Security event detection method and device, equipment and storage medium

Abstract

The invention discloses a security event detection method and device, equipment and a storage medium, relates to the technical field of network security, and performs preliminary screening on telemetry logs to obtain abnormal signals. And calling a terminal detection model to analyze the context information of the abnormal signal so as to create at least one detection task conforming to a natural language. And calling an intelligent agent matched with the task type to analyze the detection task so as to determine a detection result corresponding to each detection task. And performing fusion analysis on each detection result by using the terminal detection model to determine an ultimate detection result. And when the ultimate detection result meets the detection requirement, the current round of detection task can be ended, the next round of detection is started, and the detection result corresponding to each abnormal signal in the ultimate detection result is used as the detection result of the previous round of detection. And the detection accuracy and the research and judgment efficiency of the security event are improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method, apparatus, device, and storage medium for detecting security incidents. Background Technology

[0002] Endpoint Detection and Response (EDR) is a type of security product that is primarily used to continuously collect and analyze security-related behavioral data on endpoint devices in order to promptly detect advanced threats, support attack attribution, and provide response and handling capabilities.

[0003] The handling of security incidents typically involves five stages: detection, alerting, analysis, handling, and attribution. Traditional technologies mainly rely on engineered rules and detection engines to execute this process, which suffers from problems such as insufficient generalization ability, high false positive rates, excessive alerts, delayed response, missed detections, and incomplete attribution. With the continuous improvement of computing power, data volume, and algorithm technology, large-scale AI models are being widely used.

[0004] Currently, EDR products that combine AI large model technology typically only apply the large model to the interpretation of tracing or analysis results, using it as an auxiliary tool. They fail to fully integrate it into the entire process of security incident handling, thus limiting the improvement in detection effectiveness.

[0005] It is evident that improving the accuracy of security incident detection is a problem that needs to be addressed by those skilled in the art. Summary of the Invention

[0006] The purpose of this application is to provide a method, apparatus, device, and storage medium for detecting security events, which can improve the accuracy of security event detection.

[0007] This application provides a method for detecting security incidents, including:

[0008] Initial screening of telemetry logs reveals abnormal signals;

[0009] The terminal detection model is invoked to analyze the contextual information of the abnormal signal and create at least one detection task that conforms to natural language. The contextual information includes the associated logs of the abnormal signal, and if the abnormal signal appeared in the previous round of detection, the contextual information also includes the detection results of the previous round of detection.

[0010] The system calls upon an agent that matches the task type to analyze the detection task and determine the corresponding detection result for each task.

[0011] The terminal detection model is used to fuse and analyze the various detection results to determine the final detection result;

[0012] If the final test results meet the testing requirements, the current round of testing will end, the next round of testing will begin, and the test results corresponding to each abnormal signal in the final test results will be used as the test results of the previous round of testing.

[0013] On the one hand, the terminal detection model is invoked to analyze the contextual information of abnormal signals, creating at least one detection task conforming to natural language, including:

[0014] Based on the signal type of the target anomaly signal, target-related logs are filtered out from the telemetry logs; where the target anomaly signal is any one of all anomaly signals.

[0015] Based on the natural language instruction framework, the detection results of the previous round of detection corresponding to abnormal signals, target association logs, and abnormal information are converted into detection tasks.

[0016] On the one hand, based on the signal type of the target's abnormal signal, target-related logs are filtered out from the telemetry logs, including:

[0017] When the target abnormal signal is an abnormal IP, the target associated log of the abnormal IP is filtered out from the telemetry log according to the associated information type corresponding to the abnormal IP. The target associated log of the abnormal IP includes the attribute information, behavior operation information, association information and environmental feature information corresponding to the abnormal IP. The association information includes associated devices, same-source IPs and interactive IPs.

[0018] On the one hand, an agent matching the task type is invoked to analyze the detection task in order to determine the detection result corresponding to each detection task, including:

[0019] When the detection task is an IP detection task, an intelligence agent is invoked to analyze the IP detection task in order to determine the detection results; the detection results include normal IPs, attacking IPs, or suspicious IPs.

[0020] On the one hand, the intelligence agent is invoked to analyze the IP detection task to determine the detection results, including:

[0021] Determine whether the detection results of the previous round of detection included in the IP detection task are normal IPs;

[0022] If the detection result of the previous round of detection included in the IP detection task is a normal IP, then the detection result of the previous round of detection is reused as the detection result corresponding to the abnormal IP.

[0023] If the detection result of the previous round of detection included in the IP detection task is not a normal IP, then the intelligence agent is used to comprehensively analyze the abnormal signals, related logs and the detection results of the previous round of detection included in the IP detection task to determine the detection result of the IP detection task.

[0024] On the one hand, it also includes:

[0025] If the final detection result contains new anomalous signals, the system returns to the terminal detection model to analyze the contextual information of the anomalous signals and create at least one operation step for the detection task that conforms to natural language.

[0026] On the one hand, after using the terminal detection model to fuse and analyze the various detection results to determine the final detection result, it also includes:

[0027] If the final test results indicate the existence of a security incident, the final test results will be converted into a visual test report and displayed.

[0028] This application embodiment also provides a security event detection device, including a preliminary screening unit, a creation unit, a first analysis unit, a second analysis unit, and an execution unit;

[0029] The initial screening unit is used to perform initial screening of telemetry logs to obtain abnormal signals;

[0030] A creation unit is used to call the terminal detection model to analyze the context information of abnormal signals and create at least one detection task that conforms to natural language. The context information includes the associated logs of the abnormal signals. If the abnormal signal appeared in the previous round of detection, the context information also includes the detection results of the previous round of detection.

[0031] The first analysis unit is used to call the intelligent agent that matches the task type to analyze the detection task in order to determine the detection result corresponding to each detection task.

[0032] The second analysis unit is used to perform fusion analysis on the various detection results using the terminal detection model in order to determine the final detection result.

[0033] As a unit, it is used to end the current round of detection and start the next round of detection when the final detection result meets the detection requirements, and to take the detection results corresponding to each abnormal signal in the final detection result as the detection results of the previous round of detection.

[0034] This application also provides an electronic device, including:

[0035] Memory, used to store computer programs;

[0036] A processor, used to implement the steps of a method for detecting any of the aforementioned security events when executing a computer program.

[0037] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of the detection method for any of the above-mentioned security events.

[0038] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the detection method for any of the above-described security events.

[0039] As can be seen from the above technical solution, the telemetry logs are initially screened to obtain abnormal signals. The terminal detection model is then invoked to analyze the contextual information of the abnormal signals, creating at least one detection task that conforms to natural language. The contextual information can include the detection results of the previous round of detection in the associated logs of the abnormal signal; if the abnormal signal appeared in the previous round of detection, the contextual information also includes the detection results of the previous round. There are often multiple types of abnormal signals, therefore, there are also multiple types of detection tasks created. Different task types require different analysis methods. To improve the accuracy and efficiency of the detection task analysis, intelligent agents can be pre-built for different task types. After creating the detection task, an intelligent agent matching the task type can be invoked to analyze the detection task and determine the corresponding detection result for each detection task. The terminal detection model is then used to fuse and analyze the detection results to determine the final detection result. To achieve automated continuous analysis of security events, after the final detection result meets the detection requirements and the current round of detection ends, the next round of detection begins, and the detection results corresponding to each abnormal signal in the final detection result are used as the detection results of the previous round of detection. In this technical solution, based on the initial screening of telemetry logs, the terminal detection model performs contextual information analysis on abnormal signals. By planning tasks and calling intelligent agents, in-depth analysis of security events is achieved, which significantly improves the detection accuracy and judgment efficiency of security events. Attached Figure Description

[0040] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A flowchart illustrating a security event detection method provided in an embodiment of this application;

[0042] Figure 2This is a schematic diagram of the structure of a security event detection device provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0044] The terms "comprising" and "having," and any variations thereof, in the specification and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may include steps or units not listed.

[0045] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0046] Next, a method for detecting security events provided by an embodiment of this application will be described in detail. Figure 1 A flowchart of a security event detection method provided in this application embodiment, the method comprising:

[0047] S101: Perform initial screening on the telemetry logs to obtain abnormal signals.

[0048] Endpoint Detection and Response (EDR) is a type of security product primarily used to continuously collect and analyze security-related behavioral data on endpoint devices. This enables the timely detection of advanced threats, supports attack attribution, and provides response and handling capabilities. Endpoint devices can be personal computers (PCs), servers, or cloud hosts, among others.

[0049] Telemetry logs refer to fine-grained behavioral data generated by terminals during daily operation and continuously collected and reported by EDR product agents. The data contained in telemetry logs does not necessarily represent a security threat, but it provides complete contextual information for subsequent threat detection, attribution analysis, and attack chain reconstruction.

[0050] In this embodiment, a log analysis engine can be used to perform preliminary detection and analysis on the telemetry logs collected by the terminal, thereby filtering out abnormal signals. When the log analysis engine detects telemetry logs, it can detect a single telemetry log or multiple telemetry logs within a certain time period; no limitation is made here.

[0051] S102: Call the terminal detection model to analyze the contextual information of the abnormal signal and create at least one detection task that conforms to natural language.

[0052] In this embodiment, an artificial intelligence model, or AI big model, is obtained by training on massive amounts of data and ultra-large-scale parameters. Based on the operations to be performed, the AI ​​big model can be divided into a terminal detection model and multiple intelligent agents.

[0053] The terminal detection model can be seen as the AI ​​brain of the large AI model. It is responsible for analyzing the contextual information of abnormal signals, creating detection tasks, and assigning the detection tasks to the corresponding intelligent agents.

[0054] The intelligent agent is used to perform in-depth analysis of the detection task and output the detection results.

[0055] Contextual information can include associated logs of abnormal signals.

[0056] If the abnormal signal appeared in the previous round of detection, the context information can also include the detection results of the previous round of detection.

[0057] If the log analysis engine detects suspicious abnormal signals in the telemetry logs, it calls the terminal detection model to perform in-depth detection and analysis.

[0058] Abnormal signals include, but are not limited to, alarms with ATT&CK flags, and Intrusion Indicator / Indicator of Attack (IOC / IOA) rule hits.

[0059] ATT&CK tagging refers to mapping observed attack behaviors to tactic and technique numbers in the MITREATT&CK framework within security incidents, alerts, or detection rules, thereby making security incidents more standardized, comparable, and easier to analyze.

[0060] Taking any one of the abnormal signals, namely the target abnormal signal, as an example, the terminal detection model can filter out the target-related logs from the telemetry logs based on the signal type of the target abnormal signal.

[0061] Different types of abnormal signals require different information in their associated logs. Taking an abnormal IP as an example, the terminal detection model can filter out the target associated logs of the abnormal IP from the telemetry logs based on the type of associated information corresponding to the abnormal IP. The target associated logs of the abnormal IP can include the attribute information, behavioral operation information, association information, and environmental feature information corresponding to the abnormal IP.

[0062] The attribute information corresponding to an abnormal IP can include the IP's location and type tag. The type tag can be used to identify whether the abnormal IP is a known member of the "malicious IP database", such as a ransomware IP or a scanning IP.

[0063] Behavioral information can include querying through a threat intelligence platform to see if the abnormal IP has a history of attacks, such as launching DDoS attacks, attempting brute-force attacks, or spreading malicious code.

[0064] Association information can include associated devices, source IPs, and interacting IPs. Source IPs refer to other IPs that originate from the same region and proxy node as the abnormal IP and have similar behavior patterns. Interacting IPs refer to other IPs that have had abnormal communication with the abnormal IP.

[0065] Environmental characteristic information refers to the business requirements that match the functions accessed by the abnormal IP.

[0066] Since the language that the intelligent agent can recognize is natural language, after the terminal detection model filters out the target-related logs, it can convert the detection results of the previous round of detection corresponding to the abnormal signals, target-related logs, and abnormal information into detection tasks according to the natural language instruction framework.

[0067] S103: Invoke the agent that matches the task type to analyze the detection task and determine the detection result corresponding to each detection task.

[0068] Different task categories have their corresponding intelligent agents. For example, IP detection tasks are assigned to intelligence intelligent agents, malicious behavior detection tasks are assigned to sensitive data intelligent agents, and thread detection tasks are assigned to command parsing intelligent agents.

[0069] Taking IP detection tasks as an example, when the detection task is an IP detection task, the intelligence agent is invoked to analyze the IP detection task in order to determine the detection results of the IP detection task; among them, the detection results can include normal IPs, attacking IPs, or suspicious IPs.

[0070] Taking the malicious behavior detection task as an example, when the detection task is a malicious behavior detection task, the sensitive data intelligent agent is invoked to analyze the malicious behavior detection task in order to determine the detection result of the malicious behavior detection task; among which, the detection result can include normal behavior, attack behavior or suspicious behavior.

[0071] Taking a thread detection task as an example, when the detection task is a thread detection task, the command parsing agent is invoked to analyze the thread detection task in order to determine the detection result of the thread detection task; the detection result can include whether the thread is normal, abnormal, or suspicious.

[0072] For abnormal IPs, if the intelligence agent has already analyzed the abnormal IP in the previous round and confirmed that the abnormal IP belongs to a normal IP, the detection results of the previous round can be reused directly. If the analysis is repeated, the results will be discarded.

[0073] In its implementation, the intelligence agent can determine whether the detection result of the previous round of detection included in the IP detection task is a normal IP. If the detection result of the previous round of detection included in the IP detection task is a normal IP, then the detection result of the previous round of detection is reused as the detection result corresponding to the abnormal IP. If the detection result of the previous round of detection included in the IP detection task is not a normal IP, then the intelligence agent uses a comprehensive analysis of the abnormal signals, related logs, and detection results of the previous round of detection included in the IP detection task to determine the detection result of the IP detection task.

[0074] S104: Use the terminal detection model to perform fusion analysis on the detection results to determine the final detection result.

[0075] The terminal detection model can fuse and analyze the detection results fed back by all agents to determine the final detection result.

[0076] The final detection results may include the detection results corresponding to each abnormal signal, as well as the final assessment conclusion. The assessment conclusion may include whether there is no security incident, whether a security incident exists, or whether it is a suspicious incident. Suspicious incidents will continue to be monitored.

[0077] S105: If the final detection result meets the detection requirements, end the current round of detection task, start the next round of detection, and use the detection results corresponding to each abnormal signal in the final detection result as the detection results of the previous round of detection.

[0078] Considering that new abnormal signals may be detected when multiple detection results are fused and analyzed, the detection requirements may include determining whether new abnormal signals exist.

[0079] If new anomalous signals are found in the final detection result, it indicates that the final detection result does not meet the detection requirements, and the new anomalous signals need to be analyzed. Therefore, if the final detection result contains new anomalous signals, the process returns to the terminal detection model to analyze the contextual information of the anomalous signals and create at least one operation step for a detection task that conforms to natural language.

[0080] If no new abnormal signals are found in the final test results, it means that the final test results meet the test requirements. At this point, the current test can be completed and the next test can begin.

[0081] As can be seen from the above technical solution, the telemetry logs are initially screened to obtain abnormal signals. The terminal detection model is then invoked to analyze the contextual information of the abnormal signals, creating at least one detection task that conforms to natural language. The contextual information can include the associated logs of the abnormal signals, and if the abnormal signal appeared in the previous round of detection, it also includes the detection results of the previous round. There are often multiple types of abnormal signals, therefore, there are also multiple types of detection tasks created. Different task types require different analysis methods. To improve the accuracy and efficiency of the detection task analysis, agents can be pre-built for different task types. After creating the detection task, an agent matching the task type can be invoked to analyze the task and determine the corresponding detection result for each task. The terminal detection model is then used to fuse and analyze the detection results to determine the final detection result. To achieve automated continuous analysis of security events, after the final detection result meets the detection requirements and the current round of detection ends, the next round of detection begins. The detection results corresponding to each abnormal signal in the final detection result can be used as the detection results of the previous round. In this technical solution, based on the initial screening of telemetry logs, the terminal detection model performs contextual information analysis on abnormal signals. By planning tasks and calling intelligent agents, in-depth analysis of security events is achieved, which significantly improves the detection accuracy and judgment efficiency of security events.

[0082] After determining the final test results, if the conclusion of the final test results is that a security incident exists, the final test results can be converted into a visual test report and displayed.

[0083] In this embodiment, a log analysis engine performs preliminary detection on telemetry logs. Once a suspicious signal is detected, the system automatically invokes an AI big data model for in-depth analysis. The AI ​​big data model operates continuously without human intervention, providing 24 / 7 security event detection and threat discovery capabilities. By integrating the AI ​​big data model into the entire security event detection and analysis process, and visually demonstrating the interpretability of its analysis process and results, the system enhances user understanding and trust in AI judgments.

[0084] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0085] Figure 2 A schematic diagram of a security event detection device provided in an embodiment of this application includes a preliminary screening unit 21, a creation unit 22, a first analysis unit 23, a second analysis unit 24, and an execution unit 25;

[0086] The initial screening unit 21 is used to perform initial screening on the telemetry logs to obtain abnormal signals;

[0087] Creation unit 22 is used to call the terminal detection model to analyze the context information of the abnormal signal and create at least one detection task that conforms to natural language; wherein, the context information includes the associated log of the abnormal signal, and if the abnormal signal appeared in the previous round of detection, the context information also includes the detection result of the previous round of detection;

[0088] The first analysis unit 23 is used to call an agent that matches the task type to analyze the detection task in order to determine the detection result corresponding to each detection task.

[0089] The second analysis unit 24 is used to perform fusion analysis on the detection results using the terminal detection model in order to determine the final detection result.

[0090] Unit 25 is used to end the current round of detection and start the next round of detection when the final detection result meets the detection requirements, and to use the detection results corresponding to each abnormal signal in the final detection result as the detection results of the previous round of detection.

[0091] In some embodiments, the creation unit includes a filtering subunit and a transformation subunit;

[0092] The filtering subunit is used to filter target-related logs from the telemetry logs based on the signal type of the target anomaly signal; wherein the target anomaly signal is any one of the all anomaly signals.

[0093] The conversion subunit is used to convert the detection results of the previous round of detection corresponding to the abnormal signals, target association logs, and abnormal information into detection tasks according to the natural language instruction framework.

[0094] In some embodiments, the filtering subunit is used to filter out the target associated logs of the abnormal IP from the telemetry logs according to the type of associated information corresponding to the abnormal IP when the target abnormal signal is an abnormal IP; wherein, the target associated logs of the abnormal IP include attribute information, behavior operation information, association information and environmental feature information corresponding to the abnormal IP; the association information includes associated devices, same-source IPs and interactive IPs.

[0095] In some embodiments, the first analysis unit is used to, when the detection task is an IP detection task, invoke an intelligence agent to analyze the IP detection task in order to determine the detection result of the IP detection task; wherein, the detection result includes normal IP, attack IP, or suspicious IP.

[0096] In some embodiments, the first analysis unit includes a judgment subunit, a reuse subunit, and a comprehensive analysis subunit;

[0097] The judgment subunit is used to determine whether the detection result of the previous round of detection included in the IP detection task is a normal IP.

[0098] The reuse subunit is used to reuse the detection result of the previous round of detection as the detection result corresponding to the abnormal IP if the detection result of the previous round of detection included in the IP detection task is a normal IP.

[0099] The comprehensive analysis subunit is used to determine the detection result of the IP detection task by using an intelligence agent to comprehensively analyze the abnormal signals, related logs, and detection results of the previous round of detection included in the IP detection task, when the detection result of the previous round of detection included in the IP detection task is not a normal IP.

[0100] In some embodiments, a return unit is also included;

[0101] The return unit is used to return to the creation unit to execute the operation steps of calling the terminal detection model to analyze the context information of the abnormal signal and create at least one detection task that conforms to natural language when the final detection result contains new abnormal signals.

[0102] In some embodiments, after using the terminal detection model to perform fusion analysis on the detection results to determine the final detection result, a visualization unit is also included.

[0103] The visualization unit is used to convert the final detection results into a visualized detection report and display the report when the final detection result concludes that a security incident exists.

[0104] Figure 2 The description of the features in the corresponding embodiments can be found in [reference needed]. Figure 1The relevant descriptions of the corresponding embodiments will not be repeated here.

[0105] As can be seen from the above technical solution, the telemetry logs are initially screened to obtain abnormal signals. The terminal detection model is then invoked to analyze the contextual information of the abnormal signals, creating at least one detection task that conforms to natural language. The contextual information can include the associated logs of the abnormal signals, and if the abnormal signal appeared in the previous round of detection, it also includes the detection results of the previous round. There are often multiple types of abnormal signals, therefore, there are also multiple types of detection tasks created. Different task types require different analysis methods. To improve the accuracy and efficiency of the detection task analysis, agents can be pre-built for different task types. After creating the detection task, an agent matching the task type can be invoked to analyze the task and determine the corresponding detection result for each task. The terminal detection model is then used to fuse and analyze the detection results to determine the final detection result. To achieve automated continuous analysis of security events, after the final detection result meets the detection requirements and the current round of detection ends, the next round of detection begins. The detection results corresponding to each abnormal signal in the final detection result can be used as the detection results of the previous round. In this technical solution, based on the initial screening of telemetry logs, the terminal detection model performs contextual information analysis on abnormal signals. By planning tasks and calling intelligent agents, in-depth analysis of security events is achieved, which significantly improves the detection accuracy and judgment efficiency of security events.

[0106] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above-described embodiments of the security event detection method.

[0107] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described security event detection method embodiments when running.

[0108] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0109] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described security event detection method embodiments.

[0110] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described security event detection method embodiments.

[0111] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0112] The foregoing has provided a detailed description of a security event detection method, apparatus, device, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to aid in understanding the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for detecting security incidents, characterized in that, include: Initial screening of telemetry logs reveals abnormal signals; The terminal detection model is invoked to analyze the context information of the abnormal signal and create at least one detection task that conforms to natural language; wherein, the context information includes the associated log of the abnormal signal, and if the abnormal signal appeared in the previous round of detection, the context information also includes the detection result of the previous round of detection; The detection task is analyzed by an agent that matches the task type to determine the detection result corresponding to each detection task. The terminal detection model is used to fuse and analyze the detection results to determine the final detection result; If the final detection result meets the detection requirements, the current round of detection task ends and the next round of detection begins. The detection results corresponding to each abnormal signal in the final detection result are used as the detection results of the previous round of detection.

2. The method for detecting security incidents according to claim 1, characterized in that, The terminal detection model is invoked to analyze the contextual information of the abnormal signal, and at least one detection task conforming to natural language is created, including: Based on the signal type of the target anomaly signal, target-related logs are filtered out from the telemetry logs; wherein, the target anomaly signal is any one of all anomaly signals. According to the natural language instruction framework, the abnormal signal, the target-related log, and the detection results of the previous round of detection corresponding to the abnormal information are converted into detection tasks.

3. The method for detecting security incidents according to claim 2, characterized in that, Based on the signal type of the target's abnormal signal, target-related logs are filtered from the telemetry logs, including: When the target abnormal signal is an abnormal IP, the target associated log of the abnormal IP is filtered out from the telemetry log according to the associated information type corresponding to the abnormal IP; wherein, the target associated log of the abnormal IP includes attribute information, behavior operation information, association information and environmental feature information corresponding to the abnormal IP; the association information includes associated devices, same-source IPs and interactive IPs.

4. The method for detecting security incidents according to claim 1, characterized in that, The system invokes an agent matching the task type to analyze the detection task, thereby determining the detection result corresponding to each detection task, including: When the detection task is an IP detection task, an intelligence agent is invoked to analyze the IP detection task in order to determine the detection result of the IP detection task; wherein, the detection result includes normal IP, attack IP or suspicious IP.

5. The method for detecting security incidents according to claim 4, characterized in that, The intelligence agent is invoked to analyze the IP detection task to determine the detection results, including: Determine whether the detection result of the previous round of detection included in the IP detection task is a normal IP; If the detection result of the previous round of detection included in the IP detection task is a normal IP, then the detection result of the previous round of detection is reused as the detection result corresponding to the abnormal IP. If the detection result of the previous round of detection included in the IP detection task is not a normal IP, then the intelligence agent is used to comprehensively analyze the abnormal signals, related logs and the detection result of the previous round of detection included in the IP detection task to determine the detection result of the IP detection task.

6. The method for detecting security incidents according to claim 1, characterized in that, Also includes: If the final detection result contains new anomalous signals, the process returns to calling the terminal detection model to analyze the contextual information of the anomalous signals and create at least one detection task that conforms to natural language.

7. The method for detecting security incidents according to claim 1, characterized in that, After fusing and analyzing the detection results using the terminal detection model to determine the final detection result, the method further includes: If the final detection result concludes that a security incident exists, the final detection result will be converted into a visual detection report and displayed.

8. A detection device for a security incident, characterized in that, It includes a preliminary screening unit, a creation unit, a first analysis unit, a second analysis unit, and a processing unit; The initial screening unit is used to perform initial screening on the telemetry logs to obtain abnormal signals; The creation unit is used to call the terminal detection model to analyze the context information of the abnormal signal and create at least one detection task that conforms to natural language; wherein, the context information includes the associated log of the abnormal signal, and if the abnormal signal appears in the previous round of detection, the context information also includes the detection result of the previous round of detection; The first analysis unit is used to call an agent that matches the task type to analyze the detection task, so as to determine the detection result corresponding to each detection task. The second analysis unit is used to perform fusion analysis on each of the detection results using the terminal detection model to determine the final detection result; The unit is used to end the current round of detection and start the next round of detection when the final detection result meets the detection requirements, and to take the detection results corresponding to each abnormal signal in the final detection result as the detection results of the previous round of detection.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the method for detecting security events as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the security event detection method as described in any one of claims 1 to 7.

Images