A multi-source log association security hosting closed-loop treatment method

Abstract

This invention proposes a secure managed platform closed-loop handling method for multi-source log association. The method includes: collecting multi-source logs (identity authentication, interface calls, data transmission, asset authorization) under client authorization; preprocessing, anonymizing, and vector mapping; and generating anonymized evidence units by time weighting; calculating the relationship strength between evidence units; organizing qualified units into candidate interpretations (including supporting / conflicting evidence, behavioral chains, and interveneable nodes); selecting the primary interpretation based on a comprehensive score; generating a handling contract (evidence conditions, triggering conditions, boundary conditions, and handling actions); calculating a readiness value before execution; and determining closed-loop handling based on evidence changes after execution. This invention enables secure managed platforms to reduce the risk of misjudgment and mishandling in scenarios with high business continuity, such as medical devices, intelligent control systems, and information security transmission supervision, while improving the clarity of handling basis, the controllability of execution actions, and the predictability of closed-loop results.

Description

Technical Field

[0001] This invention belongs to the field of multi-source log security hosting, and particularly relates to a closed-loop method for security hosting of multi-source log association. Background Technology

[0002] With the deployment of medical device networking, intelligent control system integration, and information security transmission monitoring platforms in hospitals, industrial parks, and government and enterprise clients, secure managed platforms need to continuously monitor information such as identity authentication, interface calls, data transmission, and asset authorization within the client's authorized boundaries, and handle any anomalies detected.

[0003] Existing security operations platforms typically handle multi-source logs using methods such as log rule matching, time window aggregation, alarm merging, threat intelligence matching, or pre-set script orchestration. While these methods are effective within an enterprise's proprietary security systems, they have significant limitations in managed security scenarios. Managed platforms usually cannot directly grasp the full system status at the customer's site and can only make judgments based on logs and asset policies within the authorized scope. The same set of authentication, interface call, and data transmission records may correspond to multiple causes such as abnormal account use, abnormal interface configuration, legitimate business calls, or abnormal transmission tasks. Directly merging multi-source logs into a single alarm can easily lead to misjudgments. On the other hand, medical devices, intelligent control systems, and critical data transmission links have high business continuity requirements. Managed platforms cannot directly freeze sessions, restrict interfaces, suspend transmission tasks, or adjust access policies based solely on risk levels, as this could affect diagnostic and treatment operations, control links, or the exchange of core customer data. Existing automated response technologies focus more on the orchestration of actions after an alarm is triggered, lacking a mechanism to integrate log evidence, candidate causes, authorization boundaries, interventionable nodes, and handling results into a single closed loop. This results in unclear handling criteria, high risks of automated execution, and difficulty in determining the handling results.

[0004] To overcome the above problems, a secure managed closed-loop disposal method is needed that can first convert the minimum necessary multi-source logs into unified evidence, then retain multiple possible interpretations, and simultaneously consider the chain of evidence, authorization boundaries, and disposability when selecting the basis for disposal. This would enable the platform to achieve a judgmentable, executable, terminateable, or revocable disposal process without expanding the scope of data collection or exceeding the customer's authorization boundaries. Summary of the Invention

[0005] The purpose of this invention is to design a secure managed closed-loop processing method for multi-source log association to solve the above-mentioned problems.

[0006] To achieve the above objectives, this invention provides a secure managed closed-loop processing method for multi-source log association, the method comprising: S1. Collect multi-source logs within the customer's authorized boundary, wherein the multi-source logs include identity authentication logs, interface call logs, data transmission logs, and asset authorization information, and preprocess, anonymize, and map each log into a vector, and aggregate the vectors according to time weighting to generate an anonymized evidence unit; wherein the anonymized evidence unit includes a corresponding weighted vector, time recentity, and authorization boundary marker; S2. Based on any two de-identified evidence units, calculate the relationship strength between the corresponding two de-identified evidence units by combining the corresponding time recentity composite value and the managed boundary compatibility mark; calculate the relationship strength between all the de-identified evidence units, and organize the evidence units whose relationship strength reaches a preset threshold into multiple candidate interpretations according to the behavior chain; wherein, the candidate interpretations include supporting evidence, conflicting evidence, behavior chain, and interventionist nodes; S3. Calculate the comprehensive score of each candidate explanation based on the supporting evidence, conflicting evidence, and behavioral chain, and select the main explanation based on the comprehensive score; S4. Generate a disposal contract based on the main interpretation, write the corresponding supporting evidence into the evidence conditions, write the behavior chain into the trigger conditions, write the conflict evidence and authorization boundary marker into the boundary conditions, and map the interventionable nodes into disposal actions. Before executing the disposal contract, the corresponding execution readiness value is calculated, and the corresponding disposal action is initiated according to the execution readiness value. After the disposal action is executed, the closed-loop disposal is determined based on the changes in the evidence unit after disposal.

[0007] Preferably, the preprocessing includes: field integrity and time consistency checks; The desensitized subject identifier and desensitized object identifier generated by the desensitization process are generated by the client-side data collection node using irreversible hashing or a client-authorized mapping table.

[0008] Preferably, the step of generating de-identified evidence units based on the time-weighted aggregation of the vectors specifically involves: For multiple logs under the same time window, the same de-identification subject, or the same de-identification object, the exponential decay weight is calculated based on the time difference between the event time and the current analysis time. The vectors of each log are then weighted and averaged to obtain the corresponding de-identification evidence unit. The time relevance is taken as the maximum or average value of the weights of each log within the evidence unit. The authorization boundary marker is determined based on the asset authorization information: If the assets corresponding to the de-identified object are allowed to be operated by the custody platform, they are marked as operable; if they belong to a key control system or core interface, they are marked as non-operable; when the same evidence unit contains both operable and non-operable assets, it is marked as a mixed authorized evidence unit.

[0009] Preferably, the relationship strength between any two desensitized evidence units is calculated and generated based on the cosine similarity, temporal recentity composite value, and custody boundary compatibility marker between any two desensitized evidence units; The hosting boundary compatibility flag is used to indicate that when two evidence units belong to the same tenant and there is an adjacent relationship in the behavioral chain such as interface call to data transmission, login to interface call, and interface call to authorization change, and at least one evidence unit's authorization tag shows that there is an interventionable node, the value is 1; when two evidence units belong to the same tenant but only have the same asset type or only have adjacent source systems, the value is 0.5; when two evidence units are across tenants, or both authorization tags show that intervention is prohibited, the value is 0.

[0010] Preferably, the step of organizing the evidence units whose relationship strength reaches a preset threshold into multiple candidate interpretations according to the behavioral chain specifically involves: Based on the sequence of events, the direction of actions, and the relationship between asset objects, evidence units whose relationship strength reaches a threshold and can be linked into the same event chain are organized into a candidate explanation; If the relationship strength reaches the threshold but the action sequence is inconsistent with the preset security scenario, then this evidence unit is considered conflict evidence. If the same set of evidence units simultaneously generates multiple candidate interpretations, they correspond to different causal hypotheses and retain multiple attribution relationships and shared evidence markers.

[0011] Preferably, the supporting evidence comes from evidence units whose relationship strength reaches a threshold and can be chained together into the same event chain; The conflicting evidence comes from evidence units that contradict the sequence of actions, asset categories, or authorization boundaries of the interpretation within the same time frame. The behavior chain is arranged in the order of desensitization subject, action type, and desensitization object; The interventionizable node originates from the authorized boundary marker in the evidence unit.

[0012] Preferably, the step of calculating a comprehensive score for each candidate explanation based on the supporting evidence, conflicting evidence, and behavioral chain, and selecting the main explanation based on the comprehensive score, specifically involves: For each candidate explanation, the degree of fit of the evidence chain is calculated based on its supporting evidence, the degree of manageability is calculated based on its interventionable nodes, the degree of conflict resolution is calculated based on its conflicting evidence, and the management authorization threshold is determined based on the authorization status. The main explanation is selected by weighting and calculating a comprehensive score by combining the degree of fit of the evidence chain, the degree of manageability, the degree of conflict resolution, and the management authorization threshold.

[0013] Preferably, the degree of fit of the evidence chain is obtained by correcting the average value of the relationship strength between adjacent evidence units within the candidate interpretation for behavioral chain continuity. The manageable level is determined by the manageability level of the interventionable node, and the manageability level is set from small to large according to the scope of influence; The degree of conflict resolution is determined based on the quantity and type of conflict evidence, including conflict of action chain, conflict of authorization scope, conflict of tenant boundary, and conflict of proximity to critical assets. The managed authorization threshold is determined based on the authorization status of the interventionable node, whether it is automatic processing, requires customer confirmation, or is subject to restrictions.

[0014] Preferably, in step S4, the evidentiary conditions of the disposal contract require that the evidentiary units involved in the disposal belong to the same de-identified entity, the same de-identified object, or adjacent objects in the same behavioral chain; The triggering condition requires that the abnormal event still conforms to the action sequence in the main interpretation; The boundary conditions limit the handling actions to within the customer's authorized scope and prioritize nodes with less impact. The actions taken are derived from a pre-set action library, including freezing abnormal sessions, revoking temporary tokens, restricting API calls, and suspending data transmission tasks.

[0015] Preferably, the execution readiness value is calculated and generated based on the managed authorization gating value, the degree of evidence chain fit, the degree of managed disposability, and the degree of conflict suppression; When the execution readiness value reaches the automatic execution threshold, automatic execution is initiated. When the confirmation threshold is reached, a customer confirmation work order is generated. When the value is lower than the restricted suggestion threshold, restricted handling suggestions are output. After executing the disposal action, the closed-loop disposal is determined based on the changes in the evidence units after disposal, specifically including: After each action is executed, the platform waits for the corresponding execution interface to return a receipt. If the receipt is successful, the execution time, execution object, and strategy number are recorded. If the receipt is unsuccessful, the platform decides whether to retry, skip subsequent actions, or transfer the case to manual review based on the scope of the action's impact. If the receipt is partially successful, the platform records the scope of the unsuccessful action and transfers it to manual review. The execution order of actions follows the principle of increasing impact. Subsequent actions within the same disposal contract depend on the confirmation of the previous action. If the previous action has satisfied the termination condition, the subsequent actions will be stopped.

[0016] The beneficial technical effects of the present invention are at least as follows: The main improvement of this invention is that it designs multi-source log association, security event interpretation selection, and managed disposal execution as a continuously converging engineering process, rather than directly converting logs into alerts and triggering fixed scripts. The platform first constructs de-identified evidence units based on identity authentication logs, API call logs, data transmission logs, and asset authorization information. Each evidence unit simultaneously carries event semantics, time relevance, and authorization boundaries, resolving issues such as heterogeneous multi-source data, the inability to disseminate sensitive information, and unclear boundaries of the disposal targets. Then, based on the strength of event relationships between evidence units, multiple security event candidate interpretations are generated, allowing the same set of logs to generate different interpretations such as abnormal account use, abnormal API calls, or abnormal transmission tasks. Each interpretation retains supporting evidence, conflicting evidence, behavioral chains, and interveneable nodes. Next, candidate interpretations are compared based on the degree of evidence chain fit, the degree of escrow disposal, the degree of conflict, and authorization gating to determine the primary interpretation that can enter the disposal process. This ensures that the final disposal basis can interpret multi-source logs while conforming to customer authorization and actual executable conditions. Finally, a disposal contract is generated based on the primary interpretation. Supporting evidence is written into the evidence conditions, behavioral chains into the trigger conditions, conflicting evidence and authorization tags into the boundary conditions, and interveneable nodes are mapped to actual actions such as freezing abnormal sessions, revoking temporary tokens, restricting API calls, or suspending abnormal transmission tasks. After execution, the disposal is determined according to the rules of the same evidence unit, resulting in completion, manual escalation, or revocation. Through the above design, this invention transforms multi-source log association results into a manageable master interpretation and transforms automated response actions into disposal contracts constrained by evidence conditions, authorization boundaries, and termination conditions. This enables the secure managed platform to reduce the risk of misjudgment and mishandling in scenarios with strong business continuity, such as medical devices, intelligent control systems, and information security transmission supervision, and improve the clarity of disposal basis, the controllability of execution actions, and the determinability of closed-loop results. Attached Figure Description

[0017] The present invention will be further described with reference to the accompanying drawings, but the embodiments in the drawings do not constitute any limitation on the present invention. For those skilled in the art, other drawings can be obtained based on the following drawings without creative effort.

[0018] Figure 1 This is a flowchart of a secure managed closed-loop processing method for multi-source log association according to the present invention. Detailed Implementation

[0019] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0020] In one or more embodiments, such as Figure 1 As shown, a secure managed closed-loop processing method for multi-source log association is disclosed, the method comprising the following: S1. Collect multi-source logs within the customer authorization boundary, wherein the multi-source logs include identity authentication logs, interface call logs, data transmission logs and asset authorization information, and preprocess, anonymize, and map each log into a vector, and aggregate the vectors according to time weight to generate an anonymized evidence unit; wherein the anonymized evidence unit includes a corresponding weighted vector, time recentity and authorization boundary marker.

[0021] Specifically, this step is performed within the scope of the managed system authorized by the client. Before data collection, the platform reads the client's authorization policy, tenant identifier, collectable log types, collectable fields, list of disposable assets, and list of assets prohibited from intervention. If a client has not authorized a corresponding log type or an asset is marked as prohibited from collection, the collection node will not read that log source. The collection node only collects the minimum necessary fields related to identity authentication, API calls, data transmission, and asset authorization status, and does not collect patient plaintext information, treatment content, complete business data packages, or system configurations not authorized by the client. Through this limitation, the evidence unit formed in step one is constrained by the authorization boundary from the source, preventing subsequent candidate interpretations from being based on unauthorized data.

[0022] Furthermore, the platform deploys data collection nodes on the client side to collect and standardize multi-source logs directly related to secure managed disposal, including identity authentication logs, interface call logs, data transmission logs, and asset authorization information. Identity authentication logs record user or device login, logout, and permission change operations, such as login records of medical staff accounts in the hospital information system or records of remote maintenance accounts accessing the device management system. Interface call logs contain system interface call actions, including the access subject, access object, call action, and timestamp, such as medical imaging equipment accessing the storage interface. Data transmission logs record cross-system data flow events, including source, destination, and transmission status, such as imaging equipment uploading image data to the storage system. Asset authorization information provides a marker indicating whether the asset corresponding to each event allows the managed platform to perform operations, including medical equipment, network interfaces, and control system nodes. The data collection nodes parse each log into standard fields, generating anonymized subject identifiers, anonymized object identifiers, action types, timestamps, log sources, asset types, and tenant identifiers, while simultaneously stripping plaintext account information, patient information, and complete access trajectories to ensure compliance. Each parsed event is mapped to a multi-dimensional vector, where the subject category, action type, asset type, and authorization tag are each encoded as an independent dimension, forming an event vector that provides a unified representation for subsequent aggregation.

[0023] Furthermore, the collection nodes perform field integrity and time consistency checks on each log entry. Logs with missing timestamps, missing tenant identifiers, subjects or objects that cannot be anonymized, log sources not on the authorization list, or undetermined asset authorization tags do not directly participate in automatic evidence unit aggregation but instead enter the log queue awaiting review. Timestamps from different log sources are corrected according to the platform's unified time benchmark. If the clock drift of the client-side device exceeds the preset allowable range, the log source is marked as an unreliable time source and is only used for manual review or low-weight auxiliary analysis. The anonymized subject identifier and anonymized object identifier are generated by the client-side collection nodes using irreversible hashing or a mapping table authorized by the client. The platform only receives the anonymized identifier and authorization tag.

[0024] In the processing, a time-weighted aggregation formula is introduced to aggregate log events within the same time window, under the same de-identified subject, or under the same de-identified object into evidence units. This formula originates from the mathematical concept of weighted averages and, combined with the log time-series scenario of this application, incorporates a time decay weight, ensuring that recent events contribute more significantly to the evidence units. ; In the above formula, The value must be a positive integer, and the logs participating in the aggregation should belong to the same tenant and the same analysis window. If there are no valid logs in a window, or if the time weight of all logs is zero, then no corresponding evidence unit will be generated. It is generated from a preset field encoding table. The encoding table must include at least the subject category, action type, asset type, log source, and authorization tag. It is not allowed to temporarily generate unregistered dimensions based on the plaintext content of the log. It is a positive value. The platform deployment settings are configured based on the customer's business scenario and log latency characteristics; in medical device and control system scenarios, This can be configured based on common time intervals between login, API calls, and data transmission. If the log arrival time is significantly later than the event time, the platform will still calculate based on the event time. And record a late arrival log marker in the evidence unit.

[0025] in, Indicates the first Each de-identified evidence unit is obtained by aggregating several logs under the same time window, the same de-identified subject, or the same de-identified object. Indicates being classified as the first The number of logs per evidence unit; The number of participants in the aggregation of this evidence unit 1 log entry; It is The de-identified fields are encoded as vectors, including subject category code, action type code, asset type code, and authorization tag code; Indicates the first Time weight of each log entry The time difference between the event time and the analysis time. This is the time decay constant, for example, set to 3600 seconds. The denominator is used to normalize the weighted sum, enabling evidence units formed by different log volumes to be compared on the same scale. The platform also retains the time recentity of each evidence unit. , Each piece of evidence within this unit can be retrieved. The maximum or average value is used to determine whether the two evidence units are close in time.

[0026] In one embodiment, five logs generated within an analysis window for the same imaging device interface are aggregated. These five events occur 1 minute, 5 minutes, 10 minutes, 30 minutes, and 1 hour before the analysis time, with corresponding time weights of approximately 0.983, 0.920, 0.846, 0.607, and 0.368, respectively. If the event vectors of the five logs represent login, interface call, interface call, data transmission, and authorization tag status, respectively, the platform generates the [number]th log according to the aforementioned weighted average formula. The evidence unit vector ensures that recent login, API call, and data transfer events account for a higher proportion within the evidence unit. This determines the time recentity of the evidence unit. A value of 0.983 is acceptable, indicating that the evidence unit contains events close to the current analysis time.

[0027] Furthermore, each evidence unit is mapped to an interveneable node based on asset authorization information. If the asset corresponding to the de-identified object is allowed to be operated by the platform, it is marked as interveneable; if it belongs to a critical control system or core interface, it is marked as non-interventionable. For example, multiple image device upload logs within the same time window are aggregated into an evidence unit after vector mapping and time-weighted aggregation. If the authorization tag indicates that the interface allows automatic processing, then this evidence unit retains the weighted vector, time recentity, and interveneable marker simultaneously. The final generated set of de-identified evidence units... It includes weighted vectors, time relevance, and authorization boundary markers for each evidence unit. Each evidence unit can be directly used to generate candidate interpretations, ensuring structured, anonymized, and compliant interpretations. It also highlights the weight of recent anomalies in the interpretation analysis and combines the scope of assets that the custody platform can intervene in, providing a complete and operable foundation for the generation of subsequent candidate interpretations.

[0028] The evidence unit also stores the evidence number, analysis window, log source list, number of participating logs, anonymization rule version, authorization policy version, and type of interventionist node. The type of interventionist node must at least distinguish between abnormal sessions, temporary tokens, interface rate-limiting points, data transmission tasks, access policies, and assets subject to prohibition of intervention. If the same evidence unit contains both interventionist and prohibited assets, the platform marks it as a mixed-authorization evidence unit. Subsequent steps can only generate actions on interventionist nodes; prohibited assets cannot be automatically disposed of.

[0029] S2. Based on any two de-identified evidence units, calculate the relationship strength between the corresponding two de-identified evidence units by combining the corresponding time recentity composite value and the managed boundary compatibility mark; calculate the relationship strength between all the de-identified evidence units, and organize the evidence units whose relationship strength reaches a preset threshold into multiple candidate interpretations according to the behavior chain; wherein, the candidate interpretations include supporting evidence, conflicting evidence, behavior chain, and interventionist nodes.

[0030] Specifically, the platform receives the set of de-identified evidence units formed in step one. Each evidence unit contains a time-weighted event vector and authorization boundary markers. This collection has unified authentication logs, API call logs, data transfer logs, and asset authorization information into a single structure, allowing the platform to directly leverage it. This step determines whether different events might belong to the same security incident chain. In managed security scenarios, the same set of evidence may support multiple causes, such as abnormal use of remote maintenance accounts, frequent API calls, abnormal initiation of data transmission tasks, or restricted asset disposal permissions. In this step, the platform organizes the relationships between individual evidence units into multiple candidate interpretations, allowing subsequent steps to select the primary interpretation suitable for managed disposal from among these interpretations, rather than directly compressing multi-source logs into a single alert conclusion.

[0031] Furthermore, the platform first... The correlation strength is calculated for any two evidence units. During the calculation, the weighted event vectors from the evidence units are used in the vector similarity calculation, and combined with the time recentity and asset authorization boundaries retained in step one, to form the event relationship strength oriented towards custody disposal: ; In the above formula, and The vector norm should be greater than zero; if a certain evidence unit vector is an empty vector or only contains fields that cannot be encoded, then that evidence unit will not participate in the relation strength calculation. The cosine similarity calculation result can be limited to between 0 and 1 in the platform before participating in subsequent weighting to avoid negatively correlated evidence being incorrectly connected as the same event chain. Take a composite value of time recency between 0 and 1. This is a non-negative adjustment coefficient, and its value is configured based on the client's authorization strategy and the degree of conservatism in the escrow process. If both evidentiary units indicate that intervention is prohibited, If the value is set to 0, even if the semantic similarity threshold is reached, the relation can only form an observational candidate explanation and will not enter the automatic processing chain.

[0032] in, Indicates the first The evidence unit and the first The strength of the relationship between the evidence units; and These represent the two evidence unit vectors output from step one; This represents the combined value of the temporal relevance of the two evidence units, output from step one. and The calculation yields a specific value. ; The hosting boundary compatibility flag is set to 1 when two evidence units belong to the same tenant and there is an adjacent relationship in the behavioral chain such as interface call to data transmission, login to interface call, and interface call to authorization change, and at least one evidence unit's authorization tag shows that there is an interventionable node; 0.5 when two evidence units belong to the same tenant but are only of the same asset type or only of adjacent source systems; and 0 when two evidence units are across tenants or both authorization tags show that intervention is prohibited. This represents the adjustment coefficient of the custody boundary compatibility marker in relation strength, configured by the platform based on the client's authorization policy during deployment. The formula uses cosine similarity in vector space as its foundation to measure the proximity of two evidence units across encoded dimensions such as subject, object, action, and asset type. It then introduces a temporal recentity composite value, making it easier for evidence units that are temporally close to form the same candidate interpretation. Furthermore, the custody boundary compatibility marker is introduced to give higher priority to event chains with interventionable nodes within the same authorization boundary in candidate interpretation construction. All terms in the formula are converted to normalized values ​​before calculation, and a stable relation strength result is ultimately formed through upper limit truncation.

[0033] In one embodiment, a hospital's client-side data acquisition node generates three evidence units within the same time period: the first evidence unit comes from remote maintenance account login, the second evidence unit comes from an image equipment management interface call, and the third evidence unit comes from the initiation of an image data transmission task. The vector similarity of the first and second evidence units is 0.86, their combined temporal relevance is 0.92, the managed boundary compatibility flag is set to 1, and the adjustment coefficient is set to 0.08. Therefore, the relationship strength between them is 0.86 multiplied by 0.92 plus 0.08, resulting in 0.8712. The vector similarity of the second and third evidence units is 0.89, their combined temporal relevance is 0.95, and the managed boundary compatibility flag is set to 1, resulting in 0.9255. If the platform configures the candidate interpretation formation threshold to 0.75, the above three evidence units can be connected into the same event relationship chain. If another evidence unit comes from a different tenant or the authorization tag shows that its assets cannot participate in the same disposal chain, then its custody boundary compatibility tag takes a lower value. Even if the vector similarity is high, it is difficult to enter the same candidate interpretation, thus making the candidate interpretation more in line with the authorization boundary in the secure custody scenario.

[0034] Furthermore, after forming the event relationship chain, the platform organizes candidate interpretations according to the order of event occurrence, direction of action, and relationship between asset objects. Each candidate interpretation consists of supporting evidence, conflicting evidence, a behavioral chain, and an interventionist node. Supporting evidence comes from evidence units whose relationship strength reaches a threshold and can be chained together into the same event chain; conflicting evidence comes from evidence units within the same time frame that contradict the interpretation's action sequence, asset category, or authorization boundary; the behavioral chain is arranged in the order of de-identified subject, action type, and de-identified object, such as "remote operation and maintenance account login, calling the image equipment management interface, starting the image data transmission task"; interventionist nodes come from authorization boundary markers in the evidence units, such as abnormal sessions, interface call tokens, data transmission tasks, or rate-limitable interfaces. Therefore, the same set of evidence can be organized into multiple candidate interpretations. For example, one interpretation might interpret the above chain as abnormal use of a remote account, with supporting evidence consisting of three evidence units: login, API call, and data transmission. The intervention nodes are abnormal sessions and API tokens. Another interpretation might interpret it as abnormal API call, with supporting evidence focused on two evidence units: API call and data transmission. The intervention node is the API rate limiting policy. Yet another interpretation might interpret it as abnormal initiation of a data transmission task, with supporting evidence focused on the transmission task evidence unit. The intervention node is the transmission task suspension action. Multiple candidate interpretations preserve the organization of the same set of evidence under different causes, allowing subsequent steps to compare which interpretation is more credible, more in line with authorization boundaries, and more suitable for actual handling.

[0035] Furthermore, the candidate interpretation formation threshold, maximum behavior chain length, and analysis time window are pre-configured by the platform strategy. If the relationship strength reaches the threshold but the action sequence is inconsistent with the pre-defined security scenario, such as data transmission occurring before the interface call without reasonable delay records, then the evidence unit can be considered conflicting evidence rather than directly supporting evidence. If the same evidence unit can be classified into multiple candidate interpretations, the platform retains its multiple attribution relationships and marks shared evidence in the candidate interpretations. Subsequent steps consider the interpretation competition that may result from shared evidence when calculating the degree of conflict. Candidate interpretations also record the interpretation type, the number of supporting evidences, the number of conflicting evidences, the number of interveneable nodes, and an authorization status summary for quantitative comparison in step three.

[0036] The final output is a set of candidate explanations for security events. Each candidate interpretation in the set contains its supporting evidence, conflicting evidence, behavioral chain, and interveneable nodes, all of which are derived from the set of evidence units output in step one. The derivation is as follows. Through this processing method, the platform transforms the multi-source log association process from simple alarm aggregation into a candidate interpretation generation process. This allows four types of information—identity authentication, interface calls, data transmission, and asset authorization—to work synergistically within the same interpretation structure. Furthermore, it incorporates the hosting boundaries in medical device, intelligent control system, and information security transmission supervision scenarios into the candidate interpretation stage, providing complete input for the subsequent determination of the master interpretation that can be hosted.

[0037] If the candidate explanation set is empty, the platform does not generate a master explanation or execute automatic processing; instead, it outputs results with insufficient relevant evidence or only observations. If the candidate explanation only contains nodes where intervention is prohibited, the platform can generate a risk warning or a customer confirmation ticket, but it will not enter the automatic processing flow. Through this process, the candidate explanation stage clearly distinguishes between three subsequent paths: those that can be automatically processed, those requiring customer confirmation, and those that can only be observed.

[0038] S3. Calculate the comprehensive score of each candidate explanation based on the supporting evidence, conflicting evidence, and behavioral chain, and select the main explanation based on the comprehensive score.

[0039] Specifically, the platform receives the set of candidate explanations for security events output in step two. Each candidate explanation It includes supporting evidence, conflicting evidence, behavioral chains, and interveneable nodes. The platform reads these four types of content from each candidate interpretation and transforms them into comparable criteria for handling the case: supporting evidence is used to determine the degree of fit of the evidence chain. Behavioral chains are used for correction. The continuity of conflict evidence is used to determine the degree of conflict resolution. Interventional nodes are used to determine the degree of manageability. and managed authorization gate value .

[0040] in, Directly inherit the event relationship strength formed in step two When the behavioral chain of a candidate interpretation consists of multiple adjacent evidence units, the platform reads the information between adjacent evidence units. The average result is taken; if the behavior chain conforms to the preset action sequence, such as "identity authentication, interface call, data transmission" in the information security transmission supervision scenario, or "remote login, control interface call, task issuance" in the intelligent control system integration scenario, then the average result is taken as the result. If there are weak object continuation, skipped action sequences, or inconsistent tenant boundaries in the chain, the value will be reduced according to the preset chain correction level. For example, if a candidate explanation includes three supporting pieces of evidence: remote maintenance account login, image equipment management interface call, and image data transmission task initiation, with adjacency strengths of 0.8712 and 0.9255 respectively, and the action sequence is complete, then... Take the average of the two values ​​as 0.8986.

[0041] Furthermore, the platform further analyzes the candidate explanations. Determination of Interventionable Nodes and Interventionable nodes are derived from the retained results of authorized tags in step two, including abnormal sessions, temporary access tokens, API call rate limits, data transmission tasks, and asset access policies. In scenarios involving medical devices, intelligent control systems, and information security transmission supervision, the platform sets node handling levels in ascending order of impact: abnormal sessions and temporary access tokens typically have a high degree of manageable handling; API call rate limits and data transmission tasks have a medium to high degree of manageable handling; and nodes involving core medical equipment, core control links, or core business interfaces have a low degree of manageable handling. Take the value corresponding to the node with the highest handling level and the smallest impact range among the candidate explanations. For example, take 0.95 for abnormal sessions, 0.65 for interface rate limiting points, and 0.8 for data transmission task suspension. Based on the authorization status of the disposal point, nodes within the automatic disposal range are assigned a value of 1, nodes requiring customer confirmation are assigned a value of 0.6, and nodes generating restricted disposal recommendations are assigned a value of 0.3. The platform simultaneously reads conflicting evidence from candidate interpretations to form... Sources of conflict include conflicts arising from behavioral chain continuation, scope of authorization, tenant boundary, and proximity to critical assets. Specifically, a value of zero is assigned when there is no substantial conflict; minor conflicts are assigned a value of 0.1% to 0.2% based on the proportion of conflict evidence to supporting evidence; ordinary chain continuation conflicts are assigned a value of 0.35%; scope of authorization conflicts are assigned a value of 0.6%; and cross-tenant boundary conflicts or proximity conflicts involving critical medical equipment or core control links are assigned a value of 1%. When multiple conflicts exist simultaneously... The highest conflict level can be selected, or a weighted average of the conflict levels can be calculated according to preset weights. Through this process, conflict evidence in the candidate interpretations can directly influence the selection of the primary interpretation, avoiding contradictions between the basis for action and the boundaries of authorization, the continuity of the behavioral chain, or the boundaries of key assets.

[0042] in, , , and The value selection rules are pre-configured by the platform's policy table and saved with the client's authorization policy version. If multiple interveneable nodes exist among the candidate interpretations, the platform prioritizes the node with a smaller impact, stronger revocability, and clearer authorization status as the interventionable node. The computational foundation; if only nodes requiring customer confirmation exist, then Automatic disposal values ​​will not be used. If the evidence of conflict involves cross-tenant boundaries, prohibited assets, or risks of disruption to core healthcare operations, then... The highest conflict level can be directly selected, preventing that candidate interpretation from entering the automatic execution path. This process ensures that the selection of the primary interpretation not only compares the strength of evidence but also reflects business continuity and authorization boundaries.

[0043] The comprehensive evaluation formula uses the linear weighted utility model in multi-criteria decision-making as its initial source. This type of model typically combines multiple normalized evaluation quantities according to preset weights into a comprehensive utility value, suitable for scenarios where multiple evaluation factors jointly determine the priority of a candidate. This application builds upon this model to extrapolate to secure escrow disposal: it uses the degree of evidence chain fit as the primary positive term, the degree of escrow disposal capability as the secondary positive term, and converts the degree of conflict into a conflict suppression term. Then set the authorization status to the gating value. This ensures that the final score of the candidate interpretation simultaneously reflects the chain of evidence, feasibility of the disposition, and the boundaries of authorization. The resulting comprehensive score for the candidate interpretation is: ; In the above formula, , , and All scores are limited to between 0 and 1; if a certain evaluation item is missing, the candidate explanation will not participate in the automatic main explanation selection, or a conservative value will be taken according to the platform's strategy. The platform also sets a minimum score threshold for the main explanation and rules for handling parallel explanations. If the highest... If the score is below the minimum threshold, no automatic main interpretation will be output. If the score difference between multiple candidate interpretations is less than the preset tie threshold, the candidate interpretation with clearer authorization, more revocable action, and smaller impact will be selected first, or tie interpretations will be output and transferred to manual confirmation. This rule avoids forcibly generating a single basis for action when there is insufficient evidence or obvious competition for interpretation.

[0044] in, Indicates the first The overall score of each candidate explanation; Indicating the degree of fit of the chain of evidence, by Supporting evidence, behavioral chains, and the strength of relationships in step two. get; Indicates the degree of disposal under trusteeship, by The operable nodes, asset types, and authorized tags are obtained from them; Indicates the degree of conflict resolution, by The conflict evidence, the status of the behavioral chain, the status of the scope of authorization, and the proximity status of key assets are obtained. Indicates the managed authorization gate value, by The authorization status of the nodes that can be intervened in is determined. , , and All values ​​are normalized proportions. The right side of the formula is a weighted combination of the normalized proportions, and the left side... This is a comprehensive score based on the same scale. The weights of 0.45, 0.35, and 0.20 correspond to the three evaluation factors: chain of evidence, disposability, and conflict suppression. The platform can be configured according to the customer's authorization strategy during deployment, but remains fixed during a single disposal process.

[0045] In a hospital image data transmission monitoring scenario, step two generates three candidate explanations. The first candidate explanation corresponds to abnormal use of a remote account, with supporting evidence including remote login, calls to the image equipment management interface, and the initiation of image data transmission tasks. The value is 0.8986; interveneable nodes include abnormal sessions and temporary access tokens, and the authorization label indicates that the action falls within the scope of automatic action. Take 0.95. Choose one; there is limited evidence of conflict. Take 0.1. Substitute it into the formula to get... The second candidate explanation corresponds to an API call exception, and the supporting evidence focuses on two evidence units: the API call itself and the data transmission. Take 0.82; the interventionable node is the interface rate-limiting point. Take 0.65; degree of conflict Take 0.15; Authorize the gate value Take one. Substitute it into the formula to get... The third candidate explanation corresponds to the abnormal initiation of the data transmission task, and the supporting evidence is concentrated in the data transmission task evidence unit. Take 0.72; the node that can intervene is to pause the transmission task. Take 0.8; because this explanation has a weak connection with the preceding interface call. Take 0.35; the authorization label indicates that customer confirmation is required. Take 0.6. Substitute it into the formula to get... The platform compares the overall scores of each candidate explanation and selects the candidate explanation with the highest score as the primary explanation. And fully preserve the supporting evidence, conflicting evidence, behavioral chains, and interventionist nodes in the main interpretation.

[0046] The final output is the main explanation. . Sourced from the candidate explanation set The candidate explanation with the highest overall score is used as the supporting evidence for the evidence conditions in step four, its behavioral chain for the triggering conditions in step four, its interventionable nodes for the action selection in step four, and its conflict evidence and authorization status for the boundary condition setting in step four. Through this process, the multiple possible causes formed in step two are converged into a master explanation that can enter the actual disposal stage, enabling the multi-source log association results to advance from the candidate explanation set to the clear basis required for the generation of the disposal contract.

[0047] Understandable, main interpretation It also records the main interpretation number, interpretation type, overall score, score composition, selected interventionable nodes, unselected candidate interpretations, and reasons for not selecting any. If the main interpretation requires customer confirmation, the platform... The confirmation object and the reason for confirmation are marked in the middle; if the main interpretation can only form limited suggestions, then in step four, when generating the disposal contract, the automatic execution action is not initiated, but a suggestion-type contract or a manual work order is generated. This makes the formation process of the main interpretation and the disposal qualification traceable.

[0048] S4. Generate a disposal contract based on the main interpretation, write the corresponding supporting evidence into the evidence conditions, write the behavior chain into the trigger conditions, write the conflict evidence and authorization boundary marker into the boundary conditions, and map the interventionable nodes into disposal actions. Before executing the disposal contract, the corresponding execution readiness value is calculated, and the corresponding disposal action is initiated according to the execution readiness value. After the disposal action is executed, the closed-loop disposal is determined based on the changes in the evidence unit after disposal.

[0049] Specifically, the platform receives the main explanation output in step three. The platform reads supporting evidence, conflicting evidence, behavioral chains, and interventionable nodes retained in the master interpretation. Supporting evidence is written into the disposal contract based on evidentiary conditions, such as remote login evidence, interface call evidence, and data transmission task evidence jointly demonstrating the existence of an anomaly chain. Behavioral chains are written into the disposal contract based on triggering conditions, such as "remote maintenance account login, calling the imaging equipment management interface, and starting the imaging data transmission task" corresponding to an event path that can be interrupted by a disposal action. Interventionable nodes are written into the disposal contract as action objects, such as abnormal sessions, temporary access tokens, interface rate limiting points, or data transmission tasks. Conflicting evidence is written into the disposal contract based on boundary conditions, such as when the master interpretation involves key medical equipment, core control links, core business interfaces, cross-tenant assets, or customer confirmation scope, the disposal contract limits the corresponding action to execution after confirmation or a restricted recommendation. The platform generates a disposal contract based on this information. ,in Record the evidentiary conditions, triggering conditions, boundary conditions, actions taken, and termination conditions. Evidence conditions correspond to... Supporting evidence requires that the evidence units involved in the handling belong to the same de-identification subject, the same de-identification object, or adjacent objects in the same behavioral chain; the triggering conditions correspond to... The behavioral chain in the code requires that the abnormal events still conform to the order of actions in the main interpretation; the boundary conditions correspond to... The conflict evidence and authorization tags in the system require that the handling actions be within the scope of customer authorization and prioritize nodes with minimal impact on business. The handling actions come from the platform's pre-built handling action library, and each action in the library is bound to an actual execution interface. For example, freezing abnormal sessions is completed through the session management interface of the identity authentication system, revoking temporary access tokens is completed through the authorization service interface, restricting interface calls is completed through the gateway policy interface, and suspending abnormal data transmission tasks is completed through the task control interface of the information security transmission supervision platform. Termination conditions are used to determine whether the handling is completed, manually upgraded, or revoked. For example, when the abnormal call decreases and no boundary conditions are triggered, it is recorded as completed; when the abnormality continues, it is recorded as manually upgraded; when it triggers the impact on core business, the revocation action is executed and the original policy is restored.

[0050] Furthermore, the disposal contract also includes fields for contract number, tenant identifier, execution validity period, action sequence, action idempotency flag, receipt requirement, revocation action, and audit log. The execution validity period prevents continued disposal after evidence has expired; the action idempotency flag prevents the same abnormal session, the same temporary token, or the same transport task from being disposed of repeatedly; the receipt requirement specifies that each execution interface must return a success, failure, partial success, or pending confirmation status. If the evidence conditions no longer hold during pre-execution review—for example, if the abnormal session has ended naturally or the transport task has been completed—the platform does not execute the corresponding action but instead records the condition as invalid in the disposal contract.

[0051] Furthermore, the platform executes the disposal contract. Previously calculated execution ready value The initial sources for this calculation include the product conjunction rule in fuzzy logic and the product model of reliability of serial systems in engineering reliability. The product conjunction rule is used to express the comprehensive credibility when multiple conditions are met simultaneously, and the serial system reliability model is used to express the engineering relationship that a deficiency in any critical link will reduce the overall execution reliability. This application modifies this for secure managed disposal, combining the authorization status of the master interpreter, the degree of evidence chain fit, the degree of managed disposal, and the degree of conflict suppression into a pre-execution judgment value, so that the disposal action only enters automatic execution when the evidence, authorization, disposal point, and conflict control all meet the requirements. ; Understandably, in the above formula, all values ​​are derived from the score composition and authorization status explained in step three, and are limited to between 0 and 1. If To ensure that the customer confirms the corresponding intermediate value, the platform can only [do so]. A customer confirmation work order is generated when the confirmation threshold is reached; it cannot be executed automatically directly. In response to the risks of cross-tenant issues, prohibition of interference with assets, or disruption of core business operations, even if Once the automatic execution threshold is reached, the platform will also switch to manual confirmation or restricted suggestion based on boundary conditions. The automatic execution threshold, confirmation threshold, and restricted suggestion threshold are pre-configured by the client's managed policy and recorded with the disposal contract to ensure consistent execution judgment for the same client under the same policy version.

[0052] in, This indicates the execution readiness value of the corresponding disposal contract as interpreted by the main interpreter; The managed authorization threshold value for the nodes that can be intervened in the main interpretation is obtained from the authorization status corresponding to the main interpretation in step three. Nodes within the scope of automatic handling take a higher value, nodes that require customer confirmation take a middle value, and nodes with restricted suggestions take a lower value. The degree of fit of the evidence chain for the main interpretation is obtained from the supporting evidence and the strength of the event relationship inherited by the main interpretation in step three. The degree of custodial recourse indicated by the main interpretation is obtained from the interventionable nodes, asset types, and authorization tags in step three of the main interpretation. The degree of conflict in the main interpretation is indicated by the conflicting evidence in step three. All the above items use normalized proportions, and the product result remains a proportion at the same scale. This indicates the degree of conflict suppression; the higher the conflict level, the lower the execution readiness value. In a hospital image data transmission monitoring scenario, the primary interpretation is abnormal use of a remote account, and step three yields... As one, It is 0.8986. It is 0.95. If it is 0.1, then When the platform sets the automatic execution threshold to 0.7, the processing contract will enter automatic execution; otherwise... If the value is between 0.4 and 0.7, a customer confirmation work order will be generated; if If the value is below 0.4, a restricted disposal recommendation is generated. Through this calculation, disposal contracts with more complete evidence chains, clear authorization of intervention nodes, and lower conflict are given priority to enter the automated execution path, while disposal contracts that are close to the critical medical equipment itself, the core control link, or have obvious conflicts are entered into the confirmation or recommendation path.

[0053] Furthermore, the disposal of contracts After pre-execution judgment, the platform executes actions in ascending order of impact. For abnormal remote account usage (explained by the platform), the platform first calls the identity authentication system to freeze the abnormal session, then calls the authorization service to revoke the temporary access token. For abnormal interface call usage (explained by the platform), the platform first restricts the frequency of corresponding interface calls through the gateway policy interface, retaining the original policy number for future recovery. For abnormal data transmission (explained by the platform), the platform first suspends the corresponding transmission task through the information security transmission supervision platform, retaining the task status and task number for future recovery. For example, if... The behavior chain shows that after the remote operation and maintenance account logs in, it calls the imaging equipment management interface and starts a data transmission task. Furthermore, the nodes that can be intervened upon include abnormal sessions and temporary tokens. First, the session is frozen, then the token is revoked. If the same de-identified object still experiences abnormal data transmission task initiation, the platform will then pause the transmission task. Actions involving core medical equipment, core control links, or core business interfaces will be handled according to... Boundary conditions generate confirmation work orders. The work order records the supporting evidence, behavior chain, proposed action, affected objects, and cancellation method of the main interpretation. After confirmation by authorized personnel of the customer, the corresponding interface executes the action.

[0054] Furthermore, after each action is executed, the platform waits for a response from the corresponding execution interface. If the response is successful, the execution time, execution object, and policy number are recorded; if the response is unsuccessful, the platform decides whether to retry, skip subsequent actions, or transfer the case to manual review based on the scope of the action's impact; if the response is partially successful, for example, if the interface rate limiting policy only applies to some gateways, the platform records the ineffective scope and transfers the case to manual review. The execution order of actions follows the principle of increasing impact scope, and subsequent actions within the same action contract can rely on the response of the previous action; if the previous action has already satisfied the termination condition, the platform can stop subsequent actions with a larger impact scope. Through this execution method, closed-loop processing is not a one-time full action, but a step-by-step processing constrained by responses and termination conditions.

[0055] To further explain, after the action was taken, the platform targeted... The de-identified entities, de-identified objects, and interventionable nodes involved in the process receive the processed evidence units according to the same field rules as in step one, and in accordance with the processing contract. Termination conditions generate disposal results The platform counts the number of relevant abnormal evidence units within a time window of the same length as before the action, and calculates the change in the number before and after the action; when the decrease rate of relevant abnormal evidence units after the action reaches a preset completion threshold, and no boundary conditions are triggered, This is recorded as completed; if the decrease rate does not reach the preset completion threshold and the abnormal chain still exists, This is recorded as a manual upgrade; when the upgrade results in the impact on core business operations, critical medical equipment, core interface interruptions, or cross-tenant impacts as specified in the boundary conditions, as defined in the upgrade procedure. Record as revoked and execute. The platform records the revocation actions. For example, after freezing abnormal sessions and revoking temporary tokens, the platform observes changes in the same de-identified entity's calls to the imaging equipment management interface, changes in the initiation of data transmission tasks for the same de-identified object, and the status of related authorization tags. If there are twenty related abnormal evidence units within the same time window before the action, and the number decreases to four within the corresponding time window after the action (a decrease of 80%), and the preset completion threshold is 70%, and there is no core interface interruption or triggering of critical medical equipment boundaries, then... This is considered a completed process; if the number of related abnormal evidence units remains high after processing, then... Record this as a manual upgrade, and submit the main explanation, disposal contract, and execution record together; if a core business impact event as specified in the boundary conditions occurs after the disposal, then... Record as revoked and execute. The system records reversal actions, such as restoring gateway rate limiting policies, restoring transmission task status, or unfreezing sessions. The final output is the disposal contract. and the results of the handling ,in Record the evidentiary conditions, triggering conditions, boundary conditions, actions taken, and termination conditions for this action. Record the actual actions performed, the objects of execution, the execution status, and the results of completion, manual escalation, or cancellation.

[0056] The length of the post-processing evidence window, completion threshold, manual escalation threshold, and revocation trigger conditions are all pre-configured by the client's managed policy. If there is a collection delay in the post-processing logs, the platform can wait for a preset observation delay before making a judgment. If new similar evidence emerges during the observation period but originates from different de-identified entities or different authorization boundaries, the platform does not directly deem the original handling a failure. Instead, it re-enters steps one through three to form new candidate explanations. As a complete example, the platform collects three types of evidence within the authorized scope of a hospital: remote operation and maintenance account login, imaging equipment management interface calls, and imaging data transmission task initiation. Step one forms de-identified evidence units, step two forms three candidate explanations: abnormal remote account use, abnormal interface calls, and abnormal transmission tasks, and step three selects abnormal remote account use as the primary explanation. Step four generates a handling contract based on this, first freezing the abnormal session, then revoking the temporary token, and re-receiving evidence units from the same de-identified entity and the same de-identified object within the observation window. If abnormal interface calls and abnormal transmission tasks significantly decrease and do not trigger the impact of core medical equipment, the handling is considered complete. If the abnormality persists, a manual escalation is submitted. If a core interface is interrupted, a reversal action is executed, and the original strategy is restored.

[0057] The above method can be executed by the system's log collection module, de-identification and standardization module, evidence unit generation module, candidate interpretation generation module, main interpretation selection module, disposal contract generation module, action execution module, receipt auditing module, post-disposal verification module, and revocation / upgrade module. The log collection module is used to obtain identity authentication, interface call, data transmission, and asset authorization information within the scope authorized by the customer; the de-identification and standardization module is used to generate the de-identified subject, de-identified object, and standard fields; the evidence unit generation module is used to obtain... The candidate interpretation generation module is used for calculation. and form The main interpretation selection module is used for calculation. And determine The contract generation module is used to generate... and The action execution module is used to call the identity authentication, authorization services, gateway policies, and transmission task interfaces; the receipt audit module is used to record execution receipts and audit information; and the post-processing verification module is used to generate... The undo / upgrade module is used to perform an undo or submit a manual upgrade when boundary conditions are triggered or the action is deemed invalid.

[0058] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0059] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A secure managed closed-loop treatment method of multi-source log correlation, characterized in that, The method includes: S1. Collect multi-source logs within the customer's authorized boundary, wherein the multi-source logs include identity authentication logs, interface call logs, data transmission logs, and asset authorization information, and preprocess, anonymize, and map each log into a vector, and aggregate the vectors according to time weighting to generate an anonymized evidence unit; wherein the anonymized evidence unit includes a corresponding weighted vector, time recentity, and authorization boundary marker; S2. Based on any two de-identified evidence units, calculate the relationship strength between the corresponding two de-identified evidence units by combining the corresponding time recentity composite value and the managed boundary compatibility mark; calculate the relationship strength between all the de-identified evidence units, and organize the evidence units whose relationship strength reaches a preset threshold into multiple candidate interpretations according to the behavior chain; wherein, the candidate interpretations include supporting evidence, conflicting evidence, behavior chain, and interventionist nodes; S3. Calculate the comprehensive score of each candidate explanation based on the supporting evidence, conflicting evidence, and behavioral chain, and select the main explanation based on the comprehensive score; S4. Generate a disposal contract based on the main interpretation, write the corresponding supporting evidence into the evidence conditions, write the behavior chain into the trigger conditions, write the conflict evidence and authorization boundary marker into the boundary conditions, and map the interventionable nodes into disposal actions. Before executing the disposal contract, the corresponding execution readiness value is calculated, and the corresponding disposal action is initiated according to the execution readiness value. After the disposal action is executed, the closed-loop disposal is determined based on the changes in the evidence unit after disposal.

2. The secure managed closed-loop treatment method of multi-source log correlation according to claim 1, wherein, The preprocessing includes: field integrity and time consistency checks; The desensitized subject identifier and desensitized object identifier generated by the desensitization process are generated by the client-side data collection node using irreversible hashing or a client-authorized mapping table.

3. The secure managed closed-loop treatment method of multi-source log correlation according to claim 1, wherein, The process of generating de-identified evidence units based on the time-weighted aggregation of the vectors specifically involves: For multiple logs under the same time window, the same de-identification subject, or the same de-identification object, the exponential decay weight is calculated based on the time difference between the event time and the current analysis time. The vectors of each log are then weighted and averaged to obtain the corresponding de-identification evidence unit. The time relevance is taken as the maximum or average value of the weights of each log within the evidence unit. The authorization boundary marker is determined based on the asset authorization information: If the assets corresponding to the de-identified object are allowed to be operated by the custody platform, they are marked as operable; if they belong to a key control system or core interface, they are marked as non-operable; when the same evidence unit contains both operable and non-operable assets, it is marked as a mixed authorized evidence unit.

4. The secure managed closed-loop treatment method of multi-source log correlation according to claim 1, wherein, The relationship strength between any two desensitized evidence units is calculated and generated based on the cosine similarity, temporal recentity composite value, and managed boundary compatibility marker between any two desensitized evidence units. The hosting boundary compatibility flag is used to indicate that when two evidence units belong to the same tenant and there is an adjacent relationship in the behavioral chain such as interface call to data transmission, login to interface call, and interface call to authorization change, and at least one evidence unit's authorization tag shows that there is an interventionable node, the value is 1; when two evidence units belong to the same tenant but only have the same asset type or only have adjacent source systems, the value is 0.5; when two evidence units are across tenants, or both authorization tags show that intervention is prohibited, the value is 0.

5. The secure managed closed-loop treatment method of multi-source log correlation according to claim 1, wherein, The process of organizing the evidence units whose relationship strength reaches a preset threshold into multiple candidate interpretations according to the behavioral chain is as follows: Based on the sequence of events, the direction of actions, and the relationship between asset objects, evidence units whose relationship strength reaches a threshold and can be linked into the same event chain are organized into a candidate explanation; If the relationship strength reaches the threshold but the action sequence is inconsistent with the preset security scenario, then this evidence unit is considered conflict evidence. If the same set of evidence units simultaneously generates multiple candidate interpretations, they correspond to different causal hypotheses and retain multiple attribution relationships and shared evidence markers.

6. The secure managed closed-loop treatment method of multi-source log correlation according to claim 1, wherein, The supporting evidence comes from evidence units whose relationship strength reaches a threshold and can be linked together to form the same event chain; The conflicting evidence comes from evidence units that contradict the sequence of actions, asset categories, or authorization boundaries of the interpretation within the same time frame. The behavior chain is arranged in the order of desensitization subject, action type, and desensitization object; The interventionizable node originates from the authorized boundary marker in the evidence unit.

7. The secure managed closed-loop treatment method of multi-source log correlation according to claim 1, wherein, The step of calculating a comprehensive score for each candidate explanation based on the supporting evidence, conflicting evidence, and behavioral chain, and selecting the primary explanation based on the comprehensive score, specifically involves: For each candidate explanation, the degree of fit of the evidence chain is calculated based on its supporting evidence, the degree of manageability is calculated based on its interventionable nodes, the degree of conflict resolution is calculated based on its conflicting evidence, and the management authorization threshold is determined based on the authorization status. The main explanation is selected by weighting and calculating a comprehensive score by combining the degree of fit of the evidence chain, the degree of manageability, the degree of conflict resolution, and the management authorization threshold.

8. The secure managed closed-loop treatment method of multi-source log correlation according to claim 7, wherein, The degree of fit of the evidence chain is obtained by adjusting the average value of the relationship strength between adjacent evidence units within the candidate interpretation for behavioral chain continuity. The manageable level is determined by the manageability level of the interventionable node, and the manageability level is set from small to large according to the scope of influence; The degree of conflict resolution is determined based on the quantity and type of conflict evidence, including conflict of action chain, conflict of authorization scope, conflict of tenant boundary, and conflict of proximity to critical assets. The managed authorization threshold is determined based on the authorization status of the interventionable node, whether it is automatic processing, requires customer confirmation, or is subject to restrictions.

9. The secure managed closed-loop treatment method of multi-source log correlation according to claim 1, wherein, In S4, the evidentiary conditions of the disposal contract require that the evidentiary units involved in the disposal belong to the same desensitized entity, the same desensitized object, or adjacent objects in the same behavioral chain; The triggering condition requires that the abnormal event still conforms to the action sequence in the main interpretation; The boundary conditions limit the handling actions to within the customer's authorized scope and prioritize nodes with less impact. The actions taken are derived from a pre-set action library, including freezing abnormal sessions, revoking temporary tokens, restricting API calls, and suspending data transmission tasks.

10. The secure managed closed-loop treatment method of multi-source log correlation according to claim 1, wherein, The execution readiness value is calculated and generated based on the managed authorization gating value, the degree of evidence chain fit, the degree of managed disposition, and the degree of conflict suppression. When the execution readiness value reaches the automatic execution threshold, automatic execution is initiated. When the confirmation threshold is reached, a customer confirmation work order is generated. When the value is lower than the restricted suggestion threshold, restricted handling suggestions are output. After executing the disposal action, the closed-loop disposal is determined based on the changes in the evidence units after disposal, specifically including: After each action is executed, the platform waits for the corresponding execution interface to return a receipt. If the receipt is successful, the execution time, execution object, and strategy number are recorded. If the receipt is unsuccessful, the platform decides whether to retry, skip subsequent actions, or transfer the case to manual review based on the scope of the action's impact. If the receipt is partially successful, the platform records the scope of the unsuccessful action and transfers it to manual review. The execution order of actions follows the principle of increasing impact. Subsequent actions within the same disposal contract depend on the confirmation of the previous action. If the previous action has satisfied the termination condition, the subsequent actions will be stopped.

Images