Computer network information security event processing method

Abstract

The invention relates to the technical field of network security, and particularly discloses a computer network information security event processing method, which comprises the following steps: designing a security information extraction model: matching information extraction tasks by identifying different security information of a computer, and carrying out unified processing on the information extraction tasks; constructing a network security entity; performing entity identification and extraction task classification on a unified processing result; optimization of the security information extraction model: designing a prompt template according to entity identification and extraction task classification, inputting the prompt and a text as a sample set into the security information extraction model for prediction, and optimizing the security information extraction model according to a prediction result; verifying the security information extraction model: dividing the sample set into a training set and a verification set, and performing security evaluation and result verification on the initialized security information extraction model; and the occurrence frequency of the security event is predicted according to a security evaluation result, so that the security information prediction speed and efficiency are accurately improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a method for handling computer network information security incidents. Background Technology

[0002] With the advent of the information age, cybersecurity has become increasingly important to national security, and how to analyze security intelligence has become a crucial issue in the field of cybersecurity. Security intelligence data comes from diverse sources, is complex in content, and varies greatly, making its analysis costly and typically requiring advanced domain expertise. Therefore, major cybersecurity platforms are increasingly adopting automated methods, utilizing information extraction techniques to extract key information from threat intelligence reports.

[0003] However, existing unified information extraction models have a low correlation with security information events. Although they have a certain information extraction capability, they are not very sensitive to threats to relatively significant security information. Furthermore, they lack efficient and fast security information extraction models to solve the problem of low prediction speed of network information security events. Summary of the Invention

[0004] The purpose of this invention is to provide a method for handling computer network information security incidents, and to solve the following technical problems:

[0005] How to design a security information extraction model to improve the speed and efficiency of security information prediction?

[0006] The objective of this invention can be achieved through the following technical solutions:

[0007] A method for handling computer network information security incidents, the method comprising:

[0008] Step 1: Design a security information extraction model: By identifying different security information matching tasks in the computer, the information extraction tasks are processed in a unified manner.

[0009] Step 2: Construct network security entities: Perform entity identification and extraction task classification on the unified processing results;

[0010] Step 3: Optimization of the security information extraction model: Design a prompt template based on entity recognition and extraction task classification, input the prompt and text as sample sets into the security information extraction model for prediction, and optimize the security information extraction model based on the prediction results.

[0011] Step 4: Verify the security information extraction model: Divide the sample set into a training set and a validation set, and conduct a security assessment and result verification on the initialized security information extraction model.

[0012] Preferably, the specific method in step one is as follows:

[0013] S1. Input security information data into a pre-set unified information extraction model for pre-training;

[0014] S2. Extract tasks based on the output information from the pre-training results;

[0015] S3. Analyze the relationship types and event types between different information extraction tasks, and extract relationship type keywords and event type keywords;

[0016] S4. Further standardize the information extraction task based on relation type keywords and event type keywords.

[0017] Preferably, the unification process in step S4 is as follows:

[0018] S41. The dataset for identifying relation type keywords and event type keywords is denoted as set A;

[0019] S42. Decompose and reorganize all information extraction tasks into task a and task b according to the arrangement order of relation type and event type;

[0020] S43. Input set A into a pre-defined unified information extraction model and train task a and task b using a sequential strategy.

[0021] S44. Extract the unified target information based on the training results of task a and task b.

[0022] Preferably, the entity recognition and extraction task classification design prompt template in step three includes:

[0023] The target information is named after entity recognition, and the prompt input is a prompt template of the entity type;

[0024] Analyze the extracted task types, identify the relationships and event types that match the prompts, and input the prompts as prompt templates for the relationships and event types.

[0025] Preferably, the sequence strategy in step S43 is:

[0026] Through formula Obtaining the order coefficient ;in, This is a pre-defined recursive function; For task state functions, As a task type, and = a, b; For a priori value; These are sampled values; The loss function;

[0027] Will With preset threshold Comparison:

[0028] like > If so, task a is assigned first, and then the order of the memory output is arranged according to the learning machine's output order.

[0029] like < If so, task b is sorted first, and then the order of memory output is arranged according to the learning machine's output order.

[0030] Preferably, the network security entity identification in step two includes:

[0031] Text data is determined based on historical security databases, and the text data is preprocessed to remove HTML tags;

[0032] The text data (with HTML tags removed) is segmented and labeled using a word segmentation tool to determine the number of segments, n, and form a segmentation set. ;

[0033] Calling the CRF algorithm to Perform cybersecurity entity identification;

[0034] Input entity type prompt template and Predictions are made based on a pre-defined network security entity model to form a sequence of security entities;

[0035] The sequence of secure entities is classified into m classes of secure entities. And each type of security entity is labeled as: .

[0036] Preferably, the method further includes:

[0037] Step 5: Predict the frequency of security incidents based on the security assessment results.

[0038] A method for handling computer network information security incidents, wherein the method for predicting the frequency of security incidents in step five is as follows:

[0039] Through formula Calculate the error prediction coefficient ;

[0040] in, These are measured data values. To predict data values; The parameter function is the measured data value. A function that provides parameters for predicting data values; The total number of data; for The maximum value among the data values; for The minimum value among the data values; Adjustment function;

[0041] Error prediction coefficients With preset threshold range Compare:

[0042] like > If so, it can be determined that the frequency of security incidents is relatively high;

[0043] like ∈ If so, it can be determined that the frequency of security incidents is moderate;

[0044] like < If the frequency of security incidents is low, then it can be determined that the incidents occur at a low rate.

[0045] The beneficial effects of this invention are:

[0046] (1) This invention constructs a security information extraction model and optimizes and verifies the security information extraction model. Through the extraction of security events in the field of network security, it realizes the systematic and automated analysis of computer network information security events, and provides accurate information security event types and prediction and diagnosis methods in a timely manner. Furthermore, it improves the task extraction speed of the security information extraction model, reduces the response time of security event information extraction, and improves the prediction speed of security event information.

[0047] (2) This invention predicts the frequency of security events by analyzing the security assessment results; after establishing and verifying the security information extraction model for security events, it also predicts the frequency of security events by analyzing the final security assessment results data, and then feeds the results back to the actual security event monitoring platform for visualization, thereby reducing the predictability of data security monitoring and reducing the risk of data security information leakage and virus intrusion.

[0048] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1This is a flowchart illustrating the steps of a computer network information security incident handling method according to the present invention.

[0051] Figure 2 The method steps for designing a security information extraction model for this invention are illustrated in the diagram.

[0052] Figure 3 This is a flowchart illustrating the standardized processing method of the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] Please see Figure 1 As shown, the present invention is a method for handling computer network information security incidents, the method comprising:

[0055] Step 1: Design a security information extraction model: By identifying different security information matching tasks in the computer, the information extraction tasks are processed in a unified manner.

[0056] Step 2: Construct network security entities: Perform entity identification and extraction task classification on the unified processing results;

[0057] Step 3: Optimization of the security information extraction model: Design a prompt template based on entity recognition and extraction task classification, input the prompt and text as sample sets into the security information extraction model for prediction, and optimize the security information extraction model based on the prediction results.

[0058] Step 4: Verify the security information extraction model: Divide the sample set into a training set and a validation set, and conduct a security assessment and result verification on the initialized security information extraction model.

[0059] To address the aforementioned technical problems, this embodiment proposes a computer network information security incident handling method, specifically including:

[0060] First, a security information extraction model is designed: by identifying different security information from computers and matching it with information extraction tasks, the information extraction tasks are processed in a unified manner. Because the sources of information in cybersecurity incidents are wide, the information content is complex and highly varied, and the cost of analysis is high, relying on automated information extraction technology to identify and extract important information and analyze threat-related intelligence is a key aspect of resolving cybersecurity incidents. Based on information identification technology, various security information from computers is obtained and corresponding adaptive matching information extraction methods are performed, and different information extraction tasks are processed in a unified manner.

[0061] It is important to note that the implementation of existing information extraction tasks mainly relies on cybersecurity platforms for multiple information extraction tasks. Building multiple models for different extraction tasks increases the difficulty of model management and machine costs. Secondly, completely retraining independent models for specific domains requires a large amount of labeled data and encodes entity types into the model, making it difficult to introduce new entity types. Finally, different extraction tasks share some common knowledge and capabilities, and training independent models for different tasks severely limits knowledge sharing between related tasks and environments.

[0062] Then, a network security entity is constructed: entity identification and extraction task classification are performed on the unified processing results; after the security information is processed in a unified manner for different extraction tasks, it is further classified by matching the corresponding entity identification and extraction tasks, thereby reducing the multi-modal approach to information extraction and improving the information extraction efficiency of security information, thus constructing an information network security entity.

[0063] Next, the security information extraction model is optimized: a prompt template is designed based on entity recognition and extraction task classification. The prompt and text are used as sample sets to input the security information extraction model for prediction, and the model is optimized based on the prediction results. Unlike multiple information extraction templates, by constructing and designing a prompt template, the prompt template can be adjusted according to the input text type. The security information extraction model is trained with training samples to ensure secure prediction. The security prediction results are used to optimize the security information extraction model, thus ensuring the establishment and performance optimization of the information extraction model in the field of cybersecurity.

[0064] To address the issue of low prediction efficiency caused by concatenating the prompt and text input, this embodiment designs the input of text and prompt separately; in practical applications, the prediction speed of the model is improved by pre-storing the encoding vector of the prompt.

[0065] Finally, the security information extraction model is validated: the sample set is divided into a training set and a validation set, and the security assessment and result validation of the initialized security information extraction model are performed; by dividing the sample information into a training set and a validation set according to a certain ratio, the security information extraction model is validated, and the validation result depends on the security assessment and the output results of the validation set.

[0066] As one embodiment of the present invention, please refer to Figure 2 As shown, the specific method in step one is as follows:

[0067] S1. Input security information data into a pre-set unified information extraction model for pre-training;

[0068] S2. Extract tasks based on the output information from the pre-training results;

[0069] S3. Analyze the relationship types and event types between different information extraction tasks, and extract relationship type keywords and event type keywords;

[0070] S4. Further standardize the information extraction task based on relation type keywords and event type keywords.

[0071] Through the above technical solution, the specific method for designing the security information extraction model in step one of this embodiment is as follows: First, security information data is input into a preset unified information extraction model for pre-training. By pre-training the data information, the unified information extraction model is ensured to be compatible with the security information data model configuration process. At the same time, the pre-training process can also construct an extraction mode that conforms to security information, ensuring that the security information extraction model has good information extraction capabilities. Then, information extraction tasks are output according to the pre-training results. The current information extraction task is determined based on the security technology field involved in the security device set computer and the type of information extraction data. The information extraction task is determined according to the extraction structure of different service classes. In practice, the type of extraction task is determined according to the extraction structure.

[0072] Next, the relationship types and event types between different information extraction tasks are analyzed, and relationship type keywords and event type keywords are extracted. Finally, the information extraction tasks are further standardized based on the relationship type keywords and event type keywords. This ensures the establishment of the secure information extraction model in step one and the determination of different extraction task types, as well as the standardization of extraction task types. This reduces the problems of long construction time, cumbersome analysis process, and low information extraction accuracy in the construction of multiple information extraction task models in existing technologies.

[0073] The criteria for standardizing information extraction tasks are as follows: the output format of all information extraction tasks is unified into a "entity-relationship-event" triple (e.g., <hacker organization X, exploit, 0-day vulnerability, vulnerability exploitation attack>), and the task types are merged into two categories: "relationship extraction" and "event extraction," eliminating differences in output formats and redundant tasks from different original tasks.

[0074] As one embodiment of the present invention, please refer to Figure 3 As shown, the unification process in step S4 is as follows:

[0075] S41. The dataset for identifying relation type keywords and event type keywords is denoted as set A;

[0076] S42. Decompose and reorganize all information extraction tasks into task a and task b;

[0077] S43. Input set A into a pre-defined unified information extraction model and train task a and task b using a sequential strategy.

[0078] S44. Extract the unified target information based on the training results of task a and task b.

[0079] Through the above technical solution, the unification processing step in step S4 of this embodiment specifically includes: First, identifying the datasets of relation type keywords and event type keywords, denoted as set A; then, decomposing and reorganizing all information extraction tasks into task a and task b. In this embodiment, multiple different information extraction tasks are decomposed and reorganized, and interval numbers are used to express the degree of information exchange between different tasks, forming an interval number design structure matrix. This is used to decompose and reorganize the design tasks; next, set A is input into a preset unified information extraction model, and task a and task b are trained through a sequential strategy; finally, the unified target information of the information extraction tasks is output based on the training results of task a and task b.

[0080] This can be understood as decomposing and reorganizing all information extraction tasks into task a and task b according to the classification rules of "relation type extraction" and "event type extraction"; where: task a is a relation type extraction task (corresponding to relation type keywords in set A), and task b is an event type extraction task (corresponding to event type keywords in set A); if a certain original task contains both relation and event keywords, it will be split and assigned to task a and task b respectively.

[0081] As an embodiment of the present invention, the entity recognition and extraction task classification design prompt template in step three includes:

[0082] The target information is named after entity recognition, and the prompt input is a prompt template of the entity type;

[0083] Analyze the extracted task types, identify the relationships and event types that match the prompts, and input the prompts as prompt templates for the relationships and event types.

[0084] Through the above technical solution, the method for designing prompt template content for entity recognition and extraction task classification in step three of this embodiment specifically includes: naming the target information as entities, and inputting the prompt as a prompt template of entity type; then analyzing the extraction task type, identifying the relationship and event type of the prompt matching, and inputting the prompt as a prompt template of relationship and event type.

[0085] It should be noted that the prompt template uses the entity's annotation description as the prompt, and then concatenates common keywords and sentence structures; thus, the prior knowledge of the special domain is passed in the form of a prompt, so that the model can focus more on learning the general extraction ability. In addition, (1) entity type prompt template: the prompt template uses "identify words in the text that belong to the following network security entity types, the entity types are selected from the high-frequency entity categories in the historical security database (at least 5 core entities), and the keywords are the standard names of the entities (such as "SQL injection vulnerability" and "ransomware"); (2) relationship and event type prompt template: the relationship type template can use "determine whether the relationship between [entity A] and [entity B] in the text is of the following types: [exploitation, attack, association, derivation]", and the event type template can use "determine whether the event described in the text belongs to the following types: [vulnerability exploitation attack, phishing attack, DDoS attack, data leakage]", and the relationship and event types need to be accurately matched with the keywords extracted in step S3.

[0086] As an embodiment of the present invention, the sequence strategy in step S43 is as follows:

[0087] Through formula Obtaining the order coefficient ;in, This is a pre-defined recursive function; For task state functions, As a task type, and = a, b; For a priori value; These are sampled values; The loss function;

[0088] Will With preset threshold Comparison:

[0089] like > If so, task a is assigned first, and then the order of the memory output is arranged according to the learning machine's output order.

[0090] like < If so, task b is sorted first, and then the order of memory output is arranged according to the learning machine's output order.

[0091] Through the above technical solution, this embodiment trains tasks a and b using a sequential strategy; specifically, by obtaining the sequence coefficients, it ensures that the task types are pre-arranged during the initial sample training process, thereby ensuring the consistency of the model's prediction output and improving prediction accuracy; specifically, through the formula... Calculate the order coefficient ; through the set loss function and task state function It can reflect the task distribution state, and thus reflect the magnitude of the order coefficient. Furthermore, since the prediction algorithm is based on a recursive function... Automatically achieved with the help of memory state, the state values ​​are obtained by predicting the task state sizes of two task types and in a state that conforms to a mixed distribution. The adoption type that minimizes the loss function is considered, that is, the order prediction type is obtained, and its calculation result is set as the order coefficient.

[0092] By With preset threshold Compare the sizes and make a judgment; if... > If so, then task a is sorted first, and then arranged according to the order of memory output by the learning machine; if < If so, task b is sorted first, and then the order of memory output is arranged according to the learning machine's output order.

[0093] Where the threshold It can be determined based on the statistical results of the ordinal coefficients of 100 sets of historical task data, for example: =0.5 (value range [0.4, 0.6]; for complex tasks (number of subtasks ≥ 10) =0.4, for simple tasks (number of subtasks ≤ 5) =0.6); The learning machine arranges the memory output order as follows: The learning machine adopts a reinforcement learning model, and the memory output order is arranged from shortest to longest task processing time (the processing time is obtained by statistical analysis of historical task processing data).

[0094] It should be noted that the pre-defined recursive function The domain and range are obtained by defining the domain and range using historical natural number sets, including full functions that are defined everywhere and partial functions that are not necessarily defined everywhere. In this embodiment, the domain and range are determined according to the specific number set state (specifically, a weighted recursive function based on task priority, with a recursion depth of 2 levels, and the weight coefficients are set by the importance of the task to the prediction of security events); task state function. The prior value is determined based on the proportion and frequency of use of tasks a and b relative to multiple information extraction tasks and task extraction objectives; (Statistical values ​​based on historical task processing efficiency over the past 6 months), sampled values (Random sampled values ​​following a normal distribution, used to simulate the uncertainty of task processing) and loss function All conform to a mixed distribution. This reflects the magnitude of the loss (loss function) when using this strategy with partially observable parameters. Specifically, this can be obtained by combining the task scenario (optimizing the training order of tasks a and b), parameter characteristics (prior value π, sampled value τ), and the mixed distribution assumption, prioritizing the use of the cross-entropy loss function, and proceeding through determining the type → defining input parameters → deriving the calculation expression.

[0095] As an embodiment of the present invention, the network security entity identification in step two includes:

[0096] Text data is determined based on historical security databases, and the text data is preprocessed to remove HTML tags;

[0097] The text data (with HTML tags removed) is segmented and labeled using a word segmentation tool to determine the number of segments, n, and form a segmentation set. ;

[0098] Calling the CRF algorithm to Perform cybersecurity entity identification;

[0099] Input entity type prompt template and Predictions are made based on a pre-defined network security entity model to form a sequence of security entities;

[0100] The sequence of secure entities is classified into m classes of secure entities. And each type of security entity is labeled as: .

[0101] Through the above technical solution, the network security entity identification analysis in this embodiment provides intelligence support for network attack and defense in complex network environments. In network threat intelligence analysis, network data mainly identifies network security entities such as hacker organizations, units, vulnerabilities, and malicious programs. Specifically, firstly, text data is determined based on historical security databases, and the text data is preprocessed to remove HTML tags. Then, a word segmentation tool is used to segment and annotate the text data after removing HTML tags, determining the number of segments n, and forming a word segmentation set. Next, the CRF algorithm is called to... To perform network security entity identification, the CRF algorithm is used to achieve efficient and accurate identification of secure entities.

[0102] In the process of calling the CRF algorithm, Before performing cybersecurity entity identification, a neural network model is trained using the CRF algorithm. The training data mainly comes from historical cybersecurity text data. For Chinese cybersecurity entity data, manual annotation is performed. After annotation, the data is put into the training tool for training to establish a Chinese cybersecurity entity model. The CRF algorithm is then used to identify cybersecurity entities.

[0103] Furthermore, input the prompt template for the entity type and The system predicts security entities using a pre-defined network security entity model, forming a sequence of security entities. Finally, the security entity sequence is classified to form a set of m types of security entities. And each type of security entity is labeled as: .

[0104] As one embodiment of the present invention, the method further includes:

[0105] Step 5: Predict the frequency of security incidents based on the security assessment results.

[0106] Through the above technical solution, after establishing and verifying the security information extraction model for security incidents, the frequency of security incidents is predicted from the final security assessment results data, and then fed back to the actual security incident monitoring platform for visualization, which reduces the predictability of data security monitoring and reduces the risk of data security information leakage and virus intrusion.

[0107] As an embodiment of the present invention, the method for predicting the frequency of security events in step five is as follows:

[0108] Through formula Calculate the error prediction coefficient ;

[0109] in, These are measured data values. To predict data values; The parameter function is the measured data value. A function that provides parameters for predicting data values; The total number of data; for The maximum value among the data values; for The minimum value among the data values; Adjustment function;

[0110] Error prediction coefficients With preset threshold range Compare:

[0111] like > If so, it can be determined that the frequency of security incidents is relatively high;

[0112] like ∈ If so, it can be determined that the frequency of security incidents is moderate;

[0113] like < If the frequency of security incidents is low, then it can be determined that the incidents occur at a low rate.

[0114] Through the above technical solution, in this embodiment, the method of predicting the frequency of security incidents ensures data security and reliability; specifically, the method involves obtaining error prediction coefficients. It can reflect the frequency of security incidents, which is derived from real-time detection data; specifically through the formula... Calculate the error prediction coefficient ;in, These are measured data values. To predict data values; The parameter function is the measured data value. The parameter function is used to predict data values, where This refers to the type of security incident. The total number of data points (which can be represented by daily statistics based on security incident monitoring data from the past 3 months). for The maximum value among the data values; for The minimum value among the data values; Adjustment function; where adjustment function This is achieved by ensuring that the magnitude of the error prediction coefficient is within a reasonable range through a pre-set adjustment interval. Used to correct data distribution bias ∈[0.8,1.2]; when the data conforms to a normal distribution =1.0, left-skewed distribution =1.1-1.2, when the distribution is right-skewed =0.8-0.9, depending on the actual situation.

[0115] By using error prediction coefficients With preset threshold range Compare the sizes to determine if... > If the frequency of security incidents is high, then it is determined that the incidents occur frequently; if ∈ If so, the frequency of security incidents is considered moderate; if < If the frequency of security incidents is low, then it can be determined that the incidents occur at a low rate.

[0116] The above description is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined in the claims, they should all fall within the protection scope of the present invention.

Claims

1. A computer network information security incident handling method, characterized by, The method comprises: Step one, design a security information extraction model: by identifying different security information matching information extraction tasks, the information extraction tasks are unified; Step two, build a network security entity: entity recognition and extraction task classification are performed on the unified processing results; Step three, optimization of the security information extraction model: according to the entity recognition and extraction task classification, a prompt template is designed, the prompt and the text are input into the security information extraction model as a sample set for prediction, and the security information extraction model is optimized according to the prediction results; Step four, verify the security information extraction model: divide the sample set into a training set and a verification set, and perform security evaluation and result verification on the initialized security information extraction model.

2. The computer network information security event processing method of claim 1, wherein, The specific method in step one is: S1, obtain security information data and input it into a preset unified information extraction model for pre-training; S2, output the information extraction task according to the pre-training result; S3, analyze the relationship type and event type between different information extraction tasks, and extract the relationship type keyword and event type keyword; S4, further unify the information extraction tasks according to the relationship type keyword and event type keyword.

3. The computer network information security event processing method of claim 2, wherein, The step of the unified processing in step S4 is: S41, identify the data set of the relationship type keyword and the event type keyword, denoted as set A; S42, decompose and recombine all information extraction tasks into task a and task b; S43, input set A into the preset unified information extraction model, and train task a and task b through a sequential strategy; S44, output the target information of the unified information extraction task according to the training results of task a and task b.

4. The computer network information security event processing method of claim 3, wherein, The entity recognition and extraction task classification design prompt template content in step three includes: Perform entity recognition and naming on the target information, and input the prompt template as the entity type; Analyze the extraction task type, identify the relationship and event type matched by the prompt, and input the prompt template as the relationship and event type.

5. The computer network information security event processing method of claim 4, wherein, The sequential strategy in step S43 is: obtained by the formula obtained by the formula ; wherein, is a preset recursive function; is a task state function, is a task type, and = a, b; is a priori value; is a sampling value; is a loss function; comparing with a preset threshold value If > then first task a is scheduled, and then the order of memory output is arranged according to the learning machine; If < Task b is scheduled first, and the order of the memory output is arranged according to the learning machine.

6. The computer network information security event processing method of claim 4, wherein, The network security entity recognition in step two includes: Determine the text data according to the historical security database, and remove the HTML tags from the text data; The text data after removing HTML tags is tokenized by a tokenization tool to determine the number n of tokens and form a tokenization set ; calling a CRF algorithm to perform network security entity recognition ; a prompt template of an input entity type, and perform prediction to a preset network security entity model to form a security entity sequence; classifying the sequence of security entities into m classes of security entities and marking each class of security entities as .

7. The computer network information security event processing method of claim 1, wherein, The method further comprises: Step five, predict the frequency of security events according to the security evaluation results.

8. The computer network information security event processing method of claim 7, wherein, The method of predicting the frequency of security events in step five is: The error prediction coefficients are calculated by the formula ;​ wherein, is a measured data value, is a predicted data value; is a measured data value parameter function, is a predicted data value parameter function; is a total number of data values; is a maximum value of the is a minimum value of the is a minimum value of the is a minimum value of the is an adjustment function; predicting coefficients of errors compared with a preset threshold interval performing comparison: If > then it is determined that the frequency of safety events is large; If ∈ then the frequency of the security event is moderate. If < then it is determined that the frequency of safety events is low.

Images