Network security event processing method and apparatus, electronic device, medium, and product

Abstract

This application provides a method, apparatus, electronic device, medium, and product for handling network security incidents, including: acquiring original security incident logs; completing information in the original security incident logs using a context-enhanced matching mechanism to generate a structured event representation; dividing the structured event representation according to event characteristics using a multi-path Bayesian diversion method to obtain diverted events; inputting the diverted events into a large language model to generate association inference results; generating a network security incident response strategy based on the association inference results; and executing the network security incident response strategy to achieve network security incident handling, thereby reducing the false alarm rate and response latency of network security incidents.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network security incident handling method, apparatus, electronic device, medium and product. Background Technology

[0002] Against the backdrop of accelerated digital transformation in enterprises, cybersecurity threats are characterized by high dynamism, concealment, and multi-source nature, making it difficult for traditional security incident response mechanisms to meet the needs of complex threat scenarios.

[0003] Existing technologies primarily employ static response mechanisms based on rule engines, with the main process including: alarm triggering, rule matching, manual judgment, and manual handling. These methods rely on a pre-defined, fixed rule base and execute predefined actions through a linear process.

[0004] However, existing semantic understanding methods are limited to surface keyword matching and rely on manually preset response strategies, which cannot adapt to the needs of complex and ever-changing security threat scenarios, leading to increased false alarm rates and response delays in cybersecurity incidents. Summary of the Invention

[0005] This application provides a network security incident handling method, apparatus, electronic device, medium, and product to address the problems of increased false alarm rate and response delay in network security incidents in the prior art.

[0006] In a first aspect, embodiments of this application provide a network security incident handling method, including:

[0007] Obtain the raw security event log;

[0008] The original security event logs are supplemented with information using a context-enhanced matching mechanism to generate structured event representations;

[0009] The structured event representation is divided according to event characteristics using a multi-path Bayesian splitting method to obtain the split events;

[0010] The split events are input into a large language model to generate association reasoning results;

[0011] Based on the results of the correlation reasoning, a response strategy for network security incidents is generated;

[0012] The response strategy for the aforementioned network security incident is executed to handle the network security incident.

[0013] In one possible implementation, the step of inputting the split events into a large language model to generate association reasoning results includes: extracting elements from the split events using the large language model, performing semantic parsing on the extracted elements to generate semantic parsing results; mapping the entities in the semantic parsing results to a knowledge graph to generate mapping results; and performing association queries based on the mapping results using a graph neural network to generate association reasoning results.

[0014] In one possible implementation, the step of completing the information in the original security event log using a context-enhanced matching mechanism to generate a structured event representation includes: obtaining the joint distribution of multiple fields in the original security event log; determining the missing field based on the joint distribution of the multiple fields; generating context information of the missing field based on the missing field using a Hidden Markov Model; and completing the information in the original security event log based on the context information of the missing field to generate a structured event representation.

[0015] In one possible implementation, after generating the response strategy for the cybersecurity incident based on the correlation reasoning result, the method further includes: calculating a multi-dimensional score for the response strategy of the cybersecurity incident using a target optimization function; determining the weights to be adjusted for the target optimization function based on the multi-dimensional score and the business scenario of the cybersecurity incident; and adjusting the target optimization function based on the weights to be adjusted to obtain the adjusted target optimization function.

[0016] In one possible implementation, the objective optimization function is:

[0017]

[0018] In the formula, Represent the objective optimization function; This indicates the preset weighting coefficients; This represents the standardized score function for the k-th dimension; k represents the number of dimensions.

[0019] In one possible implementation, after executing the response strategy for the network security incident to handle the network security incident, the method further includes: obtaining the execution result of the response strategy for the network security incident; determining the weights to be adjusted and the prompt words to be adjusted in the knowledge graph based on the execution result; updating the prompt word templates of the knowledge graph and the large language model based on the weights to be adjusted and the prompt words to be adjusted in the knowledge graph, and generating an update result.

[0020] Secondly, embodiments of this application provide a network security incident handling apparatus, comprising:

[0021] The first acquisition module is used to acquire raw security event logs;

[0022] The information completion module is used to complete the information in the original security event log through a context-enhanced matching mechanism and generate a structured event representation;

[0023] The traffic splitting module is used to split the structured event representation according to event characteristics using a multi-path Bayesian traffic splitting method to obtain the split events.

[0024] The first generation module is used to input the split events into the large language model and generate the association reasoning results.

[0025] The second generation module is used to generate response strategies for network security incidents based on the correlation reasoning results;

[0026] The execution module is used to execute the response strategy for the network security incident in order to handle the network security incident.

[0027] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0028] The memory stores computer-executed instructions;

[0029] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0030] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0031] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0032] The network security incident handling method, apparatus, electronic device, medium, and product provided in this application complete the original log information through context-enhanced matching, and after multi-path Bayesian traffic splitting, use a large language model for deep correlation reasoning to automatically generate and execute response strategies. This achieves end-to-end, full-link intelligent processing from the original alarm to the handling action, effectively solving the core pain points of traditional security operations such as information loss, isolated analysis, and delayed response. By introducing the semantic understanding and reasoning capabilities of a large language model, it significantly improves the depth of correlation analysis of complex attack chains, the accuracy of threat judgment, and the level of intelligence in response strategy generation, reducing the false alarm rate and response delay of network security incidents. Attached Figure Description

[0033] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0034] Figure 1 This is a schematic diagram of the system structure of a computer device provided in an embodiment of this application;

[0035] Figure 2 Flowchart of the network security incident handling method provided in this application Figure 1 ;

[0036] Figure 3 Flowchart of the network security incident handling method provided in this application Figure 2 ;

[0037] Figure 4 Flowchart of the network security incident handling method provided in this application Figure 3 ;

[0038] Figure 5 A schematic diagram of the network security incident handling device provided in this application;

[0039] Figure 6 A schematic diagram of the structure of the electronic device provided in this application.

[0040] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0041] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0042] Against the backdrop of accelerated enterprise digital transformation, cybersecurity threats are exhibiting characteristics of high dynamism, concealment, and multi-source origins, making traditional security incident response mechanisms insufficient to meet the needs of complex threat scenarios. Existing technologies primarily employ static response mechanisms based on rule engines, with the main processes including: alarm triggering, rule matching, manual judgment, and manual handling. These methods rely on a pre-set, fixed rule base, executing predefined actions through a linear process. However, the semantic understanding of existing technologies is limited to surface-level keyword matching, and they depend on manually preset response strategies, failing to adapt to the complex and ever-changing security threat scenarios, leading to increased false alarm rates and response delays in cybersecurity incidents.

[0043] To address the aforementioned technical problems, this application proposes the following technical concept: The inventors, considering the integration of context-enhanced matching and large language model semantic parsing technologies, construct an end-to-end network security incident response system that automatically generates response strategies, thus solving core pain points in traditional security operations such as information gaps, isolated analysis, and delayed responses.

[0044] Figure 1 This is a schematic diagram of the system architecture of the computer device provided in an embodiment of this application. Figure 1 As shown, the computer device includes: a receiving device 101, a processing device 102, and a display device 103.

[0045] It is understood that the structure illustrated in the embodiments of this application does not constitute a specific limitation on the network security incident handling method. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0046] In the specific implementation process, the receiving device 101 can be an input / output interface or a communication interface, and can obtain the original security event log.

[0047] The processing device 102 can generate response strategies for network security incidents.

[0048] The display device 103 can be used to display response strategies for the aforementioned network security incidents.

[0049] The display device can also be a touch screen, used to receive user commands while displaying the above content, so as to realize the operation interaction with the user.

[0050] It should be understood that the above-mentioned processing device can be implemented by a processor reading instructions from memory and executing those instructions, or it can be implemented by a chip circuit.

[0051] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0052] Figure 2 Flowchart of the network security incident handling method provided in this application Figure 1 ,like Figure 2 As shown, the method includes:

[0053] S201: Obtain the raw security event log.

[0054] Specifically, security probes deployed on terminal devices are used to collect logs from network security devices in real time.

[0055] In this embodiment, the contents recorded in the original security event log include, but are not limited to, connection blocking logs, alarm logs, and abnormal behavior logs.

[0056] S202: The original security event log is supplemented with information through a context-enhanced matching mechanism to generate a structured event representation.

[0057] Specifically, the joint distribution of multiple fields in the log is obtained, the missing fields are identified, and context information is generated through a hidden Markov model to complete the information in the original security event log, generating a structured event representation.

[0058] S203: The structured event representation is split according to the event characteristics using the multi-path Bayesian splitting method to obtain the split events.

[0059] Specifically, multiple parallel routing paths are designed, with each path corresponding to the initial event processing logic.

[0060] In this embodiment, each path is a Bayesian classifier whose input is a feature vector extracted from the structured event representation. The classifier calculates the posterior probability that the event belongs to the category of this path based on the prior probability and likelihood function trained on historical data.

[0061] Specifically, events are assigned to the path with the highest posterior probability, and are initially labeled and prioritized according to path rules to form the split events.

[0062] S204: Input the split events into the large language model to generate the association reasoning results.

[0063] Specifically, the system extracts elements from the split events using a large language model, performs semantic parsing on the extracted elements, maps the entities in the semantic parsing results to a knowledge graph, and uses a graph neural network to perform related queries based on the mapping results to generate related reasoning results.

[0064] S205: Generate response strategies for cybersecurity incidents based on the results of correlation reasoning.

[0065] Specifically, based on the current network environment configuration, asset importance tags, and a pre-defined response action library, rule matching is performed to generate response strategies.

[0066] S206: Implement response strategies for cybersecurity incidents to handle them.

[0067] Specifically, the instructions in the strategy are parsed into executable operations and sent to security devices through a secure channel.

[0068] As can be seen from the above embodiments, by supplementing the original log information through context-enhanced matching, and after multi-path Bayesian routing, deep association reasoning is performed using a large language model to automatically generate and execute response strategies. This achieves end-to-end, full-link intelligent processing from the original alarm to the handling action, effectively solving the core pain points in traditional security operations such as information loss, isolated analysis, and delayed response. By introducing the semantic understanding and reasoning capabilities of the large language model, the depth of association analysis of complex attack chains, the accuracy of threat judgment, and the level of intelligence in response strategy generation are significantly improved, reducing the false alarm rate and response delay of network security incidents.

[0069] In one embodiment of this application, step S204 includes:

[0070] S2041: Extract elements from the split events using a large language model, perform semantic parsing on the extracted elements, and generate semantic parsing results.

[0071] Specifically, the split events are converted into natural language descriptions and used as prompt words to input into the large language model. The large language model extracts key elements, performs semantic analysis on the relationships and meanings between elements, and generates semantic analysis results.

[0072] In this embodiment, the types of elements include, but are not limited to, attacker entities, attack methods, and attack targets.

[0073] S2042: Map the entities in the semantic parsing results to the knowledge graph to generate the mapping results.

[0074] Specifically, the entities in the semantic parsing results are matched with the nodes in the knowledge graph to determine the position of the event elements in the graph and their associated context, thus obtaining the mapping results.

[0075] S2043: Generate association inference results by performing association queries based on the mapping results through a graph neural network.

[0076] Specifically, using the nodes determined in the mapping results as starting points, graph neural networks are used to perform multi-hop traversal and feature aggregation on the knowledge graph to generate related reasoning results.

[0077] As can be seen from the above embodiments, by extracting elements and performing semantic parsing, entities are mapped to knowledge graphs, and graph neural networks are used for association queries. A three-layer intelligent analysis architecture of "semantic understanding - knowledge association - graph reasoning" is constructed. The knowledge graph introduces structured domain prior knowledge, and the graph neural network is used to mine deep-level entity relationships, so that the final generated association reasoning results have both semantic accuracy and logical rigor.

[0078] In one embodiment of this application, step S202 includes:

[0079] S2021: Obtain the joint distribution of multiple fields in the raw security event log.

[0080] Specifically, offline analysis is performed on the raw security event logs accumulated over historical periods. For common field combinations in the logs, the probability distribution of their common occurrence in all logs is statistically analyzed, and a joint distribution probability table or probability graphical model describing the relationship between the fields is constructed.

[0081] S2022: Determine the missing field based on the joint distribution of multiple fields.

[0082] Specifically, the integrity of fields is checked by predicting missing fields given existing field values ​​in a log file, based on a joint distribution model established through querying.

[0083] S2023: Generate contextual information for missing fields based on missing fields using a Hidden Markov Model.

[0084] Specifically, a Hidden Markov Model is used to take the log sequence within the time window as the observation sequence. When a missing field is detected in the log, the known fields of the log and the adjacent logs before and after are taken as the context and input into the Hidden Markov Model. The Hidden Markov Model infers the hidden state of the missing field based on the learned log state transition rules and observation probabilities, and generates the value range of the missing field as context information.

[0085] S2024: Complete the original security event log based on the context information of the missing fields to generate a structured event representation.

[0086] Specifically, the inferred context information is associated with the original log entries, all log fields are normalized, and the completed logs are converted and encapsulated into a structured event representation in a unified format.

[0087] In this embodiment, the content recorded in the structured event representation includes, but is not limited to, event time, subject, object, action, and result.

[0088] As can be seen from the above embodiments, by analyzing the joint distribution of fields to identify missing items and using a hidden Markov model to generate contextual information for completion, it is possible to intelligently infer and fill in missing key fields based on the inherent statistical regularity of logs. This provides high-quality, structured input data for subsequent diversion, analysis and reasoning steps, avoids analysis interruption or conclusion bias caused by missing data, and improves the robustness and reliability of the processing flow.

[0089] Figure 3 Flowchart of the network security incident handling method provided in this application Figure 2 ,like Figure 3 As shown, after step S205, the following steps are also included:

[0090] S301: Calculate a multi-dimensional score for response strategies to cybersecurity incidents using an objective optimization function.

[0091] In this embodiment, the objective optimization function is used to quantitatively evaluate the quality of the response strategy.

[0092] The dimensions for evaluating the objective optimization function include, but are not limited to, effectiveness, timeliness, resource consumption, and compliance.

[0093] S302: Determine the weights to be adjusted in the objective optimization function based on multi-dimensional scoring and the business scenarios of cybersecurity incidents.

[0094] Specifically, based on the current business scenarios of cybersecurity incidents, we analyze the performance of multi-dimensional scores on each score item, determine the rationality of each weight in the objective function, and identify the weights to be adjusted.

[0095] S303: Adjust the objective optimization function according to the weights to be adjusted in the objective optimization function to obtain the adjusted objective optimization function.

[0096] Specifically, the weight coefficients of the corresponding dimensions in the objective optimization function are modified to obtain the adjusted objective optimization function.

[0097] As can be seen from the above embodiments, by calculating the multi-dimensional scores of the strategy and adjusting the weights of the objective optimization function, the quantitative evaluation and continuous optimization of the response strategy are realized, enabling the strategy generation model to adapt to the differentiated security needs of different business scenarios, thereby producing a more practical and comprehensive response solution, and improving the level of refined management of security operations.

[0098] In one embodiment of this application, the objective optimization function is:

[0099]

[0100] In the formula, Represent the objective optimization function; This indicates the preset weighting coefficients; This represents the standardized score function for the k-th dimension; k represents the number of dimensions.

[0101] In this embodiment, the dimensions in the objective optimization function include, but are not limited to, risk level, asset value, response failure, resource consumption, and business continuity.

[0102] Figure 4 Flowchart of the network security incident handling method provided in this application Figure 3 ,like Figure 4 As shown, after step S206, the following steps are also included:

[0103] S207: Obtain the execution results of the response strategy for network security incidents.

[0104] Specifically, execution results are collected from various execution points through an API polling mechanism.

[0105] In this embodiment, the content recorded in the execution result includes, but is not limited to, the execution timestamp, the changes in indicators before and after the strategy execution, and the execution status.

[0106] S208: Determine the weights and prompts to be adjusted for the knowledge graph based on the execution results.

[0107] For example, if the reason for the failure of the strategy execution in the execution result is that there is an error in the entity relationship in the knowledge graph, the confidence weight of the entity relationship is marked as a weight to be adjusted.

[0108] S209: Update the prompt word templates of the knowledge graph and the large language model based on the weights to be adjusted and the prompt words to be adjusted, and generate the update results.

[0109] For example, for knowledge graphs, Gnu executes the results to reduce the weight of erroneous relations; for large language models, it modifies instructions that cause ambiguity and adds constraints to generate updated results.

[0110] In this embodiment, the update results record the version changes of the knowledge graph and the revision history of the prompt word template.

[0111] As can be seen from the above embodiments, by adjusting the weights of the knowledge graph and the prompt word templates of the large language model in reverse according to the execution results, the system is endowed with the ability to continuously learn and self-evolve. This ensures that the associations of the knowledge graph and the reasoning logic of the large language model can continuously evolve with the emergence of new attacks and the accumulation of handling experience, thereby improving the accuracy and adaptability of the event handling model and realizing the dynamic growth of security defense capabilities.

[0112] Figure 5 A schematic diagram of the network security incident handling device provided in this application is shown below. Figure 5 As shown, the network security incident processing device 50 provided in this embodiment includes: a first acquisition module 501, an information completion module 502, a diversion module 503, a first generation module 504, a second generation module 505, and an execution module 506.

[0113] The first acquisition module 501 is used to acquire the original security event log.

[0114] The information completion module 502 is used to complete the information in the original security event log through a context-enhanced matching mechanism and generate a structured event representation.

[0115] The splitting module 503 is used to split the structured event representation according to the event characteristics using the multi-path Bayesian splitting method to obtain the split events.

[0116] The first generation module 504 is used to input the split events into the large language model and generate the association reasoning results.

[0117] The second generation module 505 is used to generate response strategies for network security incidents based on the results of correlation reasoning.

[0118] Execution module 506 is used to execute response strategies for network security incidents in order to handle network security incidents.

[0119] In one possible implementation, the first generation module 504 includes:

[0120] The extraction unit is used to extract elements from the split events using a large language model, perform semantic parsing on the extracted elements, and generate semantic parsing results.

[0121] The mapping unit is used to map entities in the semantic parsing results to the knowledge graph, generating the mapping results.

[0122] The query unit is used to perform related queries based on the mapping results through a graph neural network and generate related reasoning results.

[0123] In one possible implementation, the information completion module 502 includes:

[0124] The acquisition unit is used to obtain the joint distribution of multiple fields in the original security event log.

[0125] The determination unit is used to identify the missing field based on the joint distribution of multiple fields.

[0126] The generation unit is used to generate context information for the missing fields based on the missing fields using a hidden Markov model.

[0127] The completion unit is used to complete the information in the original security event log based on the context information of the missing fields, and generate a structured event representation.

[0128] In one possible implementation, the network security incident handling device 50 further includes:

[0129] The calculation module is used to calculate a multi-dimensional score of the response strategy for cybersecurity incidents through an objective optimization function.

[0130] The first determination module is used to determine the weights to be adjusted in the target optimization function based on multi-dimensional scoring and business scenarios of cybersecurity incidents.

[0131] The adjustment module is used to adjust the objective optimization function according to the weights to be adjusted, so as to obtain the adjusted objective optimization function.

[0132] In one possible implementation, the network security incident handling device 50 further includes:

[0133] The second acquisition module is used to acquire the execution results of response strategies for network security incidents.

[0134] The second determination module is used to determine the weights to be adjusted and the prompt words to be adjusted in the knowledge graph based on the execution results.

[0135] The update module is used to update the prompt word templates of the knowledge graph and the large language model based on the weights to be adjusted and the prompt words to be adjusted, and generate the update results.

[0136] The network security incident handling device provided in this embodiment can execute the methods provided in the above method embodiments. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0137] Figure 6 A schematic diagram of the structure of the electronic device provided in this application. Figure 6As shown, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the electronic device 60 further includes a communication component 603. The processor 601, memory 602, and communication component 603 are connected via a bus.

[0138] In the specific implementation process, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to execute the above-mentioned network security incident handling method.

[0139] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0140] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0141] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0142] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0143] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described network security incident handling method.

[0144] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the aforementioned network security incident handling method.

[0145] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0146] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0147] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0148] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0149] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0150] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0152] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for handling network security incidents, characterized in that, include: Obtain the raw security event log; The original security event logs are supplemented with information using a context-enhanced matching mechanism to generate structured event representations; The structured event representation is divided according to event characteristics using a multi-path Bayesian splitting method to obtain the split events; The split events are input into a large language model to generate association reasoning results; Based on the results of the correlation reasoning, a response strategy for network security incidents is generated; The response strategy for the aforementioned network security incident is executed to handle the network security incident.

2. The method according to claim 1, characterized in that, The step of inputting the split events into a large language model to generate association reasoning results includes: The event after splitting is subjected to element extraction using a large language model, and the extracted elements are semantically parsed to generate semantic parsing results. The entities in the semantic parsing results are mapped to the knowledge graph to generate mapping results; The graph neural network performs association queries based on the mapping results to generate association inference results.

3. The method according to claim 1, characterized in that, The step of using a context-enhanced matching mechanism to complete the information in the original security event log and generate a structured event representation includes: Obtain the joint distribution of multiple fields in the original security event log; The missing field is determined based on the joint distribution of the multiple fields; The missing field's context information is generated using a Hidden Markov Model based on the missing field. The original security event log is supplemented with information based on the context information of the missing fields to generate a structured event representation.

4. The method according to claim 1, characterized in that, After generating the response strategy for network security incidents based on the correlation reasoning results, the method further includes: A multi-dimensional score for response strategies to cybersecurity incidents is calculated using an objective optimization function. The weights to be adjusted in the target optimization function are determined based on the multi-dimensional scoring and the business scenarios of cybersecurity incidents. The objective optimization function is adjusted according to the weights to be adjusted, resulting in the adjusted objective optimization function.

5. The method according to claim 4, characterized in that, The objective optimization function is: In the formula, Represent the objective optimization function; This indicates the preset weighting coefficients; This represents the standardized score function for the k-th dimension; k represents the number of dimensions.

6. The method according to any one of claims 1 to 5, characterized in that, After implementing the response strategy for the network security incident to handle the incident, the method further includes: Obtain the execution results of the response strategy for network security incidents; Based on the execution results, determine the weights and prompts to be adjusted for the knowledge graph; The prompt word templates of the knowledge graph and the large language model are updated based on the weights to be adjusted and the prompt words to be adjusted, and the update results are generated.

7. A network security incident handling device, characterized in that, include: The first acquisition module is used to acquire raw security event logs; The information completion module is used to complete the information in the original security event log through a context-enhanced matching mechanism and generate a structured event representation; The traffic splitting module is used to split the structured event representation according to event characteristics using a multi-path Bayesian traffic splitting method to obtain the split events. The first generation module is used to input the split events into the large language model and generate the association reasoning results. The second generation module is used to generate response strategies for network security incidents based on the correlation reasoning results; The execution module is used to execute the response strategy for the network security incident in order to handle the network security incident.

8. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the network security incident handling method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the network security incident handling method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the network security incident handling method according to any one of claims 1 to 6.

Images