A multi-source alarm data fusion method and system based on knowledge retrieval association and a large language model, and a storage medium

Abstract

The application provides a multi-source alarm data fusion method and system based on knowledge retrieval association and a large language model, and a storage medium, which comprises the following steps: step 1, constructing a security field knowledge base in combination with a large language model; step 2, constructing a knowledge portrait for each data object; step 3, respectively fusing table-level and field-level features in a knowledge base channel and a semantic score channel, linearly superimposing keyword scores and semantic scores to obtain a final comprehensive matching score between source fields and target fields; step 4, using a table-level candidate filter independent of the large language model to select a preset number of candidate target tables with the highest association degree from all target tables for each heterogeneous source table; and step 5, inputting the source table and the candidate table into the large language model to perform table-level rough sorting based on the context of the same table and sibling columns. The application has the beneficial effect of effectively overcoming the defects of weak generalization ability, high maintenance cost and easy failure of traditional pattern matching based on regular expressions.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more particularly to the field of artificial intelligence technology such as database pattern matching and large language model classification. Specifically, it relates to a method, system and storage medium for multi-source alarm data fusion based on knowledge retrieval association and large language model. Background Technology

[0002] With the evolution of network architecture and the increasing complexity of network attacks, large information systems typically deploy a large number of heterogeneous security protection and detection devices (such as firewalls, web application firewalls, endpoint detection and response systems, intrusion prevention systems, etc.). These multi-source devices generate massive amounts of security alerts and log data with varying structures during operation. Due to the lack of mandatory unified industry standards, the data output by each device differs significantly in structure, granularity, and field definitions, making it difficult to directly perform cross-device event correlation and global situational awareness analysis.

[0003] Pattern matching is a crucial foundational step in achieving multi-source alarm data fusion, but its practical application faces two major technical bottlenecks: First, inconsistencies between data granularity and form logic. For the same network behavior, some devices may decouple it into multiple forms such as alarm level and event level, including fine-grained features like source MAC addresses, while others only output a single-dimensional summary form, leading to difficulties in cross-form mapping. Second, ambiguous field semantics and non-standardized naming. Security device logs often use vendor-defined proprietary abbreviations or specific business terms (e.g., expressing source IP addresses as sip, src_ip, or source_addr). Such non-standard expressions increase the complexity of field identification and semantic alignment, making it difficult to effectively extract deep-seated high-risk threat clues. To support high-level security operation tasks (such as automated response, security report generation, attack chain reconstruction, and threat organization tracing), it is urgent to accurately map and convert the aforementioned multi-source heterogeneous alarm data into a unified security event ontology to build a standardized security data foundation.

[0004] Currently, the mainstream technologies for pattern matching of heterogeneous data mainly include rule-based matching methods and large language model-based matching methods. Rule-based or regular expression-based methods rely on manually predefined mapping dictionaries for feature matching. This method is highly dependent on the prior knowledge of domain experts, has weak generalization ability, high maintenance costs, and is prone to rule failure when device firmware is updated or new fields are added. On the other hand, pattern matching methods based on large language models have been gradually introduced in recent years, but directly applying general large language models for zero-shot matching has obvious limitations: First, models that have not been sufficiently fine-tuned with vertical security corpora lack understanding of long-tail knowledge and obscure abbreviations in the security domain, easily leading to semantic drift or matching errors; second, processing long texts and massive fields results in excessive computational overhead; finally, most existing methods analyze single fields in isolation, failing to fully extract and utilize the implicit contextual logical relationships between other fields within the same form, making it difficult to accurately parse complex cross-table relational semantics.

[0005] The information disclosed in this background section is intended only to enhance understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0006] To address the problems of poor generalization of rule matching and low accuracy and lack of contextual association in existing technologies, this invention proposes a multi-source alarm data fusion method based on knowledge retrieval and large language models.

[0007] This invention provides a method for fusing multi-source alarm data with knowledge retrieval association and large language models, including: Step 1: Construct a security domain knowledge base by combining large language models: Utilize the entity extraction and concept alignment capabilities of large language models to perform batch parsing and information purification on unstructured and semi-structured corpora in the cybersecurity field, thereby constructing a structured security domain knowledge base containing standardized entities, abbreviations, aliases, and semantic descriptions. Step 2, Entity Knowledge Base Profile Construction: Construct a knowledge profile for each data object, specifically including: For each data object, calculate the profile matching sub-score between the data object and each security knowledge node; sort all security knowledge nodes in descending order of the matching sub-score, and select the top-scoring nodes. N Each knowledge node serves as a knowledge profile for the data object; wherein, the physical meaning of the knowledge profile is the set of security ontology knowledge nodes most relevant to the corresponding data object; the knowledge profile includes source field profile, source table profile, target field profile, and target table profile. Step 3, Source Field and Target Field Score Generation: Fuse table-level and field-level features in the knowledge base channel and semantic scoring channel respectively, calculate keyword scores and semantic scores, and linearly superimpose the keyword scores and semantic scores to obtain the final comprehensive matching score between the source field and the target field; for each source field, traverse all target fields and calculate the final comprehensive matching score between it and each target field; sort the target fields in descending order according to the final comprehensive matching scores, and extract a preset number of target fields with the highest ranking, and use this set as a high-quality broad candidate pool; Step 4, Table-level filtering: A table-level candidate filter is used to select a preset number of candidate target tables with the highest relevance for each source table from all target tables, thus limiting the search space in the subsequent coarse ranking stage; the table-level candidate filter does not rely on direct comparison of table names, but instead allows all fields in the source table to vote together; Step 5, Large Language Model Coarse Ranking: Input the source table and the candidate target table into the large language model for table-level coarse ranking based on the context of sibling columns in the same table; Step 6, Fine Ranking of the Large Language Model: The input of the large language model is switched to a micro view of a single source field, and the output of the large language model is a decision instruction. The decision instruction is used to indicate whether to keep the coarse ranking at Rank-1 or to promote a new candidate from the broad candidate pool to Rank-1. After the system receives the decision, it generates the final mapping sequence through a candidate set shifting mechanism. The finely ranked sequence is used as the output to drive the automatic fusion and transformation of multi-source heterogeneous security data into standard event ontology.

[0008] As a further improvement of the present invention, in step 1, the unstructured and semi-structured corpora in the field of network security are derived from authoritative network security standards and specifications, open-source security ontology definitions, and data description dictionaries published by vendors.

[0009] As a further improvement of the present invention, in step 1, in terms of data representation, the constructed knowledge base consists of discrete and independent knowledge nodes, each of which... A unique standard security attribute is formally defined as a triple structure: ,in, Indicates keywords, This represents a set of strings that encompass keyword heterogeneous abbreviations, aliases, or underscore naming styles that may appear in devices from various manufacturers. This indicates a deep semantic description of the business meaning of the field and the basis for its interpretation.

[0010] As a further improvement of the present invention, in step 2, the image matching sub-segment The calculation formula is as follows: (1) For object names and knowledge node keywords k / aliases Jaro-Winkler string similarity; Description of objects and knowledge nodes based on instructions Soft-TFIDF text similarity; The cosine similarity between the semantically dense vector of an object and the semantically dense vector of a knowledge node.

[0011] As a further improvement of the present invention, in step 3, in the knowledge base channel, for any two portraits and Calculate the following key indicators: Image overlap: Let the set of shared nodes be... If the set is empty, the score is 0; if it is not empty, the average of the minimum scores of the shared nodes in both profiles is taken. : (2) in, This represents the score of fields and keywords in the knowledge base. and Represents a field. This represents keywords in the knowledge base; Semantic similarity: The system extracts the top K node vectors from each profile and performs semantic similarity analysis on each profile. Search for the image at each node in the process. Find the nodes with the highest cosine similarity and calculate their mean: (3) in, They are nodes semantic feature vectors, This indicates the semantic similarity between fields a and b; Then, based on the image overlap index and semantic similarity index, table-level knowledge scores are calculated respectively. Field-level knowledge scoring : (4) (5) in, Indicates the source field. Indicates the target field. and Indicates hyperparameters, A knowledge profile representing a table or field. Indicates semantic similarity channels, Indicates the source table, Represent the target table; Finally, by integrating table-level and field-level features, the total score for the knowledge base channel is obtained as follows: (6) Indicates keyword score, This represents the keyword score of the table object. Indicates the score of keywords at the field level; In step 3, within the semantic scoring channel, the cosine dot product similarity is calculated using semantically dense vectors generated by the pre-trained language model, taking into account both table-level and field-level contexts, as shown in the following formula: (7) Indicates semantic similarity score, express semantic embedding, express semantic embedding, express semantic embedding, express Semantic embedding; In step 3, the final comprehensive matching score is... The formula is as follows: (8).

[0012] As a further improvement of the present invention, in step 4, the source field in the source table is... Calculate the mean dimension of the internal fields of the target table T. Overall dimensions of the target table The details are as follows: Steps for calculating the mean dimension of a field: For each field in the target table T Calculate its relationship with the source field The feature pairs are scored, and the average of all fields in the target table is calculated. This dimension measures whether a similar field cluster can be found within the target table for the source field, as shown in the following formula: (9) in, This represents the collection of all fields in a table T. This indicates the final overall matching score; The steps for calculating the overall dimension of a table are as follows: This measure determines whether the semantics of the source field conform to the overall security theme of the target table. The formula is as follows: (10) Indicates source field With target table The scores from the keyword channel and the semantic channel are linearly superimposed; Then, the mean dimension of the field and the overall dimension of the table are weighted and merged to obtain the source field. Single-field target table scoring from a specific perspective: (11) in accordance with Sort in descending order and extract a preset number of candidate target tables for each source table.

[0013] As a further improvement of the present invention, in step 6, the micro view specifically includes: current source field information, the context of the source table, the mapping results of the preset number of other fields in the same table in the coarse-ranking stage, and candidate data for two different paths: the preset number of candidates generated in the coarse-ranking stage and a global field-level broad candidate pool generated by matching the field knowledge base and not subject to table-level filtering restrictions.

[0014] The present invention also discloses a multi-source alarm data fusion system based on knowledge retrieval association and large language model, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when called by the processor.

[0015] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0016] Key technical points of this invention: 1. This invention addresses the fusion of multi-source heterogeneous data by innovatively proposing the construction of a knowledge base combining domain expert knowledge. It utilizes dual-channel feature retrieval through knowledge profiling and semantic overlap calculations, establishing precise semantic and prior associations between heterogeneous fields and standard ontologies. Existing technologies often rely on regular expression matching or single vector similarity, resulting in weak generalization and easy confusion of abbreviations. To our knowledge, this is the first time knowledge profiling has been introduced into the recall stage of pattern matching. Therefore, the innovative approach of this invention lies in applying the aforementioned fusion method based on knowledge profiling and dual-channel retrieval to data pattern matching. Its applicability extends beyond network security alarm fusion to other fields such as healthcare and finance, where highly heterogeneous data and proprietary abbreviations exist.

[0017] 2. Based on the candidate pool constructed using the aforementioned knowledge retrieval, this invention further proposes a two-stage re-ranking method for large language models based on co-table context and a candidate set correction mechanism. Existing matching schemes based on large models typically analyze single fields in isolation, which is highly susceptible to misjudgments due to model illusion. This method resolves ambiguity of isolated fields by introducing co-table column context in the coarse-ranking stage, and combines a candidate set boosting mechanism in the fine-ranking stage, maintaining a fault-tolerant baseline while aggressively exploring optimal candidates. To our knowledge, this is also the first study on pattern matching for large language models based on column collaborative reasoning and a candidate set correction mechanism. Therefore, this invention claims protection for a multi-source heterogeneous data fusion method for two-stage re-ranking of large models and its related automated analysis applications.

[0018] The beneficial effects of this invention are: 1. This invention, based on multi-source heterogeneous security device alarms, integrates network security standards and specifications with device dictionaries from various manufacturers to construct a domain-specific prior knowledge base containing standardized entities, abbreviations, aliases, and semantic descriptions. This method effectively overcomes the shortcomings of traditional regular expression-based pattern matching, such as weak generalization ability, high maintenance costs, and susceptibility to failure. Simultaneously, by using the structured knowledge base as a "reference manual," it provides objective prior constraints for large language models through multi-dimensional feature retrieval, significantly suppressing the "illusion" phenomenon that pure large models are prone to when processing long-tail fields and obscure abbreviations in vertical security domains, fundamentally improving the reliability of data alignment.

[0019] 2. This invention proposes a two-stage large language model reordering inference framework of "filtering, coarse ranking, and correction". By precisely limiting the candidate space through table-level association filtering, it effectively overcomes the computational efficiency bottleneck and attention distraction problem of traditional large models when handling massive forms. In the table-level coarse ranking stage, contextual constraints of columns within the same table are introduced to resolve semantic ambiguity of isolated security fields. In the correction stage, a global retrieval candidate pool mechanism is innovatively combined. This framework endows the model with the ability to explore globally better matches. The unified standard alarm data output by this invention can provide a high-quality, standardized data foundation for network security analysts and downstream tasks such as automated security response, covert attack chain mining, and threat tracing. It also demonstrates state-of-the-art fusion performance and extremely high engineering practical value in actual pattern matching benchmark tests. Attached Figure Description

[0020] Figure 1 This is a diagram illustrating the knowledge base construction and pattern entity matching scheme of this invention; Figure 2 This is the two-stage recall diagram of the large model of this invention. Detailed Implementation

[0021] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0022] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0023] This invention discloses a multi-source alarm data fusion method based on knowledge retrieval association and a large language model. This method constructs a prior knowledge base in the security domain, uses knowledge base retrieval as a pre- and auxiliary module for large language model reasoning, providing the model with definite prior constraints. It utilizes multi-path feature comparison and delayed interaction techniques for candidate set recall, and introduces contextual information from the same table to assist LLM in table-level logical reasoning. Furthermore, in the fine-ranking stage, the model output is effectively constrained through candidate set fusion and dynamic selection mechanisms, reducing the false matching rate, thereby achieving efficient and accurate conversion of multi-source heterogeneous alarm data into a standard alarm form.

[0024] This invention, based on multi-source heterogeneous security alarm log data, integrates field definitions, proprietary abbreviation features, and standard security semantics from various security devices to construct a domain knowledge base for alarm data standardization. For pattern matching tasks in heterogeneous alarm data fusion, a matching strategy combining multi-path feature recall and a two-stage reordering using a large language model is proposed. This method achieves state-of-the-art performance on relevant publicly available pattern matching benchmark datasets, providing a high-quality data foundation for downstream tasks such as automated security analysis, attack chain identification, and organization attribution.

[0025] In a security environment, alarm data generated by devices from different vendors exhibits high heterogeneity in field structure, granularity, and naming conventions. To achieve global automated security operations and situational analysis, the primary task is to perform high-precision pattern matching on multi-source alarm data, thereby mapping and standardizing it to a unified security event ontology model.

[0026] like Figure 1-2 As shown, this invention discloses a method for fusing multi-source alarm data based on knowledge retrieval association and a large language model, including: Step 1: First, a security domain knowledge base is constructed using a large language model. The original corpus of this knowledge base mainly comes from authoritative cybersecurity standards and specifications (such as STIX, ECS, and other frameworks), open-source security ontology definitions, and publicly available data description dictionaries from vendors. During the construction process, the entity extraction and concept alignment capabilities of the large language model are utilized to perform batch parsing and information purification of the aforementioned unstructured and semi-structured corpora, thereby constructing a high-density structured knowledge base.

[0027] In terms of data representation, the constructed knowledge base consists of a series of discrete and independent knowledge nodes. Each knowledge node... A unique standard security attribute is formally defined as a triple structure: .in, Indicates keywords (e.g., source_address); This represents a collection of strings that may appear in devices from multiple manufacturers, including heterogeneous abbreviations, aliases, or underscore naming styles (e.g., sip, src_ip, attacker_ip). This indicates a deep semantic description of the business meaning of the field and the basis for its interpretation.

[0028] The design motivation for constructing this knowledge base in this invention deeply aligns with the behavioral paradigm of human security experts when performing complex log mapping tasks. In actual security operations, when faced with unknown or obscure vendor-specific fields, security experts cannot rely solely on subjective guesses based on experience; instead, they must frequently consult various official technical documents, reference manuals, or data dictionaries to eliminate semantic ambiguity. The knowledge base constructed by this invention essentially serves as a "digital expert reference manual" within an automated system.

[0029] After the above construction is completed, the knowledge base is persistently deployed and delivered as a core knowledge infrastructure to downstream project pipelines. In the subsequent heterogeneous data access phase, the knowledge base will accept real-time queries from the system, providing objective prior knowledge constraints and inference benchmarks for multi-path feature retrieval and large-model two-stage reordering tasks.

[0030] Step 2, Entity Knowledge Base Profile Construction: For any given source field With target field This method comprehensively evaluates the matching from four dimensions: the semantic similarity of the source / target fields themselves, the semantic similarity of the context in the source / target tables, the overlap of the matched security knowledge concepts, and the semantic vector distance of the matched security knowledge concepts. The final field matching score is composed of the sum of the "knowledge base channel score" and the "semantic channel score".

[0031] Before performing pairwise matching, the system first constructs a unique knowledge profile for each of the four types of data objects, namely, a source field profile. , source table image Target Field Profiling And target table profile The physical meaning of a knowledge profile is the set of security ontology knowledge nodes most relevant to the object. For any data object... With security knowledge nodes The system calculates its profile matching sub-segments. : (1) For object names and knowledge node keywords k / aliases Jaro-Winkler string similarity; Description of objects and knowledge nodes based on instructions Soft-TFIDF text similarity; The cosine similarity is calculated between the semantically dense vectors of objects and knowledge nodes. These semantically dense vectors are encoded using the all-MiniLM-L6-v2 model. For each object... The system according to Sort in descending order and keep only the top scorers. Knowledge Nodes Constructing its knowledge profile .

[0032] Step 3, Source and Target Field Scores Generation: The knowledge base channel aims to measure the degree of overlap between the source object and the target object in the prior secure knowledge space. For any two profiles... and The system calculates two key indicators: (1) Image overlap: Measures whether objects hit the same security concept. Let the set of shared nodes be... If the set is empty, the score is 0; if it is not empty, the average of the minimum scores of the shared nodes in both profiles is taken. : (2) in, This represents the scores of fields and keywords in the knowledge base, with the two values ​​in parentheses being (field, keyword). The result is the score of both fields and keywords within the knowledge base system. and This formula calculates the overlap of the knowledge base profiles for two fields. This represents a keyword in the knowledge base that belongs to the Shared(a,b) set.

[0033] (2) Semantic Similarity: Used to bridge the semantic gap when precise words are not matched (e.g., the source matches "remote access," the target matches "initial intrusion," the concepts are not exactly the same but the vectors are similar). The system extracts the top K node vectors from each profile, targeting... For each node in the list, search Find the nodes with the highest cosine similarity and calculate their mean: (3) in, They are nodes semantic feature vectors, This represents the semantic similarity between fields a and b. Based on these two metrics, the system calculates table-level knowledge scores (compared to the source table). With target table ) and field-level knowledge score (comparison of source fields) With target field ): (4) (5) in, Indicates the source field. Indicates the target field. and These represent two hyperparameters used to control the ratio of overlap score to semantic score. A knowledge profile representing a table or field. Indicates semantic similarity channels, This represents the source table. Indicates the target table; Finally, by combining table-level and field-level features, the total score for this channel is obtained as follows: (6) Next, we calculate the cosine dot product similarity using semantically dense vectors generated by the pre-trained language model. This also integrates table-level and field-level context. (7) Indicates semantic similarity score, express (Source table) Embedding (semantic embedding). express Embedding (semantic embedding) of the target table. express (Source field) Embedding (semantic embedding). express Embedding (semantic embedding) of (target field).

[0034] Finally, the system linearly superimposes the scores from both channels to obtain the source field. With target field The final overall matching score between them: (8) For each source field The system iterates through all target fields and calculates... Subsequently, the target fields are sorted in descending order based on the comprehensive matching score, and the top-ranked (Top-30) target fields are selected. This set serves as a high-quality "broad candidate pool" and is passed to the downstream large language model's fine ranking stage. The large language model will refer to these candidates and their scores to decide whether to promote a long-tail feature candidate to the final Top-1 position.

[0035] Step 4, Table-level Filtering: For massive ontology target tables, directly relying on a large model for matching would lead to severe attention distraction and context overload. Therefore, this invention designs a table-level candidate filter independent of the large language model. Its function is to filter the top-5 candidate target tables with the highest relevance for each source table from all target tables, limiting the search space in the subsequent coarse-ranking stage. This filter does not rely on direct comparison of table names, but rather allows "all fields in the source table to vote together." This applies to the source fields in the source table. The system calculates the mean dimension of the internal fields of the target table T. Overall dimensions of the target table : (1) Field mean dimension calculation: For each field in the target table T Calculate its relationship with the source field The feature pairs are scored, and the average of all fields in the target table is calculated. This dimension measures whether a similar cluster of fields can be found within the target table for the source field. (9) (2) Overall table dimension calculation: This measures whether the semantics of the source fields conform to the overall security theme of the target table. (10) Indicates source field With target table The scores from the keyword channel and the semantic channel are linearly superimposed.

[0036] The system weights and merges the two dimensions mentioned above to obtain the source field. Single-field target table scoring from a specific perspective: (11) System basis Sort the data in descending order and extract the top-5 candidate target tables for each source table. Input the source tables and these candidate target tables into a large language model for the first round of table-level coarse sorting based on the context of sibling columns within the same table.

[0037] Step 5, Large Language Model Coarse Ranking: The design motivation for batch input in this stage is to utilize "table-level consistency." By inputting the source table as a whole, the large language model can observe the contextual constraints formed by "sibling columns in the same table." For example, when processing a security log table, if the model analyzes a single field in isolation, it may not be able to determine its exact meaning; however, when the model simultaneously sees other related attributes existing in the same table, it can significantly improve the overall matching accuracy of the target fact table based on security logic constraints.

[0038] Step 6, Large Language Model Fine Ranking: The second stage of the large model fine ranking in this invention performs a "global correction" with a tolerance baseline. In this stage, the model's input switches to a micro-view of a single source field, specifically including: current source field information, the context of the source table, the Top-1 mapping results of other fields in the same table during the coarse ranking stage, and candidate data from two different pathways: one is the Top-5 candidates generated during the coarse ranking stage; the other is a global field-level broad candidate pool generated by matching the field knowledge base, unrestricted by table-level filtering. The model's output is not a regenerated ranking, but a decision instruction: maintain the coarse ranking Rank-1, or promote a new candidate from the broad candidate pool to Rank-1. After receiving the decision, the system generates the final mapping sequence through a candidate set shifting mechanism. If the decision is "promote new candidate X", the original Rank-1 is moved one position to the next, becoming Rank-2, and so on.

[0039] During the fine-ranking phase, the large language model mines more precise security fields from the global retrieval candidate pool. This mechanism provides a margin of error while aggressively exploring global extrema, reducing the risk of harming the overall recall rate. Ultimately, the finely ranked sequence will be used as output to drive the automated fusion and transformation of multi-source heterogeneous security data into a standard event ontology.

[0040] To fully verify the effectiveness and advancement of the proposed multi-source heterogeneous data pattern matching method, we conducted comparative tests on the MIMIC pattern matching benchmark dataset, comparing our approach with the current best pattern matching method. The evaluation used a rigorous Hit@K metric as the core evaluation indicator. Specific experimental comparison data are shown in Table 1. Table 1. Experimental results of the present invention and related comparative methods. Experimental results show that the proposed solution achieves significant performance improvements across all evaluation metrics, reaching the current state-of-the-art level. The method of this invention demonstrates extremely high engineering practical value and technological advancement in multi-source alarm data fusion and complex pattern mapping tasks.

[0041] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for fusing multi-source alarm data based on knowledge retrieval association and a large language model, characterized in that, include: Step 1: Construct a security domain knowledge base by combining large language models: Utilize the entity extraction and concept alignment capabilities of large language models to perform batch parsing and information purification on unstructured and semi-structured corpora in the cybersecurity field, thereby constructing a structured security domain knowledge base containing standardized entities, abbreviations, aliases, and semantic descriptions. Step 2, Entity Knowledge Base Profile Construction: Construct a knowledge profile for each data object, specifically including: For each data object, calculate the profile matching sub-score between the data object and each security knowledge node; sort all security knowledge nodes in descending order of the matching sub-score, and select the top-scoring nodes. N Each knowledge node serves as a knowledge profile for the data object; wherein, the physical meaning of the knowledge profile is the set of security ontology knowledge nodes most relevant to the corresponding data object; the knowledge profile includes source field profile, source table profile, target field profile, and target table profile. Step 3, Source Field and Target Field Score Generation: Fuse table-level and field-level features in the knowledge base channel and semantic scoring channel respectively, calculate keyword scores and semantic scores, and linearly superimpose the keyword scores and semantic scores to obtain the final comprehensive matching score between the source field and the target field; for each source field, traverse all target fields and calculate the final comprehensive matching score between it and each target field; sort the target fields in descending order according to the final comprehensive matching scores, and extract a preset number of target fields with the highest ranking, and use this set as a high-quality broad candidate pool; Step 4, Table-level filtering: A table-level candidate filter is used to select a preset number of candidate target tables with the highest relevance for each source table from all target tables, thus limiting the search space in the subsequent coarse ranking stage; the table-level candidate filter does not rely on direct comparison of table names, but instead allows all fields in the source table to vote together; Step 5, Large Language Model Coarse Ranking: Input the source table and the candidate target table into the large language model for table-level coarse ranking based on the context of sibling columns in the same table; Step 6, Fine Ranking of the Large Language Model: The input to the large language model is switched to a micro-view of a single source field, and the output of the large language model is a decision instruction. The decision instruction is used to indicate whether to maintain the coarse ranking at Rank-1 or to promote a new candidate from the broad candidate pool to Rank-1. After the system receives the decision, it generates the final mapping sequence through a candidate set shifting mechanism. The finely ranked sequence is used as the output to drive the automatic fusion and transformation of multi-source heterogeneous security data into standard event ontology. In step 2, the image matching sub-segment The calculation formula is as follows: (1) For object names and knowledge node keywords k or aliases Jaro-Winkler string similarity; The description of the object and the knowledge nodes are based on the explanation. Soft-TFIDF text similarity; Cosine similarity between the semantically dense vector of an object and the semantically dense vector of a knowledge node; In step 3, within the knowledge base channel, for any two portraits and Calculate the following key indicators: Image overlap: Let the set of shared nodes be... If the set is empty, the score is 0; if it is not empty, the average of the minimum scores of the shared nodes in both profiles is taken. : (2) in, This represents the score of fields and keywords in the knowledge base. and Represents a field. This represents keywords in the knowledge base; Semantic similarity: The system extracts the top K node vectors from each profile and performs semantic similarity analysis on each profile. Search for the image at each node in the process. Find the nodes with the highest cosine similarity and calculate their mean: (3) in, They are nodes semantic feature vectors, This indicates the semantic similarity between fields a and b; Then, based on the image overlap index and semantic similarity index, table-level knowledge scores are calculated respectively. Field-level knowledge scoring : (4) (5) in, Indicates the source field. Indicates the target field. Indicates hyperparameters, A knowledge profile representing a table or field. Indicates semantic similarity channels, Indicates the source table, Represent the target table; Finally, by integrating table-level and field-level features, the total score for the knowledge base channel is obtained as follows: (6) Indicates keyword score, This represents the keyword score of the table object. Indicates the score of keywords at the field level; In step 3, within the semantic scoring channel, the cosine dot product similarity is calculated using semantically dense vectors generated by the pre-trained language model, taking into account both table-level and field-level contexts, as shown in the following formula: (7) Indicates semantic similarity score, express semantic embedding, express semantic embedding, express semantic embedding, express semantic embedding; In step 3, the final comprehensive matching score is... The formula is as follows: (8)。 2. The multi-source alarm data fusion method according to claim 1, characterized in that, In step 1, the unstructured and semi-structured corpora in the field of cybersecurity are derived from authoritative cybersecurity standards and specifications, open-source security ontology definitions, and publicly available data description dictionaries from vendors.

3. The multi-source alarm data fusion method according to claim 1, characterized in that, In step 1, the constructed knowledge base, in terms of data representation, consists of discrete and independent knowledge nodes, each of which... A unique standard security attribute is formally defined as a triple structure: ,in, Indicates keywords, This represents a set of strings that encompass keyword heterogeneous abbreviations, aliases, or underscore naming styles that may appear in devices from various manufacturers. This indicates a deep semantic description of the business meaning of the field and the basis for its interpretation.

4. The multi-source alarm data fusion method according to claim 1, characterized in that, In step 4, the source fields in the source table are... Calculate the mean dimension of the internal fields of the target table T. Overall dimensions of the target table The details are as follows: Steps for calculating the mean dimension of a field: For each field in the target table T Calculate its relationship with the source field The feature pairs are scored, and the average of all fields in the target table is calculated. This dimension measures whether a similar field cluster can be found within the target table for the source field, as shown in the following formula: (9) in, This represents the set of all fields in a table T. This indicates the final overall matching score; The steps for calculating the overall dimension of a table are as follows: This measure determines whether the semantics of the source field conform to the overall security theme of the target table. The formula is as follows: (10) Indicates source field With target table The scores from the keyword channel and the semantic channel are linearly superimposed; Then, the mean dimension of the field and the overall dimension of the table are weighted and merged to obtain the source field. Single-field target table scoring from a specific perspective: (11) in accordance with Sort in descending order and extract a preset number of candidate target tables for each source table.

5. The multi-source alarm data fusion method according to claim 1, characterized in that, In step 6, the micro view specifically includes: the current source field information, the context of the source table, the mapping results of the preset number of other fields in the same table during the coarse-ranking stage, and candidate data for two different paths: the preset number of candidates generated during the coarse-ranking stage and a global field-level broad candidate pool generated by matching the field knowledge base, which is not subject to table-level filtering restrictions.

6. A multi-source alarm data fusion system based on knowledge retrieval association and large language model, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method of any one of claims 1-5 when invoked by the processor.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-5 when invoked by a processor.

Images