggered the new security alert.< / id>

[0129] <keyword> Links (only specific links are needed, such as shell.jsp, xxx.com)< / keyword>

[0130] < / alert1>

[0131] <alert2> slightly< / alert2>

[0132] < / answer> ".

[0133] It should be noted that this example can be considered a general template. The entity information, entity-related alarm information, investigation steps, and query results need to be filled in according to the data in the specific situation, and are omitted in this example.

[0134] Step S13: If the investigation results include new security alarms associated with the corresponding alarm entities, then the new security alarms are taken as target security alarms, and then the process jumps to the step of extracting each alarm entity from the target security alarm until the preset end investigation conditions are met.

[0135] In this embodiment, as Figure 2 As shown, when a new security alert appears in the investigation results, it is automatically included in the target security alert and the alert entity extraction and investigation and tracing steps are repeated until the termination conditions are met, ensuring that no attack path is missed. This automated process greatly reduces the manual intervention links, solves the pain points of low efficiency and narrow coverage of existing technology tracing, and realizes end-to-end complete reconstruction of the attack path.

[0136] Specifically, the preset conditions for ending the investigation include: if any alarm entity does not generate any new associated security alarms within a consecutive target number of times, then the investigation of that alarm entity ends; and / or, if the current investigation results already contain key target information for constructing an investigation source map, then the investigation ends; and / or, if the amount of information in the current investigation results has reached a preset information amount threshold, then the investigation ends; and / or, if the current cumulative investigation duration has exceeded a preset duration threshold, then the investigation ends. In other words, this embodiment will comprehensively analyze the current investigation results and output whether the investigation needs to be terminated. The judgment conditions include, but are not limited to, the following four methods: First, it can monitor whether there is any new valid information in the current entity's investigation results. That is, the system will check whether new, unrecorded security alarms or security alarm entities have been discovered through the investigation in the most recent (or several) iterations. If no new valid information is generated in multiple consecutive investigations (such as 3 times), it means that the current investigation clues have been exhausted and the source tracing has reached the boundary. Continuing to iterate is not very meaningful, so the investigation of the current entity can be terminated. Second, it can also determine whether there is enough target key information in the current investigation results to generate an investigation source tracing map, such as whether it includes target key information such as entry point, impact area, and external connection point. If all are included, the investigation can also be terminated. Third, it can also determine whether the amount of information in the current investigation results has reached a preset information amount threshold. That is, it can check whether the current amount of information is sufficient. If so, the investigation can also be terminated. Fourth, when the current cumulative investigation time has exceeded the preset time threshold, the investigation can also be terminated to avoid being in the investigation process for a long time.

[0137] Step S14: Generate an investigation source map based on the investigation results and the alarm entity, and generate an investigation source report by calling the pre-trained model based on the fourth preset prompt word and the investigation source map.

[0138] In this embodiment, an investigation and attribution diagram is generated based on the investigation results and alerted entities to visually present the relationships between entities in the attack chain. Specifically, a structured investigation and attribution diagram is generated by summarizing and optimizing all investigation results and all alerted entities. Based on the generated investigation and attribution diagram, an attribution report is generated by a pre-trained model driven by a fourth preset prompt word, ensuring that the report is comprehensive and logically clear. This addresses the problem of existing technologies struggling to generate interpretable attribution results and supports rapid and accurate security response decisions.

[0139] An investigation origination diagram is a visual or structured relational graph used to display the temporal, causal, and behavioral relationships between various entities (such as IPs, files, users, hosts, etc.) in a security incident. Through this diagram, security analysts can reconstruct the attack chain, identify attack entry points, lateral movement paths, and ultimate impact targets, aiding in rapid response and root cause localization. An investigation origination report is a structured analytical document generated based on the investigation origination diagram and related logs, alerts, and contextual information. It typically includes an event overview, attack timeline, affected assets, attack methods, attacker profiles, remediation recommendations, remediation measures, and prevention strategies, used for internal debriefing, reporting to management, or compliance audits.

[0140] In a specific implementation, generating an investigation tracing graph based on the investigation results and the alarm entities includes: extracting the relationships between alarm entities from all investigation results; constructing an initial tracing graph using the relationships as edges and all alarm entities as nodes; the initial tracing graph being constructed based on a hash table and an adjacency table; and optimizing the initial tracing graph to generate the investigation tracing graph.

[0141] In this embodiment, each alarm entity extracted from security alerts is created as a node in the graph. During the investigation, new security alerts or entities output by the model after analyzing the query results are also created as nodes in real time. Each node carries its original information as attributes; for example, a File node might have: filename, file path, hash value; an IP node might have: IP address, geographical location, whether it's an internal network IP; an Alert node might have: alert name, severity level, timestamp. Furthermore, the relationships between alarm entities are extracted from all investigation results. It's understood that after analyzing the query results, the model directly outputs the relationships between alarm entities. These relationships include: Connects_To, Downloads, Executes, Uploads, Lateral_Movement_To, Triggers, etc. Additionally, edges can also carry attributes, such as: timestamp: the time when the relationship was first / last discovered; data source: which alert or investigation task it originated from; weight: the confidence or importance of the relationship. Therefore, this embodiment uses relationships as edges and all alarm entities as nodes to construct an initial source graph. It should be noted that the initial source graph in this embodiment is constructed based on lightweight in-memory storage structures such as hash tables and adjacency lists. That is, while controlling the number of nodes and edges, the use of graph databases is avoided, and efficient construction and querying are achieved through lightweight in-memory storage structures. Furthermore, the constructed initial source graph needs to be optimized to generate the final investigation source graph.

[0142] Specifically, the process of optimizing the initial source graph includes: if there are at least two edges between any two nodes, merging the at least two edges into one edge; and / or, if there are free nodes in the initial source graph, deleting the free nodes; and / or, hiding nodes in the initial source graph that are unrelated to the target alarm type; and / or, when multiple sibling nodes point to the same target node, hiding sibling nodes that are unrelated to the current attack path.

[0143] In a specific implementation, alarms with the same access relationship are aggregated into the same edge. For example, if the same source node has multiple identical or similar alarms to the same target node, then there are at least two edges between the source node and the target node. Therefore, at least two edges are merged into one edge, so that in the final visualization, these alarms do not need to be displayed as multiple lines, but are merged into a representative edge. In addition, the number or type of alarms can be labeled.

[0144] In a specific implementation, if there are detached nodes in the initial source map, these nodes can be deleted. It should be noted that detached nodes refer to nodes in the map that cannot be connected to the core attack chain via a path. The system will first try to see if it can be merged with the main chain, for example, whether it points to different aliases of the same asset. If it is confirmed to be irrelevant, it will be deleted. It is understood that, apart from the nodes involved in the final investigation source map, all other nodes are detached nodes. The selection of the final investigation source map will be based on a comprehensive judgment combining information such as the number of key alarms and the number of nodes.

[0145] In a specific implementation, nodes unrelated to the target alarm type in the initial source tracing graph are hidden. It is understood that certain types of alarms will generate a large number of necessary but useless nodes for understanding the main attack line. Therefore, this application will optimize for different alarm types and node types. For example, DNS (Domain Name System) related alarms will hide useless DNS server nodes, and file nodes will be automatically hidden when there is no association.

[0146] In a specific implementation, when multiple sibling nodes point to the same target node, it is necessary to determine which path was successful and led to the subsequent attack, and which were failed, unsuccessful, or irrelevant side paths, thereby hiding sibling nodes unrelated to the current attack path. For example, if A and B attack C simultaneously, and it is clear that A's attack led to the subsequent lateral movement, B can be determined as an irrelevant node, and then node B and the nodes derived from B will be hidden.

[0147] It should also be noted that the step of generating an investigation and source tracing report by calling the pre-trained model based on the fourth preset prompt word and the investigation and source tracing map includes: constructing a fourth preset prompt word based on the investigation and source tracing map and preset report content; inputting the fourth preset prompt word into the pre-trained model so that the pre-trained model can generate and output an investigation and source tracing report according to the preset report content; wherein, the preset report content includes basic information about the security incident, security alarm correlation, attack path timeline, list of affected assets, attack method analysis, handling suggestions, and remediation suggestions.

[0148] In this embodiment, a fourth preset prompt word is first constructed based on the investigation and tracing map and the content of a preset report. The preset report content includes, but is not limited to, basic information about the security incident, correlations between security alarms, timeline of attack paths, list of affected assets, attack method analysis, handling suggestions, and remediation suggestions. Then, the fourth preset prompt word is input into a pre-trained model so that the pre-trained model can generate and output an investigation and tracing report based on the preset report content.

[0149] For example, the fourth preset prompt is simplified to: The following is the data of the provided investigation and tracing diagram. Please generate an investigation and tracing report. The report should include basic information about the security incident, the correlation of security alarms, the timeline of the attack path, the list of affected assets, the analysis of attack methods, handling suggestions and remediation suggestions.

[0150] In this approach, this application first extracts key security alerts through security events, then extracts entities from these alerts, performs investigation and tracing operations on these entities, and correlates them with more security alerts. The above operations are repeated for each security alert. Finally, all security alerts and entity information are summarized and optimized to generate an investigation and tracing graph and an investigation and tracing report. All of the above processes utilize the large-scale model Prompt project for core logic implementation. Specifically, Prompt guides the large-scale model to dynamically extract alert entities, intelligently correlate cross-host alerts, iterate multiple times to expand the tracing depth, and ultimately automatically generate a structured tracing graph and an interpretable report. This solution breaks through the limitations of predefined rules, utilizes the semantic understanding capabilities of the large-scale model to accurately identify new attack associations, and achieves end-to-end automatic reconstruction of attack paths, covering key elements such as attacker IP, victim host, and attack payload. Finally, through the generated investigation and tracing graph and investigation and tracing report, all attack paths can be accurately traced, including but not limited to attacker IP, attacked host, and attack samples. This solution can accurately adapt to various complex attack scenarios such as APT attacks, lateral movement attacks, and ransomware, effectively identifying variant attacks and covert behaviors, and significantly improving the accuracy of cross-alarm semantic correlation and the completeness of source tracing. This framework is also suitable for investigation scenarios in daily operations such as weak passwords, unauthorized access, and information leakage.

[0151] As can be seen, in this application, the pre-trained model is first guided by a first preset prompt word to filter target security alerts, rather than relying on fixed rules, to filter out invalid and low-risk alerts, avoiding wasting resources on meaningless tracing tasks and significantly reducing the impact of alert fatigue on tracing efficiency. Then, with the help of a second preset prompt word, the pre-trained model can flexibly extract various alert entities, breaking through the limitations of traditional fixed field parsing and improving the generalization of entity extraction. At the same time, for each alert entity, the tracing operation is driven by a third preset prompt word, using the model's semantic understanding capabilities to mine hidden relationships between entities, effectively adapting to the association requirements of new attacks and cross-domain attacks, and solving the problems of missed and false alarms in entity association in existing technologies. When a new security alert appears in the investigation results, it is automatically included in the target security alert and the entity extraction and tracing steps are repeated until the termination condition is met, ensuring that no attack path is missed. This automated process greatly reduces manual intervention, solves the pain points of low efficiency and narrow coverage in existing technologies, and achieves end-to-end complete reconstruction of the attack path. Finally, based on the investigation results and alert entities, this application generates a structured investigation and tracing diagram, which intuitively presents the relationship between the entities in the attack chain; then, the pre-trained model is driven by the fourth preset prompt word to generate a tracing report, ensuring that the report content is comprehensive and logically clear, solving the problem that existing technologies are difficult to generate interpretable tracing results, and supporting rapid and accurate security response decisions.

[0152] See Figure 3 As shown in the figure, this application also discloses a network security alarm tracing device, including:

[0153] The alarm filtering module 11 is used to acquire target cybersecurity events for the target asset, and filter target security alarms from the target cybersecurity events based on a first preset prompt word and by calling a pre-trained model; the target cybersecurity event is a set consisting of several security alarms.

[0154] The investigation and tracing module 12 is used to extract each alarm entity from the target security alarm based on the second preset prompt word and by calling the pre-trained model, and to perform investigation and tracing operations based on the third preset prompt word and by calling the pre-trained model to obtain the investigation results of each alarm entity respectively.

[0155] The associated alarm investigation module 13 is used to, if the investigation results include a new security alarm associated with the corresponding alarm entity, take the new security alarm as the target security alarm, and then jump to the step of extracting each alarm entity from the target security alarm until the preset end investigation conditions are met.

[0156] The report generation module 14 is used to generate an investigation source map based on the investigation results and the alarm entity, and to call the pre-trained model to generate an investigation source report based on the fourth preset prompt word and the investigation source map.

[0157] As can be seen, in this application, the pre-trained model is first guided by a first preset prompt word to filter target security alerts, rather than relying on fixed rules, to filter out invalid and low-risk alerts, avoiding wasting resources on meaningless tracing tasks and significantly reducing the impact of alert fatigue on tracing efficiency. Then, with the help of a second preset prompt word, the pre-trained model can flexibly extract various alert entities, breaking through the limitations of traditional fixed field parsing and improving the generalization of entity extraction. At the same time, for each alert entity, the tracing operation is driven by a third preset prompt word, using the model's semantic understanding capabilities to mine hidden relationships between entities, effectively adapting to the association requirements of new attacks and cross-domain attacks, and solving the problems of missed and false alarms in entity association in existing technologies. When a new security alert appears in the investigation results, it is automatically included in the target security alert and the entity extraction and tracing steps are repeated until the termination condition is met, ensuring that no attack path is missed. This automated process greatly reduces manual intervention, solves the pain points of low efficiency and narrow coverage in existing technologies, and achieves end-to-end complete reconstruction of the attack path. Finally, based on the investigation results and alert entities, this application generates a structured investigation and tracing diagram, which intuitively presents the relationship between the entities in the attack chain; then, the pre-trained model is driven by the fourth preset prompt word to generate a tracing report, ensuring that the report content is comprehensive and logically clear, solving the problem that existing technologies are difficult to generate interpretable tracing results, and supporting rapid and accurate security response decisions.

[0158] In some specific embodiments, the alarm filtering module 11 may specifically include:

[0159] The first construction unit is used to construct a first preset prompt word based on the target network security event, preset context information, and a first output format; wherein, the preset context information includes host asset information and customer preference information;

[0160] The filtering unit is used to input the first preset prompt word into the pre-trained model, so as to use the pre-trained model to filter out the target security alarm from all security alarms in the target network security event, and output the target security alarm according to the first output format.

[0161] In some specific embodiments, the investigation and tracing module 12 may specifically include:

[0162] The second construction unit is used to construct a second preset prompt word based on a preset entity type, the original data corresponding to the target security alarm, and a second output format; wherein, the preset entity type includes IP address, domain name, file, process, command line, and payload, and the original data is at least one of data packet content, process chain information, and alarm description text;

[0163] The entity extraction unit is used to input the second preset prompt word into the pre-trained model, so as to use the pre-trained model to extract each alarm entity from the target security alarm according to the preset entity type, and output each alarm entity according to the second output format.

[0164] In some specific embodiments, the investigation and tracing module 12 may specifically include:

[0165] The third building unit is used to generate a third preset prompt word based on each alarm entity and the preset investigation plan;

[0166] The planning unit is used to input the third preset prompt word into the pre-trained model, so as to use the pre-trained model to plan the investigation task for each alarm entity based on the investigation plan generation instruction, so as to obtain the target investigation plan; wherein, the target investigation plan includes at least one investigation step;

[0167] The query result acquisition unit is used to convert the at least one survey step into at least one database query statement using the pre-trained model, and execute the at least one database query statement to obtain query results;

[0168] The analysis unit is used to analyze the query results using the pre-trained model to output investigation results for each alarm entity.

[0169] In some specific embodiments, the analysis unit is specifically used to input prompt words constructed based on each alarm entity, the target investigation plan, and the query results into the pre-trained model, so as to use the pre-trained model to output investigation results about each alarm entity; wherein, the investigation results include at least first investigation information for characterizing whether the query results are reasonable and second investigation information for characterizing whether there are any related new security alarms.

[0170] In some specific embodiments, the preset conditions for ending the investigation include:

[0171] If any alarm entity does not generate any new associated security alarms within a consecutive target number of times, the investigation of that alarm entity is terminated.

[0172] And / or, if the current survey results already contain key target information for constructing the source map, then the survey is terminated;

[0173] And / or, if the amount of information in the current survey results has reached the preset information threshold, the survey will end;

[0174] And / or, if the current cumulative survey duration has exceeded the preset duration threshold, the survey will end.

[0175] In some specific embodiments, the report generation module 14 may specifically include:

[0176] The extraction unit is used to extract the relationships between alarm entities from all survey results;

[0177] The source graph construction unit is used to construct an initial source graph using the aforementioned relationships as edges and all alarm entities as nodes; the initial source graph is constructed based on a hash table and an adjacency table.

[0178] An optimization unit is used to optimize the initial source map to generate an investigation source map.

[0179] In some specific embodiments, the optimization unit may specifically include:

[0180] A merging unit is used to merge at least two edges into one edge if there are at least two edges between any two nodes.

[0181] In some specific embodiments, the optimization unit may specifically include:

[0182] The deletion unit is used to delete the free node if there is a free node in the initial tracing graph.

[0183] In some specific embodiments, the optimization unit may specifically include:

[0184] The first hiding unit is used to hide nodes in the initial source map that are unrelated to the target alarm type.

[0185] In some specific embodiments, the optimization unit may specifically include:

[0186] The second hiding unit is used to hide sibling nodes that are unrelated to the current attack path when multiple sibling nodes point to the same target node.

[0187] In some specific embodiments, the report generation module 14 may specifically include:

[0188] The fourth construction unit is used to construct a fourth preset prompt word based on the investigation source map and the preset report content;

[0189] The report generation unit is used to input the fourth preset prompt word into the pre-trained model, so that the pre-trained model can generate and output an investigation and tracing report based on the preset report content; wherein, the preset report content includes basic information of the security incident, security alarm correlation, attack path timeline, list of affected assets, attack method analysis, handling suggestions and remediation suggestions.

[0190] Furthermore, embodiments of this application also provide an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0191] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network security alarm tracing method disclosed in any of the foregoing embodiments.

[0192] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0193] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222 and data 223, etc., and the storage method can be temporary storage or permanent storage.

[0194] The operating system 221 manages and controls the various hardware devices and computer programs 222 on the electronic device 20 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. It can be Windows Server, Netware, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of performing the network security alarm tracing method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 223 may include image quality control strategies collected by the electronic device 20, etc.

[0195] Furthermore, this application also discloses a storage medium storing a computer program. When the computer program is loaded and executed by a processor, it implements the network security alarm tracing method steps disclosed in any of the foregoing embodiments.

[0196] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0197] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0198] The network security alarm tracing method, apparatus, device, and storage medium provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for tracing the source of network security alarms, characterized in that, include: Obtain target cybersecurity events for the target asset, and filter out target security alerts from the target cybersecurity events based on a first preset prompt word and by calling a pre-trained model; The target network security event is a collection of several security alerts; Based on the second preset prompt word and calling the pre-trained model, each alarm entity is extracted from the target security alarm, and based on the third preset prompt word, the pre-trained model is called to perform investigation and tracing operations to obtain the investigation results of each alarm entity respectively. If the investigation results include new security alarms associated with the corresponding alarm entities, then the new security alarms are taken as target security alarms, and then the process jumps to the step of extracting each alarm entity from the target security alarm until the preset end investigation conditions are met. Based on the investigation results and the alarm entity, an investigation source map is generated, and based on the fourth preset prompt word and the investigation source map, the pre-trained model is invoked to generate an investigation source report.

2. The network security alarm tracing method according to claim 1, characterized in that, The step of filtering target security alerts from the target network security events based on a first preset prompt word and by calling a pre-trained model includes: A first preset prompt word is constructed based on the target network security event, preset context information, and a first output format; wherein, the preset context information includes host asset information and customer preference information; The first preset prompt word is input into the pre-trained model to filter out the target security alert from all security alerts in the target network security event using the pre-trained model, and the target security alert is output according to the first output format.

3. The network security alarm tracing method according to claim 1, characterized in that, The step of extracting each alarm entity from the target security alarm based on the second preset prompt word and by calling the pre-trained model includes: A second preset prompt word is constructed based on a preset entity type, the original data corresponding to the target security alarm, and a second output format; wherein, the preset entity type includes IP address, domain name, file, process, command line, and payload, and the original data is at least one of data packet content, process chain information, and alarm description text; The second preset prompt word is input into the pre-trained model to extract each alarm entity from the target security alarm according to the preset entity type, and each alarm entity is output according to the second output format.

4. The network security alarm tracing method according to claim 1, characterized in that, The step of invoking the pre-trained model based on the third preset prompt word to perform the investigation and tracing operation, in order to obtain the investigation results of each alarm entity, includes: A third preset prompt word is generated based on each alarm entity and the preset investigation plan; The third preset prompt word is input into the pre-trained model, and the pre-trained model is used to plan the investigation task for each alarm entity based on the investigation plan generation instruction to obtain the target investigation plan; wherein the target investigation plan includes at least one investigation step; The pre-trained model is used to convert the at least one survey step into at least one database query statement, and the at least one database query statement is executed to obtain query results; The query results are analyzed using the pre-trained model to output investigation results for each alarm entity.

5. The network security alarm tracing method according to claim 4, characterized in that, The step of analyzing the query results using the pre-trained model to output investigation results for each alarm entity includes: The prompt words constructed based on each alarm entity, the target investigation plan, and the query results are input into the pre-trained model to output investigation results about each alarm entity using the pre-trained model; wherein, the investigation results include at least first investigation information for characterizing whether the query results are reasonable and second investigation information for characterizing whether there are any related new security alarms.

6. The network security alarm tracing method according to claim 1, characterized in that, The preset conditions for ending the investigation include: If any alarm entity does not generate any new associated security alarms within a consecutive target number of times, the investigation of that alarm entity is terminated. And / or, if the current survey results already contain key target information for constructing the source map, then the survey is terminated; And / or, if the amount of information in the current survey results has reached the preset information threshold, the survey will end; And / or, if the current cumulative survey duration has exceeded the preset duration threshold, the survey will end.

7. The network security alarm tracing method according to claim 1, characterized in that, The generation of the investigation source map based on the investigation results and the alarm entity includes: Extract the relationships between the alarm entities from all the investigation results; An initial source graph is constructed using the aforementioned relationships as edges and all alarm entities as nodes; the initial source graph is constructed based on a hash table and an adjacency table. The initial source map is optimized to generate an investigation source map.

8. The network security alarm tracing method according to claim 7, characterized in that, The process of optimizing the initial source map includes: If there are at least two edges between any two nodes, then merge the at least two edges into one edge; And / or, if there are free nodes in the initial source graph, then delete the free nodes; And / or, hide nodes in the initial source map that are unrelated to the target alarm type; And / or, when multiple sibling nodes point to the same target node, hide sibling nodes that are not related to the current attack path.

9. The network security alarm tracing method according to any one of claims 1 to 8, characterized in that, The step of generating an investigation source tracing report by calling the pre-trained model based on the fourth preset prompt word and the investigation source tracing map includes: A fourth preset prompt word is constructed based on the aforementioned investigation source map and preset report content; The fourth preset prompt word is input into the pre-trained model so that the pre-trained model can generate and output an investigation and tracing report based on the preset report content; wherein, the preset report content includes basic information about the security incident, security alarm correlation, attack path timeline, list of affected assets, attack method analysis, handling suggestions and remediation suggestions.

10. A network security alarm tracing device, characterized in that, include: The alarm filtering module is used to acquire target cybersecurity events for the target asset, and filter out target security alarms from the target cybersecurity events based on a first preset prompt word and by calling a pre-trained model. The target network security event is a collection of several security alerts; The investigation and tracing module is used to extract each alarm entity from the target security alarm based on the second preset prompt word and by calling the pre-trained model, and to perform investigation and tracing operations based on the third preset prompt word and by calling the pre-trained model to obtain the investigation results of each alarm entity respectively. The associated alarm investigation module is used to, if the investigation results include a new security alarm associated with the corresponding alarm entity, take the new security alarm as the target security alarm, and then jump to the step of extracting each alarm entity from the target security alarm until the preset end investigation conditions are met; The report generation module is used to generate an investigation source map based on the investigation results and the alarm entity, and to call the pre-trained model to generate an investigation source report based on the fourth preset prompt word and the investigation source map.

11. An electronic device, characterized in that, The electronic device includes a processor and a memory, wherein: The memory is used to store computer programs; The computer program is loaded and executed by the processor to implement the network security alarm tracing method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, Used to store computer-executable instructions, which, when loaded and executed by a processor, implement the network security alarm tracing method as described in any one of claims 1 to 9.

Images