A Network Alarm Analysis Method and System Based on Multi-Agent Large Model Dynamic RAG

Abstract

This invention relates to a network alarm assessment method and system based on a multi-agent large model dynamic RAG. The method includes: performing multi-level filtering on raw network log data to identify target alarm objects to be assessed; extracting time-series correlation data from historical data streams based on an adaptive retrieval strategy and combining it with external knowledge base data to construct a multi-dimensional spatiotemporal constraint set containing factual evidence; scheduling multiple heterogeneous expert agents to analyze the target alarm objects; mapping the analysis conclusions of the expert agents to the multi-dimensional spatiotemporal constraint set for causal verification: if the analysis conclusions have corresponding evidence supporting them in the multi-dimensional spatiotemporal constraint set, an assessment report is generated; otherwise, a re-analysis or insufficient confidence warning is triggered. This invention significantly reduces the illusion of large model network alarm assessment through multi-dimensional context and improves resource utilization, efficiency, adaptability, and effectiveness.

Description

Technical Field

[0001] This invention belongs to the field of network security and large language model technology, specifically a network alarm analysis method and system based on a multi-agent large model dynamic RAG. Background Technology

[0002] In the field of cybersecurity operations technology, Security Operations Centers (SOCs) have become the core battleground for enterprises to defend against cyberattacks. With the deepening of digital transformation, cyberattacks are characterized by high frequency, strong concealment, and complex attack chains. In current security defense systems, intelligent analysis technology based on Large Language Models (LLMs) has become an important research direction for improving threat detection and response efficiency. Traditional Security Information and Event Management (SIEM) systems mainly rely on static rule matching to identify threats, but they still face significant technical bottlenecks when dealing with massive alerts and unknown attacks.

[0003] Existing technologies mainly include: 1. Rule-based or statistical anomaly detection systems: These systems detect anomalies using preset signature rules or traffic statistics baselines, resulting in a high false alarm rate and an inability to explain the attack principles.

[0004] 2. Classification systems based on traditional machine learning: While using algorithms such as random forest and SVM (Support Vector Machine) to classify malicious traffic improves efficiency, it lacks a deep understanding of the semantics of attacks.

[0005] 3. Analysis Systems Based on General-Purpose Large Language Models: In recent years, general-purpose large-scale models have been attempted for security log interpretation. However, due to the lack of in-depth knowledge of specific security domains (such as proprietary protocol formats and the latest vulnerability intelligence), general-purpose models are prone to "hallucination" during reasoning. For example, they may fabricate non-existent CVE (Common Vulnerabilities and Exposures) numbers or incorrectly attribute normal business traffic to attack behavior, seriously affecting the credibility of the judgment conclusions. Summary of the Invention

[0006] To reduce the "illusion rate" of large-scale model analysis, significantly improve resource utilization and analysis efficiency, and overcome the limitations of a single alarm perspective, this invention provides a network alarm analysis method based on a multi-agent large-scale model dynamic RAG, comprising: performing multi-level filtering on raw network log data to identify target alarm objects to be analyzed; in response to the target alarm object, extracting time-series correlation data from historical data streams based on an adaptive retrieval strategy, and constructing a multi-dimensional spatiotemporal constraint set containing factual evidence by combining external knowledge base data; scheduling multiple functionally heterogeneous expert agents to analyze the target alarm object; the expert agent is constructed by a fusion model of pre-trained weights based on a general language model and fine-tuned weights based on network security tasks; mapping the analysis conclusions of the expert agents to the multi-dimensional spatiotemporal constraint set for causal verification: if the analysis conclusions have corresponding evidence supporting them in the multi-dimensional spatiotemporal constraint set, an analysis report is generated; otherwise, a re-analysis or insufficient confidence warning is triggered.

[0007] In some embodiments of the present invention, the multi-level filtering process includes: using a first model with computational overhead lower than a preset overhead threshold to perform coarse-grained classification of the network log data, filtering out noisy data with confidence scores higher than a first preset threshold, and identifying risky data with confidence scores higher than a second preset threshold; using a second model with a parameter scale larger than the first model to re-judge the data with confidence scores between the first preset threshold and the second preset threshold, and determining the target alarm object.

[0008] In some embodiments of the present invention, the adaptive retrieval strategy includes: dynamically adjusting the retrieval time window length and retrieval key value according to the attack type characteristics of the target alarm object; for flood attack characteristics, using a first time window and victim index key; for penetration attack characteristics, using a second time window and attack source index key; wherein the second time window is longer than the first time window.

[0009] In some embodiments of the present invention, the fusion model of the expert agent is obtained by synthesizing the pre-trained weights of the general language model and the fine-tuned weights of the network security task through a nonlinear interpolation algorithm that preserves geometric features.

[0010] In some embodiments of the present invention, mapping the analysis conclusions of the expert agent to the multidimensional spatiotemporal constraint set for causal verification includes: constructing a directed acyclic graph workflow containing the inference node and logic check node of the expert agent; when the inference node outputs a successful attack determination, activating the corresponding logic check node; the logic check node, in the temporal correlation data, searching for whether there is a subsequent response behavior or state change record that matches the successful attack determination.

[0011] In some embodiments of the present invention, the multidimensional spatiotemporal constraint set further includes: an asset environment database, used to constrain the expert agent to perform consistency verification on the asset configuration attributes of the victim target during the reasoning process, wherein the asset configuration attributes include business importance level, operating system type and historical baseline behavior data.

[0012] A second aspect of the present invention provides a network alarm assessment system based on a multi-agent large model dynamic RAG, comprising: a filtering module for performing multi-level filtering on raw network log data to identify target alarm objects to be assessed; a construction module for extracting time-series correlation data from historical data streams based on an adaptive retrieval strategy and combining it with external knowledge base data to construct a multi-dimensional spatiotemporal constraint set containing factual evidence in response to the target alarm object; a scheduling module for scheduling multiple functionally heterogeneous expert agents to analyze the target alarm object; wherein the expert agent is constructed from a fusion model based on pre-trained weights of a general language model and fine-tuned weights of network security tasks; and a verification module for mapping the analysis conclusions of the expert agents to the multi-dimensional spatiotemporal constraint set for causal verification: if the analysis conclusions are supported by corresponding evidence in the multi-dimensional spatiotemporal constraint set, an assessment report is generated; otherwise, a re-analysis or insufficient confidence warning is triggered.

[0013] A third aspect of the present invention provides an electronic device, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the network alarm assessment method based on a multi-agent large model dynamic RAG provided in the first aspect of the present invention.

[0014] In a fourth aspect, the present invention provides a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the network alarm assessment method based on a multi-agent large model dynamic RAG provided in the first aspect of the present invention.

[0015] The beneficial effects of this invention are: 1. Significantly reduces the "illusion rate" in large-scale model analysis: Through a dual mechanism of "three-dimensional contextual fact anchoring" and "multi-expert cross-validation," the system effectively suppresses illusions at both the source (facts provided at the input end) and process (mutual verification at the output end). When faced with unknown threats, the system would rather output "unknown" than fabricate erroneous conclusions, thus ensuring business security.

[0016] 2. Significantly improves resource utilization and analysis efficiency: Through the funnel-shaped architecture of "XGBoost + lightweight model", more than 80% of noise is filtered out in the L1 / L2 layers, and only high-value alarms are sent to the L4 layer for analysis. Moreover, the L4 layer uses a lightweight expert model with 0.6B parameters, which allows the system to run on a single consumer-grade graphics card (8GB of video memory), greatly reducing hardware costs.

[0017] 3. Breaking through the limitations of a single alarm perspective: The pioneering "three-dimensional dynamic context" engine, especially the introduction of time-series context, enables analysis to go beyond a single log entry and cross time windows to identify the complete attack chain of "scanning-intrusion-exploitation", significantly reducing the false negative rate.

[0018] 4. Expert-level analytical depth: Through knowledge distillation and the Merge algorithm, the system combines the extensive knowledge of a general-purpose model with specialized expertise in specific security domains. This enables the lightweight expert agent to achieve accuracy comparable to that of a large-scale model in specific tasks such as Webshell analysis and intelligence comparison (test set accuracy reaches 95.10%). Enhanced system interpretability and trustworthiness: The system not only outputs conclusions but also provides a complete chain of evidence (e.g., "It was determined to be an attack because the payload matched the T1505 technique, and the whoami command occurred 2 seconds later"). Every inference is verifiable, eliminating the uncertainty of a "black box" model.

[0019] 5. For the first time, the Slerp (Spherical Linear Interpolation) Merge algorithm was applied to model construction in the security vertical domain: This innovatively utilizes the spherical linear interpolation algorithm to fuse models with different fine-tuning weights, solving the problem of "catastrophic forgetting" in traditional fine-tuning and achieving lossless superposition of model capabilities. A dynamic-static combined anti-illusion RAG (Retrieval-Augmented Generation) system was constructed: This combines Redis's time-series dynamic data (real-time facts) with Milvus / Neo4j's static knowledge data (standard knowledge), proposing a complete security knowledge enhancement and retrieval scheme. Attached Figure Description

[0020] Figure 1 This is a basic flowchart of a network alarm judgment method based on a multi-agent large model dynamic RAG in some embodiments of the present invention; Figure 2 This is a schematic diagram illustrating the principle of three-dimensional dynamic context construction in some embodiments of the present invention; Figure 3 A flowchart illustrating the expert construction process based on the Slerp Merge algorithm in some embodiments of the present invention; Figure 4 This is a multi-agent cooperative state transition diagram containing an illusion verification mechanism in some embodiments of the present invention; Figure 5 This is a schematic diagram of the network alarm analysis system based on multi-agent large model dynamic RAG in some embodiments of the present invention; Figure 6 This is a schematic diagram of the structure of an electronic device in some embodiments of the present invention. Detailed Implementation

[0021] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0022] Example 1 The collection, storage, use, processing, transmission, provision, and disclosure of user personal information in this technical solution comply with relevant laws and regulations and do not violate public order and good morals. In this technical solution, user authorization or consent is obtained before acquiring or collecting user personal information.

[0023] refer to Figures 1 to 4 In a first aspect, the present invention provides a network alarm judgment method based on a multi-agent large model dynamic RAG, comprising: S100. performing multi-level filtering processing on raw network log data to identify target alarm objects to be judged; S200. in response to the target alarm object, extracting time-series correlation data from historical data streams based on an adaptive retrieval strategy, and combining external knowledge base data to construct a multi-dimensional spatiotemporal constraint set containing factual evidence; S300. scheduling multiple functionally heterogeneous expert agents to analyze the target alarm object; the expert agent is constructed by a fusion model based on pre-trained weights of a general language model and fine-tuned weights of network security tasks; S400. mapping the analysis conclusions of the expert agents to the multi-dimensional spatiotemporal constraint set for causal verification: if the analysis conclusions are supported by corresponding evidence in the multi-dimensional spatiotemporal constraint set, an judgment report is generated; otherwise, a re-analysis or insufficient confidence prompt is triggered.

[0024] In step S100 of some embodiments of the present invention, multi-level filtering processing is performed on the raw network log data to identify the target alarm objects to be analyzed; wherein, the multi-level filtering processing includes: S101. The network log data is classified in a coarse-grained manner using a first model with a computational cost lower than a preset cost threshold, filtering out noisy data with a confidence level higher than the first preset threshold, and identifying risky data with a confidence level higher than the second preset threshold. Specifically, the first-level filtering involves standardizing the raw network log data to achieve unified access to heterogeneous logs. Regular expression parsing and entity extraction algorithms are used to extract five-tuples (source IP, destination IP, port, timestamp, and payload) and attack characteristics from logs from different devices such as WAF and HIDS, generating standardized JSON alert objects.

[0025] From the log stream above, the following feature vectors were extracted: Statistical features: Payload length, number of parameters, percentage of special characters (' "<> / ), Shannon entropy. Lexical features: frequency of SQL keywords (select, union), frequency of Shell commands (cat, echo).

[0026] Secondary filtering: Employing the XGBoost machine learning model, this stage performs millisecond-level initial screening based on statistical features. Input log statistical features (such as payload length, special character frequency, and entropy) and keyword features (such as SQL keyword frequency) are used, and the output is a confidence score for the alert. Alerts with extremely low scores (<0.1) are classified as "high-confidence noise" and discarded, while those with extremely high scores (>0.9) are classified as "high-confidence risk" and proceed directly to subsequent analysis.

[0027] In one example, a pre-trained XGBoost model is loaded, taking a feature vector as input and outputting a risk probability. : like Marked as "high confidence noise", it will be stored directly in cold storage.

[0028] like Marked as "high confidence risk", it is directly pushed to L3 layer.

[0029] like Marked as "fuzzy alert", it is pushed to the secondary triage.

[0030] Optionally, the confidence threshold of 0.1 or 0.9 can be adjusted based on actual feedback.

[0031] S102. Using a second model with a parameter scale larger than that of the first model, the data whose confidence scores are between the first preset threshold and the second preset threshold are re-evaluated to determine the target alarm object.

[0032] Specifically, three-level filtering: semantic analysis of alarms in fuzzy regions. This applies to XGBoost output in... For fuzzy alerts, a lightweight large model (with 0.6B parameters) that has been finely tuned by instructions is invoked, and combined with the semantic information of the attack payload for secondary discrimination to correct false alarms.

[0033] In one example, the Qwen-0.6B fine-tuning model is invoked, with the input Prompt: "Analyze the maliciousness of the following HTTP request: {Payload}". The model outputs a classification result (malicious / normal) and a brief explanation. Alerts confirmed as malicious are pushed to Layer 3.

[0034] It is understandable that the Qwen-0.6B fine-tuning model is only an example, and the above semantic analysis can be achieved by using other Qwen series, kimi series, Zhipu series, and other fine-tuning large models.

[0035] refer to Figure 2 In step S200 of some embodiments of the present invention, in response to the target alarm object, temporal correlation data is extracted from the historical data stream based on an adaptive retrieval strategy, and combined with external knowledge base data, a multidimensional spatiotemporal constraint set containing factual evidence is constructed. The adaptive retrieval strategy includes: S201. Based on the attack type characteristics of the target alarm object, dynamically adjust the retrieval time window length and retrieval key value; S202. In response to the characteristics of flood-type attacks, a time window of the first duration and the victim's index key are adopted; S203. In response to the characteristics of penetration attacks, a second duration time window and an attack source index key are adopted; wherein, the second duration is longer than the first duration.

[0036] In this disclosed multidimensional spatiotemporal constraint set, taking the construction process of a three-dimensional dynamic context consisting of temporal context, external context, and internal context as an example, we illustrate the following: Temporal Context Fact Retrieval: Constructs hot data storage based on Redis sliding windows. When a target alarm A is received, the system adaptively selects a retrieval strategy according to the alarm type, retrieving related logs within a time window (e.g., 5 minutes before and after) to provide objective behavioral facts.

[0037] Adaptive indexing strategy: For flood attacks such as DDoS, the system uses "destination IP" as the index key to retrieve high-density log sequences within a short time window (e.g., 1 minute before and after) to construct the facts of traffic bursts; for penetration attacks such as APT, the system uses "source IP" or "SessionID" as the index key to retrieve sparse log sequences (e.g., port scan -> Webshell upload -> intranet traversal) within a long time window (e.g., 30 minutes before and after) to construct the facts of the attack chain.

[0038] Density analysis and aggregation: Log density is calculated in real time after the search results are returned. If the density exceeds a threshold (e.g., 100 logs / second), aggregation is automatically performed to generate a "traffic statistics summary" instead of the original log list to prevent context overflow.

[0039] External Context Knowledge Retrieval: Construct an external knowledge base based on Milvus and Neo4j.

[0040] Vector Retrieval: Vectorize the alert payload and retrieve MITRE ATT&CK tactical descriptions and similar historical attack cases from Milvus. Graph Retrieval: Query CVE vulnerability details, CWE (Common Weakness Enumeration) vulnerability relationships, and threat intelligence entity associations from the Neo4j knowledge graph to ensure that the model references existing standard knowledge.

[0041] Internal Context Environment Retrieval: Query the enterprise's internal asset database (CMDB, Configuration Management Database) to obtain the business importance level, operating system type, and historical baseline behavior data of the assets involved, preventing the model from making assumptions about the asset environment.

[0042] Alarm Prototype Clustering: An unsupervised clustering algorithm (MiniBatchKMeans) is introduced to extract historical alarm prototypes, providing the model with diverse reference cases (Few-shot examples) and broadening the model's perspective.

[0043] In a specific implementation of the aforementioned three-dimensional dynamic context, the following is included: Redis (Hot Data Layer): Uses a key-value structure for storage, where the key is entity_id:timestamp, and the value is the alarm details. The TTL is set to 24 hours.

[0044] Index design: Two Sorted Set indexes, SrcIP:Timestamp and DstIP:Timestamp, are created simultaneously to meet different retrieval needs.

[0045] Milvus (Warm Data Layer): Stores ATT&CK technical description vectors and historical alarm prototype vectors. Uses IVF_FLAT indexing to accelerate retrieval.

[0046] Neo4j (Graph Layer): Stores CVE nodes, CWE nodes, IP entity nodes and their relationships.

[0047] In a specific implementation of the above retrieval process, when an alarm is triggered... When (source IP, destination IP, alarm type) enters Layer 3, adaptive retrieval is performed based on the attack type: Scenario 1: Retrieval for DDoS / CC attacks (based on traffic density context): 1. Identification: If the alarm type is "DenialofService" or "HighRateTraffic".

[0048] 2. Key Selection: Select the destination IP ( () is the index key.

[0049] 3. Window Settings: Set a very short window duration (e.g., ... minute).

[0050] 4. Search command: Execute ZRANGEBYSCOREindex: ( -60s)(T+60s).

[0051] 5. Post-processing: If the number of logs is returned... Instead of sending the raw logs to the model, it triggers aggregation logic to generate a statistical summary: "In the past minute, there were 5,000 requests from 1,200 different source IPs, with the main payload being...", as contextual facts.

[0052] Scenario 2: Retrieval of APT / Webshell attacks (based on the context of behavioral chains): 1. Identification: If the alarm type is "WebshellUpload", "CommandInjection" or "PrivilegeEscalation".

[0053] 2. Key Selection: Select source IP ( (or SessionID as the index key)

[0054] 3. Window settings: Set a window for a longer duration (e.g., ...). (minutes) to cover the incubation period.

[0055] 4. Search command: Execute ZRANGEBYSCOREindex: ( -900s)( +900s).

[0056] 5. Post-processing: No aggregation is performed; the original payload and timestamp of each log entry are retained.

[0057] 6. Chained construction: The model sorts the retrieved sequences (e.g., T-5m:PortScan->T:Upload->T+2s:Whoami) by time to construct a complete attack storyline context.

[0058] refer to Figure 3 In step S300 of some embodiments of the present invention, multiple functionally heterogeneous expert agents are scheduled to analyze the target alarm object; the expert agent is constructed by a fusion model of pre-trained weights based on a general language model and fine-tuned weights for network security tasks. The expert agent fusion model is obtained by synthesizing the pre-trained weights of the general language model and the fine-tuned weights of the network security task through a nonlinear interpolation algorithm that preserves geometric features.

[0059] Specifically, this invention proposes a method for constructing a hybrid expert (MOE) agent based on knowledge distillation and the Merge algorithm, comprising the following steps: ① Domain Dataset Construction: High-quality instruction tuning datasets are generated for three tasks: “attack analysis”, “threat intelligence”, and “temporal correlation”, using ultra-large-scale teacher models (such as 72B parameter models).

[0060] ② Instruction fine-tuning and distillation: Using the above dataset, fully parameter-supervised fine-tuning (SFT) is performed on the lightweight pedestal model (e.g., 0.6B parameters) to train three independent expert model weights.

[0061] ③ Model Fusion (Merge): The Spherical Linear Interpolation (Slerp) algorithm is used to fuse the fine-tuned expert weights with the base model weights. The Slerp algorithm preserves the geometric features in the high-dimensional parameter space, avoiding knowledge forgetting caused by traditional linear averaging. This allows for the construction of an expert model that understands both general semantics and specific attack characteristics, reducing illusions caused by "ignorance." The formula is as follows:

[0062] in These are parameter vectors for different models. Angle This is the fusion coefficient.

[0063] ④ Expert agent encapsulation: The fused model is encapsulated into independent agents, each endowed with specialized capabilities such as attack feature mapping, IOC comparison, and attack chain reconstruction.

[0064] A specific example of a hybrid expert (MOE) agent construction process based on knowledge distillation and the Merge algorithm includes: Step 1: Data Generation (Teacher): Using a 72B parameter teacher model, instruction data is generated for the "attack analysis" task: {"instruction":"Analyze Payload","input":"select *from users","output":"SQL Injection..."} Step Two: Supervised Fine-tuning (SFT): Using Qwen-0.6B as a base, SFT was performed on the above dataset to obtain the fine-tuned weights. .

[0065] Step 3: SlerpMerge fusion: The weights are fused using a spherical linear interpolation algorithm, as shown in the following formula:

[0066] in As the base weight, The angle between the two sets of weights. This is the fusion coefficient (e.g., 0.5). The model generated in this step is the anti-forgetting expert model.

[0067] Accordingly, the overall scheduling plan is initiated: the overall scheduling agent (Planner) based on the LangChain architecture is launched to receive the "panoramic analysis context packet" from the L3 layer. Based on the thought chain (CoT) reasoning, the Planner breaks down the judgment task into a sequence of sub-tasks (e.g., "first confirm the payload type, then check the IP reputation, and finally analyze the behavior before and after").

[0068] Dynamic Routing and Execution: Attack Analysis Expert (Model): Scheduled to analyze payload characteristics and output ATT&CK technical IDs (e.g., T1505.003). Threat Matching Expert (Model): Scheduled to compare source IPs and file hashes and output threat intelligence hit results. Time-Series Correlation Expert (Model): Scheduled to analyze time-series log sequences and output attack phase determinations (e.g., "Successful exploitation and reconnaissance execution"). State Graph Flow: Utilize LangGraph to build stateful workflows that support parallel execution between agents, conditional branching (e.g., "skip payload analysis if intelligence is hit"), and iterative loops (e.g., "request more context if the result is uncertain").

[0069] Results Synthesis and Reporting: Planner collects the analysis results from various experts, performs conflict resolution and confidence weighting, and generates a structured assessment report that includes risk level, complete attack storyline, and handling recommendations.

[0070] refer to Figure 4In step S400 of some embodiments of the present invention, the analysis conclusion of the expert agent is mapped to the multidimensional spatiotemporal constraint set for causal verification: if the analysis conclusion has corresponding evidence to support it in the multidimensional spatiotemporal constraint set, an analysis report is generated; otherwise, a reanalysis or insufficient confidence prompt is triggered.

[0071] The step of mapping the analytical conclusions of the expert agent to the multidimensional spatiotemporal constraint set for causal verification includes: S401. Construct a directed acyclic graph workflow that includes the reasoning nodes and logic checking nodes of the expert agent; Specifically, RAG-based fact anchoring: In the Prompt project, agents are required to reason solely based on the retrieved 3D context (L3 layer output), and the source must be explicitly cited, prohibiting the use of fuzzy memories from the training data for divergence.

[0072] S402. When the inference node outputs a successful attack determination, the corresponding logic check node is activated; the logic check node searches the time-series correlation data for whether there is a subsequent response behavior or state change record that matches the successful attack determination.

[0073] Specifically, perform cross-verification by multiple experts: set up verification nodes in the LangGraph workflow. For example, when the "attack analysis expert" determines that the intrusion was successful, the "time series correlation expert" must find the corresponding subsequent operations (such as reconnecting to C2, executing commands) on the timeline as supporting evidence. If there is no supporting evidence, the confidence level is reduced or the conclusion is rejected.

[0074] Implement confidence threshold filtering: Each expert must include a confidence score when outputting their conclusions. The Planner only accepts conclusions with a confidence score higher than a preset threshold (e.g., 0.85), and triggers a secondary search or manual review for conclusions with low confidence scores.

[0075] Implement structured constraint output: Force the model to output in a strict JSON format and perform regular expression validation on key fields (such as attack type and IP address) to prevent the generation of non-existent formats or illegal values.

[0076] For example, the implementation method of the hallucination detection and correction mechanism based on the above steps includes: Step a. Prompt strong constraint: The system prompt should include the message: "You are a security expert. Please analyze strictly based on the provided context. If the context lacks sufficient evidence, please answer 'Cannot determine' directly. Fabricating facts or citing non-existent knowledge is strictly prohibited." Step b. Logical consistency check (Lang Graph node): Set up a "Reflection Node" in the workflow. Logic: If the expert determines it's a "successful intrusion," the Reflection Node will automatically check the timing context provided by L3 for "response status code = 200" or "subsequent data leakage behavior." Execution: If there is a lack of logical support (e.g., the attack was successful but returned a 404), it will automatically reject the attack and require re-analysis.

[0077] Step c. Cross-validation: Planner Scheduling: Simultaneously consult both "Attack Analysis Experts" and "Threat Intelligence Experts." Verification: If the Attack Experts deem it a false alarm, but the Threat Intelligence Experts find the IP in a blacklist, Planner will trigger "Deep Source Tracing Mode," raising the alert level to avoid unilateral missed detections.

[0078] Step d. Multi-agent collaborative work: Step 1: Initialization and Planning The Planner receives the Context and outputs its thought process: "Webshell upload behavior detected, and subsequent command execution is pending. We need to first confirm the Webshell type, and then confirm the command execution result." Step 2: State Diagram Transition: The LangGraph engine schedules ExpertAgent to execute tasks in parallel according to a plan. AttackExpert: Identifies the payload as a PHP backdoor (Trojan). TemporalExpert: Confirms the upload followed by the whoami command.

[0079] Step 3: Result Generation: The Planner synthesizes conclusions from various sources and generates a JSON report: {"risk_level":"Critical", "attack_chain":"WebshellUpload->CommandExecution", "att&ck_ids":["T1505.003","T1059.001"], "hallucination_check":"Passed", "recommendation":["Isolatehost10.0.0.5","BlockIP1.2.3.4"] }

[0080] In step S300 or S400 of some embodiments of the present invention, the multidimensional spatiotemporal constraint set further includes: an asset environment database, used to constrain the expert agent to perform consistency verification on the asset configuration attributes of the victim target during the reasoning process, wherein the asset configuration attributes include business importance level, operating system type and historical baseline behavior data.

[0081] Example 2 refer to Figure 5 In a second aspect, the present invention provides a network alarm judgment system 1 based on a multi-agent large model dynamic RAG, comprising: a filtering module 11, used to perform multi-level filtering processing on raw network log data to identify target alarm objects to be judged; a construction module 12, used to extract time-series correlation data from historical data streams based on an adaptive retrieval strategy in response to the target alarm object, and combine it with external knowledge base data to construct a multi-dimensional spatiotemporal constraint set containing factual evidence; a scheduling module 13, used to schedule multiple functionally heterogeneous expert agents to analyze the target alarm object; the expert agent is constructed by a fusion model based on pre-trained weights of a general language model and fine-tuned weights of network security tasks; and a verification module 14, used to map the analysis conclusions of the expert agents to the multi-dimensional spatiotemporal constraint set for causal verification: if the analysis conclusions have corresponding evidence support in the multi-dimensional spatiotemporal constraint set, an judgment report is generated; otherwise, a re-analysis or insufficient confidence prompt is triggered.

[0082] Furthermore, the filtering module 11 includes: a filtering unit, used to perform coarse-grained classification of the network log data using a first model with computational overhead lower than a preset overhead threshold, filtering out noisy data with confidence scores higher than a first preset threshold, and identifying risky data with confidence scores higher than a second preset threshold; and a determination unit, used to use a second model with a parameter scale larger than the first model to re-judge the data with confidence scores between the first preset threshold and the second preset threshold, and determine the target alarm object.

[0083] In a specific embodiment of the present invention, the system architecture includes: a data access and triage layer (L1-L2): responsible for log collection, standardization cleaning, and XGBoost / LightLLM secondary triage. A knowledge service and storage layer (L3): comprising a three-layer storage architecture of Redis (hot data / time series), Milvus (warm data / vectors), and Neo4j (cold data / graphs), providing three-dimensional context services. An intelligent agent collaboration layer (L4): running a Planner scheduler, multiple Domain Expert agents, and a Hallucination Validator, executing the workflow defined by LangGraph. An application interaction layer (L5): responsible for the visualization of the analysis report, API integration with the SOAR system, and human feedback interfaces.

[0084] It is understood that the system architecture of this embodiment may include terminal devices and servers. A network is used as a medium to provide a communication link between the terminal devices and servers. The network may include various connection types, such as wired and / or wireless communication links, etc. Users can use terminal devices to browse various types of applications or websites. Terminal devices can be various electronic devices, including but not limited to smartphones, tablets, laptops, etc. Servers can be servers providing various services, such as a backend management server that supports and monitors websites browsed by users using terminal devices (this is just an example). The backend management server can obtain data such as the registration information, webpage content, and source code of websites browsed by users through terminal devices, detect the websites, and monitor the websites based on the detection results. The server may be deployed with a trained predetermined model, which may be a Large Language Model (LLM). At least one of the website detection methods provided in this disclosure embodiment can generally be executed by a server. Correspondingly, the website detection device provided in this disclosure embodiment can generally be set in a server. The website detection methods provided in this disclosure embodiment can also be executed by a server or server cluster that is different from the server and can communicate with the terminal devices and / or servers. Accordingly, the website detection device provided in this embodiment can also be set in a server or server cluster that is different from the server and can communicate with terminal devices and / or servers.

[0085] Example 3 refer to Figure 6 In a third aspect, the present invention provides an electronic device comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the network alarm assessment method based on a multi-agent large model dynamic RAG of the first aspect of the present invention.

[0086] Electronic device 500 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from storage device 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of electronic device 500. The processing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. An input / output (I / O) interface 505 is also connected to bus 504.

[0087] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, hard disks; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 6 Each box shown can represent a device or multiple devices as needed.

[0088] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by a processing device 501, it performs the functions defined in the methods of embodiments of this disclosure. It should be noted that the computer-readable medium described in embodiments of this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0089] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable medium carries one or more computer programs, which, when executed by the electronic device, cause the electronic device to: Computer program code for performing the operations of embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, C++, and Python—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0090] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0091] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A network alarm assessment method based on multi-agent dynamic temporal RAG, characterized in that, include: Perform multi-level filtering on the raw network log data to identify the target alarm objects to be analyzed; The multi-level filtering process includes: using a first model with computational overhead lower than a preset overhead threshold to perform coarse-grained classification of the network log data, filtering out noisy data with confidence scores higher than a first preset threshold, and identifying risky data with confidence scores higher than a second preset threshold; using a second model with a parameter scale larger than the first model to re-evaluate data with confidence scores between the first preset threshold and the second preset threshold, and determining the target alarm object; In response to the target alarm object, time-series related data is extracted from historical data streams based on an adaptive retrieval strategy, and combined with external knowledge base data to construct a multi-dimensional spatiotemporal constraint set containing factual evidence; the adaptive retrieval strategy includes: dynamically adjusting the retrieval time window length and retrieval key value according to the attack type characteristics of the target alarm object; for flood attack characteristics, a first time window and victim index key are used; for penetration attack characteristics, a second time window and attack source index key are used; wherein, the second time window is longer than the first time window; Multiple expert agents with heterogeneous functions are scheduled to analyze the target alarm object; the expert agent is constructed by a fusion model of pre-trained weights based on a general language model and fine-tuned weights for network security tasks; the fusion model of the expert agent is configured to synthesize the pre-trained weights of the general language model and the fine-tuned weights of the network security tasks through a nonlinear interpolation algorithm that preserves geometric features. The analysis conclusions of the expert agent are mapped to the multidimensional spatiotemporal constraint set for causal verification: if the analysis conclusions are supported by corresponding evidence in the multidimensional spatiotemporal constraint set, an analysis report is generated; otherwise, a reanalysis or insufficient confidence prompt is triggered.

2. The network alarm judgment method based on multi-agent dynamic temporal RAG according to claim 1, characterized in that, The step of mapping the analytical conclusions of the expert agent to the multidimensional spatiotemporal constraint set for causal verification includes: Construct a directed acyclic graph workflow that includes the reasoning nodes and logic checking nodes of the expert agent; When the inference node outputs a successful attack determination, the corresponding logic check node is activated; the logic check node searches the time-series correlation data for whether there are any subsequent response behaviors or status change records that match the successful attack determination.

3. The network alarm judgment method based on multi-agent dynamic temporal RAG according to claim 1, characterized in that, The multidimensional spatiotemporal constraint set also includes: An asset environment database is used to constrain the expert agent to perform consistency verification on the asset configuration attributes of the victim target during the reasoning process. The asset configuration attributes include business importance level, operating system type, and historical baseline behavior data.

4. A network alarm analysis system based on multi-agent dynamic temporal RAG, characterized in that, include: The filtering module is used to perform multi-level filtering on the raw network log data and identify the target alarm objects to be analyzed. The multi-level filtering process includes: using a first model with computational overhead lower than a preset overhead threshold to perform coarse-grained classification of the network log data, filtering out noisy data with confidence scores higher than a first preset threshold, and identifying risky data with confidence scores higher than a second preset threshold; using a second model with a parameter scale larger than the first model to re-evaluate data with confidence scores between the first preset threshold and the second preset threshold, and determining the target alarm object; A construction module is used to respond to the target alarm object by extracting time-series related data from historical data streams based on an adaptive retrieval strategy and combining it with external knowledge base data to construct a multi-dimensional spatiotemporal constraint set containing factual evidence. The adaptive retrieval strategy includes: dynamically adjusting the retrieval time window length and retrieval key value according to the attack type characteristics of the target alarm object; for flood attack characteristics, a first time window and victim index key are used; for penetration attack characteristics, a second time window and attack source index key are used; wherein, the second time window is longer than the first time window. The scheduling module is used to schedule multiple heterogeneous expert agents to analyze the target alarm object; the expert agent is constructed from a fusion model of pre-trained weights based on a general language model and fine-tuned weights for network security tasks; the fusion model of the expert agent is configured to synthesize the pre-trained weights of the general language model and the fine-tuned weights of the network security tasks through a nonlinear interpolation algorithm that preserves geometric features. The verification module is used to map the analysis conclusions of the expert agent to the multidimensional spatiotemporal constraint set for causal verification: if the analysis conclusions are supported by corresponding evidence in the multidimensional spatiotemporal constraint set, an analysis report is generated; otherwise, a reanalysis or insufficient confidence prompt is triggered.

5. An electronic device, comprising: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the network alarm assessment method based on multi-agent dynamic temporal RAG as described in any one of claims 1 to 3.

6. A computer-readable medium having a computer program stored thereon, wherein, When the computer program is executed by the processor, it implements the network alarm judgment method based on multi-agent dynamic temporal RAG as described in any one of claims 1 to 3.

Images