A network security rule distribution method, device, apparatus and storage medium

Abstract

The application discloses a network security rule distribution method and device, equipment and a storage medium, relates to the technical field of network security data processing, and is applied to a client and comprises the following steps: generating initial network security rules corresponding to user demand information in a context injection mode; the user demand information is user-input network security-related demand information; performing deduplication processing on the initial network security rules by using preset security rule deduplication conditions to obtain corresponding target network security rules; the preset security rule deduplication conditions comprise a first deduplication condition constructed based on semantic equivalence checking and a second deduplication condition constructed based on similarity matching; and the target network security rules are distributed to corresponding servers of the client. Thus, the network security rules bound to the user demand information can be generated in the context injection mode, and the deduplication mode combining semantic equivalence checking and similarity matching can reduce redundant rules, improve adaptability, and reduce operation and maintenance costs.

Description

Technical Field

[0001] This invention relates to the field of network security data processing technology, and in particular to a network security rule distribution method, apparatus, device, and storage medium. Background Technology

[0002] In the current field of cybersecurity data processing technology, cybersecurity protection systems such as Security Operations Centers (SOCs) and situational awareness platforms commonly employ two main approaches to automatically generate security rules: one is based on deep learning models (such as convolutional neural networks and decision trees), which generate detection rules by analyzing network traffic data, with the core advantage being the interpretability of the rules; the other is based on Large Language Models (LLMs), which translate user natural language requirements into rule code, with the core advantage being the reduction of the writing threshold. However, neither of these technologies solves the problems of rule logic redundancy and automated distribution, and both have their limitations: deep learning methods rely on a large amount of sample data and have poor flexibility in adapting to new threat scenarios; while LLM methods lower the writing threshold, the logical consistency and standardization of the generated rules are insufficient, further exacerbating the redundancy problem.

[0003] It is evident that overcoming the shortcomings of network security rules, such as logical redundancy and poor adaptability, in order to meet the comprehensive operational needs of SOC platforms and situational awareness platforms is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a network security rule distribution method, apparatus, device, and storage medium. This method generates network security rules bound to user requirement information through context injection, and by combining semantic equivalence verification and similarity matching for deduplication, it reduces redundant rules, improves adaptability, and lowers operation and maintenance costs. The specific solution is as follows: Firstly, this application provides a network security rule distribution method applied to a client, including: Initial network security rules are generated based on context injection, corresponding to user requirements information; the user requirements information refers to network security-related requirements input by the user. The initial network security rules are deduplicated using preset security rule deduplication conditions to obtain the corresponding target network security rules; the preset security rule deduplication conditions include a first deduplication condition constructed based on semantic equivalence verification and a second deduplication condition constructed based on similarity matching. The target network security rules are distributed to the server corresponding to the client.

[0005] Optionally, the generation of initial network security rules corresponding to user requirement information based on context injection includes: Obtain user demand information, as well as related user authentication information and network security task information; A first network security rule corresponding to the user's needs information is generated using a large language model; Based on the user identity authentication information and the network security task information, a context injection operation is performed on the first network security rule to obtain the initial network security rule.

[0006] Optionally, generating the first network security rule corresponding to the user's needs information through a large language model includes: The system calls a preset prompt word template and uses a large language model to perform intent recognition on the user's needs information to obtain the corresponding intent recognition results. Using the large language model, a first network security rule corresponding to the user's needs information is generated by combining the intent recognition result and the security rule model type; the security rule model type is a security rule model type that is related to the intent recognition result.

[0007] Optionally, the step of deduplicating the initial network security rules using preset security rule deduplication conditions to obtain the corresponding target network security rules includes: The initial network security rules and the preset network security rules are semantically equivalent to each other based on the security rule query language, and the corresponding semantic equivalence verification results are obtained; the security rule query language is the query language used to describe the filtering logic in the network security detection rules. The initial network security rules and the preset network security rules are similar to each other based on keyword matching to obtain the corresponding similarity calculation results. Based on the semantic equivalence verification result and the similarity calculation result, the initial network security rules are deduplicated to obtain the corresponding target network security rules.

[0008] Optionally, the step of deduplicating the initial network security rules based on the semantic equivalence verification result and the similarity calculation result to obtain the corresponding target network security rules includes: The initial network security rule is deduplicated based on the semantic equivalence verification result to obtain the second network security rule, and the initial network security rule is deduplicated based on the similarity calculation result to obtain the third network security rule. The network security rules that overlap between the second network security rule and the third network security rule are identified as the target network security rules.

[0009] Optionally, distributing the target network security rule to the server corresponding to the client includes: The target network security rules are engineered and distributed to the corresponding server of the client based on the large model context protocol. The engineering processes include directory awareness processing, compression processing, and encryption processing.

[0010] Optionally, after obtaining the corresponding target network security rules, the process further includes: The network security rules in the initial network security rules, excluding the target network security rule, are pushed to the client's interactive interface for the user to view.

[0011] Secondly, this application provides a network security rule distribution device, applied to a client, comprising: The rule generation module is used to generate initial network security rules corresponding to user requirement information based on context injection; the user requirement information is network security-related requirement information input by the user. The deduplication module is used to deduplicatize the initial network security rules using preset security rule deduplication conditions to obtain the corresponding target network security rules; the preset security rule deduplication conditions include a first deduplication condition constructed based on semantic equivalence verification and a second deduplication condition constructed based on similarity matching. The rule distribution module is used to distribute the target network security rules to the server corresponding to the client.

[0012] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor for executing the computer program to implement the network security rule distribution method described above.

[0013] Fourthly, this application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the network security rule distribution method described above.

[0014] Therefore, the technical solution of this application, applied to the client side, firstly generates initial network security rules corresponding to user requirement information based on context injection; the user requirement information refers to network security-related requirement information input by the user; then, the initial network security rules are deduplicated using preset security rule deduplication conditions to obtain corresponding target network security rules; the preset security rule deduplication conditions include a first deduplication condition constructed based on semantic equivalence verification and a second deduplication condition constructed based on similarity matching; finally, the target network security rules are distributed to the server corresponding to the client. In this way, this application can generate network security rules bound to user requirement information through context injection, facilitating auditing and backtracking of the security rule lifecycle; and by combining semantic equivalence verification and similarity matching to construct a dual-track deduplication method, redundant rules can be reduced from the source, adaptability can be improved, and operation and maintenance costs can be reduced. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0016] Figure 1 This application discloses a flowchart of a network security rule distribution method. Figure 2 This application discloses a specific network security rule distribution system module architecture diagram; Figure 3 This application discloses a flowchart of a specific network security rule distribution method. Figure 4 This is a schematic diagram of the structure of a network security rule distribution device disclosed in this application; Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] See Figure 1 As shown, this embodiment of the invention discloses a network security rule distribution method applied to a client, including: Step S11: Generate initial network security rules corresponding to user requirement information based on context injection; the user requirement information is network security-related requirement information input by the user.

[0019] In this embodiment, to ensure the traceability of the rule throughout its entire lifecycle and meet the security audit compliance requirements, a context injection method can be used to achieve a strong binding between network security rules and specific security tasks. Through context injection, context information related to user needs can be injected into network security rules, and the context information and network security rules form a complete data structure, which facilitates the full-process traceability of security rules.

[0020] In one specific embodiment, during the generation of initial network security rules corresponding to user requirement information based on context injection, the user requirement information, along with related user authentication information and network security task information, are first obtained. Simultaneously, a first network security rule corresponding to the user requirement information is generated using a large language model. Then, based on the user authentication information and the network security task information, a context injection operation is performed on the first network security rule to obtain the initial network security rule. It is understood that the user requirement information is network security-related requirement information input by the user, corresponding to user authentication information and specific network security task information. That is, the context information of the user requirement information may include security task number, task name, creator's identity information, creation time, department, etc. Based on the user requirement information, a network security rule can be generated using a large language model, denoted as the first network security rule. Subsequently, a context injection operation is performed on the generated first network security rule based on the context information, that is, the context information corresponding to the user requirement information is injected into the network security rule, for example, by injecting information into the security rule in the form of extended fields. The context information and the original security rule form a complete data structure. The network security rule after injecting the context information is denoted as the initial network security rule. This enables full-process traceability of security rules from generation to deployment and use, and also provides data support for possible rule classification and management in the future.

[0021] In one specific embodiment, during the process of generating a first network security rule corresponding to the user's requirement information using a large language model, a preset prompt word template is first invoked, and the user's requirement information is subjected to intent recognition by the large language model to obtain the corresponding intent recognition result. Then, the first network security rule corresponding to the user's requirement information is generated by combining the intent recognition result and the security rule model type with the large language model. The security rule model type is a security rule model type that is related to the intent recognition result. Specifically, after the user's requirement information in natural language is input into the large language model, intent recognition can be performed by combining a preset prompt word template (which may include rule type judgment guidance, syntax specifications, format requirements, etc.) to obtain the corresponding intent recognition result. Afterwards, the large language model can automatically determine the matching security rule model type based on the intent recognition result and generate the first network security rule corresponding to the user's requirement information. It is understood that the determination of the security rule model type may include feature matching, correlation analysis, and frequency statistics, etc., and the generated network security rule may be a YAML (a readable data serialization format) rule that includes filtering logic, rule name, description, and output template.

[0022] Step S12: Use preset security rule deduplication conditions to deduplicatize the initial network security rules to obtain the corresponding target network security rules; the preset security rule deduplication conditions include a first deduplication condition constructed based on semantic equivalence verification and a second deduplication condition constructed based on similarity matching.

[0023] In this embodiment, the initial network security rules corresponding to the user's needs information can be obtained through the above steps. To ensure the effectiveness of the rules and eliminate logical redundancy, the obtained initial network security rules can be deduplicated using pre-set security rule deduplication conditions. It should be noted that the security rule deduplication conditions used here include semantic equivalence verification and similarity matching, that is, the initial network security rules obtained in the above steps are deduplicated by combining the first deduplication condition based on semantic equivalence verification and the second deduplication condition based on similarity matching; this can achieve accurate deduplication and eliminate the logical redundancy of the generated network security rules.

[0024] In one specific embodiment, during the process of deduplicating the initial network security rules using preset security rule deduplication conditions to obtain the corresponding target network security rules, firstly, the initial network security rules and preset network security rules are semantically equivalent to each other based on a security rule query language, obtaining the corresponding semantic equivalence verification result; the security rule query language is the query language used to describe filtering logic in network security detection rules; simultaneously, the initial network security rules and preset network security rules are similar to each other based on keyword matching, obtaining the corresponding similarity calculation result; then, the initial network security rules are deduplicated based on the semantic equivalence verification result and the similarity calculation result to obtain the corresponding target network security rules. Specifically, the initial network security rules and preset network security rules (AIQL statements prepared in the rule base) are semantically equivalent compared and verified using a security rule query language (AIQL, the core query language used to describe filtering logic in security detection rules), obtaining the corresponding semantic equivalence verification result indicating whether the semantics are consistent. Correspondingly, keyword matching can be used to calculate the similarity between the initial network security rules and the preset network security rules. For example, by calculating the Jaccard coefficient (simple matching coefficient, similarity = number of intersection keywords / number of union keywords) of the non-logical part keywords of the initial network security rules and the preset network security rules, the corresponding similarity calculation result (i.e., Jaccard coefficient) can be obtained.

[0025] Furthermore, in a specific embodiment, during the process of deduplicating the initial network security rules based on the semantic equivalence verification results and the similarity calculation results to obtain the corresponding target network security rules, firstly, the initial network security rules are deduplicated based on the semantic equivalence verification results to obtain a second network security rule, and then the initial network security rules are deduplicated based on the similarity calculation results to obtain a third network security rule; then, the network security rules that overlap between the second and third network security rules are identified as the target network security rules. Specifically, during the deduplication process, the initial network security rules can be deduplicated using both the semantic equivalence verification results and the similarity calculation results, thus obtaining two deduplicated network security rules, namely the second network security rule and the third network security rule; then, these two network security rules are merged to obtain the target network security rule after semantic equivalence verification deduplication and similarity matching deduplication. It is understood that this can solve the redundancy problem of different expressions but consistent logic, taking into account both logical accuracy and structural similarity, and can improve the effectiveness and adaptability of the generated network security rules.

[0026] Step S13: Distribute the target network security rules to the server corresponding to the client.

[0027] In this embodiment, the target network security rules, which have been deduplicated by semantic equivalence verification and similarity matching, can be obtained through the above steps. Then, the obtained target network security rules are distributed to the corresponding server on the client so as to deploy the corresponding network security rules and complete the corresponding network security tasks.

[0028] In one specific embodiment, during the distribution of the target network security rule to the server corresponding to the client, the target network security rule is first engineered, and then distributed to the server corresponding to the client based on the Model Context Protocol (MCP). The engineered processing includes directory awareness processing, compression processing, and encryption processing. Specifically, during the distribution of network security rules, the target network security rule can be engineered. First, directory awareness and location are performed, such as locating the corresponding physical storage directory by combining the model type and department information of the network security rule, avoiding errors in manual directory searches. Then, a compression algorithm can be used to atomically compress the target network security rule, generating independent rule compressed packages, ensuring that each compressed package corresponds to a unique rule for easy management. Afterwards, the compressed rules can be encrypted to ensure the security of rule transmission and storage. Finally, a standardized connection with the server can be established based on the Model Context Protocol (MCP), and the encrypted rule compressed package can be uploaded to a designated directory on the server. In this specific embodiment, the transmission status can be monitored in real time during the rule upload process, and automatic retry can be performed if an interruption occurs to ensure the reliability of rule transmission.

[0029] In another specific embodiment, after obtaining the corresponding target network security rule, the network security rules other than the target network security rule in the initial network security rules can also be pushed to the client's interactive interface for the user to view. Specifically, the relevant information of the network security rules can be fed back to the user through a visual interface or API (Application Programming Interface), such as showing the upload status of the target network security rule, visualizing the access link and deployment status, or showing abnormal situations of other network security rules besides the target network security rule: the rule logic already exists, highly similar rules are detected, etc.

[0030] Therefore, this application proactively injects multi-dimensional contextual information through context injection, achieving a strong binding between rules and security tasks. This generates cybersecurity rules that are tied to user needs, facilitating auditing and backtracking of the security rule lifecycle. Furthermore, it solidifies the syntax and format requirements of security rules through customized prompt word templates, guiding the large language model to directly generate cybersecurity rules that conform to engineering specifications, reducing manual correction costs, lowering the rule-writing threshold, and allowing non-professionals to independently generate effective rules. Further, by combining semantic equivalence verification and similarity matching to construct a dual-track deduplication method, it can accurately solve the problem of rule redundancy with different expressions but consistent logic, adapting to diverse rule scenarios. Moreover, this application combines the natural language parsing capabilities of the large language model, semantic deduplication algorithms, and the engineering application of the MCP (Model Context Protocol, an open communication protocol) protocol, eliminating manual intervention in stages such as writing, deduplication, and deployment, achieving end-to-end automation from natural language requirements to rule activation and use, significantly improving rule iteration efficiency.

[0031] like Figure 2 As shown in the diagram, this embodiment discloses a specific network security rule distribution system module architecture diagram, involving natural language intent parsing, dual-track deduplication, context injection, automated engineering processing, and result feedback and distribution, realizing the automated generation and management of network security rules. Specifically, it includes: Understandably, the core function of the Natural Language Intent Parsing module is to receive user natural language requests, complete intent recognition, model type determination, and rule generation, and output YAML format rules that conform to engineering specifications. The dual-track deduplication module includes an AIQL semantic equivalence verification unit and a Jaccard similarity matching unit. Its core function is to perform logical deduplication and similarity judgment on the generated rules, and output deduplication results and prompts. The core function of the Context Injection module is to inject task identifiers and context information into the generated rules, realize strong binding between rules and security tasks, and ensure traceability. The automated engineering processing module includes a directory-aware compression unit and a secure upload unit. Its core function is to perform engineering processing on the deduplicated rules and complete encrypted upload through the MCP protocol. The core function of the result feedback and distribution module is to receive the upload results, generate a visual access link, provide feedback to the user, complete the standardized distribution and deployment of the rules, and store deduplication records and rule information. Furthermore, the data flow between modules is as follows: Natural Language Intent Parsing Module → Context Injection Module → Dual-Track Deduplication Module → Automated Engineering Processing Module → Result Feedback and Distribution Module, forming a closed-loop logic; If the Dual-Track Deduplication Module detects duplicate or highly similar rules, it directly feeds back to the Result Feedback Module to guide users to reuse existing rules.

[0032] Specifically, the Natural Language Intent Parsing module can receive natural language security requirements input by the user. Through the collaboration of LLM and preset Prompt templates, it can complete intent recognition, rule model type judgment, and automatically generate security rules that conform to YAML format specifications and AIQL syntax requirements without manual intervention. Furthermore, the system first receives user request information via API or a visual interface, receiving natural language input such as "detect successful login after brute-force attack" or "monitor more than 5 abnormal login requests per hour." It also obtains auxiliary information such as the user's department and security task number. Next, it determines the intent and model type by inputting the natural language request into a pre-trained LLM. Combined with a pre-set Prompt template (containing "rule type judgment guidelines, AIQL syntax specifications, YAML format requirements," etc.), the LLM automatically determines the rule model type, including feature matching, association analysis, and frequency statistics, while extracting core detection conditions (such as behavior type, threshold, triggering conditions, etc.). Then, it generates rules and performs standardized preprocessing output. Based on the judgment results (rule model type and specificity), the LLM generates YAML format rules containing AIQL core filtering logic, rule names, descriptions, and output templates. Simultaneously, it performs basic syntax validation on the generated rules, correcting syntax errors (such as mismatched brackets, incorrect keywords, etc.) to ensure the rules are directly executable.

[0033] Furthermore, the standardized YAML rules generated in the above steps are transmitted to the Context Injection module (i.e., injecting context information to obtain the initial network security rules). This injects context information into the generated security rules, achieving a strong binding between the rules and specific security tasks, ensuring the traceability of the rules throughout their entire lifecycle, and meeting security audit compliance requirements. Specifically, collecting context information can automatically collect information such as the security task number (task_id), task name, creator, creation time, and department provided by the user. If the user does not provide a task_id, a unique identifier is automatically generated. The collected context information is then injected into the YAML rules as extended fields, including "task_id, creator, create_time, department, and rule_source (marked as automatically generated by LLM)," forming a complete data structure with the original rule content. Simultaneously, generation logs are retained, recording information such as input requirements, generation time, and LLM version. Furthermore, the rules after context injection can be associated with and stored in a temporary database, generating a traceability index, facilitating subsequent audits by querying complete link information using task_id or rule number. The rules carrying context information are then transmitted to the dual-track deduplication module, while the context information is simultaneously synchronized to the result feedback module for subsequent link generation and logging. Understandably, by actively injecting context information, the problem of "rules being disconnected from tasks" can be solved, enabling full-process traceability from rule generation to deployment and use, meeting the audit and compliance requirements of security operations, and providing data support for rule classification management.

[0034] Furthermore, the dual-track deduplication module involves semantic and other aspects as the core innovation module of this invention. Through the dual-track collaboration of AIQL semantic equivalence verification and Jaccard structural similarity matching, it achieves precise rule deduplication and similarity prompting, eliminates logical redundancy, and at the same time establishes an association with the existing rule library to guide rule reuse. Specifically, first, the rules are split. The YAML rules after Context injection are received and split into the core logic part (AIQL statements) and the non-logic part (rule name, description, output template), and are sent to the corresponding verification units respectively. Among them, the first track is AIQL semantic equivalence verification, which is executed by the AiqlComparator module: 1. Condition normalization. Sort the logical conditions in the AIQL statements. For example, sort "A AND B" and "B AND A" uniformly as "A AND B", and sort "A OR B OR C" in lexicographical order to eliminate the influence caused by the difference in condition order; 2. Syntax unification. Standardize the logical operators (AND, OR, NOT are unified as uppercase), quote types (single quotes are uniformly converted to double quotes), and space formats (remove redundant spaces and retain necessary separator spaces) to ensure consistent syntax expressions; 3. Nested parsing. Use a recursive algorithm to process the nested bracket logic in the AIQL statements, expand the nested structure by levels and then re-sort. For example, "(A AND B) OR C" and "C OR (B AND A)" are unified as "A AND B OR C" after processing to achieve equivalent recognition of nested logic; 4. Equivalence judgment. Compare the preprocessed AIQL statements with the existing AIQL statements in the rule library. If they are exactly the same, it is determined as an absolutely duplicate rule. The second track is Jaccard structural similarity matching. The specific steps include: 1. Word segmentation processing. Perform Chinese word segmentation on the non-logic part of the rules (using the jieba word segmentation algorithm), filter out stop words (such as meaningless words like "of", "used for", "detection", etc.), and extract core keywords; 2. Similarity calculation. Calculate the Jaccard coefficient of the keywords in the non-logic part of the rule to be detected and the existing rules in the rule library (similarity = number of intersection keywords / number of union keywords); 3. Similarity determination. If the Jaccard coefficient ≥ 0.85, it is determined as a highly similar rule; ifIt is understandable that this embodiment can solve the core redundancy problem of "different expressions but consistent logic" by focusing on the equivalence judgment at the semantic level of AIQL. By combining semantic equivalence verification and similarity matching for deduplication, it takes into account both logical accuracy and structural similarity, avoiding absolute redundancy and reducing the repeated generation of highly similar rules. At the same time, the recursive nested parsing capability of AiqlComparator (the algorithm for semantic equivalence verification, which has standardized operators, semantic ranking algorithms and nested logic parsing functions) can adapt to the deduplication requirements of complex AIQL statements and cover more application scenarios.

[0035] Furthermore, the automated engineering processing module performs engineering processing on the rules deduplicated using a dual-track system, achieving directory-aware compression and encrypted upload based on the MCP protocol, ensuring the automation, security, and standardization of the rule distribution process. Specific steps include: 1. Directory-aware location: Based on the rule's model type (feature matching, association analysis, etc.) and department information, automatically locate the preset physical storage directory (e.g., " / security / rules / feature_match / departmentA"), avoiding errors from manual directory searches; 2. Atomic compression: Atomically compress the YAML rule file using a specific compression algorithm (e.g., zip), generating independent rule compressed packages named "task_id_rule_id.zip," ensuring each compressed package corresponds to a unique rule for easy management; 3. Encryption: Encrypt the compressed package using the AES-256 encryption algorithm. The key is automatically generated by the system and stored in association with the rule ID, decryption is only possible for authorized users, ensuring the security of rule transmission and storage; 4. MCP protocol upload. A standardized connection with the server is established based on the Model Context Protocol (MCP). Following the MCP client-server architecture, the encrypted rule package is uploaded to the designated directory on the server. During the upload process, the transmission status is monitored in real time, and automatic retry is initiated if an interruption occurs to ensure transmission reliability. 5. Upload result feedback: After receiving the data, the server returns a confirmation of successful upload and the rule access path. This information is then transmitted to the result feedback and distribution module. It is understandable that the MCP protocol enables standardized uploading of network security rules, solving the problems of fragmented rule distribution processes and poor cross-system compatibility in existing technologies. Directory awareness and atomic compression design ensure the standardization and independence of rule storage, while encryption ensures the security of rules during transmission and storage, preventing leakage.

[0036] Furthermore, the results feedback and distribution module receives feedback information from various modules, outputs visualized results to users, completes the standardized distribution and deployment of rules, and records a full-process log to support subsequent querying and management. Specific steps include: 1. Result classification and processing. Receives deduplication results from the dual-track deduplication module and upload results from the automated engineering processing module, and classifies them as follows: If it is a duplicate / highly similar rule, it organizes existing rule information and reuse guidelines; if it is a new rule, it organizes upload success information, a visualized access link, and deployment status; 2. User feedback. Feedback is provided to users through a visualized interface or API: For duplicate rules, the message "This rule logic already exists, existing rule ID: XXX, path: XXX, should it be reused directly?" is displayed; for highly similar rules, the message "A highly similar rule was detected (similarity: XX), it is recommended to check existing rules before deciding whether to generate it" is displayed; for new rules, the message "Rule uploaded successfully, access link: XXX, deployment status: pending activation / activated" is displayed; 3. Rule distribution and deployment. If the user confirms the reuse of existing rules, the existing rules are automatically associated with the current security task; if it is a new rule, it is automatically deployed to the rule engine of the SOC or situational awareness platform according to the user's instructions and activated; the rule status (pending activation, activated, disabled) is updated synchronously during the deployment process; 4. Intelligent logging and full-link storage. Based on context information, the entire process of "requirement input - rule generation - deduplication verification - upload deployment - user operation - running status" is recorded in traceability logs. The logs contain key details such as the dual-track deduplication verification process and encrypted upload links. A bidirectional index is built through task_id and rule_id, and a hierarchical storage strategy is adopted to adapt to compliance requirements. At the same time, new rules, context information, deduplication records and log data are associated and stored in the core database, updating the rule base while providing data support for system self-optimization, forming a complete closed loop. Understandably, the personalized result feedback and automated distribution and deployment simplify user operations through visual links, while completely recording the entire process logs, forming a closed-loop management of "generation-deduplication-distribution-logging", improving the controllability of security operations.

[0037] In one specific embodiment, such as Figure 3The diagram illustrates a specific network security rule distribution method. Specifically, users can input natural language security requirements (such as "detecting successful login after brute-force attack") through a visual interface or API, simultaneously submitting auxiliary information such as their department and security task number. The natural language intent parsing module receives the requirements, calls the LLM and a preset Prompt template, completes intent recognition and rule model type determination (feature matching / association analysis / frequency statistics), generates initial rules conforming to YAML format specifications and AIQL syntax requirements (i.e., in the above embodiment), and performs basic syntax validation. Afterwards, the Context injection module automatically collects information such as task_id, creator, and creation time, injecting it into the initial rules as extended fields to form complete rules with traceability information, which are then stored in a temporary database. Furthermore, the dual-track deduplication module splits rules into logical parts (AIQL statements) and non-logical parts (names / descriptions, etc.), performing dual-track verification in parallel. During AIQL semantic equivalence verification, the network security rules are first preprocessed with condition normalization, syntax unification, and nested parsing, then compared with existing AIQL statements in the rule base to determine absolute duplication. During Jaccard similarity matching, the non-logical parts are segmented and their similarity calculated, then compared with a 0.85 threshold to determine high similarity. Further, after semantic equivalence verification and similarity matching, if network security rules are found to be absolutely duplicated, reuse information is provided; if highly similar rules are found, the user is prompted for confirmation; if the network security rules are dissimilar, they proceed to the next step of automated engineering processing. Correspondingly, the automated engineering processing module completes directory-aware location, atomic compression (ZIP format), AES-256 encryption, establishes a connection with the server based on the MCP protocol, and uploads the rule package. Understandably, the server receives and stores the rule package, automatically deploys it to the SOC / situational awareness platform rule engine, and returns the deployment status and a visual access link. Understandably, the results feedback and distribution module can push precise feedback information to users: absolutely duplicate rules push reuse guidelines, corresponding rule IDs and storage paths, and support one-click association with the current security task; highly similar rules push similarity values, core difference comparison lists and existing rule preview links to guide users to make quick decisions; new rules push deployment status, visual access links and one-click activation entry.Simultaneously, a three-in-one log mechanism of "multi-dimensional association - hierarchical storage - self-optimization iteration" can be constructed: First, full-volume traceability log recording, covering the original text of the requirement input, LLM generation parameters, dual-track deduplication verification process (including statements before and after AIQL normalization, details of Jaccard coefficient calculation), encrypted upload link information, user operation trajectory, and running data after rule deployment (detection hit rate, false alarm rate); Second, four-dimensional association traceability, through bidirectional indexing of task_id and rule_id, to achieve deep binding of "rule-task-deduplication record-running effect", supporting multi-dimensional fast retrieval; Third, hierarchical storage and compliance self-adaptation, core task logs adopt a local + cloud dual backup strategy, ordinary task logs are compressed and stored as needed, and the built-in compliance verification module automatically adapts to log retention and audit requirements, without the need for additional audit tools; Fourth, self-optimization data support, which can automatically analyze user interaction behavior (repeated rule reuse rate, similar rule ignore rate), and provide feedback on threshold adjustment suggestions to the dual-track deduplication module (such as dynamically increasing the Jaccard threshold to 0.9 in core business scenarios), helping the system iterative optimization. Through the above technical content, this technical solution can avoid the limitations of simply archiving basic logs, upgrade the log module from an auxiliary function to a core support unit of the system, and form a closed-loop optimization of "feedback-recording-adjustment".

[0038] As can be seen, in this embodiment, the natural language intent parsing module is the core of rule generation, the context injection module ensures traceability, the dual-track deduplication module solves the redundancy problem, the automated engineering processing module realizes standardized distribution, and the result feedback and distribution module realizes the process closed loop. All modules work together to support the full lifecycle management of security rules.

[0039] Therefore, this technical solution can generate network security rules bound to user needs information through context injection, facilitating auditing and backtracking of the security rule lifecycle. Furthermore, by combining semantic equivalence verification and similarity matching to construct a dual-track deduplication method, it can accurately identify absolutely duplicate rules and highly similar rules, reducing redundant rule accumulation at the source, lowering storage resource consumption, avoiding rule execution conflicts, improving SOC platform detection efficiency, significantly reducing the workload of rule compilation for operations and maintenance personnel, improving rule adaptability, and lowering operation and maintenance costs. Moreover, the automated processing flow based on the MCP protocol eliminates manual compression, uploading, and deployment steps, improving rule distribution efficiency. Simultaneously, encrypted and standardized protocol transmission avoids rule leakage and human error, ensuring the security and compliance of the distribution process. Furthermore, Context injection combined with intelligent logging and end-to-end storage enables end-to-end rule traceability, improving audit efficiency and eliminating the need for manual analysis of link relationships. Log compliance verification allows logs to adapt to multiple industry security standards, reducing compliance adaptation costs. Based on log data analysis and self-optimization capabilities, the dual-track deduplication threshold and feedback message priority can be dynamically adjusted, continuously improving the system's adaptability to different scenarios. It should be noted that this technical solution's end-to-end traceability and self-optimization system supports the generation of multiple rule types, including feature matching, correlation analysis, and frequency statistics, adapting to various security operation scenarios such as SOCs and situational awareness platforms, while also being compatible with security devices from different brands, significantly improving versatility. Furthermore, this technical solution reduces reliance on core security experts in the network security rule generation and distribution process, lowering labor costs; it also improves threat response speed and reduces losses caused by network attacks; simultaneously, the standardized rule generation and management system promotes the standardized development of the security operations industry, possessing broad application prospects.

[0040] like Figure 4 As shown, this embodiment discloses a network security rule distribution device applied to a client, including: Rule generation module 11 is used to generate initial network security rules corresponding to user requirement information based on context injection; the user requirement information is network security-related requirement information input by the user. The deduplication module 12 is used to deduplicatize the initial network security rule using preset security rule deduplication conditions to obtain the corresponding target network security rule; the preset security rule deduplication conditions include a first deduplication condition constructed based on semantic equivalence verification and a second deduplication condition constructed based on similarity matching. The rule distribution module 13 is used to distribute the target network security rule to the server corresponding to the client.

[0041] Therefore, this application can generate network security rules that are bound to user needs information through context injection, which facilitates the audit and backtracking of the security rule lifecycle; and by combining semantic equivalence verification and similarity matching to build a dual-track deduplication method, redundant rules can be reduced from the source, adaptability can be improved and operation and maintenance costs can be reduced.

[0042] In one specific embodiment, the rule generation module 11 may include: The information acquisition unit is used to acquire user demand information, as well as related user identity authentication information and network security task information; The first rule generation submodule is used to generate a first network security rule corresponding to the user's requirement information through a large language model; The second rule generation unit is used to perform a context injection operation on the first network security rule based on the user identity authentication information and the network security task information to obtain an initial network security rule.

[0043] In one specific embodiment, the first rule generation submodule may include: The intent recognition unit is used to call a preset prompt word template, perform intent recognition on the user's demand information through a large language model, and obtain the corresponding intent recognition result. The first rule generation unit is used to generate a first network security rule corresponding to the user's demand information by combining the intent recognition result and the security rule model type with the large language model; the security rule model type is a security rule model type that is related to the intent recognition result.

[0044] In one specific embodiment, the deduplication module 12 may include: The semantic equivalence verification unit is used to perform semantic equivalence verification on the initial network security rules and the preset network security rules based on the security rule query language, and obtain the corresponding semantic equivalence verification results; the security rule query language is the query language used to describe the filtering logic in the network security detection rules; The similarity calculation unit is used to perform similarity calculation on the initial network security rules and the preset network security rules based on keyword matching, and obtain the corresponding similarity calculation results; The deduplication submodule is used to deduplicatize the initial network security rules based on the semantic equivalence verification result and the similarity calculation result to obtain the corresponding target network security rules.

[0045] In another specific embodiment, the deduplication submodule may include: The deduplication unit is used to deduplicatize the initial network security rule according to the semantic equivalence verification result to obtain the second network security rule, and to deduplicatize the initial network security rule according to the similarity calculation result to obtain the third network security rule. The rule determination unit is used to determine the network security rules that are repeated between the second network security rule and the third network security rule as the target network security rule.

[0046] In one specific embodiment, the rule distribution module 13 may include: The rule distribution unit is used to perform engineering processing on the target network security rules and distribute the processed network security rules to the server corresponding to the client based on the large model context protocol; wherein, the engineering processing includes directory awareness processing, compression processing and encryption processing.

[0047] In one specific embodiment, the device may further include: The rule push module is used to push network security rules other than the target network security rule from the initial network security rules to the client's interactive interface so that the user can view them.

[0048] Furthermore, embodiments of this application also disclose an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0049] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network security rule distribution method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0050] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0051] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0052] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the network security rule distribution method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0053] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned network security rule distribution method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0054] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0055] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0056] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0057] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0058] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only intended to help understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for distributing network security rules, characterized in that, Applied to the client side, including: Initial network security rules are generated based on context injection, corresponding to user requirements information; the user requirements information refers to network security-related requirements input by the user. The initial network security rules are deduplicated using preset security rule deduplication conditions to obtain the corresponding target network security rules; the preset security rule deduplication conditions include a first deduplication condition constructed based on semantic equivalence verification and a second deduplication condition constructed based on similarity matching. The target network security rules are distributed to the server corresponding to the client.

2. The network security rule distribution method according to claim 1, characterized in that, The method of generating initial network security rules corresponding to user requirement information based on context injection includes: Obtain user demand information, as well as related user authentication information and network security task information; A first network security rule corresponding to the user's needs information is generated using a large language model; Based on the user identity authentication information and the network security task information, a context injection operation is performed on the first network security rule to obtain the initial network security rule.

3. The network security rule distribution method according to claim 2, characterized in that, The generation of the first network security rule corresponding to the user's needs information through a large language model includes: The system calls a preset prompt word template and uses a large language model to perform intent recognition on the user's needs information to obtain the corresponding intent recognition results. Using the large language model, a first network security rule corresponding to the user's needs information is generated by combining the intent recognition result and the security rule model type; the security rule model type is a security rule model type that is related to the intent recognition result.

4. The network security rule distribution method according to claim 1, characterized in that, The process of deduplicating the initial network security rules using preset security rule deduplication conditions to obtain the corresponding target network security rules includes: The initial network security rules and the preset network security rules are semantically equivalent to each other based on the security rule query language, and the corresponding semantic equivalence verification results are obtained; the security rule query language is the query language used to describe the filtering logic in the network security detection rules. The initial network security rules and the preset network security rules are similar to each other based on keyword matching to obtain the corresponding similarity calculation results. Based on the semantic equivalence verification result and the similarity calculation result, the initial network security rules are deduplicated to obtain the corresponding target network security rules.

5. The network security rule distribution method according to claim 4, characterized in that, The step of deduplicating the initial network security rules based on the semantic equivalence verification result and the similarity calculation result to obtain the corresponding target network security rules includes: The initial network security rule is deduplicated based on the semantic equivalence verification result to obtain the second network security rule, and the initial network security rule is deduplicated based on the similarity calculation result to obtain the third network security rule. The network security rules that overlap between the second network security rule and the third network security rule are identified as the target network security rules.

6. The network security rule distribution method according to claim 1, characterized in that, The step of distributing the target network security rules to the server corresponding to the client includes: The target network security rules are engineered and distributed to the corresponding server of the client based on the large model context protocol. The engineering processes include directory awareness processing, compression processing, and encryption processing.

7. The network security rule distribution method according to any one of claims 1 to 6, characterized in that, After obtaining the corresponding target network security rules, the process also includes: The network security rules in the initial network security rules, excluding the target network security rule, are pushed to the client's interactive interface for the user to view.

8. A network security rule distribution device, characterized in that, Applied to the client side, including: The rule generation module is used to generate initial network security rules corresponding to user requirement information based on context injection; the user requirement information is network security-related requirement information input by the user. The deduplication module is used to deduplicatize the initial network security rules using preset security rule deduplication conditions to obtain the corresponding target network security rules; the preset security rule deduplication conditions include a first deduplication condition constructed based on semantic equivalence verification and a second deduplication condition constructed based on similarity matching. The rule distribution module is used to distribute the target network security rules to the server corresponding to the client.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the network security rule distribution method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the network security rule distribution method as described in any one of claims 1 to 7.

Images