Safety alarm evidence completeness checking method, device and electronic equipment

Abstract

The application discloses a kind of safety alarm evidence completeness checking method, device and electronic equipment, is especially related to the technical field of safety operation automation, method includes: according to the investigation procedure sequence of alarm type corresponding investigation is carried out, record the collected evidence of each investigation procedure in investigation procedure sequence acquisition;With evidence requirement list, determine the comparison result of each evidence requirement item being satisfied, and the missing evidence item of evidence requirement list not being satisfied by collected evidence;According to the importance level of each evidence requirement item, the completeness measure value of the current evidence completeness degree is obtained;When the completeness measure value does not satisfy preset completeness condition, according to the collection method information of missing evidence item, the evidence corresponding to missing evidence item is collected and added to collected evidence, and the comparison result and completeness measure value are updated;When the completeness measure value satisfies preset completeness condition, the research and judgment conclusion of safety alarm is generated based on collected evidence.

Description

Technical Field

[0001] This invention relates to the field of automated safety operation technology, and in particular to a method, apparatus and electronic device for checking the completeness of safety alarm evidence. Background Technology

[0002] Currently, with the surge in the number of cybersecurity alerts, the industry typically uses intelligent security analysis agents or manual investigations to handle these incidents. In a standard investigation process, the investigating entity collects relevant data as evidence for the received security alerts and directly outputs a conclusion based on the obtained evidence.

[0003] However, existing security alarm investigation schemes have significant limitations in actual operation: key evidence is often missed, evidence collection is incomplete, and the depth of investigation is insufficient. These objective defects result in the final judgments lacking sufficient data support, leading to low accuracy and confidence levels, and posing a significant risk of false alarms and missed alarms when dealing with complex alarms.

[0004] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to solve the technical problem that there are omissions in the evidence collected during alarm investigations compared to the evidence that should have been collected, and that these omissions are not identified before the judgment conclusion is output. This invention provides a method, device, and electronic device for checking the completeness of security alarm evidence.

[0006] The first aspect of this invention provides a method for checking the completeness of evidence in a security alarm. The method includes: in response to receiving a security alarm, identifying the alarm type; matching an investigation standard operating procedure (SOP) corresponding to the alarm type from a standard operating procedure (SOP) knowledge base, and extracting a list of evidence requirements defined by the investigation SOP; the SOP knowledge base stores multiple investigation SOPs, each including a sequence of investigation steps and the evidence requirement list, the evidence requirement list including multiple evidence requirement items, each of which is pre-set with an importance level and collection method information; executing an investigation according to the investigation step sequence corresponding to the alarm type, and recording the collected evidence in each investigation step of the investigation step sequence. Evidence; the collected evidence is compared item by item with the evidence requirement list to determine the comparison results of each evidence requirement item being met, and the missing evidence items in the evidence requirement list that are not met by the collected evidence; the comparison results are weighted according to the preset weights corresponding to the importance level of each evidence requirement item to obtain a completeness metric value representing the current completeness of the evidence; when the completeness metric value does not meet the preset completeness conditions, evidence corresponding to the missing evidence item is collected according to the collection method information of the missing evidence item and added to the collected evidence, and the comparison results and the completeness metric value are updated; when the completeness metric value meets the preset completeness conditions, a judgment conclusion for the security alarm is generated based on the collected evidence.

[0007] In one embodiment of the present invention, after the completeness metric does not meet the preset completeness condition and evidence corresponding to the missing evidence item is collected, and the comparison result and the completeness metric are updated, the method further includes: repeatedly executing the steps of collecting evidence corresponding to the missing evidence item and updating the comparison result and the completeness metric until the updated completeness metric meets the preset completeness condition, or the number of repeated executions of the collection reaches a preset number; when the number of repeated executions reaches the preset number and the completeness metric still does not meet the preset completeness condition, the unmet missing evidence item is output and manual intervention is triggered.

[0008] In one embodiment of the present invention, the step of weighting the comparison results according to the preset weights corresponding to the importance levels of each of the evidence requirements to obtain a completeness measure value characterizing the current completeness of the evidence includes: determining the collection completeness of each of the evidence requirements, wherein the collection completeness is taken as a first value for evidence requirements fully satisfied by the collected evidence, a second value for evidence requirements not satisfied, and a value between the second value and the first value for evidence requirements partially satisfied, wherein the first value is greater than the second value; accumulating the products of the collection completeness of each of the evidence requirements and the preset weights corresponding to their importance levels to obtain a first sum, accumulating the preset weights corresponding to the importance levels of each of the evidence requirements to obtain a second sum, and using the ratio of the first sum to the second sum as the completeness measure value; the preset completeness condition is that the completeness measure value is not lower than a preset completeness rate threshold.

[0009] In one embodiment of the present invention, the completeness threshold is stored as metadata of the SOP knowledge base, and the completeness threshold is associated with the alarm risk level of the security alarm, with different alarm risk levels corresponding to different completeness thresholds.

[0010] In one embodiment of the present invention, the importance levels include a critical level, an important level, and an auxiliary level. The preset weight corresponding to the critical level is greater than the preset weight corresponding to the important level, and the preset weight corresponding to the important level is greater than the preset weight corresponding to the auxiliary level. The step of collecting evidence corresponding to the missing evidence item according to the collection method information of the missing evidence item includes: sorting the missing evidence items according to their importance levels, and collecting the evidence corresponding to the missing evidence items in descending order of importance level.

[0011] In one embodiment of the present invention, the data collection method information includes a tool identifier, a parameter template, and a data source identifier. The parameter template is configured to inject variables from the context of the security alarm. The step of collecting evidence corresponding to the missing evidence item based on the data collection method information includes: encapsulating the tool identifier, the call parameters obtained by injecting variables into the parameter template according to the context of the security alarm, and the data source identifier into a tool call instruction conforming to a preset tool call protocol and issuing it to drive the tool corresponding to the data source pointed to by the data source identifier to collect the evidence corresponding to the missing evidence item. The tool corresponding to each data source, which is encapsulated as a standardized service, is called via a unified client according to the preset tool call protocol.

[0012] In one embodiment of the present invention, the alarm type is divided into a first-level category, a second-level subcategory, and a third-level subcategory variant according to granularity, wherein the second-level subcategory belongs to the first-level category, and the third-level subcategory variant belongs to the second-level subcategory; the step of matching the investigation standard operating procedure corresponding to the alarm type from the SOP knowledge base includes:

[0013] The SOP knowledge base is matched at the granularity of the third-level subclass variant. If no matching result is found, the matching process reverts to the granularity of the second-level subclass. If no matching result is found, the matching process reverts to the granularity of the first-level category. If no matching result is found at the granularity of the first-level category, a pre-set general investigation standard operating procedure is loaded. The general investigation standard operating procedure includes a general sequence of investigation steps and a minimum set of evidence as the evidence requirement list.

[0014] In one embodiment of the present invention, the step of comparing the collected evidence with the evidence requirement list item by item includes: when a matching rule is configured for the evidence requirement item, matching the collected evidence according to the matching rule, and determining that the collected evidence meets the evidence requirement item when the matching is successful; when no matching rule is configured for the evidence requirement item, converting the description text of the collected evidence and the description text of the evidence requirement item into embedding vectors and calculating the similarity, determining that the collected evidence meets the evidence requirement item when the similarity is not lower than a first threshold, marking the collected evidence as pending confirmation when the similarity is lower than the first threshold but not lower than a second threshold, and determining that the collected evidence does not meet the evidence requirement item when the similarity is lower than the second threshold, wherein the first threshold is greater than the second threshold.

[0015] A second aspect of the present invention provides a device for checking the completeness of security alarm evidence. The device includes: an alarm receiving module, configured to identify the alarm type of the security alarm in response to receiving a security alarm; a process matching module, configured to match the investigation standard operating procedure corresponding to the alarm type from a standard operating procedure (SOP) knowledge base, and extract the evidence requirement list defined by the investigation standard operating procedure; the SOP knowledge base stores multiple investigation standard operating procedures, each investigation standard operating procedure including an investigation step sequence and the evidence requirement list, the evidence requirement list including multiple evidence requirement items, each evidence requirement item being preset with importance level and collection method information; and an investigation execution module, configured to execute an investigation according to the investigation step sequence corresponding to the alarm type, and record the collected evidence collected in each investigation step of the investigation step sequence. The comparison module is used to compare the collected evidence with the evidence requirement list item by item to determine the comparison results of each evidence requirement item being met, and the missing evidence items in the evidence requirement list that are not met by the collected evidence. The completeness measurement module is used to weight the comparison results according to the preset weights corresponding to the importance level of each evidence requirement item to obtain a completeness measurement value that characterizes the current completeness of the evidence. The supplementary collection module is used to collect the evidence corresponding to the missing evidence item according to the collection method information of the missing evidence item and add it to the collected evidence when the completeness measurement value does not meet the preset completeness conditions, and update the comparison results and the completeness measurement value. The judgment module is used to generate a judgment conclusion of the security alarm based on the collected evidence when the completeness measurement value meets the preset completeness conditions.

[0016] A third aspect of the present invention provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the security alarm evidence completeness check method as described in the first aspect.

[0017] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the security alarm evidence completeness check method as described in the first aspect.

[0018] Compared with the prior art, the technical effects achieved by the present invention are as follows: This invention pre-configures importance levels and collection method information for each evidence requirement item in the SOP knowledge base. This allows alarm investigations to be executed based on the matched evidence requirement list, comparing the collected evidence item by item against the list. This identifies missing evidence items not met by the collected evidence before the judgment is output, ensuring evidence omissions are detected before the judgment. A completeness metric is obtained by weighting the results according to the preset weights corresponding to the importance levels of each evidence requirement item. This metric represents the completeness of evidence in a quantitative form that incorporates differences in evidence importance, and is compared with preset completeness conditions. When the completeness metric does not meet the preset completeness conditions, corresponding evidence is collected based on the preset collection method information for the missing evidence item, and the comparison results and completeness metric are updated. This allows supplementary collection of missing evidence to be initiated based on preset information. The judgment is generated only after the completeness metric meets the preset completeness conditions, ensuring the judgment is based on the collected evidence constrained by the completeness metric. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating a method for checking the completeness of security alarm evidence according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the framework of a security alarm evidence completeness checking device according to an embodiment of the present invention. Figure 3 This is a schematic diagram of the frame of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0020] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0021] The technical solution of the present invention is illustrated below through specific embodiments. It should be understood that the one or more steps mentioned in the present invention do not preclude the existence of other methods and steps before or after the combined steps, or that other methods and steps may be inserted between these explicitly mentioned steps. It should also be understood that these examples are for illustrative purposes only and are not intended to limit the scope of the present invention. Unless otherwise stated, the numbering of each method step is only for the purpose of identifying each method step, and not for limiting the order of each method or limiting the scope of the present invention. Changes or adjustments to their relative relationships, without substantial changes to the technical content, can also be considered as within the scope of the present invention.

[0022] In one embodiment of this application, a method for checking the completeness of security alarm evidence is provided, which can be executed by a security assessment intelligent agent platform. The security assessment intelligent agent platform refers to a computing entity deployed with alarm assessment logic, such as a physical server or server cluster within a security operations center, or a virtual host hosted on cloud computing resources.

[0023] The standard operating procedure (SOP) knowledge base upon which this method relies refers to a pre-built and persistently stored structured data set containing multiple survey SOPs. Each survey SOP includes a sequence of survey steps arranged in order of execution and a list of evidence requirements. This SOP knowledge base can be hosted in a relational database, document database, or key-value store, for example.

[0024] like Figure 1 As shown, the method may specifically include the following steps: S101, in response to receiving a security alarm, identify the alarm type of the security alarm.

[0025] After capturing security alert records generated by underlying network devices through asynchronous listening or interface polling, the system directly extracts feature fields such as source address, destination port, or malicious code hash encapsulated in the records. These features are then matched against a pre-defined threat signature database to determine the category of the security alert. This precise identification of alert types aims to establish a unique matching index for the system's subsequent addressing within a vast knowledge base. Essentially, the security alert is a structured data packet thrown by the security monitoring component when it detects abnormal traffic at the network boundary or suspicious host behavior.

[0026] For example, the security alert may be a phishing email alert, a web shell backdoor detection alert, or an abnormal login alert, etc. This application does not limit the specific type of alert.

[0027] S102, Match the investigation standard operating procedure corresponding to the alarm type from the SOP knowledge base, and extract the evidence requirement list defined by the investigation standard operating procedure.

[0028] Indexed by alarm type, the corresponding investigation standard operating procedure is retrieved from the SOP knowledge base, and the defined evidence requirement list is extracted for subsequent comparison. The evidence requirement list includes multiple evidence requirement items, each with a preset importance level and collection method information.

[0029] It should be noted that the "pre-set" here refers to the fact that the above-mentioned importance level and collection method information are filled in by security experts based on their attack and defense experience and domain knowledge during the SOP knowledge base entry stage, and stored together with the evidence requirements, rather than being temporarily deduced and generated during the investigation process.

[0030] The importance level is used to characterize the degree of influence of the evidence requirement on the judgment conclusion. As an implementable method, it can be divided into three levels: critical, important, and auxiliary. The critical level indicates evidence that is difficult to form a reliable conclusion if it is missing. The important level indicates evidence that will reduce the confidence of the judgment if it is missing. The auxiliary level indicates evidence used to enrich the context of the judgment. The information on the collection method is used to record the way to obtain the evidence. For example, it can record the tool identifier, the data source identifier, and the corresponding parameters.

[0031] In one example, taking the evidence requirement list corresponding to a phishing email alert as an example, the evidence requirement items may include the sender's email authentication result, the sandbox analysis result of the link in the email, the sandbox analysis result of the email attachment, etc. Each item has its own preset importance level and collection method information. For example, the sender's email authentication result is preset to the critical level, and its collection method information records the email authentication query tool to be called and the sending domain parameters to be queried.

[0032] S103, Perform the investigation according to the investigation step sequence corresponding to the alarm type, and record the collected evidence collected in each investigation step of the investigation step sequence.

[0033] In this embodiment, the investigation step sequence specifies the actions that should be performed sequentially in this investigation. The security assessment intelligent agent platform executes each investigation step one by one. Each time an investigation step is executed, the corresponding evidence data is collected and recorded as collected evidence. As the investigation step sequence progresses, the collected evidence gradually accumulates, forming the input for subsequent completeness determination.

[0034] Optionally, the recorded collected evidence may include fields such as the content text of the evidence, the source of the evidence, and the time of evidence collection, so as to identify and locate the evidence in subsequent comparison and supplementary collection.

[0035] S104. Compare the collected evidence with the evidence requirement list item by item to determine the comparison results of each evidence requirement item being met, as well as the missing evidence items in the evidence requirement list that are not met by the collected evidence.

[0036] In this embodiment, for each evidence requirement item in the evidence requirement list, it is determined whether there is evidence in the collected evidence that matches the item. If there is, the comparison result of the evidence requirement item is recorded as satisfied; if there is no such evidence, it is recorded as unsatisfied and classified as a missing evidence item. Thus, the comparison result reflecting whether each item is satisfied and the missing evidence items that need to be supplemented are obtained.

[0037] Preferably, the above item-by-item comparison can be performed according to the matching rules configured for the evidence requirement items. If a match is successful, the corresponding evidence requirement item is determined to be satisfied. If no matching rules are configured for the evidence requirement items, the description text of the collected evidence and the description text of the evidence requirement items are converted into embedding vectors, and their similarity is calculated. If the similarity is not lower than a first threshold, it is determined to be satisfied. If the similarity is lower than the first threshold but not lower than a second threshold, the collected evidence is marked as pending confirmation. If the similarity is lower than the second threshold, it is determined to be unsatisfied, where the first threshold is greater than the second threshold. In one example, the first threshold can be 0.8, and the second threshold can be 0.6. Evidence marked as pending confirmation can be temporarily excluded from the completeness measurement and a prompt will be given for manual judgment of its attribution.

[0038] S105, the results are weighted according to the preset weights corresponding to the importance levels of each evidence requirement, to obtain a completeness measure that represents the current completeness of the evidence.

[0039] In this embodiment, based on the comparison results, corresponding preset weights are extracted according to the importance level of each evidence requirement item. These weights are applied to each comparison result and then aggregated to obtain a completeness metric. This allows the completeness of the currently collected evidence relative to the evidence requirement list to be quantitatively represented in the form of differences in evidence importance. Different importance levels are pre-associated with different preset weights, and the higher the importance level, the greater its corresponding preset weight.

[0040] For example, the critical level, important level, and auxiliary level can be associated with preset weights of 3.0, 2.0, and 1.0, respectively.

[0041] In one example, the completeness of evidence collection can be determined for each evidence requirement. For evidence requirements that are fully satisfied by the collected evidence, a first value is taken; for evidence requirements that are not satisfied, a second value is taken; and for evidence requirements that are partially satisfied, a value between the second value and the first value is taken, with the first value being greater than the second value. Then, the sum of the products of the completeness of each evidence requirement and its weight is used as the numerator, and the sum of the weights of each evidence requirement is used as the denominator. The ratio of the two is used as the completeness measure. For example, the first value is taken as 1.0, the second value is taken as 0, and the partially satisfied evidence requirements can be taken as values ​​between 0 and 1 depending on the actual data completeness. When a certain investigation should collect three key level evidence items and all of them are satisfied, one of the two important level evidence items is partially satisfied with a completeness of 0.5, the other item is not satisfied, and both auxiliary level evidence items are satisfied, the numerator is 3×3.0+0.5×2.0+0×2.0+1.0×2×1.0, the denominator is 3×3.0+2×2.0+2×1.0, and the resulting ratio is the completeness measure value for that investigation.

[0042] S106, when the completeness measure does not meet the preset completeness condition, collect the evidence corresponding to the missing evidence item according to the collection method information of the missing evidence item and add the collected evidence, and update the comparison result and the completeness measure.

[0043] In this embodiment, when the completeness metric does not meet the preset completeness conditions, it indicates that the collected evidence is still missing from the evidence requirement list. The security assessment intelligent agent platform reads the collection method information preset in S102 for each missing evidence item, initiates supplementary collection of the corresponding evidence according to the recorded path, and adds the obtained evidence to the collected evidence. Then, the changed comparison results and completeness metric are recalculated and updated. Since the collection method information is stored in advance with the evidence requirement items, the supplementary collection can be initiated directly according to the preset content without having to infer the collection path temporarily in this step.

[0044] It should be noted that the preset completeness condition is a pre-set criterion used to determine whether the current completeness level meets the standard. As an implementable approach, it can be set that the completeness metric value is not lower than a preset completeness rate threshold. Preferably, this completeness rate threshold can be stored as metadata in the SOP knowledge base and associated with the alarm risk level. A higher threshold is set for high-risk alarms, and a lower threshold is set for medium- and low-risk alarms. For example, high-risk alarms require a completeness rate of not less than 0.90, and medium-risk alarms require a completeness rate of not less than 0.80.

[0045] Optionally, when the security assessment intelligent agent platform initiates supplementary collection based on the collection method information, it can encapsulate the tool identifier in the collection method information, the call parameters obtained by injecting variables into the parameter template according to the context of the security alarm, and the data source identifier into a tool call instruction that conforms to the preset tool call protocol and issue it to drive the tool corresponding to the data source pointed to by the data source identifier to collect the corresponding evidence. The data source can be, for example, a sandbox, a threat intelligence source, or a log system. The tools corresponding to each data source are encapsulated into standardized services according to the preset tool call protocol and called through a unified client.

[0046] As another feasible approach, the security assessment intelligent agent platform can repeat the above-mentioned supplementary collection and update until the updated completeness metric meets the preset completeness conditions, or the number of repetitions reaches the preset number. If the preset completeness conditions are still not met after reaching the preset number of repetitions, the platform outputs the missing evidence items that have not been met and triggers manual intervention. During the repeated supplementary collection process, an index of collected evidence that records the collection status of each evidence requirement item can also be maintained. Before issuing the tool call command, evidence requirement items with a collection status of "collected" can be filtered out based on this index, and supplementary collection can only be initiated for missing evidence items with a collection status of "not collected".

[0047] S107, when the completeness metric meets the preset completeness conditions, generate the judgment conclusion of the security alarm based on the collected evidence.

[0048] In this embodiment, when the completeness metric meets the preset completeness condition, that is, when the completeness of the currently collected evidence relative to the evidence requirement list meets the standard, the security assessment intelligent agent platform uses the accumulated collected evidence at this time as the assessment basis to comprehensively assess the security alarm and generate the corresponding assessment conclusion for output, so that the assessment conclusion is obtained under the premise that the completeness metric is constrained by the preset completeness condition.

[0049] It should be noted that the reference numerals S101 to S107 are only used to distinguish different steps and do not constitute a sole limitation on their execution order. Within the logically permissible range, the timing of some steps can be adjusted accordingly. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application.

[0050] Through the embodiments of this application, importance levels and collection method information are pre-configured in each evidence requirement item of the SOP knowledge base. Alarm investigations are then executed based on the matched evidence requirement list, comparing the collected evidence item by item against the list. This identifies missing evidence items not met by the collected evidence before the judgment conclusion is output, ensuring evidence omissions are detected before judgment. A completeness metric is obtained by weighting the comparison results according to the preset weights corresponding to the importance levels of each evidence requirement item. The completeness of the evidence is represented in a quantitative form that incorporates differences in evidence importance, and compared with preset completeness conditions. When the completeness metric does not meet the preset completeness conditions, corresponding evidence is collected based on the pre-set collection method information of the missing evidence item, and the comparison results and completeness metric are updated. This allows supplementary collection of missing evidence to be initiated based on preset information. A judgment conclusion is generated only after the completeness metric meets the preset completeness conditions, ensuring the judgment conclusion is based on the collected evidence constrained by the completeness metric.

[0051] Following S106, the execution process of supplementary data collection can be further refined and expanded to constitute a supplementary implementation method to S106.

[0052] In one embodiment of this application, after the completeness metric does not meet the preset completeness condition and evidence corresponding to the missing evidence item is collected according to the collection method information of the missing evidence item, added to the collected evidence, and the comparison result and completeness metric are updated, the security judgment intelligent agent platform repeatedly executes the process of collecting evidence corresponding to the missing evidence item and updating the comparison result and completeness metric until the updated completeness metric meets the preset completeness condition, or the number of times the collection is repeated reaches the preset number.

[0053] In this process, each round of supplementary collection is completed, and the collected evidence is expanded accordingly. The security assessment intelligent agent platform re-compares the expanded collected evidence item by item and recalculates the completeness metric. Then, it compares the completeness metric with the preset completeness condition to determine whether to continue the next round of supplementary collection. This makes the supplementary collection and completeness judgment form a cycle, approaching the preset completeness condition round by round. The reason for setting an upper limit on the number of repeated executions is that some missing evidence may not be obtained through supplementary collection due to query failure or unreachable data source. Setting an upper limit can terminate the cycle when the evidence cannot be supplemented, avoiding infinite loop.

[0054] It should be noted that the preset number of times is a parameter set in advance to limit the number of supplementary collection cycles. As an implementable method, it can be three times, that is, the cycle stops when the completeness metric value still does not meet the preset completeness condition after three consecutive supplementary collection cycles. This application does not limit the specific value of the preset number of times.

[0055] When the number of repetitions reaches the preset number and the completeness metric still does not meet the preset completeness condition, the security assessment intelligent agent platform outputs the missing evidence items that are not met and triggers manual intervention.

[0056] In this embodiment, the security assessment intelligent agent platform will output the missing evidence items that are not satisfied by the collected evidence when the loop terminates, and trigger manual intervention so that the security analyst can confirm whether the missing evidence items that are still not satisfied are indeed impossible to obtain.

[0057] Optionally, in addition to the missing evidence items that have not been satisfied, the above output may also include the importance level of each missing evidence item and its collection status in previous rounds of supplementary collection, so that when human intervention is needed, the degree of impact of the remaining missing items on the judgment conclusion can be determined.

[0058] In one embodiment of this application, the results are weighted according to the preset weights corresponding to the importance levels of each evidence requirement to obtain a completeness measure value that characterizes the current completeness of the evidence. This includes: the security assessment intelligent agent platform first determines the collection completeness of each evidence requirement, and then divides the sum of the products of the collection completeness of each evidence requirement and the preset weights corresponding to its importance level by the sum of the preset weights corresponding to the importance levels of each evidence requirement. The resulting ratio is used as the completeness measure value. Accordingly, the preset completeness condition is that the completeness measure value is not lower than a preset completeness rate threshold.

[0059] In this embodiment, the completeness of evidence collection is introduced to refine the satisfaction status of each evidence requirement from a simple "satisfied" or "unsatisfied" value to a continuous value that reflects the degree of evidence acquisition. This allows partially acquired evidence to be included in the completeness measurement according to its actual acquisition level. The introduction of preset weights allows each evidence requirement to contribute to the completeness measurement value to different degrees according to its importance level, giving greater influence to the acquisition and absence of key evidence in the measurement results.

[0060] The completeness of evidence collection is a quantitative value used to characterize the degree to which a single evidence requirement is satisfied by the collected evidence. A first value is taken for evidence requirements that are fully satisfied by the collected evidence, a second value is taken for evidence requirements that are not satisfied, and a value between the second value and the first value is taken for evidence requirements that are partially satisfied, with the first value being greater than the second value.

[0061] For example, the first value can be 1.0 and the second value can be 0; for evidence requirements that are partially satisfied, such as when a certain piece of evidence only obtains a partial result due to a query timeout, its collection completeness can be taken between 0 and 1.0 depending on the actual data completeness obtained, such as 0.5.

[0062] In one example, suppose the evidence requirement list for a certain investigation includes three key pieces of evidence, two important pieces of evidence, and two supporting pieces of evidence. The preset weights for key, important, and supporting pieces of evidence are 3.0, 2.0, and 1.0, respectively. If all three key pieces of evidence are fully satisfied, the completeness of the evidence collection is 1.0. If one of the two important pieces of evidence is partially satisfied (with a completeness of 0.5) and the other is not satisfied (with a completeness of 0), and both supporting pieces of evidence are fully satisfied... If both the completeness and data collection completeness are set to 1.0, then the sum of the above products (i.e., the numerator) is 1.0×3.0×3+0.5×2.0+0×2.0+1.0×1.0×2, and the sum of the preset weights (i.e., the denominator) is 3.0×3+2.0×2+1.0×2. The ratio of the two is the completeness measure of this survey. This ratio is compared with the preset completeness threshold. If it is not lower than the completeness threshold, the completeness measure is determined to meet the preset completeness condition.

[0063] In one embodiment of this application, the completeness threshold is persistently stored as metadata storage for the SOP knowledge base, and the completeness threshold is associated with the alarm risk level of the security alarm, with different alarm risk levels corresponding to different completeness thresholds.

[0064] The completeness threshold is stored as metadata in the SOP knowledge base along with the knowledge base, so that the threshold can be managed in a unified manner with the standard operating procedures of each investigation. By associating the completeness threshold with the alarm risk level, alarms of different risk levels are subject to their respective thresholds when determining the preset completeness conditions. This allows alarms with higher risk to be constrained by higher completeness requirements, while alarms with lower risk are constrained by relatively lower completeness requirements.

[0065] The alarm risk level is a graded identifier used to characterize the potential harm level of a safety alarm, and can be divided into three levels: high, medium, and low as an implementable method.

[0066] For example, the association between the completeness threshold and the alarm risk level can be stored in key-value format, such as using the alarm risk level as the key and the corresponding completeness threshold as the value, configured as a completeness threshold of 0.90 for high-risk alarms, 0.80 for medium-risk alarms, and 0.70 for low-risk alarms.

[0067] Specifically, the aforementioned completeness threshold can be loaded into the memory cache when the security assessment intelligent agent platform starts up. When the completeness threshold is modified, the modified value is written to the storage and the memory cache is refreshed synchronously, so that the modified completeness threshold takes effect in subsequent completeness determinations.

[0068] In one example, the completeness threshold can be configured not only according to the alarm risk level, but also according to the alarm subtype. That is, a completeness threshold can be set separately for a specific alarm subtype. If a separate threshold exists for the alarm subtype, the threshold will be applied first. If no threshold exists, the threshold corresponding to the alarm risk level will be applied.

[0069] In one embodiment of this application, the importance levels include critical level, important level and auxiliary level, and the preset weight corresponding to the critical level is greater than the preset weight corresponding to the important level, and the preset weight corresponding to the important level is greater than the preset weight corresponding to the auxiliary level. Accordingly, evidence corresponding to the missing evidence items is collected based on the information on the collection method for missing evidence items, including: the security assessment intelligent agent platform first sorts the missing evidence items according to their importance level, and then collects the evidence corresponding to the missing evidence items in descending order of importance level.

[0070] In this embodiment, the weight of critical level is higher than that of important level, and the weight of important level is higher than that of auxiliary level, so that the fulfillment or absence of critical evidence has a greater impact on the completeness metric. Supplementary collection is initiated in descending order of importance level, so that missing evidence that is more critical to the judgment is collected first. When supplementary collection cannot complete all missing evidence due to the limit of the number of times or the unavailability of the data source, the evidence that has a greater impact on the judgment is obtained first.

[0071] For example, the preset weights corresponding to the critical level, important level, and auxiliary level can be 3.0, 2.0, and 1.0, respectively. This application does not limit the specific values ​​of the weights at each level, as long as the relationship between the critical level and the important level is greater than that between the important level and the auxiliary level is satisfied.

[0072] In one example, when the missing evidence items identified in an investigation include evidence requirements at the critical, important, and auxiliary levels, the security assessment intelligent agent platform first initiates supplementary collection of the critical level missing evidence items. After the critical level missing evidence items are processed, it then initiates supplementary collection of the important and auxiliary level missing evidence items in sequence. For multiple missing evidence items within the same importance level, the collection order is not limited.

[0073] In one embodiment of this application, the data collection method information includes a tool identifier, a parameter template, and a data source identifier, and the parameter template is configured to inject variables from the context of a security alarm; Accordingly, evidence corresponding to the missing evidence items is collected based on the information on the collection method for the missing evidence items, including but not limited to: The tool identifier, the call parameters obtained by injecting variables into the parameter template according to the context of the security alarm, and the data source identifier are encapsulated into a tool call instruction that conforms to the preset tool call protocol and issued to drive the tool corresponding to the data source pointed to by the data source identifier to collect evidence corresponding to the missing evidence item. The tool corresponding to each data source is encapsulated into a standardized service according to the preset tool call protocol and is called through a unified client.

[0074] In this embodiment, the tool identifier indicates which tool should perform the data collection, the data source identifier indicates which data source should be used to obtain evidence, and the parameter template reserves variable positions to be filled. Variables are injected into the parameter template according to the context of the current security alarm to obtain the calling parameters, so that the same parameter template can be adapted to the specific values ​​of different alarms. After the above three are encapsulated into a tool calling instruction that conforms to the preset tool calling protocol and then issued, since the tools corresponding to each data source have been encapsulated into standardized services according to the same protocol, the security assessment intelligent agent platform can initiate the call through a unified client according to the protocol, without having to adapt the calling methods for different data sources separately.

[0075] In a preferred example, the preset tool invocation protocol specifically adopts the Model Context Protocol (MCP), and the corresponding generated tool invocation instruction is a standard MCP request message.

[0076] The parameter template is a pre-configured parameter structure containing variable bits to be filled in the data collection method information. The values ​​of these variable bits are provided by the context of the security alarm. For example, for the data collection method information corresponding to the sender domain reputation query, its parameter template may contain a sender domain variable bit. The security analysis intelligent agent platform injects the sender domain of the current phishing email alarm into this variable bit according to the context of the current phishing email alarm, thus obtaining the call parameters used in this call.

[0077] The preset tool invocation protocol is a unified interface convention used to standardize tool discovery and invocation, defining the request and response formats that tool invocation should follow. In one example, the preset tool invocation protocol can be a model context protocol, and the tool invocation instruction is correspondingly a tool invocation structure conforming to the model context protocol. After the tools corresponding to each data source are encapsulated into standardized services according to the protocol, they are invoked through a unified client according to the interface defined by the protocol.

[0078] Optionally, the data source pointed to by the data source identifier can be at least one of a sandbox, a threat intelligence source, or a log system. The corresponding tools can be, for example, tools that submit samples to the sandbox and obtain analysis reports, tools that query the indicator reputation of the threat intelligence source, or tools that retrieve log records from the log system. Each tool is encapsulated into a standardized service according to the above-mentioned preset tool calling protocol and called by a unified client.

[0079] In one embodiment of this application, the alarm type is divided into a first-level category, a second-level subcategory, and a third-level subcategory variant according to granularity, wherein the second-level subcategory belongs to the first-level category, and the third-level subcategory variant belongs to the second-level subcategory; accordingly, the standard operating procedure for investigation corresponding to the alarm type is matched from the SOP knowledge base, including: the security assessment intelligent agent platform first matches the SOP knowledge base at the granularity of the third-level subcategory variant, and if there is no matching result at this granularity, it falls back to the granularity of the second-level subcategory for matching, and if there is still no matching result at the granularity of the second-level subcategory, it falls back to the granularity of the first-level category for matching, and if there is still no matching result at the granularity of the first-level category, a preset general standard operating procedure for investigation is loaded, which includes a general sequence of investigation steps and a minimum set of evidence as a list of evidence requirements.

[0080] In this process, the matching is backed down from fine-grained to coarse-grained level. This is to prioritize the use of a more detailed procedure for the alarm when it exists in the SOP knowledge base, and only use a coarser-grained procedure when it is missing. Setting up a general investigation standard operating procedure as a fallback ensures that even if there are no matching results at any level, the alarm can still be investigated and its completeness determined based on the general investigation step sequence and minimum evidence set contained in the general procedure, so that it cannot be handled due to the lack of a matching procedure.

[0081] In this system, the first-level category represents the granularity distinguished by the type of alarm source, the second-level subclass represents the granularity distinguished by the specific attack type, and the third-level subclass variant represents a more detailed distinction within the same attack type. For example, the first-level category can be email alarms, host alarms, or network alarms; the second-level subclass under email alarms can be phishing emails; and the third-level subclass variant under phishing emails can be phishing emails with attachments and phishing emails with plain links.

[0082] The minimum set of evidence is a set of basic evidence requirements that are pre-configured for the general investigation standard operating procedure and serve as its evidence requirement list. It specifies the basic evidence that should be collected for any alarm even in the absence of a specific procedure, thereby providing the general investigation standard operating procedure with an evidence requirement list that can be compared item by item and used to determine its completeness.

[0083] Optionally, each survey standard operating procedure can be configured with an applicable scope label, and alarm types can be configured with alarm type labels. The above-mentioned matching of the SOP knowledge base at each granularity can be achieved by performing multi-label intersection matching between the alarm type label and the applicable scope label of each survey standard operating procedure, and the survey standard operating procedures with intersection are determined as the matching results of that granularity.

[0084] In one embodiment of this application, the collected evidence is compared item by item with the evidence requirement list, including: for each evidence requirement item, if a matching rule is configured for the evidence requirement item, the security assessment intelligent agent platform matches the collected evidence according to the matching rule, and determines that the collected evidence meets the evidence requirement item when the match is successful; if no matching rule is configured for the evidence requirement item, the description text of the collected evidence and the description text of the evidence requirement item are converted into embedding vectors respectively and the similarity between the two is calculated. If the similarity is not lower than a first threshold, the collected evidence is determined to meet the evidence requirement item; if the similarity is lower than the first threshold but not lower than a second threshold, the collected evidence is marked as pending confirmation; if the similarity is lower than the second threshold, the collected evidence is determined not to meet the evidence requirement item, wherein the first threshold is greater than the second threshold.

[0085] In this process, evidence requirements with configured matching rules are matched first because the fulfillment of such evidence requirements can be directly determined by explicit rules without further semantic comparison. For evidence requirements without configured matching rules, the descriptive text of both is converted into embedded vectors and the semantic similarity between the vectors is used to measure their semantic consistency. This allows for semantic judgment of consistency even when the collected evidence and the expression of the evidence requirements are not completely consistent. The judgment results are then divided into three categories: satisfied, pending confirmation, and unsatisfied, based on a first threshold and a second threshold. This allows collected evidence with moderate consistency that is difficult to classify directly as satisfied or unsatisfied to be marked separately for further processing.

[0086] The matching rule is a pre-configured condition in the evidence requirement item, used to directly determine whether the collected evidence meets the condition of the item. For example, it can be a limitation on the value of the evidence type field, such as limiting the value of the evidence type field of the collected evidence to a certain specified value, which is considered to meet the condition.

[0087] The embedded vector is a numerical vector representing the semantics of the text, obtained by vectorizing the descriptive text. One feasible approach is to encode the descriptive text using a text embedding model. The similarity can be achieved by using the cosine similarity between two embedded vectors. For example, the first threshold can be 0.8, and the second threshold can be 0.6. That is, a similarity of 0.8 or higher is considered satisfactory, a similarity between 0.6 and 0.8 is marked as pending confirmation, and a similarity below 0.6 is considered unsatisfactory.

[0088] Optionally, for collected evidence marked as pending confirmation, the security assessment intelligent agent platform may temporarily exclude it from the completeness metric calculation and output the collected evidence and its candidate evidence requirements in the comparison results, leaving it for manual judgment of its attribution.

[0089] Another embodiment of the present invention relates to a device for checking the completeness of security alarm evidence, such as... Figure 2 As shown, the device may specifically include: The alarm receiving module 20 is used to identify the alarm type of the security alarm in response to receiving a security alarm; The process matching module 21 is used to match the investigation standard operating procedure corresponding to the alarm type from the standard operating procedure (SOP) knowledge base, and extract the evidence requirement list defined by the investigation standard operating procedure; the SOP knowledge base stores multiple investigation standard operating procedures, each of which includes a sequence of investigation steps and the evidence requirement list, the evidence requirement list includes multiple evidence requirement items, and each evidence requirement item is preset with importance level and collection method information; The investigation execution module 22 is used to execute an investigation according to the investigation step sequence corresponding to the alarm type, and record the collected evidence collected in each investigation step of the investigation step sequence; The comparison module 23 is used to compare the collected evidence with the evidence requirement list item by item, determine the comparison result of each evidence requirement item being met, and the missing evidence items in the evidence requirement list that are not met by the collected evidence. The completeness measurement module 24 is used to weight the comparison results according to the preset weights corresponding to the importance levels of each of the evidence requirements to obtain a completeness measurement value that characterizes the current degree of evidence completeness. The supplementary acquisition module 25 is used to acquire evidence corresponding to the missing evidence item and add the acquired evidence according to the acquisition method information of the missing evidence item when the completeness metric does not meet the preset completeness condition, and update the comparison result and the completeness metric. The analysis module 26 is used to generate an analysis conclusion of the security alarm based on the collected evidence when the completeness metric value meets the preset completeness condition.

[0090] Optionally, in this embodiment, the device further includes: The first execution module is used to repeatedly execute the steps of collecting evidence corresponding to the missing evidence item and updating the comparison result and the completeness measure value after the completeness measure value does not meet the preset completeness condition and evidence corresponding to the missing evidence item is collected and the comparison result and the completeness measure value are updated, until the updated completeness measure value meets the preset completeness condition, or the number of times the collection is repeated reaches a preset number. The prompting module is used to output the missing evidence items that are not met and trigger manual intervention when the number of repeated executions reaches the preset number and the completeness metric still does not meet the preset completeness condition.

[0091] Optionally, in this embodiment, the completeness measurement module 24 includes: The first determining submodule is used to determine the collection completeness of each of the evidence requirements. The collection completeness is a first value for evidence requirements that are fully satisfied by the collected evidence, a second value for evidence requirements that are not satisfied, and a value between the second value and the first value for evidence requirements that are partially satisfied. The first value is greater than the second value. The second determining submodule is used to accumulate the product of the completeness of the collection of each of the evidence requirements and the preset weight corresponding to its importance level to obtain a first accumulated sum, and to accumulate the preset weight corresponding to the importance level of each of the evidence requirements to obtain a second accumulated sum, and to use the ratio of the first accumulated sum to the second accumulated sum as the completeness measure value. The preset completeness condition is that the completeness metric value is not lower than a preset completeness rate threshold.

[0092] Optionally, in this embodiment, the completeness threshold is used as metadata storage for the SOP knowledge base. The completeness threshold is associated with the alarm risk level of the security alarm, and different alarm risk levels correspond to different completeness thresholds.

[0093] Optionally, in this embodiment, the importance levels include critical, important, and auxiliary levels, wherein the preset weight corresponding to the critical level is greater than the preset weight corresponding to the important level, and the preset weight corresponding to the important level is greater than the preset weight corresponding to the auxiliary level; the supplementary data acquisition module 25 includes: The first data collection submodule is used to sort the missing evidence items according to their importance level, and collect the evidence corresponding to the missing evidence items in descending order of importance level.

[0094] Optionally, in this embodiment, the data collection method information includes a tool identifier, a parameter template, and a data source identifier, wherein the parameter template is configured to inject variables from the context of the security alarm; Supplementary acquisition module 25 includes: The first acquisition submodule is used to encapsulate the tool identifier, the call parameters obtained by injecting variables into the parameter template according to the context of the security alarm, and the data source identifier into a tool call instruction that conforms to a preset tool call protocol and send it out to drive the tool corresponding to the data source pointed to by the data source identifier to collect the evidence corresponding to the missing evidence item. In this process, tools corresponding to each of the data sources, which are encapsulated as standardized services, are invoked via a unified client according to the preset tool invocation protocol.

[0095] Optionally, in this embodiment, the alarm types are divided into a first-level category, a second-level subcategory, and a third-level subcategory variant according to granularity, wherein the second-level subcategory belongs to the first-level category, and the third-level subcategory variant belongs to the second-level subcategory; the process matching module 21 includes: The first matching submodule is used to match the SOP knowledge base at the granularity of the third-level subclass variant, and when there is no matching result, it falls back to the granularity of the second-level subclass for matching, and when there is no matching result, it falls back to the granularity of the first-level category for matching. The second matching submodule is used to load a pre-set general survey standard operating procedure when there is still no matching result at the granularity of the first-level category. The general survey standard operating procedure includes a general sequence of survey steps and a minimum set of evidence as the evidence requirement list.

[0096] Optionally, in this embodiment, the comparison module 23 includes: The third matching submodule is used to match the collected evidence according to the matching rules when the evidence requirement item is configured with matching rules, and to determine that the collected evidence meets the evidence requirement item when the matching is successful. The first processing submodule is configured to, when no matching rule is configured for the evidence requirement item, convert the description text of the collected evidence and the description text of the evidence requirement item into embedding vectors and calculate the similarity, determine that the collected evidence meets the evidence requirement item when the similarity is not lower than a first threshold, mark the collected evidence as pending confirmation when the similarity is lower than the first threshold but not lower than a second threshold, and determine that the collected evidence does not meet the evidence requirement item when the similarity is lower than the second threshold, wherein the first threshold is greater than the second threshold.

[0097] Another embodiment of the present invention relates to an electronic device, such as Figure 3 As shown, it includes: at least one processor 301; and a memory 302 communicatively connected to the at least one processor 301; wherein the memory 302 stores instructions executable by the at least one processor 301, the instructions being executed by the at least one processor 301 to enable the at least one processor 301 to perform the security alarm evidence completeness check method in the above embodiments.

[0098] The memory and processor are connected via a bus, which can include any number of interconnecting buses and bridges, connecting various circuits of one or more processors and memories. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.

[0099] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.

[0100] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method embodiments described above.

[0101] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0103] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for checking the completeness of security alarm evidence, characterized in that, The method includes: In response to receiving a security alarm, identify the alarm type of the security alarm; Match the investigation standard operating procedure (SOP) corresponding to the alarm type from the standard operating procedure (SOP) knowledge base, and extract the evidence requirement list defined by the investigation standard operating procedure; the SOP knowledge base stores multiple investigation standard operating procedures, each of which includes a sequence of investigation steps and the evidence requirement list, which includes multiple evidence requirement items, and each evidence requirement item is preset with importance level and collection method information; The investigation is carried out according to the investigation step sequence corresponding to the alarm type, and the collected evidence collected in each investigation step of the investigation step sequence is recorded. The collected evidence is compared item by item with the evidence requirement list to determine the comparison results of each evidence requirement item being met, as well as the missing evidence items in the evidence requirement list that are not met by the collected evidence. The comparison results are weighted according to the preset weights corresponding to the importance levels of each of the aforementioned evidence requirements to obtain a completeness measure that characterizes the current degree of evidence completeness. When the completeness metric does not meet the preset completeness condition, the evidence corresponding to the missing evidence item is collected according to the collection method information of the missing evidence item, and the collected evidence is added, and the comparison result and the completeness metric are updated. When the completeness metric meets the preset completeness condition, the judgment conclusion of the security alarm is generated based on the collected evidence.

2. The method according to claim 1, characterized in that, After the completeness metric fails to meet the preset completeness condition and evidence corresponding to the missing evidence item is collected, and the comparison result and the completeness metric are updated, the method further includes: Repeat the steps of collecting evidence corresponding to missing evidence items and updating the comparison results and the completeness metric until the updated completeness metric satisfies the preset completeness condition, or the number of times the collection is repeated reaches the preset number. When the number of repeated executions reaches the preset number and the completeness metric still does not meet the preset completeness condition, the missing evidence item that is not met is output and manual intervention is triggered.

3. The method according to claim 1, characterized in that, The comparison results are weighted according to the preset weights corresponding to the importance levels of each of the aforementioned evidence requirements to obtain a completeness metric representing the current level of evidence completeness, including: The completeness of the collection of each of the evidence requirements is determined. The completeness of the collection is a first value for evidence requirements that are fully satisfied by the collected evidence, a second value for evidence requirements that are not satisfied, and a value between the second value and the first value for evidence requirements that are partially satisfied. The first value is greater than the second value. The first sum is obtained by multiplying the completeness of each evidence requirement by its preset weight corresponding to its importance level, and the second sum is obtained by multiplying the preset weight corresponding to the importance level of each evidence requirement. The ratio of the first sum to the second sum is used as the completeness measure. The preset completeness condition is that the completeness metric value is not lower than the preset completeness rate threshold.

4. The method according to claim 3, characterized in that, The completeness threshold is stored as metadata in the SOP knowledge base. The completeness threshold is associated with the alarm risk level of the security alarm, and different alarm risk levels correspond to different completeness thresholds.

5. The method according to claim 1, characterized in that, The importance levels include critical, important, and auxiliary levels. The preset weight corresponding to the critical level is greater than the preset weight corresponding to the important level, and the preset weight corresponding to the important level is greater than the preset weight corresponding to the auxiliary level. The step of collecting evidence corresponding to the missing evidence item based on the collection method information of the missing evidence item includes: sorting the missing evidence items according to their importance level, and collecting the evidence corresponding to the missing evidence items in descending order of importance level.

6. The method according to claim 1, characterized in that, The data collection method information includes a tool identifier, a parameter template, and a data source identifier. The parameter template is configured to inject variables from the context of the security alarm. The step of collecting evidence corresponding to the missing evidence item based on the collection method information of the missing evidence item includes: The tool identifier, the call parameters obtained by injecting variables into the parameter template according to the context of the security alarm, and the data source identifier are encapsulated into a tool call instruction that conforms to a preset tool call protocol and sent out to drive the tool corresponding to the data source pointed to by the data source identifier to collect the evidence corresponding to the missing evidence item. In this process, tools corresponding to each of the data sources, which are encapsulated as standardized services, are invoked via a unified client according to the preset tool invocation protocol.

7. The method according to claim 1, characterized in that, The alarm types are divided into a first-level category, a second-level subcategory, and a third-level subcategory variant according to granularity. The second-level subcategory belongs to the first-level category, and the third-level subcategory variant belongs to the second-level subcategory. The standard operating procedure for matching the alarm type from the SOP knowledge base includes: The SOP knowledge base is matched at the granularity of the third-level subclass variant. If no matching result is found, the matching process reverts to the granularity of the second-level subclass. If no matching result is found, the matching process reverts to the granularity of the first-level category. If no matching result is found at the first-level category granularity, a pre-set general investigation standard operating procedure is loaded. The general investigation standard operating procedure includes a general sequence of investigation steps and a minimum set of evidence as the evidence requirement list.

8. The method according to claim 1, characterized in that, The step of comparing the collected evidence with the evidence requirement list item by item includes: When the evidence requirement item is configured with matching rules, the collected evidence is matched according to the matching rules, and when the matching is successful, it is determined that the collected evidence meets the evidence requirement item; When no matching rule is configured for the evidence requirement item, the description text of the collected evidence and the description text of the evidence requirement item are converted into embedding vectors and their similarity is calculated. When the similarity is not lower than a first threshold, the collected evidence is determined to meet the evidence requirement item. When the similarity is lower than the first threshold but not lower than a second threshold, the collected evidence is marked as pending confirmation. When the similarity is lower than the second threshold, the collected evidence is determined not to meet the evidence requirement item. The first threshold is greater than the second threshold.

9. A device for checking the completeness of security alarm evidence, characterized in that, The device includes: An alarm receiving module is used to identify the alarm type of a security alarm in response to receiving a security alarm. The process matching module is used to match the investigation standard operating procedure corresponding to the alarm type from the standard operating procedure (SOP) knowledge base, and extract the evidence requirement list defined by the investigation standard operating procedure; the SOP knowledge base stores multiple investigation standard operating procedures, each of which includes a sequence of investigation steps and the evidence requirement list, the evidence requirement list includes multiple evidence requirement items, and each evidence requirement item is preset with importance level and collection method information; The investigation execution module is used to execute the investigation according to the investigation step sequence corresponding to the alarm type, and record the collected evidence collected in each investigation step of the investigation step sequence; The comparison module is used to compare the collected evidence with the evidence requirement list item by item, determine the comparison results of each evidence requirement item being met, and the missing evidence items in the evidence requirement list that are not met by the collected evidence. The completeness measurement module is used to weight the comparison results according to the preset weights corresponding to the importance levels of each of the evidence requirements, so as to obtain a completeness measurement value that represents the current degree of evidence completeness. The supplementary acquisition module is used to acquire evidence corresponding to the missing evidence item and add the acquired evidence when the completeness metric does not meet the preset completeness condition, based on the acquisition method information of the missing evidence item, and update the comparison result and the completeness metric. The analysis module is used to generate an analysis conclusion for the security alarm based on the collected evidence when the completeness metric meets the preset completeness condition.

10. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the security alarm evidence completeness check method as described in any one of claims 1 to 8.

Images