Multi-source security alarm research and judgment method and system based on large model and vector retrieval

Abstract

The present application relates to the field of data processing, specifically to a multi-source security alarm judgment method and system based on large models and vector retrieval, according to historical warning marks, anchor several heterogeneous interfaces to extract multi-modal heterogeneous data, and perform multiple preprocessing to build an evidence data set; screening and converting the evidence data set to build a feature vector library; matching and verifying the current warning marks of the feature vector library to obtain the target feature vector; performing large model cross-source correlation reasoning according to the target feature vector to determine the network security abnormal event; analyzing the network security abnormal event to obtain several discrete network attack behaviors; performing context tracing on the several discrete network attack behaviors to determine whether a complete network attack chain is formed to perform network security alarm operations. Through the construction of data base, vector retrieval matching, large model correlation reasoning, complete attack chain reasoning and security alarm, efficient and accurate alarm identification of network security dynamic evolution is realized.

Description

Technical Field

[0001] This invention relates to the field of data processing, and in particular to a method and system for analyzing multi-source security alarms based on large models and vector retrieval. Background Technology

[0002] As enterprises deepen their digital transformation, cybersecurity protection systems, as a crucial component of enterprise information security, typically employ multiple heterogeneous security platforms, such as detection and response platforms, vulnerability scanning platforms, and threat intelligence platforms. While these platforms monitor the real-time operation of the enterprise network from different perspectives, they still suffer from the following shortcomings in monitoring integration and unified alerting: First, data silos exist between these heterogeneous security platforms, leading to fragmented evidence. The independent operation of these platforms, with their varying data formats and inconsistent time bases, makes it difficult to form a complete chain of evidence, resulting in low efficiency and the potential for overlooking critical information. Second, traditional rule engines lack adaptability. Existing engines often rely on fixed rules or simple field concatenation, failing to handle deep correlations in unstructured data and exhibiting insufficient detection capabilities for variant attacks. Third, high false positive rates and a lack of interpretability are common in security issues. Enterprise operations are complex, and normal maintenance, compliance changes, and malicious attacks often exhibit high similarities at the log level. Traditional judgment methods suffer from high false positive rates and cannot provide the reasoning process behind real network attacks, making it difficult to continuously ensure network security. It is evident that there is an urgent need for security alert identification methods that can perform real-time data monitoring and complete attack behavior reasoning for multi-source network scenarios, thereby identifying the internal attack chain and its dynamic evolution within the network. Summary of the Invention

[0003] Given that existing network security monitoring and early warning systems suffer from problems such as difficulty in integrating multi-source heterogeneous data, low level of intelligence in predictive and correlated alerts, high false alarm rate for security issues, and lack of effective reasoning about the true intent of network attacks, the reliability of network security monitoring and protection is affected.

[0004] To address the above problems, this invention provides a multi-source security alarm analysis method based on large models and vector retrieval, including: Step S1: Based on historical warning indicators, anchor several heterogeneous interfaces to extract multimodal heterogeneous data; perform multiple preprocessing steps on the multimodal heterogeneous data to construct an evidence data set; Step S2: Filter and transform the evidence data set to construct a feature vector library; perform current warning identifier matching and verification on the feature vector library to obtain target feature vectors; wherein, the target feature vectors satisfy the preset evidence complete coverage condition; Step S3: Perform cross-source correlation reasoning based on the target feature vector to determine network security anomalies; analyze the network security anomalies to obtain several discrete network attack behaviors; Step S4: Perform context tracing on the several discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, execute a network security alarm operation.

[0005] Optionally, in step S1, based on historical warning identifiers, several heterogeneous interfaces are anchored to extract multimodal heterogeneous data; multiple preprocessing steps are performed on the multimodal heterogeneous data to construct an evidence data set, including: Obtain the origination attribute information of historical early warning identifiers; wherein, the historical early warning identifier refers to the early warning notification initiated due to the detection of abnormal network behavior during a historical period; the origination attribute information refers to the network location and time of initiation of the early warning notification; By comparing the originating attribute information and the network link layout, several heterogeneous interfaces that are spatially and / or temporally related to the abnormal network behavior are identified; wherein, the heterogeneous interface refers to the interface that performs corresponding modal monitoring on the network; based on the dynamic attributes of the data flow of the several heterogeneous interfaces, multimodal heterogeneous data is extracted; The multimodal heterogeneous data is preprocessed with time alignment, noise reduction and deduplication, and attribution tagging to obtain several preprocessed data packets. Multi-dimensional element extraction is performed on the several preprocessed data packets to construct a structured evidence data set. The structured evidence data set includes alarm subject, environmental context, and behavior timeline.

[0006] Optionally, in step S2, the evidence data set is filtered and transformed to construct a feature vector library; the feature vector library is then matched and verified against the current warning identifier to obtain the target feature vector, including: Based on the multi-dimensional element type attributes of the evidence data set, multi-dimensional keywords are selected from the evidence data set; semantic normalization transformation is performed on each dimension keyword to obtain feature vectors, and the feature vectors corresponding to all dimension keywords are assembled to form a feature vector library; Several representational attributes of current network anomalies are extracted from the current warning identifier. These attributes are then processed by a pre-trained language model to generate semantic features. The feature vector library is searched based on these semantic features to obtain a target feature vector that satisfies a preset evidence association condition with the semantic features. The target feature vector contains elements corresponding to all types of evidence required to identify network security anomalies.

[0007] Optionally, in step S3, large-scale cross-source correlation inference is performed based on the target feature vector to determine network security anomalies; the network security anomalies are analyzed to obtain several discrete network attack behaviors, including: Obtain the business association attributes between every two business execution terminals under the network and the element association attributes between every two elements under the target feature vector; perform large language model inference based on the business association attributes and the element association attributes to determine the data interaction mismatch between business association and element association; wherein, the data interaction mismatch refers to the data interaction type mismatch; Based on the cumulative prediction results of the data interaction mismatch time, network security anomalies are identified; wherein, the network security anomaly refers to a network data accumulation event caused by mismatched data interaction. The system predicts and responds to network security anomalies at each business execution end, and determines the resource configuration attributes of each business execution end to cope with network security anomalies. Based on the resource configuration attributes, the system estimates the operating load of each business execution end, thereby determining the discrete network attack behaviors suffered by each business execution end.

[0008] Optionally, in step S4, context tracing is performed on the plurality of discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, a network security alarm operation is executed, including: Obtain the multidimensional attributes of each of the discrete network attack behaviors; wherein, the multidimensional attributes include the business scenario attributes and behavior content attributes of each discrete network attack behavior; Based on the multidimensional attributes, contextual tracing is performed on the discrete network attack behaviors to determine whether the discrete network attack behaviors are consistent in the business scenario and whether they are continuous in terms of content. If so, it is determined that the discrete network attack behaviors constitute a complete network attack chain; otherwise, it is determined that the discrete network attack behaviors do not constitute a complete network attack chain. Obtain the current attack path coverage of the complete network attack chain, perform attack response performance evaluation on all service execution terminals within the current attack path coverage, and predict the attack spillover attributes of each service execution terminal; based on the attack spillover attributes, execute network attack object evolution alarm operation.

[0009] As one aspect of the present invention, the present invention also provides a multi-source security alarm analysis system based on large model and vector retrieval, comprising: The heterogeneous data extraction module is used to extract multimodal heterogeneous data by anchoring several heterogeneous interfaces based on historical early warning indicators. The evidence construction module is used to perform multiple preprocessing steps on the multimodal heterogeneous data to construct an evidence data set. The vector library construction module is used to filter and transform the evidence data set to construct a feature vector library; The vector determination module is used to match and verify the current warning identifier in the feature vector library to obtain the target feature vector; wherein the target feature vector satisfies the preset evidence completeness coverage condition; An anomaly event determination module is used to perform cross-source correlation reasoning of a large model based on the target feature vector to determine network security anomalies. The attack behavior determination module is used to analyze the network security anomaly and obtain several discrete network attack behaviors. The alarm module is used to perform contextual tracing of the several discrete network attack behaviors to determine whether they constitute a complete network attack chain; and to execute network security alarm operations based on the determination result of the complete network attack chain.

[0010] Optionally, the heterogeneous data extraction module is used to extract multimodal heterogeneous data by anchoring several heterogeneous interfaces based on historical early warning identifiers, including: Obtain the origination attribute information of historical early warning identifiers; wherein, the historical early warning identifier refers to the early warning notification initiated due to the detection of abnormal network behavior during a historical period; the origination attribute information refers to the network location and time of initiation of the early warning notification; By comparing the originating attribute information and the network link layout, several heterogeneous interfaces that are spatially and / or temporally related to the abnormal network behavior are identified; wherein, the heterogeneous interface refers to the interface that performs corresponding modal monitoring on the network; based on the dynamic attributes of the data flow of the several heterogeneous interfaces, multimodal heterogeneous data is extracted; The evidence construction module is used to perform multiple preprocessing steps on the multimodal heterogeneous data to construct an evidence data set, including: The multimodal heterogeneous data is preprocessed with time alignment, noise reduction and deduplication, and attribution tagging to obtain several preprocessed data packets. Multi-dimensional element extraction is performed on the several preprocessed data packets to construct a structured evidence data set. The structured evidence data set includes alarm subject, environmental context, and behavior timeline.

[0011] Optionally, the vector library construction module is used to filter and transform the evidence data set to construct a feature vector library, including: Based on the multi-dimensional element type attributes of the evidence data set, multi-dimensional keywords are selected from the evidence data set; semantic normalization transformation is performed on each dimension keyword to obtain feature vectors, and the feature vectors corresponding to all dimension keywords are assembled to form a feature vector library; The vector determination module is used to match and verify the current warning identifier in the feature vector library to obtain the target feature vector; wherein, the target feature vector satisfies a preset evidence completeness coverage condition, including: Several representational attributes of current network anomalies are extracted from the current warning identifier. These attributes are then processed by a pre-trained language model to generate semantic features. The feature vector library is searched based on these semantic features to obtain a target feature vector that satisfies a preset evidence association condition with the semantic features. The target feature vector contains elements corresponding to all types of evidence required to identify network security anomalies.

[0012] Optionally, the anomaly event determination module is used to perform large-scale cross-source correlation reasoning based on the target feature vector to determine network security anomalies, including: Obtain the business association attributes between every two business execution terminals under the network and the element association attributes between every two elements under the target feature vector; perform large language model inference based on the business association attributes and the element association attributes to determine the data interaction mismatch between business association and element association; wherein, the data interaction mismatch refers to the data interaction type mismatch; Based on the cumulative prediction results of the data interaction mismatch time, network security anomalies are identified; wherein, the network security anomaly refers to a network data accumulation event caused by mismatched data interaction. The attack behavior determination module is used to analyze the network security anomaly to obtain several discrete network attack behaviors, including: The system predicts and responds to network security anomalies at each business execution end, and determines the resource configuration attributes of each business execution end to cope with network security anomalies. Based on the resource configuration attributes, the system estimates the operating load of each business execution end, thereby determining the discrete network attack behaviors suffered by each business execution end.

[0013] Optionally, the alarm module is used to perform contextual tracing of the plurality of discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, it executes network security alarm operations, including: Obtain the multidimensional attributes of each of the discrete network attack behaviors; wherein, the multidimensional attributes include the business scenario attributes and behavior content attributes of each discrete network attack behavior; Based on the multidimensional attributes, contextual tracing is performed on the discrete network attack behaviors to determine whether the discrete network attack behaviors are consistent in the business scenario and whether they are continuous in terms of content. If so, it is determined that the discrete network attack behaviors constitute a complete network attack chain; otherwise, it is determined that the discrete network attack behaviors do not constitute a complete network attack chain. Obtain the current attack path coverage of the complete network attack chain, perform attack response performance evaluation on all service execution terminals within the current attack path coverage, and predict the attack spillover attributes of each service execution terminal; based on the attack spillover attributes, execute network attack object evolution alarm operation.

[0014] The beneficial effects of the above-mentioned technical solutions provided in the embodiments of the present invention include at least the following: This invention provides a multi-source security alarm analysis method and system based on a large model and vector retrieval. Based on historical warning identifiers, it anchors several heterogeneous interfaces to extract multimodal heterogeneous data and performs multiple preprocessing steps to construct an evidence data set. The evidence data set is then filtered and transformed to construct a feature vector library. The feature vector library is matched and verified against current warning identifiers to obtain target feature vectors. Based on the target feature vectors, a large model cross-source correlation inference is performed to determine network security anomalies. These anomalies are analyzed to obtain several discrete network attack behaviors. Contextual tracing of these discrete network attack behaviors is performed to determine whether they constitute a complete network attack chain, thereby executing a network security alarm operation. By constructing a data foundation, using vector retrieval matching, large model correlation inference, complete attack chain inference, and security alarms, efficient and accurate alarm identification of dynamic network security evolution is achieved. Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description and the accompanying drawings.

[0015] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating the multi-source security alarm assessment method based on large model and vector retrieval provided in this embodiment of the invention.

[0017] Figure 2 This is a schematic diagram of the structure of the multi-source security alarm analysis system based on large model and vector retrieval provided in an embodiment of the present invention. Detailed Implementation

[0018] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0019] Please see Figure 1 As shown, an embodiment of this application provides a multi-source security alarm assessment method based on large model and vector retrieval. This multi-source security alarm assessment method based on large model and vector retrieval includes: Step S1: Based on historical warning indicators, anchor several heterogeneous interfaces to extract multimodal heterogeneous data; perform multiple preprocessing steps on the multimodal heterogeneous data to construct an evidence data set; Step S2: Filter and transform the evidence data set to construct a feature vector library; perform current warning identifier matching and verification on the feature vector library to obtain the target feature vector; wherein, the target feature vector satisfies the preset evidence complete coverage condition; Step S3: Perform cross-source correlation reasoning based on the target feature vector to identify network security anomalies; analyze the network security anomalies to obtain several discrete network attack behaviors; Step S4: Perform context tracing on several discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, execute network security alert operations.

[0020] This multi-source security alarm analysis method based on large models and vector retrieval achieves automatic aggregation and analysis of cross-source data by constructing a data foundation, vector retrieval matching, large model correlation reasoning, complete attack chain reasoning, and security alarms, enabling efficient and accurate alarm identification of dynamic network security evolution.

[0021] In another embodiment, in step S1, based on historical warning identifiers, several heterogeneous interfaces are anchored to extract multimodal heterogeneous data; multiple preprocessing steps are performed on the multimodal heterogeneous data to construct an evidence data set, including: Obtain the origin attribute information of historical early warning identifiers; whereby historical early warning identifiers refer to early warning notifications initiated due to the detection of abnormal network behavior during a historical period; origin attribute information refers to the network location and time at which the early warning notification was initiated; By comparing the originating attribute information and network link layout, several heterogeneous interfaces that are spatially and / or temporally related to abnormal network behavior are identified; where heterogeneous interfaces refer to interfaces that perform corresponding modal monitoring on the network; based on the dynamic attributes of the data flow of several heterogeneous interfaces, multimodal heterogeneous data is extracted. Multimodal heterogeneous data undergoes time alignment preprocessing, noise and deduplication preprocessing, and attribution label preprocessing to obtain several preprocessed data packets. Multi-dimensional element extraction is performed on these preprocessed data packets to construct a structured evidence data set. The structured evidence data set includes the alarm subject, environmental context, and behavior timeline.

[0022] To handle different types of business, several business execution terminals are distributed throughout the network. Each terminal processes a specific type of business by utilizing corresponding memory, computing power, and / or communication resources. It's understood that all business execution terminals can flexibly connect to multiple heterogeneous security platforms. For example, a single terminal can connect to different heterogeneous security platforms at different times. By changing the heterogeneous security platform a terminal connects to, timely adaptation and monitoring of its actual situation are ensured. Considering that the business execution terminals within the network do not operate in isolation, they interact with other terminals during actual operation. Attacks on the network are not limited to a single location (such as a single gateway node) but target multiple locations within the network, forming attack chains. To comprehensively characterize the network's internal abnormal behavior under attack, historical network monitoring is necessary to obtain corresponding multimodal heterogeneous data within the network.

[0023] Specifically, the system obtains the initiating network location and initiation time of early warning notifications generated by detected abnormal behavior during historical periods. It can be understood that the aforementioned initiating network location and initiation time correspond to the network location and occurrence time of the aforementioned abnormal behavior. As a data interaction system, any abnormal behavior will propagate within the network; that is, an abnormal behavior occurring at a certain network location and time will spread outwards and subsequently appear at another network location at a later time. Therefore, by comparing the network location and occurrence time of the aforementioned abnormal behavior with the internal communication link layout of the network, the system determines other potential network locations and occurrence times of the impact after the abnormal behavior propagates within the network. Then, based on these other network locations and the occurrence times of the impact, several heterogeneous interfaces are anchored. These anchored heterogeneous interfaces can accurately perform monitoring work on the aforementioned other network locations and / or the occurrence times of the aforementioned impacts. Furthermore, these anchored heterogeneous interfaces can perform corresponding modal monitoring operations for the aforementioned other network locations and / or the occurrence times of the aforementioned impacts. Based on the dynamic change attribute of the monitoring data stream rate generated by the aforementioned anchored heterogeneous interface, multimodal heterogeneous data is adaptively extracted. For example, when the monitoring data stream rate is large, multimodal heterogeneous data is extracted in large batches; when the monitoring data stream rate is small, multimodal heterogeneous data is extracted in small batches.

[0024] Considering the differences in time reference, data interference noise, data format, and data object ownership among the extracted multimodal heterogeneous data, direct integration of multimodal heterogeneous data is not feasible. Therefore, the multimodal heterogeneous data undergoes timeline alignment preprocessing, noise filtering and duplicate content removal and merging preprocessing, and object identity tagging preprocessing to obtain several preprocessed data packets. These preprocessed data packets correspond to the complete record of abnormal network behavior occurring during a historical period. Furthermore, multi-dimensional representation elements of abnormal behavior are extracted from these preprocessed data packets to construct a structured evidence data set corresponding to the alarm subject, environmental context, and behavior timeline. Here, the alarm subject refers to the subject object to which the abnormal behavior was applied; the environmental context refers to the network record information generated during the application of the abnormal behavior; and the behavior timeline refers to the timeline record corresponding to the application of the abnormal behavior.

[0025] In another embodiment, in step S2, the evidence data set is filtered and transformed to construct a feature vector library; the feature vector library is then matched and verified against the current warning identifier to obtain the target feature vector, including: Based on the multi-dimensional element type attributes of the evidence data set, multi-dimensional keywords are selected from the evidence data set; semantic normalization transformation is performed on each dimension keyword to obtain feature vectors, and the feature vectors corresponding to all dimension keywords are assembled to form a feature vector library; Several representational attributes of current network anomalies are extracted from the current warning identifiers. These attributes are then processed by a pre-trained language model to generate semantic features. Based on these semantic features, a feature vector library is searched to obtain a target feature vector that satisfies the preset evidence association conditions with the semantic features. The target feature vector contains elements corresponding to all types of evidence required to identify network security anomalies.

[0026] The evidence dataset contains multi-dimensional representation elements of anomalous behavior, characterizing the network's anomalous behavior over a historical period based on attributes such as the subject of the attack, network record information during the attack, and the duration of the attack. To standardize and transform the anomalous behavior occurring during the historical period and create a searchable database, based on the multi-dimensional element type attributes of the evidence dataset, multi-dimensional keywords corresponding to the subject of the attack, network record information during the attack, and the duration of the attack are selected from the dataset. Then, semantic standardization transformation is performed on each dimension keyword to obtain a feature vector for each keyword. These feature vectors provide a semantic vectorized representation of each dimension keyword. Finally, the feature vectors corresponding to all dimension keywords are assembled to form a feature vector library, realizing the transformation of anomalous behavior experienced by the network during its historical period into a quantifiable and searchable database.

[0027] When an abnormal network behavior is detected and an early warning notification is issued (i.e., an early warning indicator is issued), several representative attributes are extracted from the heterogeneous security platform that is interacting with the current abnormal behavior. These representative attributes may include, but are not limited to, the subject of the current abnormal behavior, network record information during the application, and the duration of the application. A pre-trained language model is used to process and transform these representative attributes to generate vector-based semantic features. Then, based on these semantic features, a feature vector library is searched (e.g., nearest neighbor search) to obtain target feature vectors that satisfy a preset evidence association similarity range with the semantic features. The target feature vectors obtained contain elements corresponding to all types of evidence that identify the network security anomaly. These elements may include, but are not limited to, the subject, process records, and duration range of the network security anomaly, providing a basis for subsequent determination of the network security anomaly.

[0028] In another embodiment, in step S3, cross-source correlation inference of a large model is performed based on the target feature vector to determine network security anomalies; the network security anomalies are analyzed to obtain several discrete network attack behaviors, including: Obtain the business association attributes between every two business execution terminals under the network and the element association attributes between every two elements under the target feature vector; perform large language model inference based on the business association attributes and element association attributes to determine the data interaction mismatch between business association and element association; where data interaction mismatch refers to the mismatch of data interaction types. Based on the cumulative prediction results of data interaction mismatch time, network security anomalies are identified; among them, network security anomalies refer to network data accumulation events caused by mismatched data interactions. Predict and respond to network security anomalies at each business execution end, and determine the resource configuration attributes of each business execution end to respond to network security anomalies; based on the resource configuration attributes, estimate the operating load of each business execution end, and thus determine the discrete network attack behaviors suffered by each business execution end.

[0029] As discussed above, any two service execution ends within the network can potentially interact, including but not limited to data connection and transfer between them. The elements under the target feature vector correspond to the interaction status between different service execution ends involved in the network security anomaly (i.e., the corresponding element association attributes), and these interaction statuses correspond to the data connection and transfer interactions between the aforementioned different service execution ends. Under normal circumstances, the element association attributes between any two elements under the target feature vector are consistent with the service association attributes between any two service execution ends in the network, primarily in the consistency of the data types used for connection and transfer. However, under attack, the element association attributes between any two elements under the target feature vector are inconsistent with the service association attributes between any two service execution ends in the network, meaning the data types used for connection and transfer are inconsistent. This inconsistency in data types prevents the receiving service execution end from processing data normally, leading to data accumulation on the receiving side. This data accumulation directly triggers the network security anomaly. When processing network security anomalies caused by data backlog, the business execution end needs to utilize corresponding memory and / or computing resources. If the configured resource types and quantities cannot promptly clear and reduce the backlogged data, the workload of the business execution end increases, leading to local vulnerability to discrete network attacks. Identifying discrete network attack behaviors on the business execution end can provide a basis for subsequently identifying complete network attack chains.

[0030] In another embodiment, in step S4, contextual tracing is performed on several discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, a network security alarm operation is executed, including: Obtain the multidimensional attributes of several discrete network attack behaviors; among which, the multidimensional attributes include the business scenario attributes and behavior content attributes of each discrete network attack behavior; Based on multidimensional attributes, contextual tracing is performed on several discrete network attack behaviors to determine whether these behaviors are consistent in the business scenario and whether they are continuous in terms of content. If so, the discrete network attack behaviors are determined to constitute a complete network attack chain; otherwise, they are determined not to constitute a complete network attack chain. Obtain the current attack path coverage of the complete network attack chain, conduct attack response performance assessment on all business execution terminals within the current attack path coverage, predict the attack spillover attributes of each business execution terminal, and execute network attack object evolution alarm operations based on the attack spillover attributes.

[0031] It is understandable that the discrete network attacks suffered by each business execution end are not all caused by the same network attack. To determine whether a complete network attack chain caused by the same network attack has formed within the network, we first obtain the business scenario attributes and behavioral content attributes of each discrete network attack behavior. This allows us to perform contextual tracing of all discrete network attack behaviors, determining whether several discrete network attack behaviors are consistent in business scenario and whether they are continuous in behavioral content. The consistency in business scenario means that all discrete network attack behaviors have the same business scenario type; the continuity in behavioral content means that all discrete network attack behaviors are coherently related in behavioral content according to their chronological order of occurrence. By determining whether there is consistency in business scenario and continuity in behavioral content, we can accurately determine whether several discrete network attack behaviors constitute a complete network attack chain. Furthermore, the system obtains the current attack path coverage of the complete network attack chain and performs an attack response performance assessment on all service execution terminals within this coverage area. This assessment evaluates whether each subordinate service execution terminal can suppress the attack. If it can, it is determined that the corresponding service execution terminal will not experience attack spillover; otherwise, it is determined that the corresponding service execution terminal will experience attack spillover (i.e., the attack received locally by the service execution terminal will spill over to other adjacent service execution terminals). Then, based on the attack spillover path attributes, a network attack object evolution alarm operation is executed. This network attack object evolution alarm operation may include, but is not limited to, issuing notification messages about the locations of other service execution terminals that the attack spillover may reach.

[0032] Please see Figure 2 As shown, an embodiment of this application provides a multi-source security alarm analysis system based on large model and vector retrieval. This multi-source security alarm analysis system based on large model and vector retrieval includes: The heterogeneous data extraction module is used to extract multimodal heterogeneous data by anchoring several heterogeneous interfaces based on historical early warning indicators. The evidence construction module is used to perform multiple preprocessing steps on multimodal heterogeneous data to construct an evidence data set. The vector library construction module is used to filter and transform evidence data sets to build a feature vector library; The vector determination module is used to match and verify the current warning identifier in the feature vector library to obtain the target feature vector; wherein the target feature vector satisfies the preset evidence completeness coverage condition; The anomaly event determination module is used to perform cross-source correlation reasoning of a large model based on the target feature vector to determine network security anomalies. The attack behavior determination module is used to analyze network security anomalies and obtain several discrete network attack behaviors. The alarm module is used to perform contextual tracing of several discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, it executes network security alarm operations.

[0033] The beneficial effects of the above embodiments are that the multi-source security alarm analysis system based on large models and vector retrieval achieves automatic aggregation and analysis of cross-source data by constructing a data foundation, vector retrieval matching, large model association reasoning, complete attack chain reasoning, and security alarms, thereby realizing efficient and accurate alarm identification of the dynamic evolution of network security.

[0034] In another embodiment, the heterogeneous data extraction module is used to extract multimodal heterogeneous data by anchoring several heterogeneous interfaces based on historical early warning identifiers, including: Obtain the origin attribute information of historical early warning identifiers; whereby historical early warning identifiers refer to early warning notifications initiated due to the detection of abnormal network behavior during a historical period; origin attribute information refers to the network location and time at which the early warning notification was initiated; By comparing the originating attribute information and network link layout, several heterogeneous interfaces that are spatially and / or temporally related to abnormal network behavior are identified; where heterogeneous interfaces refer to interfaces that perform corresponding modal monitoring on the network; based on the dynamic attributes of the data flow of several heterogeneous interfaces, multimodal heterogeneous data is extracted. The evidence construction module is used to perform multiple preprocessing steps on multimodal heterogeneous data to construct an evidence dataset, including: Multimodal heterogeneous data undergoes time alignment preprocessing, noise and deduplication preprocessing, and attribution label preprocessing to obtain several preprocessed data packets. Multi-dimensional element extraction is performed on these preprocessed data packets to construct a structured evidence data set. The structured evidence data set includes the alarm subject, environmental context, and behavior timeline.

[0035] In another embodiment, the vector library construction module is used to filter and transform the evidence data set to construct a feature vector library, including: Based on the multi-dimensional element type attributes of the evidence data set, multi-dimensional keywords are selected from the evidence data set; semantic normalization transformation is performed on each dimension keyword to obtain feature vectors, and the feature vectors corresponding to all dimension keywords are assembled to form a feature vector library; The vector determination module is used to match and verify the current warning identifier in the feature vector library to obtain the target feature vector; wherein, the target feature vector satisfies the preset evidence completeness coverage conditions, including: Several representational attributes of current network anomalies are extracted from the current warning identifiers. These attributes are then processed by a pre-trained language model to generate semantic features. Based on these semantic features, a feature vector library is searched to obtain a target feature vector that satisfies the preset evidence association conditions with the semantic features. The target feature vector contains elements corresponding to all types of evidence required to identify network security anomalies.

[0036] In another embodiment, the anomaly event determination module is used to perform large-model cross-source correlation inference based on the target feature vector to determine network security anomalies, including: Obtain the business association attributes between every two business execution terminals under the network and the element association attributes between every two elements under the target feature vector; perform large language model inference based on the business association attributes and element association attributes to determine the data interaction mismatch between business association and element association; where data interaction mismatch refers to the mismatch of data interaction types. Based on the cumulative prediction results of data interaction mismatch time, network security anomalies are identified; among them, network security anomalies refer to network data accumulation events caused by mismatched data interactions. The attack behavior determination module is used to analyze network security anomalies and obtain several discrete network attack behaviors, including: Predict and respond to network security anomalies at each business execution end, and determine the resource configuration attributes of each business execution end to respond to network security anomalies; based on the resource configuration attributes, estimate the operating load of each business execution end, and thus determine the discrete network attack behaviors suffered by each business execution end.

[0037] In another embodiment, the alarm module is used to perform contextual tracing of several discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, it executes network security alarm operations, including: Obtain the multidimensional attributes of several discrete network attack behaviors; among which, the multidimensional attributes include the business scenario attributes and behavior content attributes of each discrete network attack behavior; Based on multidimensional attributes, contextual tracing is performed on several discrete network attack behaviors to determine whether these behaviors are consistent in the business scenario and whether they are continuous in terms of content. If so, the discrete network attack behaviors are determined to constitute a complete network attack chain; otherwise, they are determined not to constitute a complete network attack chain. Obtain the current attack path coverage of the complete network attack chain, conduct attack response performance assessment on all business execution terminals within the current attack path coverage, predict the attack spillover attributes of each business execution terminal, and execute network attack object evolution alarm operations based on the attack spillover attributes.

[0038] The operation and effect of the multi-source security alarm judgment system based on large model and vector retrieval of the present invention are consistent with the above-mentioned multi-source security alarm judgment method based on large model and vector retrieval. Therefore, the multi-source security alarm judgment system based on large model and vector retrieval will not be described again here.

[0039] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. This disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims. Thus, if these modifications and variations of the invention fall within the scope of the claims of the invention and their equivalents, the invention is also intended to include these modifications and variations.

Claims

1. A multi-source security alarm analysis method based on large model and vector retrieval, characterized in that, include: Step S1: Based on historical warning indicators, anchor several heterogeneous interfaces to extract multimodal heterogeneous data; Multiple preprocessing steps are performed on the multimodal heterogeneous data to construct an evidence data set, including: Obtain the origination attribute information of historical early warning identifiers; wherein, the historical early warning identifier refers to the early warning notification initiated due to the detection of abnormal network behavior during a historical period; the origination attribute information refers to the network location and time of initiation of the early warning notification; By comparing the originating attribute information and the network link layout, several heterogeneous interfaces that are spatially and / or temporally related to the abnormal network behavior are identified; wherein, the heterogeneous interface refers to the interface that performs corresponding modal monitoring on the network; based on the dynamic attributes of the data flow of the several heterogeneous interfaces, multimodal heterogeneous data is extracted; The multimodal heterogeneous data is preprocessed with time alignment, noise reduction and deduplication, and attribution tagging to obtain several preprocessed data packets; multi-dimensional element extraction is performed on the several preprocessed data packets to construct a structured evidence data set; wherein, the structured evidence data set includes alarm subject, environmental context, and behavior timeline; Step S2: Filter and transform the evidence data set to construct a feature vector library; perform current warning identifier matching and verification on the feature vector library to obtain target feature vectors; wherein, the target feature vectors satisfy the preset evidence complete coverage condition; Step S3: Perform large-scale cross-source correlation inference based on the target feature vector to determine network security anomalies; analyze the network security anomalies to obtain several discrete network attack behaviors, including: Obtain the business association attributes between every two business execution terminals under the network and the element association attributes between every two elements under the target feature vector; perform large language model inference based on the business association attributes and the element association attributes to determine the data interaction mismatch between business association and element association; wherein, the data interaction mismatch refers to the data interaction type mismatch; Based on the cumulative prediction results of the data interaction mismatch time, network security anomalies are identified; wherein, the network security anomaly refers to a network data accumulation event caused by mismatched data interaction. Predict and respond to network security anomalies at each business execution end, and determine the resource configuration attributes of each business execution end to respond to network security anomalies; based on the resource configuration attributes, estimate the operating load of each business execution end, and thereby determine the discrete network attack behaviors suffered by each business execution end; Step S4: Perform context tracing on the aforementioned discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, execute network security alarm operations, including: Obtain the multidimensional attributes of each of the discrete network attack behaviors; wherein, the multidimensional attributes include the business scenario attributes and behavior content attributes of each discrete network attack behavior; Based on the multidimensional attributes, contextual tracing is performed on the discrete network attack behaviors to determine whether the discrete network attack behaviors are consistent in the business scenario and whether they are continuous in terms of content. If so, it is determined that the discrete network attack behaviors constitute a complete network attack chain; if not, it is determined that the discrete network attack behaviors do not constitute a complete network attack chain. Obtain the current attack path coverage of the complete network attack chain, perform attack response performance evaluation on all service execution terminals within the current attack path coverage, and predict the attack spillover attributes of each service execution terminal; based on the attack spillover attributes, execute network attack object evolution alarm operation.

2. The multi-source security alarm analysis method based on large model and vector retrieval as described in claim 1, characterized in that: In step S2, the evidence data set is filtered and transformed to construct a feature vector library; The feature vector library is matched and verified with the current warning identifier to obtain the target feature vector, including: Based on the multi-dimensional element type attributes of the evidence data set, multi-dimensional keywords are selected from the evidence data set; semantic normalization transformation is performed on each dimension keyword to obtain feature vectors, and the feature vectors corresponding to all dimension keywords are assembled to form a feature vector library; Several representational attributes of current network anomalies are extracted from the current warning identifier. These attributes are then processed by a pre-trained language model to generate semantic features. The feature vector library is searched based on these semantic features to obtain a target feature vector that satisfies a preset evidence association condition with the semantic features. The target feature vector contains elements corresponding to all types of evidence required to identify network security anomalies.

3. A multi-source security alarm analysis system based on large models and vector retrieval, characterized in that, include: The heterogeneous data extraction module is used to extract multimodal heterogeneous data by anchoring several heterogeneous interfaces based on historical early warning indicators, including: Obtain the origination attribute information of historical early warning identifiers; wherein, the historical early warning identifier refers to the early warning notification initiated due to the detection of abnormal network behavior during a historical period; the origination attribute information refers to the network location and time of initiation of the early warning notification; By comparing the originating attribute information and the network link layout, several heterogeneous interfaces that are spatially and / or temporally related to the abnormal network behavior are identified; wherein, the heterogeneous interface refers to the interface that performs corresponding modal monitoring on the network; based on the dynamic attributes of the data flow of the several heterogeneous interfaces, multimodal heterogeneous data is extracted; The evidence construction module is used to perform multiple preprocessing steps on the multimodal heterogeneous data to construct an evidence data set, including: The multimodal heterogeneous data is preprocessed with time alignment, noise reduction and deduplication, and attribution tagging to obtain several preprocessed data packets; multi-dimensional element extraction is performed on the several preprocessed data packets to construct a structured evidence data set; wherein, the structured evidence data set includes alarm subject, environmental context, and behavior timeline; The vector library construction module is used to filter and transform the evidence data set to construct a feature vector library; The vector determination module is used to match and verify the current warning identifier in the feature vector library to obtain the target feature vector; wherein the target feature vector satisfies the preset evidence completeness coverage condition; Anomaly determination module, used to perform large-scale cross-source correlation inference based on the target feature vector to determine network security anomalies, including: Obtain the business association attributes between every two business execution terminals under the network and the element association attributes between every two elements under the target feature vector; perform large language model inference based on the business association attributes and the element association attributes to determine the data interaction mismatch between business association and element association; wherein, the data interaction mismatch refers to the data interaction type mismatch; Based on the cumulative prediction results of the data interaction mismatch time, network security anomalies are identified; wherein, the network security anomaly refers to a network data accumulation event caused by mismatched data interaction. The attack behavior determination module is used to analyze the network security anomaly and obtain several discrete network attack behaviors, including: Predict and respond to network security anomalies at each business execution end, and determine the resource configuration attributes of each business execution end to respond to network security anomalies; based on the resource configuration attributes, estimate the operating load of each business execution end, and thereby determine the discrete network attack behaviors suffered by each business execution end; The alarm module is used to perform contextual tracing of the aforementioned discrete network attack behaviors to determine whether they constitute a complete network attack chain; based on the determination result of the complete network attack chain, it executes network security alarm operations, including: Obtain the multidimensional attributes of each of the discrete network attack behaviors; wherein, the multidimensional attributes include the business scenario attributes and behavior content attributes of each discrete network attack behavior; Based on the multidimensional attributes, contextual tracing is performed on the discrete network attack behaviors to determine whether the discrete network attack behaviors are consistent in the business scenario and whether they are continuous in terms of content. If so, it is determined that the discrete network attack behaviors constitute a complete network attack chain; if not, it is determined that the discrete network attack behaviors do not constitute a complete network attack chain. Obtain the current attack path coverage of the complete network attack chain, perform attack response performance evaluation on all service execution terminals within the current attack path coverage, and predict the attack spillover attributes of each service execution terminal; based on the attack spillover attributes, execute network attack object evolution alarm operation.

4. The multi-source security alarm analysis system based on large model and vector retrieval as described in claim 3, characterized in that: The vector library construction module is used to filter and transform the evidence data set to construct a feature vector library, including: Based on the multi-dimensional element type attributes of the evidence data set, multi-dimensional keywords are selected from the evidence data set; semantic normalization transformation is performed on each dimension keyword to obtain feature vectors, and the feature vectors corresponding to all dimension keywords are assembled to form a feature vector library; The vector determination module is used to match and verify the current warning identifier in the feature vector library to obtain the target feature vector; wherein, the target feature vector satisfies a preset evidence completeness coverage condition, including: Several representational attributes of current network anomalies are extracted from the current warning identifier. These attributes are then processed by a pre-trained language model to generate semantic features. The feature vector library is searched based on these semantic features to obtain a target feature vector that satisfies a preset evidence association condition with the semantic features. The target feature vector contains elements corresponding to all types of evidence required to identify network security anomalies.

Images