Supervision event analysis method and device based on large language model and medium

Abstract

The invention discloses a supervision event analysis method and equipment based on a large language model, and a medium, mainly relates to the technical field of supervision event analysis, and is used for solving the problems of insufficient event detail identification and lack of intelligentization in the existing scheme. Comprising the following steps: acquiring a context vector of a current operation event, and acquiring abnormal knowledge graph data corresponding to the current operation event from a preset detail abnormal graph; inputting the context vector and the abnormal knowledge graph into a trained large language model, and outputting an event description text; splicing the abnormal knowledge graph data, the external knowledge information and the event tetrad as processing data; obtaining semantic association features between the processing data and a preset historical event sequence; and according to the semantic association feature of the current operation event, extracting a historical processing case with the highest similarity from a historical event initial database, and further determining a processing suggestion corresponding to the historical processing case as a processing suggestion corresponding to the current operation event.

Description

Technical Field

[0001] This application relates to the field of regulatory event analysis technology, and in particular to a regulatory event analysis method, device and medium based on a large language model. Background Technology

[0002] As informatization deepens, organizations generate massive amounts of logs, traffic, and security alerts daily within their intranets and critical information systems. Existing monitoring incident analysis and handling technologies typically rely on Security Information and Incident Management (SIEM) platforms or similar systems. These systems collect data from terminals, networks, and servers, then combine this data with rule engines and signature databases for detection, generating alerts, which are ultimately analyzed and handled by human analysts. While this approach is widely used in engineering practice and provides fundamental support for monitoring, its overall architecture and processing methods are relatively fixed, exhibiting certain limitations.

[0003] While existing technologies can detect common violations or known attacks, they still have the following limitations: (1) Insufficient identification of event details: Existing technologies rely on overall identification and cannot integrate and identify detailed errors in the process of abnormal events, which may lead to the omission of potential risks. (2) Lack of intelligent handling: Existing systems have fixed handling mechanisms and it is difficult to dynamically generate handling plans based on event semantics, historical behavior and risk level. When facing complex compliance requirements, they lack flexibility and strategy adaptability. Summary of the Invention

[0004] This application provides a regulatory event analysis method, device, and medium based on a large language model to address the problems of insufficient identification of event details and lack of intelligent handling in existing solutions.

[0005] Firstly, this application provides a regulatory event analysis method based on a large language model, the method comprising: Configure data acquisition modules on various processing terminals involved in the current operation event; use the data acquisition modules to obtain raw acquisition log data; Obtain the set of raw event logs corresponding to the current operation event from several raw collected log data; calculate the information entropy value corresponding to the raw event log set; determine whether the raw event log set should be aggregated and compressed based on the range of the information entropy value or external triggers, and obtain the event log set to be processed; Based on the set of event logs to be processed, obtain the context vector of the current operation event, obtain the anomaly knowledge graph data corresponding to the current operation event from the preset detailed anomaly graph, obtain the corresponding external knowledge information, and extract the event quadruple; wherein, the anomaly knowledge graph data includes preset anomaly nodes and / or preset anomaly operations and / or preset anomaly relationships between nodes related to the current operation event; Input the context vector and the anomaly knowledge graph into the trained large language model, and output the event description text; concatenate the anomaly knowledge graph data, external knowledge information, and event quadruples as the processing data. Obtain the semantic association features between the processed data and the preset historical event sequence; based on the semantic association features of the current operation event, extract the historical processing cases with the highest similarity from the initial historical event database, and then determine the disposal suggestions corresponding to the historical processing cases as the disposal suggestions corresponding to the current operation event.

[0006] In one implementation of this application, calculating the information entropy value corresponding to the original event log set specifically includes: Identify the preset event types of each raw event log in the raw event log set; Through the formula: Calculate the information entropy value ; in, L This represents the original event log set; n represents the total number of preset event types; Indicates the i-th preset event type in L The probability of it appearing in; This represents the i-th preset event type log sequence in the original event log set.

[0007] In one implementation of this application, based on the range of information entropy values ​​or external triggers, it is determined whether the original event log set should undergo aggregation and compression processing to obtain a set of event logs to be processed, specifically including: When the information entropy value is less than the preset minimum threshold, the original event log set is aggregated and compressed to obtain the event log set to be processed; when the information entropy value is greater than or equal to the preset minimum threshold but less than the preset maximum threshold, the current processor's running capacity is obtained, and it is determined whether to perform aggregated compression based on the running capacity; when aggregated compression is not performed, or when the information entropy value is greater than or equal to the preset maximum threshold, the original event log set is determined to be the event log set to be processed.

[0008] In one implementation of this application, obtaining the context vector of the current operation event specifically includes: Obtain the preset event characteristics of the current operation event; Extract the log features and specific details of the features involved in the set of event logs to be processed; Through the formula: The context representation A is calculated. Where Q represents the preset event characteristic, V represents log characteristics, and V represents the specific content of the characteristics. This represents the vector dimension of K.

[0009] In one implementation of this application, obtaining the anomaly knowledge graph data corresponding to the current operation event from a preset detailed anomaly graph specifically includes: Extract entities, relationships between entities, and actual operations involved in the entities from the set of pending event logs; Obtain a preset detailed anomaly map consisting of preset anomaly nodes, preset anomaly operations, and preset anomaly relationships between nodes; Based on the entities involved in the event log set to be processed, the relationships between entities, and the actual operations involved in the entities, the preset abnormal nodes, preset abnormal operations, and preset abnormal relationships between nodes that match the current event log set to be processed are retrieved from the preset detailed anomaly graph. The preset abnormal nodes, preset abnormal operations, and preset abnormal relationships between nodes that match the current set of event logs to be processed will be used as the abnormal knowledge graph data corresponding to the current operation event.

[0010] In one implementation of this application, obtaining the corresponding external knowledge information and extracting the event quadruple specifically includes: Access a pre-defined external knowledge database; Extract the specific features of the log characteristics involved in the set of event logs to be processed; Calculate the cosine similarity between the specific content of the feature and the external knowledge information in the preset external knowledge database; External knowledge information with a cosine similarity greater than a preset threshold is used as the external knowledge information corresponding to the current set of event logs to be processed. Using keyword extraction technology, specific content related to the preset behavior subject, preset behavior action, preset target object, and preset context environment is extracted from the current set of pending event logs to form an event quadruple.

[0011] In one implementation of this application, before inputting the context vector and the anomaly knowledge graph into the trained large language model and outputting the event description text, the method further includes: By using context vectors, anomaly knowledge graphs, and pre-defined standard descriptive texts from historical time periods as training samples, a well-trained large language model can be obtained.

[0012] In one implementation of this application, obtaining the semantic association features between the processed data and the preset historical event sequence specifically includes: Through the context behavior association analysis module: Obtain semantic association features O ; in, Temporal graph convolutional network functions are used to process a preset historical event sequence. Capture the event association structure that has a time correlation; Multi-head self-attention mechanism computation function; This indicates a preset sequence of historical events; This indicates that data is being processed.

[0013] Secondly, this application provides a regulatory event analysis device based on a large language model, the device comprising: processor; And a memory containing executable code, which, when executed, causes the processor to perform a regulatory event analysis method based on a large language model, as described above.

[0014] Thirdly, this application provides a non-volatile computer storage medium storing computer instructions, which, when executed, implement a regulatory event analysis method based on a large language model as described above.

[0015] As can be seen from the above technical solutions, this application has the following advantages: Benefit 1: Accurately identify event details and enhance risk perception capabilities. By integrating multi-dimensional data and performing structured analysis, the ability to identify event details has been enhanced. Specifically, its beneficial effects are reflected in the following aspects: Dynamic aggregation and compression mechanism: By calculating the information entropy value of the original event log set, it can intelligently determine whether to perform aggregation and compression processing. This mechanism avoids interference from redundant information in massive log data, ensuring that the event log set to be processed focuses on key operational details, providing accurate input for subsequent analysis.

[0016] Multi-source knowledge fusion: It integrates context vectors, anomaly knowledge graph data, external knowledge information, and event quadruples. Among them, the anomaly knowledge graph pre-defines anomaly nodes, operations, and relationships. Combined with external knowledge supplementation, it can comprehensively capture potential anomaly patterns in operation events, making up for the omission of details in traditional overall recognition.

[0017] Structured Feature Extraction: The introduction of event quadruples transforms operational events into quantifiable semantic units, which are then concatenated with pre-defined graph data to form processed data. This process not only preserves the complete context of the event's occurrence but also enhances the model's sensitivity to subtle errors through structured features, thereby improving the comprehensiveness of risk identification.

[0018] Benefit 2: Intelligent generation of handling solutions, enhancing strategy adaptability: By using semantic association analysis and historical case matching, dynamic generation and optimization of treatment plans were achieved, with direct beneficial effects including: Semantic association feature extraction: This function calculates the semantic association features between the processed data and a preset historical event sequence, enabling it to capture the similarity between the current operation event and historical cases. It avoids the limitations of fixed handling mechanisms and allows for dynamic adjustment of analysis strategies based on event semantics.

[0019] Intelligent matching of historical cases: By extracting the most similar historical cases, the system can directly reuse their handling suggestions. This mechanism combines historical behavioral data to provide solutions based on practical experience for current operational events, improving the reliability and operability of the handling plan.

[0020] Dynamic strategy generation: The solution integrates external knowledge and historical handling suggestions to form a dynamic handling plan tailored to the current event's risk level. This semantically related generation method enables the system to flexibly adapt to complex compliance requirements, enhancing the intelligence of the handling process and its strategy adaptability. Attached Figure Description To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a regulatory event analysis method based on a large language model provided in an embodiment of this application.

[0022] Figure 2 This is a schematic diagram of the internal structure of a regulatory event analysis device based on a large language model, provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Those skilled in the art should understand that the embodiments described below are merely preferred embodiments of this disclosure and do not imply that this disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely used to explain the technical principles of this disclosure and are not intended to limit the scope of protection of this disclosure. Based on the preferred embodiments provided by this disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of this disclosure.

[0025] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0026] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0027] The embodiment provides a regulatory event analysis method based on a large language model, such as Figure 1 As shown in the embodiments of this application, the method mainly includes the following steps: Step 110: Configure data acquisition modules on various processing terminals involved in the current operation event; use the data acquisition modules to obtain raw acquisition log data.

[0028] In some embodiments, the original collection logs include: terminal device logs, network traffic data logs, server operation logs, and security device alarm information logs.

[0029] The various processing terminals involved in the current operation event have been preset, and those skilled in the art can configure the modules according to the actual preset content.

[0030] It should be noted that in step 110, the configuration of the data acquisition module needs to be adapted according to the type and function of the processing end. For example, for terminal devices, a lightweight log acquisition agent can be deployed to capture system events, application running status, and user operation records in real time; the network traffic processing end needs to integrate traffic mirroring or probe technology to collect protocol parsing, session connection, and traffic characteristic data; the server end can use a centralized log management tool to collect system resource indicators such as CPU, memory, and disk I / O; security devices need to connect to alarm interfaces to synchronize threat events from firewalls, intrusion detection devices, and other devices. All acquisition modules should follow the preset data format specifications and support timestamp synchronization to ensure the integrity and relevance of log data.

[0031] Step 120: Obtain the set of original event logs corresponding to the current operation event from several original collected log data; calculate the information entropy value corresponding to the set of original event logs; determine whether the set of original event logs should be aggregated and compressed based on the range of the information entropy value or external triggers, and obtain the set of event logs to be processed.

[0032] The calculation of the information entropy value corresponding to the original event log set specifically includes: Identify the preset event types of each raw event log in the raw event log set; Through the formula: Calculate the information entropy value ; in, L This represents the original event log set; n represents the total number of preset event types (e.g., categorized by event type: login success, login failure, file access, database query, alarm events, etc.). There are 5 types of log events; categorized by user behavior patterns: regular user login, administrator login, remote access, and batch file transfer, for example: (because it identified four user behavior patterns). Indicates the i-th preset event type in The probability of it appearing in; This represents the i-th preset event type log sequence in the original event log set.

[0033] Specifically, identifying the preset event types of each raw event log in the raw event log set can be: The preset event type of the current raw event log is determined through semantic recognition.

[0034] Specifically, based on the range of information entropy values ​​or external triggers, it is determined whether the original event log set should undergo aggregation and compression processing to obtain the event log set to be processed, which includes: When the information entropy value is less than the preset minimum threshold, the original event log set is aggregated and compressed to obtain the event log set to be processed; when the information entropy value is greater than or equal to the preset minimum threshold but less than the preset maximum threshold, the current processor's running capacity is obtained, and it is determined whether to perform aggregated compression based on the running capacity; when aggregated compression is not performed, or when the information entropy value is greater than or equal to the preset maximum threshold, the original event log set is determined to be the event log set to be processed.

[0035] It's important to note that most logs originate from a few categories, indicating high redundancy. These can be aggregated / compressed into summary records to reduce noise and storage overhead. High entropy (large H): Logs are diverse in type and evenly distributed, containing more varied information. Blind aggregation should be avoided, as they may contain valuable anomalies or emerging attack chains. Changes in entropy (ΔH): A sudden increase may represent new behavior, attack activity, or a change in system state; a sudden decrease (on a normal baseline) may indicate a large number of recurring similar events (such as flooding or tool-based scanning)—both warrant attention.

[0036] It should be noted that if the current processor's processing power is greater than the preset value, aggregation compression will not be performed; otherwise, aggregation compression will be performed.

[0037] The specific process of aggregation and compression can be as follows: using a semantic recognition algorithm, extracting summary records from the original event logs in the original event log set.

[0038] It should be further explained that in step 120, each log entry in the original event log set is first classified into event types using preset semantic recognition rules. These rules match keywords, syntactic structures, and contextual features in the log text. For example, logs containing "authentication failure" are classified as login failure events, and logs containing "database query" are classified as database query events. After classification, the frequency of each event type is counted, the probability of each event type appearing in the set is calculated, and the result is substituted into the information entropy formula to obtain a quantified information entropy value. This entropy value reflects the uniformity of event type distribution in the log set: a low entropy value indicates concentrated log types with many repetitive patterns; a high entropy value indicates dispersed log types with strong information diversity.

[0039] Based on the calculated information entropy value, the system employs a hierarchical decision-making mechanism to determine whether to perform aggregation and compression processing. When the information entropy value is below a preset minimum threshold (e.g., 0.5), the aggregation and compression process is automatically triggered, merging consecutive log records of the same type into a single summary record. When the entropy value is within a preset threshold range, the system monitors processor load metrics in real time, including CPU utilization, memory usage, and the number of current concurrent tasks. If any metric exceeds the set threshold, the aggregation operation is suspended. For cases where the entropy value exceeds the maximum threshold, the system preserves the complete form of the original log set to ensure that no potentially important anomaly information is lost.

[0040] During the aggregation and compression process, the system employs a template-based semantic extraction method to generate summary records. Specifically, a summary template is predefined for each event type; for example, the login failure event template may include fields such as "number of login failures from IP addresses within the time period." The system divides logs of the same type into time windows, extracts key parameters, and populates them into templates, forming compressed records that include a start timestamp, event type, frequency statistics, and a summary of key parameters. This process effectively reduces data storage and computational overhead for subsequent processing while preserving core semantic information.

[0041] Step 130: Based on the set of event logs to be processed, obtain the context vector of the current operation event, obtain the anomaly knowledge graph data corresponding to the current operation event from the preset detailed anomaly graph, obtain the corresponding external knowledge information, and extract the event quadruple.

[0042] It should be noted that the anomaly knowledge graph data includes preset anomaly nodes and / or preset anomaly operations and / or preset anomaly relationships between nodes related to the current operation event.

[0043] Specifically, obtaining the context vector of the current operation event includes: Obtain the preset event characteristics of the current operation event; Extract the log features and specific details of the features involved in the set of event logs to be processed; Through the formula: The context representation A is calculated. Where Q represents the preset event characteristic, V represents log characteristics, and V represents the specific content of the characteristics. This represents the vector dimension of K.

[0044] Specifically, the process of obtaining the anomaly knowledge graph data corresponding to the current operation event from the preset detailed anomaly graph includes: Extract entities, relationships between entities, and actual operations involved in the entities from the set of pending event logs; Obtain a preset detailed anomaly map consisting of preset anomaly nodes, preset anomaly operations, and preset anomaly relationships between nodes; Based on the entities involved in the event log set to be processed, the relationships between entities, and the actual operations involved in the entities, the preset abnormal nodes, preset abnormal operations, and preset abnormal relationships between nodes that match the current event log set to be processed are retrieved from the preset detailed anomaly graph. The preset abnormal nodes, preset abnormal operations, and preset abnormal relationships between nodes that match the current set of event logs to be processed will be used as the abnormal knowledge graph data corresponding to the current operation event.

[0045] This includes acquiring relevant external knowledge information and extracting event quadruples, specifically: Access a pre-defined external knowledge database; Extract the specific features of the log characteristics involved in the set of event logs to be processed; Calculate the cosine similarity between the specific content of the feature and the external knowledge information in the preset external knowledge database; External knowledge information with a cosine similarity greater than a preset threshold is used as the external knowledge information corresponding to the current set of event logs to be processed. Using keyword extraction technology, specific content related to the preset behavior subject, preset behavior action, preset target object, and preset context environment is extracted from the current set of pending event logs to form an event quadruple.

[0046] It should be noted that in step 130, the set of event logs to be processed first needs to undergo feature extraction and vectorization. Specifically, the system identifies key event features in the logs, including but not limited to the event occurrence time, the type of operation involved, related entities and their attributes, etc. After these features are encoded into structured data, they are converted into numerical context vectors through a preset vectorization model (such as word embedding or graph neural network). This vector can comprehensively reflect the contextual information of the current operation event in multiple dimensions such as time series, entity association, and operation semantics, providing a basic feature representation for subsequent anomaly detection.

[0047] While acquiring the context vector, the system retrieves anomalous knowledge related to the current operation event from a pre-defined detailed anomaly graph. This graph pre-constructs a knowledge network containing anomalous nodes (such as suspicious IP addresses and anomalous process names), anomalous operations (such as logins at unusual times and privilege escalation behaviors), and anomalous relationships between nodes (such as high-frequency connections and cross-domain access). The system uses entity linking technology to match entities in the logs to be processed with nodes in the graph and identifies related anomalous operations and relationships based on semantic similarity of operations. The matching process employs a combination of rule-based and statistical methods to ensure the accuracy and coverage of the retrieval results.

[0048] The acquisition of external knowledge focuses on supplementing the background information of the current operation. The system connects to pre-set external knowledge databases (such as threat intelligence databases, vulnerability databases, and industry security baselines), and filters out highly relevant supplementary information by calculating the semantic similarity between the features of the log to be processed and external knowledge entries. For example, if specific vulnerability exploitation features appear in the log, the system will associate them with knowledge such as the vulnerability's CVE number, scope of impact, and remediation suggestions. This process uses a similarity calculation method based on a pre-trained language model, quantifies the degree of matching through indicators such as cosine similarity, and sets dynamic thresholds to filter out low-relevance information.

[0049] Finally, the system extracts event quadruples from the logs to be processed using natural language processing technology. These quadruples consist of the subject of the action (e.g., user account, service process), the action (e.g., login, query), the target object (e.g., database table, file path), and the context (e.g., time, geographical location). The quadruple extraction employs a hybrid approach based on dependency parsing and named entity recognition, combined with a domain dictionary to improve recognition accuracy. The extraction results, along with the aforementioned context vectors, anomaly knowledge graph data, and external knowledge information, constitute a complete knowledge representation of the current operation event, providing structured input for subsequent anomaly detection and response decisions.

[0050] Step 140: Input the context vector and the anomaly knowledge graph into the trained large language model, and output the event description text; concatenate the anomaly knowledge graph data, external knowledge information, and event quadruples as processing data.

[0051] In some embodiments, before inputting the context vector and the anomaly knowledge graph into the trained large language model and outputting the event description text, the method further includes: By using context vectors, anomaly knowledge graphs, and pre-defined standard descriptive texts from historical time periods as training samples, a well-trained large language model can be obtained.

[0052] It should be noted that before inputting the context vectors and anomaly knowledge graph into the trained large language model in step 140, a training sample set needs to be constructed first. Specifically, context vectors generated within a historical time period, corresponding anomaly knowledge graph data, and standard descriptive text annotated by security experts need to be collected as training samples. Using this sample set, supervised learning methods are employed to fine-tune the large language model, enabling it to learn the ability to generate accurate and coherent event descriptions from multi-source heterogeneous data. Existing loss functions and optimizers are set during training, and cross-validation is used to ensure the model's generalization performance.

[0053] Step 150: Obtain the semantic association features between the processed data and the preset historical event sequence; based on the semantic association features of the current operation event, extract the historical processing cases with the highest similarity from the initial database of historical events, and then determine the disposal suggestions corresponding to the historical processing cases as the disposal suggestions corresponding to the current operation event.

[0054] Specifically, obtaining semantic association features between the processed data and the preset historical event sequence includes: Through the context behavior association analysis module: Obtain semantic association features O ; in, Temporal graph convolutional network functions are used to process a preset historical event sequence. Capture the event association structure that has a time correlation; Multi-head self-attention mechanism computation function; This indicates a preset sequence of historical events; This indicates that data is being processed.

[0055] It should be further explained that in step 150, the semantic association features are acquired through the contextual behavior association analysis module. This module first uses a temporal graph convolutional network to analyze a preset historical event sequence, extracting the topological association structure between events based on the time dimension, and identifying behavioral patterns with temporal dependencies. Subsequently, a multi-head self-attention mechanism is used to interactively compute the processed data and the historical sequence processed by graph convolution, capturing deep semantic associations across sequences, and finally outputting a semantic association feature vector representing the strength of the association between the current operation event and the historical event sequence.

[0056] Based on the calculated semantic association features, the system retrieves similar cases from the initial historical event database. The retrieval process employs a feature vector-based nearest neighbor search algorithm, calculating the cosine similarity between the current event features and the features of historical cases, and selecting the historical case with the highest similarity as the matching result. Finally, the system outputs the verified handling suggestions recorded in these historical cases as the recommended handling plan for the current event.

[0057] As described above, this embodiment enhances the ability to identify event details through multi-dimensional data integration and structured analysis. Specifically, its beneficial effects are reflected in the following aspects: By calculating the information entropy value of the original event log set, the system can intelligently determine whether to perform aggregation and compression processing. This mechanism avoids interference from redundant information in massive log data, ensuring that the event log set to be processed focuses on key operational details, providing accurate input for subsequent analysis. It integrates context vectors, anomaly knowledge graph data, external knowledge information, and event quadruples. The anomaly knowledge graph pre-defines anomaly nodes, operations, and relationships; combined with external knowledge supplementation, it can comprehensively capture potential anomaly patterns in operational events, compensating for the omission of detailed errors in traditional overall identification. The introduction of event quadruples transforms operational events into quantifiable semantic units, which are then concatenated with the pre-definement graph data to form processed data. This process not only preserves the complete context of the event's occurrence but also enhances the model's sensitivity to detailed errors through structured features, thereby improving the comprehensiveness of risk identification.

[0058] By combining semantic association analysis with historical case matching, the system achieves dynamic generation and optimization of handling plans. Its direct benefits include: calculating the semantic association features between processed data and preset historical event sequences allows for the capture of similarities between current operational events and historical cases. This avoids the limitations of fixed handling mechanisms, enabling dynamic adjustment of analysis strategies based on event semantics. By extracting the most similar historical cases, the system can directly reuse their handling suggestions. This mechanism, combined with historical behavioral data, provides solutions based on practical experience for current operational events, improving the reliability and operability of the handling plans. The plan integrates external knowledge information with historical handling suggestions to form a dynamic handling plan tailored to the risk level of the current event. This semantic association-based generation method allows the system to flexibly adapt to complex compliance requirements, enhancing the intelligence and strategy adaptability of the handling process.

[0059] The above are method embodiments of this application. Based on the same inventive concept, this application also provides a regulatory event analysis device based on a large language model. Figure 2 As shown, the device includes: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform a regulatory event analysis method based on a large language model as described in the above embodiments.

[0060] Specifically, the server configures data acquisition modules on various processing ends involved in the current operation event; uses the data acquisition modules to acquire raw acquisition log data; acquires a set of raw event logs corresponding to the current operation event from several sets of raw acquisition log data; calculates the information entropy value corresponding to the raw event log set; determines whether the raw event log set should be aggregated and compressed based on the range of the information entropy value or external triggers, to obtain a set of event logs to be processed; based on the set of event logs to be processed, acquires the context vector of the current operation event, acquires the anomaly knowledge graph data corresponding to the current operation event from the preset detailed anomaly graph, and acquires the corresponding external knowledge information. Extract event quadruples; whereby, the anomaly knowledge graph data contains preset anomaly nodes and / or preset anomaly operations and / or preset anomaly relationships between nodes related to the current operation event; input the context vector and the anomaly knowledge graph into a trained large language model, and output event description text; concatenate the anomaly knowledge graph data, external knowledge information, and event quadruples as processing data; obtain the semantic association features between the processing data and the preset historical event sequence; based on the semantic association features of the current operation event, extract the historical processing cases with the highest similarity from the initial historical event database, and then determine the disposal suggestions corresponding to the historical processing cases as the disposal suggestions corresponding to the current operation event.

[0061] As described above, this embodiment enhances the ability to identify event details through multi-dimensional data integration and structured analysis. Specifically, its beneficial effects are reflected in the following aspects: By calculating the information entropy value of the original event log set, the system can intelligently determine whether to perform aggregation and compression processing. This mechanism avoids interference from redundant information in massive log data, ensuring that the event log set to be processed focuses on key operational details, providing accurate input for subsequent analysis. It integrates context vectors, anomaly knowledge graph data, external knowledge information, and event quadruples. The anomaly knowledge graph pre-defines anomaly nodes, operations, and relationships; combined with external knowledge supplementation, it can comprehensively capture potential anomaly patterns in operational events, compensating for the omission of detailed errors in traditional overall identification. The introduction of event quadruples transforms operational events into quantifiable semantic units, which are then concatenated with the pre-definement graph data to form processed data. This process not only preserves the complete context of the event's occurrence but also enhances the model's sensitivity to detailed errors through structured features, thereby improving the comprehensiveness of risk identification.

[0062] By combining semantic association analysis with historical case matching, the system achieves dynamic generation and optimization of handling plans. Its direct benefits include: calculating the semantic association features between processed data and preset historical event sequences allows for the capture of similarities between current operational events and historical cases. This avoids the limitations of fixed handling mechanisms, enabling dynamic adjustment of analysis strategies based on event semantics. By extracting the most similar historical cases, the system can directly reuse their handling suggestions. This mechanism, combined with historical behavioral data, provides solutions based on practical experience for current operational events, improving the reliability and operability of the handling plans. The plan integrates external knowledge information with historical handling suggestions to form a dynamic handling plan tailored to the risk level of the current event. This semantic association-based generation method allows the system to flexibly adapt to complex compliance requirements, enhancing the intelligence and strategy adaptability of the handling process.

[0063] In addition, embodiments of this application also provide a non-volatile computer storage medium storing executable instructions, which, when executed, implement the above-described regulatory event analysis method based on a large language model.

[0064] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A regulatory event analysis method based on a large language model, characterized in that, The method includes: Configure data acquisition modules on various processing terminals involved in the current operation event; use the data acquisition modules to obtain raw acquisition log data; Obtain the set of raw event logs corresponding to the current operation event from several raw collected log data; calculate the information entropy value corresponding to the raw event log set; determine whether the raw event log set should be aggregated and compressed based on the range of the information entropy value or external triggers, and obtain the event log set to be processed; Based on the set of event logs to be processed, obtain the context vector of the current operation event, obtain the anomaly knowledge graph data corresponding to the current operation event from the preset detailed anomaly graph, obtain the corresponding external knowledge information, and extract the event quadruple; wherein, the anomaly knowledge graph data includes preset anomaly nodes and / or preset anomaly operations and / or preset anomaly relationships between nodes related to the current operation event; Input the context vector and the anomaly knowledge graph into the trained large language model, and output the event description text; concatenate the anomaly knowledge graph data, external knowledge information, and event quadruples as the processing data. Obtain the semantic association features between the processed data and the preset historical event sequence; based on the semantic association features of the current operation event, extract the historical processing cases with the highest similarity from the initial historical event database, and then determine the disposal suggestions corresponding to the historical processing cases as the disposal suggestions corresponding to the current operation event.

2. The regulatory event analysis method based on a large language model according to claim 1, characterized in that, Calculating the information entropy value corresponding to the original event log set specifically includes: Identify the preset event types of each raw event log in the raw event log set; Through the formula: Calculate the information entropy value ; in, L This represents the original event log set; n represents the total number of preset event types; Indicates the i-th preset event type in L The probability of it appearing in; This represents the i-th preset event type log sequence in the original event log set.

3. The regulatory event analysis method based on a large language model according to claim 1, characterized in that, Based on the range of information entropy values ​​or external triggers, determine whether the original event log set needs to be aggregated and compressed to obtain the event log set to be processed, specifically including: When the information entropy value is less than the preset minimum threshold, the original event log set is aggregated and compressed to obtain the event log set to be processed; when the information entropy value is greater than or equal to the preset minimum threshold but less than the preset maximum threshold, the current processor's running capacity is obtained, and it is determined whether to perform aggregated compression based on the running capacity; when aggregated compression is not performed, or when the information entropy value is greater than or equal to the preset maximum threshold, the original event log set is determined to be the event log set to be processed.

4. The regulatory event analysis method based on a large language model according to claim 1, characterized in that, Obtain the context vector of the current operation event, specifically including: Obtain the preset event characteristics of the current operation event; Extract the log features and specific details of the features involved in the set of event logs to be processed; Through the formula: The context representation A is calculated. Where Q represents the preset event characteristic, V represents log characteristics, and V represents the specific content of the characteristics. This represents the vector dimension of K.

5. The regulatory event analysis method based on a large language model according to claim 1, characterized in that, Obtain the anomaly knowledge graph data corresponding to the current operation event from the preset detailed anomaly graph, specifically including: Extract entities, relationships between entities, and actual operations involved in the entities from the set of pending event logs; Obtain a preset detailed anomaly map consisting of preset anomaly nodes, preset anomaly operations, and preset anomaly relationships between nodes; Based on the entities involved in the event log set to be processed, the relationships between entities, and the actual operations involved in the entities, the preset abnormal nodes, preset abnormal operations, and preset abnormal relationships between nodes that match the current event log set to be processed are retrieved from the preset detailed anomaly graph. The preset abnormal nodes, preset abnormal operations, and preset abnormal relationships between nodes that match the current set of event logs to be processed will be used as the abnormal knowledge graph data corresponding to the current operation event.

6. The regulatory event analysis method based on a large language model according to claim 1, characterized in that, Obtaining relevant external knowledge information and extracting event quadruples, specifically including: Access a pre-defined external knowledge database; Extract the specific features of the log characteristics involved in the set of event logs to be processed; Calculate the cosine similarity between the specific content of the feature and the external knowledge information in the preset external knowledge database; External knowledge information with a cosine similarity greater than a preset threshold is used as the external knowledge information corresponding to the current set of event logs to be processed. Using keyword extraction technology, specific content related to the preset behavior subject, preset behavior action, preset target object, and preset context environment is extracted from the current set of pending event logs to form an event quadruple.

7. The regulatory event analysis method based on a large language model according to claim 1, characterized in that, Before inputting the context vectors and anomaly knowledge graph into the trained large language model and outputting event description text, the method further includes: By using context vectors, anomaly knowledge graphs, and pre-defined standard descriptive texts from historical time periods as training samples, a well-trained large language model can be obtained.

8. The regulatory event analysis method based on a large language model according to claim 1, characterized in that, Obtain semantic association features between the processed data and a preset historical event sequence, specifically including: Through the context behavior association analysis module: Obtain semantic association features O ; in, This represents a time-series graph convolutional network function used to process a preset historical event sequence. Capture the event association structure that has a time correlation; This represents the computation function for the multi-head self-attention mechanism; This indicates a preset sequence of historical events; This indicates that data is being processed.

9. A regulatory event analysis device based on a large language model, characterized in that, The device includes: processor; And a memory having executable code stored thereon, which, when executed, causes the processor to perform a regulatory event analysis method based on a large language model as described in any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that, It stores computer instructions, which, when executed, implement a regulatory event analysis method based on a large language model as described in any one of claims 1-8.

Images