Enterprise SIEM rule optimization method, equipment, medium and product

Abstract

The invention discloses an enterprise SIEM rule optimization method and device, a medium and a product. The method comprises the steps that an enterprise network environment portrait of a target enterprise is constructed through interaction with network security personnel of the target enterprise; analyzing the internal SIEM rule base by using a multi-rule adapter to generate a standardized rule; according to historical logs and enterprise network environment portraits, untriggered rules and high false alarm rules are identified, root cause classification is carried out, and a diagnosis report is formed; collecting a plurality of standard external SIEM rules associated with each untriggered rule and each high false alarm rule in the diagnosis report in a standard external SIEM rule base, and generating a target optimization strategy according to each standard external SIEM rule; and according to the target optimization strategy, performing optimization processing on the enterprise internal SIEM rule base of the target enterprise, and according to the technical scheme of the embodiment of the invention, the detection accuracy and the operation and maintenance efficiency of the target enterprise SIEM system are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, device, medium and product for optimizing SIEM rules for enterprises. Background Technology

[0002] With the increasing complexity of cybersecurity threats and the continuous evolution of insider attack methods, the accuracy and adaptability of detection rules in Security Information and Event Management (SIEM) systems, as core components of enterprise security operations centers, have become crucial for ensuring the security of enterprise digital assets. However, the heterogeneity of enterprise network environments, the diversity of business characteristics, and the covert nature of security threats have led to prominent problems with traditional SIEM rules, such as poor adaptability, high false alarm rates, and delayed response times, severely restricting the improvement of security protection effectiveness.

[0003] Existing SIEM rule optimization techniques largely rely on static rule base matching or single-dimensional statistical analysis, lacking a deep understanding of the enterprise's personalized environment. They either adjust thresholds solely based on historical alert data, failing to adapt to dynamically changing business scenarios, or use generic threat intelligence for rule updates, unable to effectively coordinate with the enterprise's internal network topology and asset characteristics. These methods cannot accurately identify the root causes of rule silence and false positives, nor can they effectively integrate with external best practices, resulting in inefficient security operations and a protection system that lags behind threat evolution. Summary of the Invention

[0004] This invention provides a method, device, medium, and product for optimizing SIEM rules for enterprises, enabling intelligent diagnosis and continuous optimization of SIEM rule quality.

[0005] According to one aspect of the present invention, a method for optimizing SIEM rules for an enterprise is provided, the method comprising:

[0006] By conducting multiple rounds of structured interactions with the cybersecurity personnel of the target company, a profile of the target company's corporate network environment is generated.

[0007] Obtain the target enterprise's currently configured internal SIEM rule base, and use a multi-rule adapter to perform syntactic and / or semantic parsing on each internal rule in the internal SIEM rule base to obtain each standardized internal rule;

[0008] Based on the target company's historical network logs and network environment profile, identify non-triggered rules and high false alarm rules in various standardized internal rules, and perform root cause classification on the identified non-triggered rules and high false alarm rules to obtain a diagnostic report that matches the company's internal SIEM rule knowledge base;

[0009] Collect multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generate target optimization strategies based on each standard external SIEM rule;

[0010] Based on the target optimization strategy, the internal SIEM rule base of the target enterprise is optimized.

[0011] According to another aspect of the present invention, an apparatus for optimizing SIEM rules for an enterprise is provided, the apparatus comprising:

[0012] The network environment profile generation module is used to generate a profile of the target company's network environment through multiple rounds of structured interaction with the target company's network security personnel.

[0013] The standardization module is used to obtain the target enterprise's currently configured internal SIEM rule base and use a multi-rule adapter to perform syntactic and / or semantic parsing processing on each internal rule in the enterprise's internal SIEM rule base to obtain each standardized internal rule;

[0014] The diagnostic module is used to identify untriggered rules and high false alarm rules in various standardized internal rules based on the target enterprise's historical network logs and enterprise network environment profile, and to perform root cause classification on the identified untriggered rules and high false alarm rules to obtain a diagnostic report that matches the enterprise's internal SIEM rule knowledge base;

[0015] The optimization strategy generation module is used to collect multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generate target optimization strategies based on each standard external SIEM rule;

[0016] The optimization module is used to optimize the internal SIEM rule base of the target enterprise according to the target optimization strategy.

[0017] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0018] At least one processor; and

[0019] A memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform a SIEM rule optimization method for an enterprise as described in any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement a SIEM rule optimization method for an enterprise as described in any embodiment of the present invention.

[0022] According to another aspect of the present invention, a computer program product is also provided, including computer instructions that, when executed by a processor, implement the steps of the method as described in any embodiment of the present invention.

[0023] The technical solution of this invention generates a corporate network environment profile through multi-round structured interaction with the target company's cybersecurity personnel. It then acquires the company's internal SIEM rule base and uses a multi-rule adapter to perform syntactic and semantic parsing of the rules to obtain standardized internal rules. Next, it combines historical network logs and the corporate network environment profile to identify untriggered rules and high-false-positive rules, performs root cause classification on them, and generates a diagnostic report matching the company's internal SIEM rule knowledge base. Subsequently, it collects external rules associated with the diagnostic report from a standard external SIEM rule base and generates a target optimization strategy accordingly. Finally, it optimizes the company's internal SIEM rule base based on this strategy. This novel corporate SIEM rule optimization method significantly improves the accuracy and timeliness of threat detection. Simultaneously, it leverages a continuous learning mechanism to enable the system to self-evolve, reducing security operation and maintenance costs while building a dynamically adaptive proactive defense system for the enterprise.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of a SIEM rule optimization method for enterprises according to Embodiment 1 of the present invention;

[0027] Figure 2 This is a flowchart of another SIEM rule optimization method for enterprises provided according to Embodiment 2 of the present invention;

[0028] Figure 3This is a flowchart of another SIEM rule optimization method for enterprises provided according to Embodiment 3 of the present invention;

[0029] Figure 4 This is a schematic diagram of the structure of a SIEM rule optimization device for an enterprise according to Embodiment 4 of the present invention;

[0030] Figure 5 This is a schematic diagram of the structure of an electronic device that implements an enterprise SIEM rule optimization method according to an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] Example 1

[0034] Figure 1 This is a flowchart of a SIEM rule optimization method for an enterprise provided in Embodiment 1 of the present invention. This embodiment can be applied to scenarios where the enterprise's SIEM rule library has poor adaptability and high false alarm rate, requiring intelligent optimization. This method can be executed by the enterprise's SIEM rule optimization device, which can be implemented in hardware and / or software and is generally configured in an electronic device.

[0035] Correspondingly, such as Figure 1 As shown, the method includes:

[0036] S110. Generate a profile of the target company's network environment through multiple rounds of structured interaction with the target company's cybersecurity personnel.

[0037] In this context, the enterprise network environment profile can be understood as a detailed record of the enterprise's network security status. By systematically collecting and integrating multi-dimensional information about the enterprise, a comprehensive and structured digital model is constructed.

[0038] In this embodiment, multiple rounds of structured interaction are first conducted with the cybersecurity personnel of the target enterprise to dynamically collect multi-dimensional information, including basic enterprise information, network environment, cloud environment, security team, live network equipment, SIEM platform, and historical experience. This process constructs a comprehensive and accurate profile of the enterprise's network environment, providing the necessary contextual basis for subsequent rule analysis.

[0039] The dimensions are categorized as follows: Basic Information: Industry type, company size, business type, compliance requirements, etc.; Network Environment: Network architecture, subnetting, DMZ (Demilitarized Zone) configuration, distribution of critical assets, etc.; Cloud Environment: Cloud service provider, hybrid cloud ratio, cloud security tools, etc.; Security Team: Number of personnel, skill level, work mode, response SLA (Service Level Agreement), etc.; Existing Network Equipment: Firewall brand, IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) type, endpoint security, log sources, etc.; SIEM Platform: SIEM product, version, log access volume, number of existing rules, etc.; Historical Experience: Common attack types, historical security incidents, false positives, and pain points, etc.

[0040] S120. Obtain the target enterprise's currently configured internal SIEM rule base, and use a multi-rule adapter to perform syntax and / or semantic parsing processing on each internal rule in the internal SIEM rule base to obtain each standardized internal rule.

[0041] The SIEM rule base can be understood as a centralized database storing all detection rules. These rules are essentially a series of predefined logical statements used to guide the SIEM system in identifying potential security threats or abnormal behaviors from massive amounts of log data. The quality of the rule base directly determines the accuracy and efficiency of security monitoring. The multi-rule adapter can be understood as a tool that, because different vendors' SIEM products use their own unique rule syntax and structure, transforms these heterogeneous and inconsistent raw rules into a unified, standardized intermediate format through multiple built-in parsing engines for syntax parsing and semantic extraction.

[0042] In this embodiment, the enterprise's currently configured internal security information and event management rule base are obtained, and a multi-rule adapter is used to perform syntax parsing and semantic extraction on these rules, converting them into a standardized internal rule format to eliminate differences between different platforms and ensure the consistency and processability of rule data.

[0043] S130. Based on the target enterprise's historical network logs and enterprise network environment profile, identify non-triggered rules and high false alarm rules in each standardized internal rule, and perform root cause classification on the identified non-triggered rules and high false alarm rules to obtain a diagnostic report that matches the enterprise's internal SIEM rule knowledge base.

[0044] Among them, "non-triggered rules" can be understood as detection rules that have never generated any security alarms within the preset monitoring period. "High false alarm rules" can be understood as detection rules that, although frequently triggering alarms, are confirmed by security personnel to be normal business activities.

[0045] In this embodiment, based on historical network logs and the established enterprise network environment profile, standardized internal rules are analyzed to identify rules that have never been triggered and rules with high false positive rates. By classifying these rules into root causes, such as missing data sources, overly strict filtering conditions, or attack surface mismatches, a detailed diagnostic report is generated. This report is closely matched with the enterprise's internal rule knowledge base, providing clear directions for subsequent optimization.

[0046] S140. Collect multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generate target optimization strategies based on each standard external SIEM rule.

[0047] Among them, standard external SIEM rules can be understood as general detection templates that have been verified by industry practice. Their core value lies in transforming global threat intelligence into actionable detection logic.

[0048] In this embodiment, referencing the standard external security information and event management rule base, external rules semantically related to the non-triggered rules and high false alarm rules identified in the diagnostic report are collected. Through vectorized matching and similarity calculation, the most relevant external rules are selected as references, and targeted optimization strategies are generated based on these rules, including specific suggestions such as rule logic adjustment, threshold optimization, and enhanced filtering conditions.

[0049] S150. Based on the target optimization strategy, optimize the internal SIEM rule base of the target enterprise.

[0050] In this embodiment, based on the generated optimization strategy, the enterprise's internal security information and event management rule base is actually optimized, such as by modifying rule code, adjusting parameter settings, or adding whitelist configurations. A gradual deployment approach, such as canary releases, ensures the optimization process is secure and controllable. The rule base is continuously adjusted and updated based on operational feedback data, achieving iterative improvement and long-term optimization of the rules.

[0051] The technical solution of this invention generates a corporate network environment profile through multi-round structured interaction with the target company's cybersecurity personnel. It then acquires the company's internal SIEM rule base and uses a multi-rule adapter to perform syntactic and semantic parsing of the rules to obtain standardized internal rules. Next, it combines historical network logs and the corporate network environment profile to identify untriggered rules and high-false-positive rules, performs root cause classification on them, and generates a diagnostic report matching the company's internal SIEM rule knowledge base. Subsequently, it collects external rules associated with the diagnostic report from a standard external SIEM rule base and generates a target optimization strategy accordingly. Finally, it optimizes the company's internal SIEM rule base based on this strategy. This novel corporate SIEM rule optimization method significantly improves the accuracy and timeliness of threat detection. Simultaneously, it leverages a continuous learning mechanism to enable the system to self-evolve, reducing security operation and maintenance costs while building a dynamically adaptive proactive defense system for the enterprise.

[0052] Example 2

[0053] Figure 2 This is a flowchart of another SIEM rule optimization method for enterprises provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiments and is optimized. Specifically, the step of "generating a corporate network environment profile of the target enterprise through multiple rounds of structured interaction with the target enterprise's cybersecurity personnel" has been refined.

[0054] Correspondingly, such as Figure 2 As shown, the method includes:

[0055] S210. Conduct structured dialogues with the target company's cybersecurity personnel to collect critical network environment information from multiple cybersecurity dimensions.

[0056] In this embodiment, structured dialogue with the target company's cybersecurity personnel is used to systematically collect multi-dimensional information, including basic enterprise information, network environment, cloud environment, security team, current network equipment, SIEM platform, and historical experience. This interactive approach ensures the comprehensiveness and accuracy of the information obtained, laying a data foundation for the subsequent construction of an environmental profile.

[0057] S220. Based on the collected key network environment information, construct the prompt text and provide the prompt text to the large language model to obtain a network security environment survey questionnaire for the target enterprise.

[0058] After obtaining environmental information, it needs to be transformed into cue text that can be processed by a large language model. This process requires structuring and semantically processing the collected information to create clearly targeted cue content. Based on these cue words and its built-in cybersecurity knowledge base, the large language model generates customized questionnaires for the target company. The questionnaire content will fully consider personalized factors such as the company's industry characteristics and size.

[0059] The questionnaire is divided into seven units: network topology, business characteristics, asset inventory, security policy, log source, threat surface, and operational capabilities. Each unit contains three to five questions, using a combination of single-choice, multiple-choice, and fill-in-the-blank formats. The questionnaire takes eight to ten minutes to complete.

[0060] S230. Provide a network security environment survey questionnaire to network security personnel, and then provide the questionnaire results returned by the network security personnel to the large language model to obtain a profile of the target company's network environment.

[0061] After the generated questionnaires are completed by cybersecurity personnel, their feedback is input into a large language model for in-depth analysis. The model uses natural language processing (NLP) technology to perform semantic parsing and correlation analysis on the questionnaire feedback, identifying the inherent connections between information across various dimensions. The final output is a structured profile of the enterprise network environment, which not only includes basic environmental parameters but also reflects the logical relationships between various security elements, providing complete contextual support for subsequent rule analysis.

[0062] S240. Obtain the target enterprise's currently configured internal SIEM rule base, and use a multi-rule adapter to perform syntactic and / or semantic parsing processing on each internal rule in the internal SIEM rule base to obtain each standardized internal rule.

[0063] Optionally, based on the above embodiments, a multi-rule adapter is used to perform syntactic and / or semantic parsing processing on each internal rule in the enterprise's internal SIEM rule base to obtain standardized internal rules, which may include:

[0064] Obtain a multi-platform rule adapter, which integrates a syntax parser for Splunk search processing language, a syntax analyzer for Ariel query language, and a YAML format processor for Elasticsearch detection rules;

[0065] The multi-platform rule adapter performs syntax parsing on the internal rules of various enterprises, extracting structured elements such as numeric source fields, filtering condition expressions, and trigger threshold settings from the rules;

[0066] The parsed structured elements are converted into a unified standardized format representation, generating unified standardized internal rules.

[0067] Generally, when acquiring a multi-platform rule adapter, the adapter integrates syntax parsing components for various common security information and event management platforms. For example, there is a search processing language parser for the Splunk platform, an Ariel query language analyzer for the QRadar platform, and a detection rule YAML format processor for the Elasticsearch platform. These components can specifically handle the rule syntax of their respective platforms, ensuring that rules from different sources can be interpreted uniformly, providing basic support for subsequent analysis.

[0068] Generally, when parsing the internal rules of various enterprises through a multi-platform rule adapter, the process will deeply extract the key structured elements in the rules, such as data source fields, filter condition expressions, and trigger threshold settings. These elements are the core components of the rule logic. The parser will break down the rule content item by item, identify the data source, judgment conditions, and threshold values ​​that trigger alarms that the rule depends on, thereby transforming complex rule statements into standardized data blocks that are easy to process.

[0069] Generally, when converting parsed structured elements into a unified, standardized format, the adapter recombines these elements into a common internal rule format, such as a JSON-based structured representation. This format eliminates platform differences, allowing all rules to be stored and compared consistently, ultimately generating unified, standardized internal rules that facilitate subsequent intelligent diagnostics and optimization. For example, after parsing an original Splunk rule, its data source, filtering conditions, and thresholds are extracted and converted into a JSON object, enabling seamless integration with rules from other platforms.

[0070] S250. Based on the target enterprise's historical network logs and enterprise network environment profile, identify untriggered rules and high false alarm rules in each standardized internal rule, and perform root cause classification on the identified untriggered rules and high false alarm rules to obtain a diagnostic report that matches the enterprise's internal SIEM rule knowledge base.

[0071] Optionally, based on the above embodiments, according to the target enterprise's historical network logs and enterprise network environment profile, identifying untriggered rules in each standardized internal rule and performing root cause classification on the identified untriggered rules may include:

[0072] By collecting alarm data from network logs within a preset historical period from the target enterprise's SIEM system, non-triggered rules are filtered out based on rule-based alarm trigger records;

[0073] The data source field in the non-triggered rules is compared with the actual log list in the enterprise network environment profile in turn to identify non-triggered rules caused by missing data sources and classify them as non-triggered rules with missing data sources.

[0074] Analyze the matching degree between the filter condition expressions in the non-triggered rules and the normal business baseline of the enterprise, detect non-triggered rules caused by overly strict threshold settings and / or overly harsh filter conditions, and classify them as non-triggered rules due to filter condition mismatch.

[0075] By comparing the detected attack patterns in the non-triggered rules with the actual threat surface in the enterprise network environment, we can identify non-triggered rules caused by attack surface mismatch and classify them as attack surface mismatch type non-triggered rules.

[0076] Generally, in the operation of a security information and incident management platform, the first step is to collect alarm data from network logs within a pre-defined historical time period from the target enterprise's management platform, and then filter out non-triggered rules that have never generated alarms based on the alarm trigger records of the rules. This step aims to initially identify the set of rules that may have problems, providing a foundation for subsequent in-depth analysis.

[0077] Generally, the data source fields in the untriggered rules will be compared one by one with the actual log list recorded in the enterprise network environment profile to identify untriggered rules caused by missing data sources. For example, if a specific log type that the rule depends on is not deployed or collected in the enterprise environment, such rules are classified as data source missing untriggered rules, which reflects the disconnect between rule design and actual environment.

[0078] Generally, it is then necessary to analyze the degree of matching between the filter condition expression in the non-triggered rule and the normal business baseline of the enterprise, and to detect whether the rule cannot be triggered due to the threshold setting being too strict or the filter condition being too harsh. For example, if the rule sets the threshold for the number of login failures too high, exceeding the normal business fluctuation range, such rules are classified as non-triggered rules due to filter condition mismatch, reflecting the inconsistency between the rule parameters and the actual operating mode of the enterprise.

[0079] Generally, the final step involves comparing the attack patterns defined in the non-triggered rules with the actual threat surface in the enterprise network environment. This identifies rule failures caused by attack surface mismatch. For example, a rule might target a specific network attack method, but the enterprise network lacks the relevant vulnerabilities or access paths. These rules are categorized as attack surface mismatch non-triggered rules, highlighting the gap between the rule scenario and the enterprise's real threat environment. In a specific example, a rule might aim to detect external intrusion attempts through a specific port, but the enterprise firewall policy has blocked that port, preventing the rule from triggering. This is a typical case of attack surface mismatch, and such analysis can pinpoint the root cause of rule ineffectiveness.

[0080] Optionally, based on the above embodiments, according to the target enterprise's historical network logs and enterprise network environment profile, high false positive rules are identified in each standardized internal rule, and root cause classification is performed on the identified high false positive rules, which may include:

[0081] By collecting alarm data from network logs within a preset historical period from the target enterprise's SIEM system, high false alarm rules are filtered out based on rule-based alarm trigger records.

[0082] Cluster analysis was performed on alarm data with high false alarm rules to identify common characteristics of false alarms, including sets of IP addresses that repeatedly trigger the alarms, distribution over fixed time periods, and specific operation command patterns.

[0083] The specific operation command patterns in high false alarms are compared with the operation command patterns in the normal business processes of the enterprise in turn to identify situations where normal business operations are mistakenly judged as threats, and these situations are classified as business misjudgment type high false alarm rules.

[0084] The detection logic defects of high false positive rules were analyzed, including unreasonable time window settings and missing whitelist configurations, and these were classified as high false positive rules with logical defects.

[0085] Generally, in the operation of a security information and incident management platform, the first step is to collect network log alarm data within a pre-defined historical time period from the target enterprise's management platform, and then filter out high false alarm rules based on the alarm trigger records of the rules. This step aims to initially identify the set of rules that may have problems, providing basic data support for subsequent in-depth analysis.

[0086] Generally, the next step is to perform cluster analysis on the alarm data with high false alarm rules. Data mining techniques are used to identify common characteristics of false alarms, such as the set of Internet protocol addresses that are repeatedly triggered, the distribution of fixed time periods, and specific operation command patterns, thereby revealing the regularity of false alarms and helping to locate the root cause of the problem.

[0087] Generally, the specific operation command patterns identified in the high false alarm alerts will then be compared one by one with the operation command patterns in the enterprise's normal business processes to identify situations where normal business operations are misjudged as threats, such as routine maintenance commands being incorrectly marked as malicious behavior. These rules are classified as business misjudgment type high false alarm rules, reflecting the mismatch between the rules and the enterprise's actual business logic.

[0088] Generally, the final step involves analyzing the detection logic flaws of high-false-positive rules, including issues such as unreasonable time window settings or missing whitelist configurations. For example, a rule might misjudge short-lived, high-frequency access as an attack while ignoring normal fluctuations during peak business periods. These rules are categorized as logic-flawed high-false-positive rules, highlighting inappropriate parameter or condition settings in the rule design. In a specific example, a rule designed to detect abnormal login behavior might fail to add internet protocol addresses regularly scanned by the company to the whitelist, leading to frequent false positives from scanning activities. This is a typical example of a logic-flawed rule, and such analysis can help precisely optimize the rule logic to reduce false positives.

[0089] S260. Collect multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generate a target optimization strategy based on each standard external SIEM rule.

[0090] S270. Based on the target optimization strategy, optimize the internal SIEM rule base of the target enterprise.

[0091] The technical solution of this invention, based on structured dialogue with the cybersecurity personnel of the target enterprise to collect key network environment information, constructs prompt text and generates a targeted cybersecurity environment questionnaire using a large language model. The questionnaire feedback is then input into the large language model again to form a complete enterprise network environment profile. Subsequently, the internal rule base currently configured by the target enterprise is obtained, and a multi-rule adapter is used to perform syntactic and semantic parsing on each rule to obtain standardized internal rules. Next, historical network logs and the environment profile are combined to identify untriggered rules and high-false-positive rules, and a diagnostic report matching the internal rule knowledge base is generated through root cause classification. Then, relevant external rules are collected from a standard external rule base, and a target optimization strategy is generated accordingly. Finally, the internal rule base is optimized based on this strategy. This novel enterprise SIEM rule optimization method, through a human-machine collaborative environment profile construction mechanism, significantly reduces the traditionally weeks-long manual survey cycle, significantly improving the efficiency of environment adaptation before rule deployment. Simultaneously, relying on multi-dimensional diagnosis, the rule base has the ability to continuously evolve and adapt, effectively improving the accuracy of threat detection while reducing false positive rates.

[0092] Example 2

[0093] Figure 3 This is a flowchart of another SIEM rule optimization method for enterprises provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiments and is optimized. Specifically, the step of "collecting multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generating a target optimization strategy based on each standard external SIEM rule" has been refined.

[0094] Correspondingly, such as Figure 3 As shown, the method includes:

[0095] S310. Generate a profile of the target company's network environment through multiple rounds of structured interaction with the target company's cybersecurity personnel.

[0096] S320. Obtain the target enterprise's currently configured internal SIEM rule base, and use a multi-rule adapter to perform syntactic and / or semantic parsing processing on each internal rule in the internal SIEM rule base to obtain each standardized internal rule.

[0097] S330. Based on the target enterprise's historical network logs and enterprise network environment profile, identify untriggered rules and high false alarm rules in each standardized internal rule, and perform root cause classification on the identified untriggered rules and high false alarm rules to obtain a diagnostic report that matches the enterprise's internal SIEM rule knowledge base.

[0098] S340. Obtain the standard external SIEM rule base, which integrates standardized rules from the Sigma rule base, the MITRE ATTCK framework, and open-source threat intelligence platforms.

[0099] In this embodiment, the first step is to obtain standardized external rule base resources from multiple authoritative sources. These resources include industry-recognized threat detection rule bases, internationally accepted attack pattern classification frameworks, and threat intelligence platforms maintained by open-source communities. These external rule bases contain proven detection logic, covering feature descriptions and detection methods for various common attack techniques, providing rich reference for subsequent rule optimization.

[0100] S350. The semantic information of internal enterprise rules and standard external rules is converted into vector representations through a text embedding model. The semantic similarity between vectors is calculated using a cosine similarity algorithm, and a similarity threshold is set to filter the most relevant number of standard external rules.

[0101] The text embedding model can be understood as a natural language processing technique that transforms textual information into numerical vectors. This model extracts semantic features from the text using deep learning algorithms, mapping the textual descriptions to specific coordinate points in a high-dimensional vector space. The cosine similarity algorithm can be understood as a mathematical method for measuring the directional consistency between two vectors. This algorithm evaluates the similarity by calculating the cosine of the angle between two vectors, with the result ranging from -1 to +1. The similarity threshold can be understood as a judgment standard set according to actual needs, used to filter matching results that meet the conditions. This threshold acts as a critical point; only when the similarity calculation result exceeds this preset value is it considered a meaningful match.

[0102] In this embodiment, the next step is to establish the association between internal and external rules. By employing text vectorization technology, the semantic information of both internal and external rules is transformed into numerical vector representations. The cosine similarity algorithm is then used to calculate the degree of matching between these vectors, thereby quantifying the similarity between internal and external rules in the detection logic. By setting a reasonable similarity threshold, the external rules most relevant to the internal rules can be selected as optimization references.

[0103] S360. Based on the similarity matching results, the optimization elements in the external standard rules are fused with the diagnostic results of the internal rules to generate a customized target optimization strategy. The target optimization strategy includes rule logic adjustment suggestions, threshold optimization parameters, and additional filtering conditions.

[0104] In this embodiment, a specific optimization plan needs to be formulated based on the similarity matching results. The effective elements from the selected external rules are organically combined with the diagnostic results of the internal rules, for example, by referencing more sophisticated detection logic or more reasonable parameter settings from the external rules. Based on these analysis results, a customized optimization strategy tailored to the specific circumstances of the enterprise is generated. This strategy includes specific suggestions for adjusting rule logic, optimization schemes for threshold parameters, and the necessary additional filtering conditions.

[0105] Furthermore, in the comprehensive quality evaluation model stage, this embodiment constructs a five-dimensional indicator system to comprehensively evaluate rule quality. This system starts from five core dimensions: rule effectiveness, false positive control level, environmental adaptability, rule quality, and threat intelligence alignment. A weighted scoring algorithm is used to calculate a quantitative comprehensive evaluation result. Rule effectiveness, with a weight of 25%, focuses on evaluating the triggering frequency and threat detection coverage of rules; false positive control, with the highest weight of 30%, rigorously examines the false positive rate and the rationality of whitelist configuration; environmental adaptability, accounting for 20%, focuses on analyzing the degree of matching between rules and the enterprise's actual network architecture and business characteristics; rule quality, with a weight of 15%, evaluates grammatical correctness and logical rigor; and threat intelligence alignment, accounting for 10%, verifies the accuracy of the mapping between rules and the latest threat framework. The final evaluation report not only includes specific scores and level classifications but also provides detailed optimization suggestions and priority rankings for each dimension, providing a clear direction for subsequent rule iterations. The entire evaluation process relies on the natural language generation capabilities of the large language model to transform technical indicators into highly readable analytical conclusions, effectively supporting the continuous optimization of the rule base.

[0106] S370. Based on the target optimization strategy, optimize the internal SIEM rule base of the target enterprise.

[0107] Optionally, based on the above embodiments, optimizing the target enterprise's internal SIEM rule base according to the target optimization strategy may include:

[0108] Based on the logical adjustment suggestions and parameter settings in the target optimization strategy, executable rule code that conforms to the syntax of the SIEM platform is automatically generated;

[0109] A three-stage canary release strategy is used to optimize the internal SIEM rule base of the target enterprise. The three-stage canary release strategy includes: the first stage verifies the syntax correctness of the rule code and the effectiveness of simulated attack detection in an isolated test environment; the second stage deploys the rules in the production environment but sets them to logging mode, monitoring the false alarm rate, system load and alarm correlation indicators within a preset time period; the third stage automatically switches to the formal alarm mode after the indicators meet the standards and updates the internal SIEM rule base.

[0110] Generally, based on the logical adjustment suggestions and parameter settings in the target optimization strategy, executable rule code conforming to the syntax of the security information and event management platform is automatically generated. This process involves parsing the specific instructions in the optimization strategy and converting them into rule statements that can be directly executed on the platform, ensuring the accuracy and operability of the code. Next, the enterprise's internal rule base is optimized through a phased canary release strategy. In the initial phase, the syntax correctness of the rule code and the effectiveness of simulated attack detection are verified in an isolated test environment to ensure that the rule logic is error-free and can accurately identify threats. In the subsequent phase, the rules are deployed in the production environment but set to a logging-only mode, monitoring the false positive rate, platform load, and alarm correlation indicators within a preset time period to assess the actual impact and stability of the rules. Finally, once the indicators meet the targets, the system automatically switches to formal alarm mode and updates the enterprise's internal rule base, achieving a smooth transition and risk control. For example, assuming the optimization strategy suggests adjusting the threshold parameters of the login failure detection rule, the automatically generated code will modify the corresponding threshold and gradually verify through canary release whether it maintains detection capability while reducing false positives.

[0111] The technical solution of this invention, based on generating a corporate network environment profile and obtaining its internal rule base through multi-round structured interactions with the target company's cybersecurity personnel, employs a multi-rule adapter to perform syntactic and semantic parsing of the rules to obtain standardized internal rules. Then, it combines historical network logs and the environment profile to identify untriggered rules and high-false-positive rules, performs root cause classification, and generates a diagnostic report. Subsequently, it acquires an integrated Sigma rule base and MITRE... This novel enterprise SIEM rule optimization method utilizes standard external rule bases such as the ATT&CK framework. It converts internal and external rules into vector representations using a text embedding model and calculates semantic similarity using a cosine similarity algorithm. A similarity threshold is set to filter relevant external rules. Finally, based on the matching results, the optimization elements of the external rules are fused with the internal diagnostic results to generate a target optimization strategy. This strategy is then used to optimize the internal rule base. Through intelligent analysis across the entire process, this method significantly improves the accuracy of rule detection and operational efficiency, effectively reducing false positives and shortening threat response time. In particular, in the process of introducing external rule bases and performing intelligent matching, the method integrates authoritative industry knowledge bases and real-time threat intelligence to ensure the forward-looking and practical nature of the optimization strategy. This enables enterprises to quickly adapt to the ever-evolving network threat environment, thereby building a continuously evolving security protection system.

[0112] Example 4

[0113] Figure 4 This is a schematic diagram of a SIEM rule optimization device for an enterprise, provided in Embodiment 3 of the present invention. Figure 4As shown, the device includes: a network environment profile generation module 410, a standardization module 420, a diagnostic module 430, an optimization strategy generation module 440, and an optimization module 450, wherein:

[0114] The network environment profile generation module 410 is used to generate a network environment profile of the target enterprise through multiple rounds of structured interaction with the network security personnel of the target enterprise.

[0115] The standardization module 420 is used to obtain the target enterprise's currently configured internal SIEM rule base and to use a multi-rule adapter to perform syntactic and / or semantic parsing processing on each internal rule in the internal SIEM rule base to obtain each standardized internal rule;

[0116] The diagnostic module 430 is used to identify non-triggered rules and high false alarm rules in various standardized internal rules based on the target enterprise's historical network logs and enterprise network environment profile, and to perform root cause classification on the identified non-triggered rules and high false alarm rules to obtain a diagnostic report that matches the enterprise's internal SIEM rule knowledge base.

[0117] The optimization strategy generation module 440 is used to collect multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generate target optimization strategies based on each standard external SIEM rule;

[0118] The optimization module 450 is used to optimize the internal SIEM rule base of the target enterprise according to the target optimization strategy.

[0119] The technical solution of this invention generates a corporate network environment profile through multi-round structured interaction with the target company's cybersecurity personnel. It then acquires the company's internal SIEM rule base and uses a multi-rule adapter to perform syntactic and semantic parsing of the rules to obtain standardized internal rules. Next, it combines historical network logs and the corporate network environment profile to identify untriggered rules and high-false-positive rules, performs root cause classification on them, and generates a diagnostic report matching the company's internal SIEM rule knowledge base. Subsequently, it collects external rules associated with the diagnostic report from a standard external SIEM rule base and generates a target optimization strategy accordingly. Finally, it optimizes the company's internal SIEM rule base based on this strategy. This novel corporate SIEM rule optimization method significantly improves the accuracy and timeliness of threat detection. Simultaneously, it leverages a continuous learning mechanism to enable the system to self-evolve, reducing security operation and maintenance costs while building a dynamically adaptive proactive defense system for the enterprise.

[0120] Based on the above embodiments, the network environment profile generation module 410 can be specifically used for:

[0121] Engage in structured dialogues with cybersecurity personnel at the target company to gather critical network environment information across multiple cybersecurity dimensions.

[0122] Based on the collected key network environment information, a prompt text is constructed and provided to a large language model to obtain a cybersecurity environment survey questionnaire for the target enterprise.

[0123] A cybersecurity environment survey questionnaire was provided to cybersecurity personnel, and the questionnaire results provided by the cybersecurity personnel were then fed back to the large language model to obtain a profile of the target company's corporate network environment.

[0124] Based on the above embodiments, the standardized module 420 can be specifically used for:

[0125] Obtain a multi-platform rule adapter, which integrates a syntax parser for Splunk search processing language, a syntax analyzer for Ariel query language, and a YAML format processor for Elasticsearch detection rules;

[0126] The multi-platform rule adapter performs syntax parsing on the internal rules of various enterprises, extracting structured elements such as numeric source fields, filtering condition expressions, and trigger threshold settings from the rules;

[0127] The parsed structured elements are converted into a unified standardized format representation, generating unified standardized internal rules.

[0128] Based on the above embodiments, the diagnostic module 430 can be specifically used for:

[0129] By collecting alarm data from network logs within a preset historical period from the target enterprise's SIEM system, non-triggered rules are filtered out based on rule-based alarm trigger records;

[0130] The data source field in the non-triggered rules is compared with the actual log list in the enterprise network environment profile in turn to identify non-triggered rules caused by missing data sources and classify them as non-triggered rules with missing data sources.

[0131] Analyze the matching degree between the filter condition expressions in the non-triggered rules and the normal business baseline of the enterprise, detect non-triggered rules caused by overly strict threshold settings and / or overly harsh filter conditions, and classify them as non-triggered rules due to filter condition mismatch.

[0132] By comparing the detected attack patterns in the non-triggered rules with the actual threat surface in the enterprise network environment, we can identify non-triggered rules caused by attack surface mismatch and classify them as attack surface mismatch type non-triggered rules.

[0133] Based on the above embodiments, the diagnostic module 430 can be specifically used for:

[0134] By collecting alarm data from network logs within a preset historical period from the target enterprise's SIEM system, high false alarm rules are filtered out based on rule-based alarm trigger records.

[0135] Cluster analysis was performed on alarm data with high false alarm rules to identify common characteristics of false alarms, including sets of IP addresses that repeatedly trigger the alarms, distribution over fixed time periods, and specific operation command patterns.

[0136] The specific operation command patterns in high false alarms are compared with the operation command patterns in the normal business processes of the enterprise in turn to identify situations where normal business operations are mistakenly judged as threats, and these situations are classified as business misjudgment type high false alarm rules.

[0137] The detection logic defects of high false positive rules were analyzed, including unreasonable time window settings and missing whitelist configurations, and these were classified as high false positive rules with logical defects.

[0138] Based on the above embodiments, the optimization strategy generation module 440 can be specifically used for:

[0139] Obtain a standard external SIEM rule base, which integrates standardized rules from the Sigma rule base, the MITRE ATT CK framework, and open-source threat intelligence platforms;

[0140] The semantic information of internal enterprise rules and standard external rules is converted into vector representations through a text embedding model. The semantic similarity between vectors is calculated using a cosine similarity algorithm, and a similarity threshold is set to filter the most relevant standard external rules.

[0141] Based on the similarity matching results, the optimization elements in the external standard rules are fused with the diagnostic results of the internal rules to generate a customized target optimization strategy. The target optimization strategy includes rule logic adjustment suggestions, threshold optimization parameters, and additional filtering conditions.

[0142] Based on the above embodiments, the optimization module 450 can be specifically used for:

[0143] Based on the logical adjustment suggestions and parameter settings in the target optimization strategy, executable rule code that conforms to the syntax of the SIEM platform is automatically generated;

[0144] A three-stage canary release strategy is used to optimize the internal SIEM rule base of the target enterprise. The three-stage canary release strategy includes: the first stage verifies the syntax correctness of the rule code and the effectiveness of simulated attack detection in an isolated test environment; the second stage deploys the rules in the production environment but sets them to logging mode, monitoring the false alarm rate, system load and alarm correlation indicators within a preset time period; the third stage automatically switches to the formal alarm mode after the indicators meet the standards and updates the internal SIEM rule base.

[0145] The SIEM rule optimization device for enterprises provided in the embodiments of the present invention can execute the SIEM rule optimization method for enterprises provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0146] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0147] Example 5

[0148] Figure 5 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0149] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0150] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0151] Processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as performing a SIEM rule optimization method for an enterprise as described in any embodiment of the present invention, namely:

[0152] By conducting multiple rounds of structured interactions with the cybersecurity personnel of the target company, a profile of the target company's corporate network environment is generated.

[0153] Obtain the target enterprise's currently configured internal SIEM rule base, and use a multi-rule adapter to perform syntactic and / or semantic parsing on each internal rule in the internal SIEM rule base to obtain each standardized internal rule;

[0154] Based on the target company's historical network logs and network environment profile, identify non-triggered rules and high false alarm rules in various standardized internal rules, and perform root cause classification on the identified non-triggered rules and high false alarm rules to obtain a diagnostic report that matches the company's internal SIEM rule knowledge base;

[0155] Collect multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generate target optimization strategies based on each standard external SIEM rule;

[0156] Based on the target optimization strategy, the internal SIEM rule base of the target enterprise is optimized.

[0157] In some embodiments, the SIEM rule optimization method for an enterprise as described in any of the embodiments of the present invention can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the SIEM rule optimization method for an enterprise as described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the SIEM rule optimization method for an enterprise as described in any of the embodiments of the present invention by any other suitable means (e.g., by means of firmware).

[0158] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0159] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0160] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0161] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0162] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0163] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0164] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0165] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for optimizing enterprise security information and incident management (SIEM) rules, characterized in that, The method includes: By conducting multiple rounds of structured interactions with the cybersecurity personnel of the target company, a profile of the target company's corporate network environment is generated. Obtain the target enterprise's currently configured internal SIEM rule base, and use a multi-rule adapter to perform syntactic and / or semantic parsing on each internal rule in the internal SIEM rule base to obtain each standardized internal rule; Based on the target company's historical network logs and network environment profile, identify non-triggered rules and high false alarm rules in various standardized internal rules, and perform root cause classification on the identified non-triggered rules and high false alarm rules to obtain a diagnostic report that matches the company's internal SIEM rule knowledge base; Collect multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generate target optimization strategies based on each standard external SIEM rule; Based on the target optimization strategy, the internal SIEM rule base of the target enterprise is optimized.

2. The method according to claim 1, characterized in that, Through multiple rounds of structured interaction with the target company's cybersecurity personnel, a profile of the target company's corporate network environment is generated, including: Engage in structured dialogues with cybersecurity personnel at the target company to gather critical network environment information across multiple cybersecurity dimensions. Based on the collected key network environment information, a prompt text is constructed and provided to a large language model to obtain a cybersecurity environment survey questionnaire for the target enterprise. A cybersecurity environment survey questionnaire was provided to cybersecurity personnel, and the questionnaire results provided by the cybersecurity personnel were then fed back to the large language model to obtain a profile of the target company's corporate network environment.

3. The method according to claim 1, characterized in that, A multi-rule adapter is used to perform syntactic and / or semantic parsing on the various internal rules in the enterprise's internal SIEM rule base to obtain standardized internal rules, including: Obtain a multi-platform rule adapter, which integrates a syntax parser for Splunk search processing language, a syntax analyzer for Ariel query language, and a YAML format processor for Elasticsearch detection rules; The multi-platform rule adapter performs syntax parsing on the internal rules of various enterprises, extracting structured elements such as numeric source fields, filtering condition expressions, and trigger threshold settings from the rules; The parsed structured elements are converted into a unified standardized format representation, generating unified standardized internal rules.

4. The method according to claim 1, characterized in that, Based on the target company's historical network logs and network environment profile, identify untriggered rules within each standardized internal rule set, and classify the root causes of these untriggered rules, including: By collecting alarm data from network logs within a preset historical period from the target enterprise's SIEM system, non-triggered rules are filtered out based on rule-based alarm trigger records; The data source field in the non-triggered rules is compared with the actual log list in the enterprise network environment profile in turn to identify non-triggered rules caused by missing data sources and classify them as non-triggered rules with missing data sources. Analyze the matching degree between the filter condition expressions in the non-triggered rules and the normal business baseline of the enterprise, detect non-triggered rules caused by overly strict threshold settings and / or overly harsh filter conditions, and classify them as non-triggered rules due to filter condition mismatch. By comparing the detected attack patterns in the non-triggered rules with the actual threat surface in the enterprise network environment, we can identify non-triggered rules caused by attack surface mismatch and classify them as attack surface mismatch type non-triggered rules.

5. The method according to claim 1, characterized in that, Based on the target company's historical network logs and network environment profile, high-false-positive rules are identified among various standardized internal rules, and root cause classification is performed on the identified high-false-positive rules, including: By collecting alarm data from network logs within a preset historical period from the target enterprise's SIEM system, high false alarm rules are filtered out based on rule-based alarm trigger records. Cluster analysis was performed on alarm data with high false alarm rules to identify common characteristics of false alarms, including sets of IP addresses that repeatedly trigger the alarms, distribution over fixed time periods, and specific operation command patterns. The specific operation command patterns in high false alarms are compared with the operation command patterns in the normal business processes of the enterprise in turn to identify situations where normal business operations are mistakenly judged as threats, and these situations are classified as business misjudgment type high false alarm rules. The detection logic defects of high false positive rules were analyzed, including unreasonable time window settings and missing whitelist configurations, and these were classified as high false positive rules with logical defects.

6. The method according to any one of claims 1-5, characterized in that, Collect multiple standard external SIEM rules associated with each non-triggered rule and each high false alarm rule in the diagnostic report from the standard external SIEM rule base, and generate target optimization strategies based on each standard external SIEM rule, including: Obtain a standard external SIEM rule base, which integrates standardized rules from the Sigma rule base, the MITRE ATT CK framework, and open-source threat intelligence platforms; The semantic information of internal enterprise rules and standard external rules is converted into vector representations through a text embedding model. The semantic similarity between vectors is calculated using a cosine similarity algorithm, and a similarity threshold is set to filter the most relevant standard external rules. Based on the similarity matching results, the optimization elements in the external standard rules are fused with the diagnostic results of the internal rules to generate a customized target optimization strategy. The target optimization strategy includes rule logic adjustment suggestions, threshold optimization parameters, and additional filtering conditions.

7. The method according to any one of claims 1-5, characterized in that, Based on the target optimization strategy, the internal SIEM rule base of the target enterprise is optimized, including: Based on the logical adjustment suggestions and parameter settings in the target optimization strategy, executable rule code that conforms to the syntax of the SIEM platform is automatically generated; A three-stage canary release strategy is used to optimize the internal SIEM rule base of the target enterprise. The three-stage canary release strategy includes: the first stage verifies the syntax correctness of the rule code and the effectiveness of simulated attack detection in an isolated test environment; the second stage deploys the rules in the production environment but sets them to logging mode, monitoring the false alarm rate, system load and alarm correlation indicators within a preset time period; the third stage automatically switches to the formal alarm mode after the indicators meet the standards and updates the internal SIEM rule base.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the SIEM rule optimization method of the enterprise as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the SIEM rule optimization method of the enterprise as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the SIEM rule optimization method of the enterprise according to any one of claims 1-7.

Images