A large model-based security detection method and device, a storage medium and an electronic device

Abstract

This specification discloses a security detection method, apparatus, storage medium, and electronic device based on a large-scale model. The method includes: determining original process alarm information; extracting process tree data and original process name information from the original process alarm information; using the process tree data and original process name information, employing a security detection large-scale model and a process alarm vector library to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies; and performing alarm processing on the original alarm information based on the alarm identification results and the alarm handling strategies.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a security detection method, device, storage medium, and electronic device based on a large model. Background Technology

[0002] In cybersecurity operations, the sheer volume of alerts has become a major challenge for security teams. As cyberattacks become increasingly sophisticated, current alert filtering and processing methods suffer from numerous false alarms—incorrectly labeling normal behavior as a security threat. This is a common problem in security monitoring systems. These false alarms not only consume significant human resources but may also cause genuine security threats to be overlooked. Summary of the Invention

[0003] This specification provides a security detection method, apparatus, storage medium, and electronic device based on a large model. The technical solution is as follows:

[0004] Firstly, embodiments of this specification provide a security detection method based on a large model, the method comprising:

[0005] Determine the original process alarm information, and extract process tree data and original process name information from the original process alarm information;

[0006] Based on the process tree data and the original process name information, a large-scale security detection model and a process alarm vector library are used to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies.

[0007] The original alarm information is processed based on the alarm identification results and the alarm handling strategy.

[0008] In one feasible implementation, the step of using a security detection big data model and a process alarm vector library based on the process tree data and original process name information to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies includes:

[0009] The process tree data and original process name information are input into the security detection model. The security detection model extracts process semantic information from the process tree data. Based on the process semantic information, semantic vector representation is performed to obtain the original process alarm vector. Based on the process alarm vector library, vector matching is performed on the original process alarm vector to obtain the vector matching result. Based on the vector matching result, alarm identification processing is performed to obtain the alarm identification result. Based on the alarm identification result, an alarm handling strategy is generated.

[0010] In one feasible implementation, the step of extracting process semantic information from the process tree data using the security detection big data model, and then performing semantic vector representation based on the process semantic information to obtain the original process alarm vector includes:

[0011] The process tree data is parsed using the security detection big model to obtain parent-child process relationship features, keyword information features, and keyword position features.

[0012] The original process alarm vector is obtained by feature embedding processing based on the parent-child process relationship features, keyword information features, and keyword position features.

[0013] In one feasible implementation, the step of performing vector matching on the original process alarm vector based on the process alarm vector library to obtain the vector matching result includes:

[0014] The original process alarm vector is matched with the reference process alarm vector in the process alarm vector library.

[0015] If there exists a target process alarm vector that matches the original process alarm vector, then a known alarm vector matching result is generated for the target process alarm vector;

[0016] If there is no target process alarm vector that matches the original process alarm vector, then an unknown alarm vector matching result is generated for the original process alarm vector.

[0017] In one feasible implementation, the step of performing vector matching processing between the original process alarm vector and the reference process alarm vector in the process alarm vector library includes:

[0018] Calculate the vector similarity parameter between the original process alarm vector and the reference process alarm vector in the process alarm vector library, and match the original process name information and the reference process name information;

[0019] If there exists a reference vector similarity parameter of the reference process alarm vector that is greater than the similarity parameter threshold and the original process name information matches the reference process name information, then the target process alarm vector that is determined to have a reference vector similarity parameter greater than the similarity parameter threshold and the original process name information matches the reference process name information is determined.

[0020] If the reference vector similarity parameter of all the reference process alarm vectors is less than or equal to the similarity parameter threshold and / or the original process name information does not match all the reference process name information, then it is determined that there is no target process alarm vector that matches the original process alarm vector.

[0021] In one feasible implementation, the alarm identification process based on the vector matching result to obtain an alarm identification result, and the generation of an alarm handling strategy based on the alarm identification result, includes:

[0022] If the vector matching result is the known alarm vector matching result, then based on querying the alarm vector library to find the historical alarm handling strategy associated with the target process alarm vector, the historical alarm handling strategy is used as the alarm handling strategy for the original process alarm information.

[0023] If the vector matching result is the unknown alarm vector matching result, then a recommended alarm handling strategy is configured for the original process alarm information. The original process alarm vector is associated with the original process alarm information, the original process alarm information, and the original process name information to obtain alarm vector association data. The original process alarm vector and the alarm vector association data are added to the alarm vector library.

[0024] In one feasible implementation, configuring a recommended alarm processing strategy for the original process alarm information includes:

[0025] A large security detection model is used to search for process alarm context information for the original process alarm information, and based on the process alarm context information, multiple candidate alarm vectors are matched and associated data is obtained from the alarm vector library.

[0026] Based on the candidate alarm vector association data, a recommended alarm processing strategy is generated from the original process alarm information.

[0027] Secondly, embodiments of this specification provide a security detection device based on a large model, the device comprising:

[0028] The extraction module is used to determine the original process alarm information and extract process tree data and original process name information from the original process alarm information;

[0029] The alarm module is used to perform alarm identification processing on the original process alarm information based on the process tree data and the original process name information, using a security detection big model and a process alarm vector library, to obtain alarm identification results and alarm handling strategies.

[0030] The processing module is used to process the original alarm information based on the alarm identification result and the alarm handling strategy.

[0031] In one feasible implementation, the step of using a security detection big data model and a process alarm vector library based on the process tree data and original process name information to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies includes:

[0032] The process tree data and original process name information are input into the security detection model. The security detection model extracts process semantic information from the process tree data. Based on the process semantic information, semantic vector representation is performed to obtain the original process alarm vector. Based on the process alarm vector library, vector matching is performed on the original process alarm vector to obtain the vector matching result. Based on the vector matching result, alarm identification processing is performed to obtain the alarm identification result. Based on the alarm identification result, an alarm handling strategy is generated.

[0033] In one feasible implementation, the step of extracting process semantic information from the process tree data using the security detection big data model, and then performing semantic vector representation based on the process semantic information to obtain the original process alarm vector includes:

[0034] The process tree data is parsed using the security detection big model to obtain parent-child process relationship features, keyword information features, and keyword position features.

[0035] The original process alarm vector is obtained by feature embedding processing based on the parent-child process relationship features, keyword information features, and keyword position features.

[0036] In one feasible implementation, the step of performing vector matching on the original process alarm vector based on the process alarm vector library to obtain the vector matching result includes:

[0037] The original process alarm vector is matched with the reference process alarm vector in the process alarm vector library.

[0038] If there exists a target process alarm vector that matches the original process alarm vector, then a known alarm vector matching result is generated for the target process alarm vector;

[0039] If there is no target process alarm vector that matches the original process alarm vector, then an unknown alarm vector matching result is generated for the original process alarm vector.

[0040] In one feasible implementation, the step of performing vector matching processing between the original process alarm vector and the reference process alarm vector in the process alarm vector library includes:

[0041] Calculate the vector similarity parameter between the original process alarm vector and the reference process alarm vector in the process alarm vector library, and match the original process name information and the reference process name information;

[0042] If there exists a reference vector similarity parameter of the reference process alarm vector that is greater than the similarity parameter threshold and the original process name information matches the reference process name information, then the target process alarm vector that is determined to have a reference vector similarity parameter greater than the similarity parameter threshold and the original process name information matches the reference process name information is determined.

[0043] If the reference vector similarity parameter of all the reference process alarm vectors is less than or equal to the similarity parameter threshold and / or the original process name information does not match all the reference process name information, then it is determined that there is no target process alarm vector that matches the original process alarm vector.

[0044] In one feasible implementation, the alarm identification process based on the vector matching result to obtain an alarm identification result, and the generation of an alarm handling strategy based on the alarm identification result, includes:

[0045] If the vector matching result is the known alarm vector matching result, then based on querying the alarm vector library to find the historical alarm handling strategy associated with the target process alarm vector, the historical alarm handling strategy is used as the alarm handling strategy for the original process alarm information.

[0046] If the vector matching result is the unknown alarm vector matching result, then a recommended alarm handling strategy is configured for the original process alarm information. The original process alarm vector is associated with the original process alarm information, the original process alarm information, and the original process name information to obtain alarm vector association data. The original process alarm vector and the alarm vector association data are added to the alarm vector library.

[0047] In one feasible implementation, configuring a recommended alarm processing strategy for the original process alarm information includes:

[0048] A large security detection model is used to search for process alarm context information for the original process alarm information, and based on the process alarm context information, multiple candidate alarm vectors are matched and associated data is obtained from the alarm vector library.

[0049] Based on the candidate alarm vector association data, a recommended alarm processing strategy is generated from the original process alarm information.

[0050] Thirdly, embodiments of this specification provide a computer storage medium storing a plurality of instructions adapted for loading by a processor and executing the above-described method steps.

[0051] Fourthly, embodiments of this specification provide an electronic device that may include: a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the above-described method steps.

[0052] The beneficial effects of the technical solutions provided in some embodiments of this specification include at least the following:

[0053] In one or more embodiments of this specification, the electronic device extracts process tree data and original process name information from the original process alarm information. Based on the process tree data and original process name information, it uses a security detection big data model and a process alarm vector library to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies. Based on the alarm identification results and alarm handling strategies, the original alarm information is processed. By combining the security detection big data model and the process alarm vector library, the automation and intelligence level of alarm processing is significantly improved. Alarm identification based on process tree data and process name information can accurately distinguish between normal behavior and potential threats, reducing false alarms. Furthermore, processing using the security detection big data model and the process alarm vector library not only accelerates the identification process of new alarms but also provides reasonable response solutions by referring to the process alarm vector library, ensuring the targeting and effectiveness of the processing. Finally, the automated execution of alarm processing based on alarm identification results and handling strategies optimizes response time and efficiency, further improving the adaptability and accuracy of the system, thereby effectively improving the overall security protection capability, reducing the need for manual intervention, and improving the efficiency of security operations. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart illustrating a security detection method based on a large model provided in the embodiments of this specification;

[0056] Figure 2 This is a schematic diagram of an alarm identification process based on a large model, provided in the embodiments of this specification.

[0057] Figure 3 This is a flowchart illustrating a process semantic extraction and semantic vector representation provided in an embodiment of this specification;

[0058] Figure 4 This is a schematic diagram of a vector matching process provided in an embodiment of this specification;

[0059] Figure 5 This is a schematic diagram of the structure of a security detection device based on a large model provided in the embodiments of this specification;

[0060] Figure 6 This is a schematic diagram of the structure of an electronic device provided in the embodiments of this specification;

[0061] Figure 7 This is a schematic diagram of the operating system and user space structure provided in the embodiments of this specification;

[0062] Figure 8 yes Figure 7 Architecture diagram of the Android operating system in China;

[0063] Figure 9 yes Figure 7 Architecture diagram of the iOS operating system. Detailed Implementation

[0064] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0065] In the description of this specification, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. In the description of this specification, it should be noted that, unless otherwise expressly specified and limited, "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. Those skilled in the art can understand the specific meaning of the above terms in this specification based on the specific circumstances. Furthermore, in the description of this specification, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0066] In related technologies, security operations primarily rely on blacklists and whitelists. This method uses predefined rules to categorize known secure or insecure behaviors into whitelists and blacklists, respectively. However, this approach requires significant effort from security operations to maintain and update these lists, and necessitates continuous operation to adapt to the ever-changing threat environment. Furthermore, if whitelists are set too broadly, genuine security threats may be missed, resulting in false negatives.

[0067] In summary, current false alarm handling methods have many problems in practical applications, including high resource consumption, insufficient real-time performance, and limited ability to identify new threats. Therefore, it is necessary to improve these methods to enhance the efficiency and effectiveness of security operations.

[0068] The present specification will now be described in detail with reference to specific embodiments.

[0069] In one embodiment, such as Figure 1 As shown, a security detection method based on a large model is proposed. This method can be implemented using a computer program and can run on a large model-based security detection device based on the von Neumann architecture. The computer program can be integrated into the application or run as a standalone utility application. The large model-based security detection device can be an electronic device, including but not limited to: personal computers, tablets, handheld devices, vehicle-mounted devices, server devices, computing devices, or other processing devices connected to a wireless modem. Terminal devices may have different names in different networks, such as: user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user equipment, cellular phone, cordless phone, device in 5G network or future evolved network, etc.

[0070] Specifically, this security detection method based on large models includes:

[0071] S102: Determine the original process alarm information, and extract process tree data and original process name information from the original process alarm information.

[0072] Raw process alert information: Raw process alert information is generated by security monitoring systems and typically contains detailed information about a specific process. This information is usually generated by monitoring systems (such as IDS, IPS, EPP, etc.) and used to warn security teams of potential threats. Raw alerts may include the process's start time, path, command-line arguments, associated parent processes, etc.

[0073] Process tree data: Process tree data is a data structure that describes processes and their parent-child relationships. Each process is considered a node in the tree, and the parent-child relationships between processes are represented by the hierarchical structure of the tree. For example, if a parent process starts multiple child processes, these child processes will be represented as child nodes of the parent process.

[0074] Raw process name information: Process name information refers to the process name or process identifier contained in the alert, which helps identify the program that started the process or the task it was performing. The raw process name can be an executable file name or an identifier for a specific process;

[0075] As an illustration, the system receives alarm data from the security monitoring system—raw process alarm information, typically an alarm for a specific process (such as malware, abnormal behavior, etc.). Two key pieces of information are extracted from the raw alarm information:

[0076] Process tree data: By analyzing the parent-child relationships between processes, a process tree structure is constructed to reveal the execution logic and hierarchical relationships of processes.

[0077] Original process name information: Identifying the process name of the alarm helps determine whether the process belongs to known normal or abnormal behavior.

[0078] S104: Based on the process tree data and the original process name information, a security detection big model and a process alarm vector library are used to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies.

[0079] The security detection large-scale model is a large model trained using a basic large language model adapted to alarm recognition scenarios. It is used to analyze and detect process behavior, malicious activities, etc. This model can perform alarm recognition processing based on the input process tree data and process name information.

[0080] Process Alarm Vector Library: This is a database that stores various historical alarms and their related information (such as process characteristics, handling strategies, etc.). Each historical alarm and its related information is converted into a vector.

[0081] Alarm identification results: This is the output after analyzing alarm information, indicating whether the alarm is a real threat, its type, and its severity.

[0082] Alarm handling strategy: This can be a suggested response based on the alarm type and threat level, such as process termination, device isolation, log review, etc.

[0083] As an illustration, the process tree data (including parent-child process relationships) extracted from the original alert and the original process name information are input into the security detection model. The security detection model processes the input process tree data and process name information to identify whether the alert is a known threat type. For example, the model will determine whether it is known malware and assess whether it has suspicious behavior. The original alert information is converted into vectors, and similarity matching is performed using a vector database. If similar historical alerts already exist in the database, the type of alert and handling plan can be quickly located. If no match is found, the alert is considered to belong to a new type, requiring the generation of a new handling strategy. Further alert handling strategies are generated: based on the alert identification results, the system generates recommended alert handling strategies. For example, if the alert is identified as malware, the handling strategy might include isolating the affected host, terminating the malicious process, and enabling firewall policies.

[0084] S106: Perform alarm processing on the original alarm information based on the alarm identification result and the alarm handling strategy.

[0085] Alarm handling refers to taking appropriate measures to address potential security threats based on alarm identification results. Alarm handling includes both automated response and manual intervention.

[0086] As an example, based on the alarm identification results, the system determines the type and severity of the alarm. If it is identified as a high-risk alarm, the system will take immediate action. According to the generated alarm handling strategy, a series of protective measures will be executed automatically or manually:

[0087] Automated handling: For alarms with known threats or low complexity, electronic devices can automatically execute handling plans.

[0088] Manual intervention: For complex or high-risk alerts, review by security experts and manual operation may be required.

[0089] In one or more embodiments of this specification, the electronic device extracts process tree data and original process name information from the original process alarm information. Based on the process tree data and original process name information, it uses a security detection big data model and a process alarm vector library to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies. Based on the alarm identification results and alarm handling strategies, the original alarm information is processed. By combining the security detection big data model and the process alarm vector library, the automation and intelligence level of alarm processing is significantly improved. Alarm identification based on process tree data and process name information can accurately distinguish between normal behavior and potential threats, reducing false alarms and missed alarms. Furthermore, processing using the security detection big data model and the process alarm vector library not only accelerates the identification process of new alarms but also provides reasonable response solutions by referring to the process alarm vector library, ensuring the targeting and effectiveness of the processing. Moreover, the automated execution of alarm processing based on alarm identification results and handling strategies optimizes response time and efficiency, further improving the adaptability and accuracy of the system, thereby effectively improving the overall security protection capability, reducing the need for manual intervention, and improving the efficiency of security operations.

[0090] Please see Figure 2 , Figure 2 This is a flowchart illustrating a large-scale model-based alarm identification process proposed in this specification. Specifically, the process uses a security detection large-scale model and a process alarm vector library based on the process tree data and original process name information to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies. The following methods can be used as a reference:

[0091] S2002: Input the process tree data and the original process name information into the security detection big model, extract process semantics from the process tree data through the security detection big model to obtain process semantic information, and perform semantic vector representation based on the process semantic information to obtain the original process alarm vector.

[0092] Process semantic information: These are meaningful features extracted from process tree data and process name information by the large model, which help describe process behavior, the malice or legitimacy of a process, etc.

[0093] Semantic vector representation is the process of converting process semantic information into vectors. Vectors are a way of representing semantic information in a quantifiable way, enabling machines to process and compare data more efficiently.

[0094] The original process alarm vector is a vector generated based on process semantic information. It contains all the key information of the process alarm and can be used for subsequent matching and processing.

[0095] In a schematic representation, the process tree data and process name information extracted from the original alerts are input into the security detection model. The process tree data contains the hierarchical relationships between processes, while the process name information helps identify specific processes. The security detection model analyzes the process tree data, extracting semantic information from the processes. By identifying process behavior patterns, parent-child process relationships, and key parameters, the model understands the potential risks of the processes. Based on the extracted process semantic information, the security detection model generates a high-dimensional semantic vector—the process alert vector. This vector can fully represent the characteristics of the process alert, including the differences between normal and malicious behavior. The final generated process alert vector will serve as the representation of the original process alert for subsequent vector matching and alert processing.

[0096] S2004: Based on the process alarm vector library, perform vector matching on the original process alarm vector to obtain the vector matching result;

[0097] Vector matching: This involves comparing the currently generated process alarm vector with existing vectors in the library and calculating the similarity. In this way, the large model can identify whether the current alarm is similar to historical alarms.

[0098] Vector matching results refer to the relevance data returned based on the matching results, including the most similar historical alarms and their corresponding handling strategies.

[0099] S2006: Based on the vector matching result, perform alarm identification processing to obtain alarm identification result, and generate alarm handling strategy based on the alarm identification result.

[0100] Alarm identification and processing: This involves classifying, analyzing, and determining current alarms based on vector matching results. By comparing the similarity between current alarms and historical alarms, the large model can identify the alarm type and its risk level.

[0101] Alarm identification results: This can be the output after classifying and evaluating the current alarm, indicating whether the alarm is a known threat type and giving the corresponding risk level.

[0102] Alarm handling strategies: Based on the alarm identification results, the large model generates appropriate handling measures. These strategies may include stopping processes, isolating devices, and auditing logs.

[0103] As an illustration, based on the vector matching results from the previous step, the security detection big data model identifies the current alert, determines its category (e.g., malware, abnormal behavior, etc.), and assesses its severity. Based on the alert type and risk level, the security detection big data model automatically generates corresponding alert handling strategies. For example, if identified as high-risk malware, it might recommend isolating the affected host and terminating the relevant processes.

[0104] In one feasible implementation, the following illustrates the model training process of a large-scale security detection model:

[0105] 1. Obtain a basic large language model, and create an initial large security detection model for the security detection and processing scenario based on the basic large language model;

[0106] Large Language Models (LLMs) are artificial intelligence content generation models designed to understand and generate human language. Trained on large datasets, LLMs can perform a wide range of tasks, including text summarization, translation, sentiment analysis, and more. Optionally, LLMs can employ models such as the Tongyi Qianwen Large Model, the Bailing Large Model, or the GPT System Large Model.

[0107] 2. Obtain sample data. The sample data consists of sample process tree data and sample process name information of historical process alarm information. Label the sample data with alarm identification result labels and alarm handling strategy labels.

[0108] 3. The initial security detection model is trained at least once using sample process tree data and sample process name information. During the forward propagation training process, the initial security detection model extracts process semantics from the sample process tree data to obtain predicted process semantic information. Based on the predicted process semantic information, it performs semantic vector representation to obtain predicted process alarm vectors. Based on the process alarm vector library, it performs vector matching on the predicted process alarm vectors to obtain predicted vector matching results. Based on the predicted vector matching results, it performs alarm identification processing to obtain predicted alarm identification results. Based on the predicted alarm identification results, it generates predicted alarm handling strategies.

[0109] 4. During the forward propagation training of the model, the result prediction loss is determined by the model loss calculation formula based on the predicted alarm identification result and the alarm identification result label. The strategy prediction loss is determined by the model loss calculation formula based on the predicted alarm handling strategy and the alarm handling strategy label. The comprehensive model loss is determined based on the result prediction loss and the strategy prediction loss. The model parameters of the initial security detection large model are adjusted based on the comprehensive model loss until the model training conditions are met to obtain the security detection large model.

[0110] Optionally, the model loss value can be obtained using a model loss calculation function in related technologies, such as any one of the following: hinge loss function, contrast loss function, Euclidean distance loss function, or cross-entropy loss function.

[0111] Optionally, the conditions for ending model training may include the loss function value being less than or equal to a preset loss function threshold, or the number of iterations reaching a preset threshold. The conditions for ending model training can be determined based on the actual situation and are not specifically limited here.

[0112] In the embodiments described in this specification, the above method effectively extracts key features from process alarm information and matches them with process semantic vectors generated by the security detection big data model. Combined with the process alarm vector library, the security detection big data model can quickly identify whether the current alarm belongs to a known threat type and generate corresponding handling strategies based on the matching results of historical alarms. This processing method not only improves the efficiency and accuracy of alarm identification but also ensures timely response and handling of security incidents.

[0113] Optional, please refer to Figure 3 , Figure 3 This is a flowchart illustrating process semantic extraction and semantic vector representation. Specifically, the process semantic information is obtained by extracting process semantics from the process tree data using the security detection model, and the original process alarm vector is obtained by representing the process semantic information using semantic vectors. This can be achieved in the following ways:

[0114] S3002: The process tree data is parsed using the security detection big model to obtain parent-child process relationship features, keyword information features, and keyword position features;

[0115] Parent-child process relationship characteristics refer to the hierarchy and dependencies between processes in a process tree. For example, a parent process can start multiple child processes; this information helps determine whether process behavior is legal or suspicious.

[0116] Keyword information features refer to keywords involved in a process, such as command-line arguments, execution paths, and filenames. These keywords help reveal the process's intent and behavior.

[0117] Keyword positional characteristics refer to the position or order of keywords within a process. For example, certain keywords may appear at the beginning of a command or at the end of the execution path; this positional information is helpful in understanding the intent of the process.

[0118] In a schematic representation, the large-scale security detection model parses the process tree data to extract features such as parent-child process relationships, keywords, and their positions. The model first analyzes the process tree structure, identifying the hierarchical relationships between parent and child processes to obtain parent-child process relationship features, and extracts keyword information features from process command lines, paths, and other data. The model then performs positional analysis on the extracted keywords, marking their order or position in the command line or path to obtain keyword positional features. These keyword positional features help in subsequent analysis of process behavior patterns, further understanding whether there is any abnormal or malicious intent.

[0119] S3004: Based on the parent-child process relationship features, keyword information features, and keyword position features, feature embedding processing is performed to obtain the original process alarm vector.

[0120] Feature embedding: Feature embedding is the process of transforming discrete features (such as parent-child process relationships, keywords, etc.) into continuous, high-dimensional vector representations. Through this process, the model can process and compare these features more efficiently.

[0121] The original process alarm vector is a vector representation obtained by embedding various features of the process (such as parent-child relationships, keywords, and location). These vector representations contain semantic information about the process alarms, which can support subsequent matching and processing.

[0122] In a schematic representation, the security detection model embeds extracted parent-child process relationship features, keyword information features, and keyword position features. Each feature is transformed into a high-dimensional vector, and different nodes and features in the process tree are encoded into vector representations. Then, all extracted feature vectors are fused to generate a comprehensive raw process alarm vector. This raw process alarm vector contains complete semantic information about the process tree structure, describing the process's behavior and potential security threats. The final generated raw process alarm vector serves as the numerical representation of the process alarm for subsequent matching, identification, and processing.

[0123] In this specification, the security detection big data model employing the above method can deeply analyze process tree data, extracting key information such as parent-child process relationships, keyword information, and their location features. These features, after embedding processing, generate raw process alarm vectors, enabling efficient representation of the semantic information of process behavior. In this way, the security detection big data model can not only accurately capture the structure and potential threats of processes, but also transform this information into vector representations that are easy for machine learning models to process, thereby improving the accuracy and efficiency of alarm identification and security response.

[0124] Optional, please refer to Figure 4 , Figure 4This is a flowchart illustrating a vector matching process. Specifically, the vector matching result obtained by performing vector matching on the original process alarm vector based on the process alarm vector library can be achieved using the following method:

[0125] S4002: Perform vector matching processing on the original process alarm vector and the reference process alarm vector in the process alarm vector library;

[0126] Reference process alarm vectors can be understood as vector representations generated by preprocessing, feature extraction, and embedding historical alarm data. Each reference vector reflects not only the semantic information, structural features, parent-child process relationships, keywords, and their locations of historical process alarms, but also metadata such as the classification label and handling strategy of that historical alarm. These vectors are stored as "reference standards" in the process alarm vector library and used for similarity matching with newly generated original process alarm vectors.

[0127] This process illustratively retrieves all or part of the historical reference process alarm vectors from the process alarm vector library. Vector matching algorithms (such as cosine similarity or Euclidean distance) are used to calculate the similarity between the original vector and each reference vector. For example, when using cosine similarity, the similarity is measured by calculating the cosine of the angle between two vectors. The calculation result assigns a similarity score to each reference vector, reflecting their semantic and structural closeness. Based on a preset matching threshold (e.g., similarity greater than 0.90), target process alarm vectors that meet the criteria are selected. If the similarity of one or more reference vectors exceeds this threshold, the current original alarm is considered to have a high similarity to these historical cases. The selected target reference vectors, their similarities, and relevant metadata information (such as alarm classification, handling strategies, etc.) are used as the result of vector matching processing to support subsequent steps.

[0128] In one feasible implementation, the vector matching process between the original process alarm vector and the reference process alarm vector in the process alarm vector library can be performed as follows:

[0129] A2: Calculate the vector similarity parameter between the original process alarm vector and the reference process alarm vector in the process alarm vector library, and match the original process name information and the reference process name information;

[0130] A4: If there exists a reference vector similarity parameter of the reference process alarm vector that is greater than the similarity parameter threshold and the original process name information and the reference process name information match, then determine the target process alarm vector whose reference vector similarity parameter is greater than the similarity parameter threshold and whose original process name information and the reference process name information match.

[0131] A6: If the reference vector similarity parameter of all the reference process alarm vectors is less than or equal to the similarity parameter threshold and / or the original process name information does not match all the reference process name information, then it is determined that there is no target process alarm vector that matches the original process alarm vector.

[0132] S4004: If there exists a target process alarm vector that matches the original process alarm vector, then generate a known alarm vector matching result for the target process alarm vector;

[0133] Target process alarm vector: refers to historical reference vectors that have a high degree of matching with the original process alarm vector after similarity calculation during the vector matching process. These vectors represent known alarm cases and their characteristics in history.

[0134] Known alarm vector matching result: This refers to the matching result generated by the system if one or more target process alarm vectors exist during the vector matching process and their similarity meets the preset matching criteria. This result includes historical alarm information, classification labels, and handling strategies related to the target vector, facilitating automated response.

[0135] As an illustration, after calculating the similarity between the original process alarm vector and the reference vector in the process alarm vector library, if one or more target process alarm vectors have a similarity exceeding a set threshold, a match is considered to have occurred. At this point, the closest target vector (or multiple target vectors) can be selected from the matching results, and its associated historical alarm information, classification, and handling strategies can be extracted. A "Known Alarm Vector Matching Result" is generated, which contains detailed information about the successfully matched target process alarm vectors and their corresponding response measures. This allows for the direct invocation of historical handling strategies to achieve automated or semi-automated alarm response.

[0136] S4006: If there is no target process alarm vector that matches the original process alarm vector, then generate an unknown alarm vector matching result for the original process alarm vector.

[0137] Unknown alarm vector matching result: This refers to the matching result generated by the system if no target process alarm vector meets the preset matching criteria during the vector matching process. This result indicates that no similar cases were found in the historical data for the current original process alarm, requiring further analysis and decision-making by security experts. It can also serve as a basis for subsequent updates to the vector library.

[0138] As an illustration, if, after vector matching calculation in S4002, no reference vector has a similarity to the original process alarm vector that reaches a preset threshold, then it is considered that no target process alarm vector has been matched. In this case, the situation is identified as an "unknown alarm," and an unknown matching result for the original process alarm vector is generated. Optionally, an "unknown alarm vector matching result" is generated, indicating that no similar cases were found in the historical data for the current alarm, and further analysis by security experts is required to develop a new handling strategy. Simultaneously, this alarm record can also be used for subsequent expansion and updating of the vector library.

[0139] In this specification, step S4004 generates a "known alarm vector matching result" by determining whether there is a target vector with a high degree of matching with the original process alarm vector. This quickly identifies known threats similar to historical records and invokes the corresponding handling strategy. Step S4006 handles the case where no target vector is matched, generating an "unknown alarm vector matching result." Together, they constitute an important part of the vector matching process, providing data support for the automatic generation of alarm classification and handling strategies, and significantly improving the accuracy and efficiency of security response.

[0140] Furthermore, after determining the vector matching result, S2006 is executed to perform alarm identification processing based on the vector matching result to obtain the alarm identification result. An alarm handling strategy is generated based on the alarm identification result, which can be done in the following way:

[0141] B2: If the vector matching result is the known alarm vector matching result, then based on querying the alarm vector library to find the historical alarm handling strategy associated with the target process alarm vector, the historical alarm handling strategy shall be used as the alarm handling strategy for the original process alarm information.

[0142] Historical alarm handling strategies: These refer to handling solutions that have been verified as effective in historical alarm records and are associated with the alarm vector of the target process, such as isolating the host, terminating the process, and initiating detailed log review.

[0143] As an illustration, during the preceding vector matching process (S4002–S4006), if a target process alarm vector is found whose similarity to the original process alarm vector reaches a preset threshold, the vector matching result is "Known Alarm Vector Matching Result". Using this target process alarm vector as a keyword, the associated historical alarm handling strategies and related metadata are queried from the process alarm vector database. The retrieved historical alarm handling strategies are then used as the handling strategy for the current original process alarm, directly applied to automated alarm response or provided to security experts for reference, thereby quickly completing alarm handling.

[0144] B4: If the vector matching result is the unknown alarm vector matching result, then a recommended alarm processing strategy is configured for the original process alarm information. The original process alarm vector is associated with the original process alarm information based on the recommended alarm processing strategy, the original process alarm information, and the original process name information to obtain alarm vector association data. The original process alarm vector and the alarm vector association data are added to the alarm vector library.

[0145] Recommended alarm handling strategy: For unknown alarms, the handling suggestions generated by analyzing the original process alarm information through a large model usually include initial response, isolation suggestions and subsequent investigation steps.

[0146] Alarm vector association data: refers to the data record formed by associating the recommended alarm handling strategy, the original process alarm information and the original process name information with the original process alarm vector. This data is used to update the alarm vector library so as to match similar new alarms in the future.

[0147] As an illustration, if the vector matching result shows that no target process alarm vector matches the original process alarm vector, the matching result is "Unknown alarm vector matching result". A large model can be used to perform in-depth analysis of the original process alarm information and configure a recommended alarm handling strategy. This strategy provides an initial response and subsequent investigation suggestions based on the characteristics, context information, and historical experience of the current alarm. The generated recommended alarm handling strategy is then associated with the original process alarm information and the original process name information to form alarm vector association data. This data record fully describes the characteristics of the current unknown alarm and the recommended handling scheme. Finally, the original process alarm vector and its associated alarm vector association data are added to the process alarm vector library so that similar new alarms can be identified in future vector matching, enabling continuous learning and optimization.

[0148] In this specification, the above method ensures that when the vector matching result shows a known alarm, historical handling strategies can be quickly retrieved by querying the vector library, achieving automated and rapid response. For unknown alarms, recommended handling strategies are generated through a large model, and the newly generated alarm vectors and associated data are updated to the vector library, thereby continuously enriching historical data and improving the system's ability to identify new threats. Together, these constitute the alarm identification and handling strategy generation process based on vector matching results, effectively improving the accuracy of alarm response, the level of automation, and the system's continuous learning capability.

[0149] In one feasible implementation, the recommended alarm handling strategy for configuring the original process alarm information can be executed in the following manner:

[0150] 1: Employ a large-scale security detection model to search for process alarm context information in response to the original process alarm information, and match multiple candidate alarm vectors with associated data from the alarm vector library based on the process alarm context information;

[0151] Process alarm context information: This refers to supplementary information and background data surrounding the original process alarm information, such as the process's runtime environment, system logs, network connection information, and parent-child relationships between processes. Context information helps to more accurately determine the nature of the alarm.

[0152] Candidate alarm vector association data: This dataset consists of multiple sets of historical alarm records, along with their associated handling strategies, classification labels, and other metadata, matched from the alarm vector library and related to the current original process alarm information. This dataset provides candidate references for recommending handling strategies.

[0153] This example illustrates how a large-scale security detection model is used to search for contextual information. The model parses the raw alarm data to extract process alarm contextual information, such as the process execution path, command parameters, parent-child process relationships, and related system logs. This contextual information comprehensively describes the alarm's environment and behavior, helping to accurately match similar historical cases. Based on the extracted contextual information, it is mapped to the same feature space and compared with historical alarm vectors in the alarm vector library. This results in multiple candidate alarm vector association data. Each data point contains the vector representation of the historical alarm, along with its associated handling strategy and alarm classification information, resulting in a set of candidate alarm vector association data. These data represent historical cases that have a high degree of semantic and structural similarity to the current raw alarm information.

[0154] 2: Based on the candidate alarm vector association data, a recommended alarm processing strategy is generated from the original process alarm information to obtain a recommended alarm processing strategy.

[0155] Recommended alarm handling strategy: Suggested handling solutions generated based on the current original process alarm information, which usually include automated response measures, isolation suggestions, further investigation steps, etc. It is generated based on the candidate alarm vector correlation data and the context analysis results of the current alarm.

[0156] In a schematic manner, the security detection big data model integrates and analyzes the associated data of the matched candidate alarm vectors, identifies the most representative handling strategies and modes in the candidate data, analyzes the handling effects of historical alarms, and determines which handling measures perform better in similar scenarios, thus providing a reference for the current alarm. Based on the associated data of candidate alarm vectors, the security detection big data model generates a recommended alarm handling strategy. This strategy will combine the specific characteristics of the current original process alarm information and historical experience in the candidate data to propose preliminary response measures, isolation suggestions, and subsequent investigation steps.

[0157] This specification utilizes a large-scale security detection model to extract contextual information from original process alarms, and based on this information, matches multiple candidate alarm vector association data from an alarm vector library. Then, based on the candidate data, a recommended alarm handling strategy is generated. This method not only quickly matches similar cases using historical data, but also, through model analysis and candidate data fusion, forms effective handling suggestions for new or unknown alarms, thereby improving the intelligence and automation level of security response.

[0158] The following will combine Figure 5 This specification provides a detailed description of the large-model-based security detection device provided in the embodiments. It should be noted that... Figure 5 The security detection device based on a large model shown is used to execute the functions described in this specification. Figures 1-4 The methods shown in the embodiments are illustrated for ease of explanation, showing only the parts related to the embodiments of this specification. For specific technical details not disclosed, please refer to this specification. Figures 1-4 The example shown.

[0159] Please see Figure 5 This diagram illustrates the structure of a large-model-based security detection device according to an embodiment of this specification. The large-model-based security detection device 1 can be implemented as all or part of a device / apparatus through software, hardware, or a combination of both. According to some embodiments, the large-model-based security detection device 1 includes an extraction module 11, an alarm module 12, and a processing module 13, specifically used for:

[0160] Extraction module 11 is used to determine the original process alarm information and extract process tree data and original process name information from the original process alarm information;

[0161] Alarm module 12 is used to perform alarm identification processing on the original process alarm information based on the process tree data and the original process name information, using a security detection big model and a process alarm vector library to obtain alarm identification results and alarm handling strategies.

[0162] Processing module 13 is used to process the original alarm information based on the alarm identification result and the alarm handling strategy.

[0163] In one feasible implementation, the step of using a security detection big data model and a process alarm vector library based on the process tree data and original process name information to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies includes:

[0164] The process tree data and original process name information are input into the security detection model. The security detection model extracts process semantic information from the process tree data. Based on the process semantic information, semantic vector representation is performed to obtain the original process alarm vector. Based on the process alarm vector library, vector matching is performed on the original process alarm vector to obtain the vector matching result. Based on the vector matching result, alarm identification processing is performed to obtain the alarm identification result. Based on the alarm identification result, an alarm handling strategy is generated.

[0165] In one feasible implementation, the step of extracting process semantic information from the process tree data using the security detection big data model, and then performing semantic vector representation based on the process semantic information to obtain the original process alarm vector includes:

[0166] The process tree data is parsed using the security detection big model to obtain parent-child process relationship features, keyword information features, and keyword position features.

[0167] The original process alarm vector is obtained by feature embedding processing based on the parent-child process relationship features, keyword information features, and keyword position features.

[0168] In one feasible implementation, the step of performing vector matching on the original process alarm vector based on the process alarm vector library to obtain the vector matching result includes:

[0169] The original process alarm vector is matched with the reference process alarm vector in the process alarm vector library.

[0170] If there exists a target process alarm vector that matches the original process alarm vector, then a known alarm vector matching result is generated for the target process alarm vector;

[0171] If there is no target process alarm vector that matches the original process alarm vector, then an unknown alarm vector matching result is generated for the original process alarm vector.

[0172] In one feasible implementation, the step of performing vector matching processing between the original process alarm vector and the reference process alarm vector in the process alarm vector library includes:

[0173] Calculate the vector similarity parameter between the original process alarm vector and the reference process alarm vector in the process alarm vector library, and match the original process name information and the reference process name information;

[0174] If there exists a reference vector similarity parameter of the reference process alarm vector that is greater than the similarity parameter threshold and the original process name information matches the reference process name information, then the target process alarm vector that is determined to have a reference vector similarity parameter greater than the similarity parameter threshold and the original process name information matches the reference process name information is determined.

[0175] If the reference vector similarity parameter of all the reference process alarm vectors is less than or equal to the similarity parameter threshold and / or the original process name information does not match all the reference process name information, then it is determined that there is no target process alarm vector that matches the original process alarm vector.

[0176] In one feasible implementation, the alarm identification process based on the vector matching result to obtain an alarm identification result, and the generation of an alarm handling strategy based on the alarm identification result, includes:

[0177] If the vector matching result is the known alarm vector matching result, then based on querying the alarm vector library to find the historical alarm handling strategy associated with the target process alarm vector, the historical alarm handling strategy is used as the alarm handling strategy for the original process alarm information.

[0178] If the vector matching result is the unknown alarm vector matching result, then a recommended alarm handling strategy is configured for the original process alarm information. The original process alarm vector is associated with the original process alarm information, the original process alarm information, and the original process name information to obtain alarm vector association data. The original process alarm vector and the alarm vector association data are added to the alarm vector library.

[0179] In one feasible implementation, configuring a recommended alarm processing strategy for the original process alarm information includes:

[0180] A large security detection model is used to search for process alarm context information for the original process alarm information, and based on the process alarm context information, multiple candidate alarm vectors are matched and associated data is obtained from the alarm vector library.

[0181] Based on the candidate alarm vector association data, a recommended alarm processing strategy is generated from the original process alarm information.

[0182] It should be noted that the large-model-based security detection device provided in the above embodiments is only illustrated by the division of the functional modules described above when executing the large-model-based security detection method. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the large-model-based security detection device and the large-model-based security detection method embodiments provided in the above embodiments belong to the same concept, and the implementation process is detailed in the method embodiments, which will not be repeated here.

[0183] The example numbers in this specification are for descriptive purposes only and do not represent the superiority or inferiority of the examples.

[0184] This specification also provides a computer storage medium that can store multiple instructions adapted to be loaded and executed by a processor as described above. Figures 1-4 The security detection method based on a large model described in the illustrated embodiment can be found in the following documentation for its specific execution process. Figures 1-4 The specific details of the illustrated embodiments will not be elaborated here.

[0185] This specification also provides a computer program product that stores at least one instruction, said at least one instruction being loaded and executed by the processor as described above. Figures 1-4 The security detection method based on a large model described in the illustrated embodiment can be found in the following documentation for its specific execution process. Figures 1-4 The specific details of the illustrated embodiments will not be elaborated here.

[0186] Please refer to Figure 6 This diagram illustrates a structural block diagram of an electronic device provided in an exemplary embodiment of this specification. The electronic device in this specification may include one or more components such as a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, memory 120, input device 130, and output device 140 may be connected via the bus 150.

[0187] Processor 110 may include one or more processing cores. Processor 110 connects to various parts of the electronic device using various interfaces and lines, and performs various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 120, and by calling data stored in memory 120. Optionally, processor 110 may be implemented using at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), or programmable logic array (PLA). Processor 110 may integrate one or more of the following: central processing unit (CPU), graphics processing unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into processor 110 and may be implemented separately using a communication chip.

[0188] The memory 120 may include random access memory (RAM) or read-only memory (ROM). Optionally, the memory 120 may include a non-transitory computer-readable storage medium. The memory 120 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 120 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), instructions for implementing the various method embodiments described below, etc. The operating system may be the Android system, including systems deeply developed based on the Android system, the iOS system developed by Apple Inc., including systems deeply developed based on the iOS system, or other systems. The data storage area may also store data created by the electronic device during use, such as phonebook data, audio and video data, chat log data, etc.

[0189] See Figure 7As shown, the memory 120 can be divided into operating system space and user space. The operating system runs in the operating system space, while native and third-party applications run in the user space. To ensure that different third-party applications can achieve good running performance, the operating system allocates corresponding system resources for each application. However, different application scenarios within the same third-party application have different requirements for system resources. For example, in local resource loading scenarios, third-party applications have high requirements for disk read speed; in animation rendering scenarios, third-party applications have high requirements for GPU performance. Since the operating system and third-party applications are independent of each other, the operating system often cannot promptly perceive the current application scenario of a third-party application, resulting in the operating system's inability to adapt system resources accordingly to the specific application scenario of the third-party application.

[0190] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to establish data communication between the third-party applications and the operating system. This would allow the operating system to obtain the current scenario information of the third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0191] Taking the Android operating system as an example, the programs and data stored in memory 120 are as follows: Figure 8As shown, the memory 120 can store the Linux kernel layer 320, the system runtime library layer 340, the application framework layer 360, and the application layer 380. The Linux kernel layer 320, system runtime library layer 340, and application framework layer 360 belong to the operating system space, while the application layer 380 belongs to the user space. The Linux kernel layer 320 provides low-level drivers for various hardware components of the electronic device, such as display drivers, audio drivers, camera drivers, Bluetooth drivers, Wi-Fi drivers, and power management. The system runtime library layer 340 provides support for key features of the Android system through several C / C++ libraries. For example, the SQLite library provides database support, the OpenGL / ES library provides 3D graphics support, and the Webkit library provides browser kernel support. The system runtime library layer 340 also provides the Android runtime library, which mainly provides core libraries that allow developers to write Android applications using the Java language. The Application Framework Layer 360 provides various APIs that may be used when building applications. Developers can also use these APIs to build their own applications, such as activity management, window management, view management, notification management, content provider, package management, call management, resource management, and location management. At least one application runs in the Application Layer 380. These applications can be native applications that come with the operating system, such as contacts, SMS, clock, and camera apps; or third-party applications developed by third-party developers, such as games, instant messaging, and photo editing apps.

[0192] Taking the operating system as an example (iOS), the programs and data stored in memory 120 are as follows: Figure 9As shown, the iOS system includes: Core OS layer 420, Core Services layer 440, Media layer 460, and Cocoa Touch layer 480. Core OS layer 420 includes the operating system kernel, drivers, and low-level program frameworks. These low-level program frameworks provide hardware-level functionality for use by the program frameworks located in Core Services layer 440. Core Services layer 440 provides system services and / or program frameworks required by applications, such as Foundation framework, account framework, advertising framework, data storage framework, network connectivity framework, geolocation framework, motion framework, etc. Media layer 460 provides applications with audiovisual interfaces, such as interfaces related to graphics and images, audio technology, video technology, and AirPlay (wireless playback of audio and video transmission technologies). Cocoa Touch layer 480 provides various commonly used interface-related frameworks for application development and is responsible for user touch interaction on electronic devices. Examples include local notification services, remote push services, advertising frameworks, game tool frameworks, message user interface (UI) frameworks, UIKit frameworks, map frameworks, and so on.

[0193] exist Figure 9 The framework shown includes, but is not limited to, the base framework in the core service layer 440 and the UIKit framework in the touchable layer 480. The base framework provides many basic object classes and data types, offering the most basic system services to all applications, and is independent of the UI. The UIKit framework, on the other hand, provides a basic UI class library for creating touch-based user interfaces. iOS applications can use the UIKit framework to provide their UI, thus providing the application's infrastructure for building user interfaces, drawing, handling user interaction events, responding to gestures, and so on.

[0194] The methods and principles for implementing data communication between third-party applications and the operating system in the iOS system can be found in the Android system, and will not be repeated here.

[0195] The input device 130 is used to receive input instructions or data, and includes, but is not limited to, a keyboard, mouse, camera, microphone, or touch device. The output device 140 is used to output instructions or data, and includes, but is not limited to, a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined into a touch screen, which is used to receive touch operations from the user using a finger, stylus, or any suitable object on or near it, and to display the user interface of various applications. The touch screen is usually located on the front panel of the electronic device. The touch screen can be designed as a full-screen, curved screen, or irregularly shaped screen. The touch screen can also be designed as a combination of a full-screen and a curved screen, or a combination of an irregularly shaped screen and a curved screen; this specification does not limit this aspect.

[0196] In addition, those skilled in the art will understand that the structure of the electronic device shown in the above figures does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements. For example, the electronic device may also include radio frequency circuits, input units, sensors, audio circuits, wireless fidelity (WiFi) modules, power supplies, Bluetooth modules, etc., which will not be described in detail here.

[0197] In the embodiments of this specification, the executing entity for each step can be the electronic device described above. Optionally, the executing entity for each step can be the operating system of the electronic device. The operating system can be Android, iOS, or other operating systems; this specification does not limit this.

[0198] The electronic device described in this specification can also be equipped with a display device. This display device can be any device capable of displaying information, such as a cathode ray tube display (CR), a light-emitting diode display (LED), an e-ink screen, a liquid crystal display (LCD), or a plasma display panel (PDP). Users can use the display device on the electronic device to view displayed text, images, videos, and other information. The electronic device can be a smartphone, tablet computer, gaming device, AR (Augmented Reality) device, automobile, data storage device, audio playback device, video playback device, laptop, desktop computing device, or wearable device such as a smartwatch, smart glasses, smart helmet, smart bracelet, smart necklace, or smart clothing.

[0199] exist Figure 6 In the illustrated electronic device, which can be a terminal, the processor 110 can be used to call the application stored in the memory 120 and specifically perform the following operations:

[0200] Determine the original process alarm information, and extract process tree data and original process name information from the original process alarm information;

[0201] Based on the process tree data and the original process name information, a large-scale security detection model and a process alarm vector library are used to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies.

[0202] The original alarm information is processed based on the alarm identification results and the alarm handling strategy.

[0203] In one feasible implementation, the step of using a security detection big data model and a process alarm vector library based on the process tree data and original process name information to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies includes:

[0204] The process tree data and original process name information are input into the security detection model. The security detection model extracts process semantic information from the process tree data. Based on the process semantic information, semantic vector representation is performed to obtain the original process alarm vector. Based on the process alarm vector library, vector matching is performed on the original process alarm vector to obtain the vector matching result. Based on the vector matching result, alarm identification processing is performed to obtain the alarm identification result. Based on the alarm identification result, an alarm handling strategy is generated.

[0205] In one feasible implementation, the step of extracting process semantic information from the process tree data using the security detection big data model, and then performing semantic vector representation based on the process semantic information to obtain the original process alarm vector includes:

[0206] The process tree data is parsed using the security detection big model to obtain parent-child process relationship features, keyword information features, and keyword position features.

[0207] The original process alarm vector is obtained by feature embedding processing based on the parent-child process relationship features, keyword information features, and keyword position features.

[0208] In one feasible implementation, the step of performing vector matching on the original process alarm vector based on the process alarm vector library to obtain the vector matching result includes:

[0209] The original process alarm vector is matched with the reference process alarm vector in the process alarm vector library.

[0210] If there exists a target process alarm vector that matches the original process alarm vector, then a known alarm vector matching result is generated for the target process alarm vector;

[0211] If there is no target process alarm vector that matches the original process alarm vector, then an unknown alarm vector matching result is generated for the original process alarm vector.

[0212] In one feasible implementation, the step of performing vector matching processing between the original process alarm vector and the reference process alarm vector in the process alarm vector library includes:

[0213] Calculate the vector similarity parameter between the original process alarm vector and the reference process alarm vector in the process alarm vector library, and match the original process name information and the reference process name information;

[0214] If there exists a reference vector similarity parameter of the reference process alarm vector that is greater than the similarity parameter threshold and the original process name information matches the reference process name information, then the target process alarm vector that is determined to have a reference vector similarity parameter greater than the similarity parameter threshold and the original process name information matches the reference process name information is determined.

[0215] If the reference vector similarity parameter of all the reference process alarm vectors is less than or equal to the similarity parameter threshold and / or the original process name information does not match all the reference process name information, then it is determined that there is no target process alarm vector that matches the original process alarm vector.

[0216] In one feasible implementation, the alarm identification process based on the vector matching result to obtain an alarm identification result, and the generation of an alarm handling strategy based on the alarm identification result, includes:

[0217] If the vector matching result is the known alarm vector matching result, then based on querying the alarm vector library to find the historical alarm handling strategy associated with the target process alarm vector, the historical alarm handling strategy is used as the alarm handling strategy for the original process alarm information.

[0218] If the vector matching result is the unknown alarm vector matching result, then a recommended alarm handling strategy is configured for the original process alarm information. The original process alarm vector is associated with the original process alarm information, the original process alarm information, and the original process name information to obtain alarm vector association data. The original process alarm vector and the alarm vector association data are added to the alarm vector library.

[0219] In one feasible implementation, configuring a recommended alarm processing strategy for the original process alarm information includes:

[0220] A large security detection model is used to search for process alarm context information for the original process alarm information, and based on the process alarm context information, multiple candidate alarm vectors are matched and associated data is obtained from the alarm vector library.

[0221] Based on the candidate alarm vector association data, a recommended alarm processing strategy is generated from the original process alarm information.

[0222] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory, or random access memory, etc.

[0223] The above-disclosed embodiments are merely preferred embodiments of this specification and should not be construed as limiting the scope of this specification. Therefore, any equivalent variations made in accordance with the claims of this specification shall still fall within the scope of this specification.

Claims

1. A security detection method based on a large model, characterized in that, The method includes: Determine the original process alarm information, and extract process tree data and original process name information from the original process alarm information; Based on the process tree data and the original process name information, a large-scale security detection model and a process alarm vector library are used to perform alarm identification processing on the original process alarm information to obtain alarm identification results and alarm handling strategies. The original alarm information is processed based on the alarm identification results and the alarm handling strategy.

2. The method according to claim 1, characterized in that, The process tree data and original process name information are used to perform alarm identification processing on the original process alarm information using a large-scale security detection model and a process alarm vector library to obtain alarm identification results and alarm handling strategies, including: The process tree data and original process name information are input into the security detection model. The security detection model extracts process semantic information from the process tree data. Based on the process semantic information, semantic vector representation is performed to obtain the original process alarm vector. Based on the process alarm vector library, vector matching is performed on the original process alarm vector to obtain the vector matching result. Based on the vector matching result, alarm identification processing is performed to obtain the alarm identification result. Based on the alarm identification result, an alarm handling strategy is generated.

3. The method according to claim 2, characterized in that, The process semantic information is obtained by extracting process semantics from the process tree data using the security detection big data model, and the original process alarm vector is obtained by semantic vector representation based on the process semantic information, including: The process tree data is parsed using the security detection big model to obtain parent-child process relationship features, keyword information features, and keyword position features. The original process alarm vector is obtained by feature embedding processing based on the parent-child process relationship features, keyword information features, and keyword position features.

4. The method according to claim 2, characterized in that, The step of performing vector matching on the original process alarm vector based on the process alarm vector library to obtain the vector matching result includes: The original process alarm vector is matched with the reference process alarm vector in the process alarm vector library. If there exists a target process alarm vector that matches the original process alarm vector, then a known alarm vector matching result is generated for the target process alarm vector; If there is no target process alarm vector that matches the original process alarm vector, then an unknown alarm vector matching result is generated for the original process alarm vector.

5. The method according to claim 4, characterized in that, The step of performing vector matching processing between the original process alarm vector and the reference process alarm vector in the process alarm vector library includes: Calculate the vector similarity parameter between the original process alarm vector and the reference process alarm vector in the process alarm vector library, and match the original process name information and the reference process name information; If there exists a reference vector similarity parameter of the reference process alarm vector that is greater than the similarity parameter threshold and the original process name information matches the reference process name information, then the target process alarm vector that is determined to have a reference vector similarity parameter greater than the similarity parameter threshold and the original process name information matches the reference process name information is determined. If the reference vector similarity parameter of all the reference process alarm vectors is less than or equal to the similarity parameter threshold and / or the original process name information does not match all the reference process name information, then it is determined that there is no target process alarm vector that matches the original process alarm vector.

6. The method according to claim 4, characterized in that, The alarm identification process based on the vector matching result yields an alarm identification result, and an alarm handling strategy is generated based on the alarm identification result, including: If the vector matching result is the known alarm vector matching result, then based on querying the alarm vector library to find the historical alarm handling strategy associated with the target process alarm vector, the historical alarm handling strategy is used as the alarm handling strategy for the original process alarm information. If the vector matching result is the unknown alarm vector matching result, then a recommended alarm handling strategy is configured for the original process alarm information. The original process alarm vector is associated with the original process alarm information, the original process alarm information, and the original process name information to obtain alarm vector association data. The original process alarm vector and the alarm vector association data are added to the alarm vector library.

7. The method according to claim 6, characterized in that, The configuration of recommended alarm handling strategies for the original process alarm information includes: A large security detection model is used to search for process alarm context information for the original process alarm information, and based on the process alarm context information, multiple candidate alarm vectors are matched and associated data is obtained from the alarm vector library. Based on the candidate alarm vector association data, a recommended alarm processing strategy is generated from the original process alarm information.

8. A security detection device based on a large model, characterized in that, The device includes: The extraction module is used to determine the original process alarm information and extract process tree data and original process name information from the original process alarm information; The alarm module is used to perform alarm identification processing on the original process alarm information based on the process tree data and the original process name information, using a security detection big model and a process alarm vector library, to obtain alarm identification results and alarm handling strategies. The processing module is used to process the original alarm information based on the alarm identification result and the alarm handling strategy.

9. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions, which are adapted to be loaded by a processor and executed as method steps as claimed in any one of claims 1 to 7.

10. An electronic device, characterized in that, include: A processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and executed the method steps as claimed in any one of claims 1 to 7.

Images