A large model-based attack event correlation analysis and judgment method and system, and a storage medium

Abstract

The application provides an attack event correlation analysis and judgment method and system based on a large model, and a storage medium, which comprises the following steps: step 1, accessing multi-source data; step 2, processing the multi-source data to form structured evidence fragments; step 3, introducing attack stage evolution constraints to link and combine the evidence fragments and remove noise to form candidate attack chains; step 4, generating a search query for the attribute information of the candidate attack chains, and generating evidence index records for the searched evidence; step 5, for each attack step or causal judgment, a large model references the corresponding evidence index set, and if the reference fails, the judgment is marked as uncertain or hypothetical; step 6, converting the natural language judgment result into a structured object to generate a risk score and a disposal level; step 7, performing disposal arrangement; and step 8, forming a security knowledge base and a case base and updating them. The beneficial effect is that the accuracy of cross-source event correlation can be greatly improved and noise can be reduced.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, system, and storage medium for attack event correlation analysis and judgment based on a large model. Background Technology

[0002] Existing security operations platforms (such as situational awareness) typically form a closed-loop workflow through multi-source log access, rule-based or model-based alert detection, retrieval and visualization analysis, and incident orchestration. In recent years, solutions have emerged that graph security data (unified entity graph / source graph / knowledge graph) to enhance cross-source correlation capabilities, and have begun exploring the use of large language models for alert interpretation, threat reasoning, or report generation. Some solutions also introduce retrieval enhancement (RAG / GraphRAG) to reduce illusions and enhance analysis. However, in real-world enterprise scenarios, the above technical approaches still have the following key shortcomings: First, the input boundaries are uncontrollable: multi-source logs / alarms can form a graph or a source graph, but when analyzing attack events, there is a lack of a unified mechanism for how to stably and repeatedly converge to the minimum set of evidence for the "same attack event" from massive graph data; this results in either an input that is too wide (high noise, LLM inference drift) or an input that is too narrow (missing key evidence, unreliable conclusions), requiring operations personnel to spend a lot of time deduplication, filtering, and context completion.

[0003] Secondly, the associated links lack joint constraints of "stage, reachability and causality": existing associations mostly rely on field consistency, time window aggregation or graph traversal / path search, but often lack joint constraints of time order, network reachability / authority reachability, and attack stage evolution into executable rules, making it difficult to filter combinations that do not meet the attack logic in cross-device and cross-layer data, resulting in a large number of "seemingly related but inexplicable" links.

[0004] Finally, the results of large-scale model analysis are difficult to audit and implement: In security scenarios, existing large-scale models often output natural language conclusions, lacking structured expressions of "evidence conflicts / evidence gaps / uncertainties," and even more so lacking the ability to map the analysis results into event objects that can be programmed, audited, and have preconditions set, making them unsuitable as controlled triggering bases and still requiring a lot of manual secondary processing.

[0005] Therefore, a new solution is needed for a closed-loop security operation: based on graph correlation analysis, it can converge the evidence boundary with candidate attack chains as the core, drive the large model to perform verifiable reasoning on the "traceable evidence package", and at the same time structure the results and enter the disposal orchestration under the constraints of the guardrail.

[0006] The information disclosed in this background section is intended only to enhance understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0007] To address the problems in existing technologies, this invention provides a method for attack event correlation analysis and judgment based on a large model, including: Step 1, Multi-source data access: Access raw data from multiple data sources and generate corresponding data source identifiers, collection timestamps and integrity verification information for each piece of raw data accessed; Step 2, Standardization and Entity Parsing: The multi-source data is parsed, time-aligned, and standardized. Unified entities and their relationships are extracted from the processed data as evidence fragments for generating subsequent candidate attack chains. The extraction results include: unified entity ID, relationship type, and evidence strength and quality fields. Step 3, Evidence Graph Construction and Attack Chain Modeling: Based on the unified entities and their relationships output in Step 2, determine the semantic roles and semantic relationships of each unified entity, construct an evidence graph, and introduce attack stage evolution constraints to link and denoise the evidence fragments; the attack stage labels and stage sequence relationships are expressed and constrained using a preset attack stage model, and at the same time, combined with time series constraints, reachability constraints and behavioral stage evolution constraints, the event fragments are initially screened, denoised and logically combined to form candidate attack chains; Step 4, Retrieve Enhanced Evidence Aggregation: Generate a retrieval query based on the attribute information of each node and / or edge of the candidate attack chain formed in Step 3, and generate an evidence index record for each retrieved piece of evidence; Step 5, Large Model Analysis and Correlation Reasoning: For each attack step or causal judgment, the large model must reference the corresponding evidence index set. If it cannot reference it, the judgment is marked as uncertain or hypothetical, and no action should be triggered. The content verified and output in this step includes: candidate attack chain reconstruction, multi-source consistency verification, confidence and uncertainty, supplementary evidence suggestions and draft action suggestions. Step 6, Implementation of Structured Conclusions and Risk Scoring: The natural language analysis results output in Step 5 are transformed into structured objects. When calculating risk scores and disposal levels, evidence completeness, conflict intensity, and consistency verification are used as core input features. Combined with asset importance, business dependence, and disposal costs, risk scores and disposal levels are generated, making disposal explicitly subject to evidence quality constraints. Step 7, Arrangement of treatment and safety barriers: Perform treatment arrangement based on the risk score and treatment level output in Step 6; Step 8, Closed-loop learning and rule / model evolution: Form a structured summary and store it in the security knowledge base and case library, and update the retrieval index of step 4, the prompt word template and constraint rules of step 5, and the structured mapping rules of step 6.

[0008] As a further improvement of the present invention, in step 1, the data source includes network traffic probes, boundary security devices, internal security devices, host audit logs, application audit logs, identity authentication systems, and asset management systems.

[0009] As a further improvement of the present invention, in step 3, the time series constraint includes: the occurrence time of adjacent behaviors in the candidate attack chain must meet the preset sequential logic, that is, the adjacent evidence fragments define time windows and directional rules. If the sequential order is violated or the maximum time window is exceeded, the adjacent evidence fragments are removed. The reachability constraints include: network reachability, permission reachability, and access control consistency. The reachability constraints are used to determine whether there is a reachable path between entities. The stage evolution constraints include: mapping each evidence fragment to a corresponding attack stage label or attack technique label, predefining a stage state machine and a set of allowed stage transitions, and requiring adjacent evidence fragments in the candidate attack chain to satisfy the allowed transitions, otherwise the adjacent evidence fragments are directly eliminated.

[0010] As a further improvement of the present invention, the network reachability includes: generating a reachability matrix or reachable path based on asset partition information, routing or security domain information, ACL or firewall policy, and micro-segmentation policy; The accessibility of permissions includes: constructing an authorization graph based on the authorization relationship between accounts, roles, permissions, and resources and the session authentication context; querying the authorization graph to see if there are direct authorization or role authorization records; if there are direct authorization or role authorization records, output "allow"; if there are explicit denial records, output "disallow"; if authorization data is missing or fields cannot be matched, output "unknown"; where "unknown" is not used as a hard veto condition, but only for link scoring demotion or generating supplementary certificate prompts. The access control consistency includes: if evidence indicates that access has occurred, but the policy and topology determine that it is unreachable or without permission within the same time frame, then the edge is marked as a reachability conflict edge, and the link confidence is reduced or output as a conflicting link to be verified. Specifically, this includes: Observational evidence, determined based on logs, network traffic, or audit data; Obtain the control policy conclusion corresponding to the access request. The control policy conclusion includes network reachability result and permission reachability result. The network reachability result includes allowed, prohibited, or unknown. The permission reachability result includes allowed, prohibited, or unknown. Compare the actual access result with the control policy conclusion. Determine whether the access control is consistent based on the comparison result. If observational evidence indicates successful access and the control policy conclusion is prohibition, then the associated edge is marked as a reachability conflict edge; edges that are allowed or unknown are not marked as conflict edges and are only used for scoring; conflicted edges are not directly deleted but are added to the conflict list of candidate attack chains. edges The list will prompt for supplementary certification and review in subsequent steps.

[0011] As a further improvement of the present invention, step 3 further includes: Using alarm triggering nodes or high-risk entities as seeds, constraint graph traversal is performed to generate multiple candidate attack chains. A link score is calculated for each candidate attack chain, thereby outputting the candidate attack chain and its structured representation. The structured representation of the candidate attack chain includes: constraint hit score, evidence quality score, and key edge coverage. The constraint graph traversal includes: under the premise of satisfying time series constraints, reachability constraints and behavioral stage constraints, expanding layer by layer with a preset maximum chain length L and branch upper limit B, and retaining the Top-K part of the path in each layer according to the link score for further expansion, finally obtaining the Top-N candidate attack chains and their conflict edge / gap item list.

[0012] As a further improvement of the present invention, step 3 further includes: The preset attack phase model is either the MITRE ATT&CK tactical system, the Cyber ​​Kill Chain model, or a predefined phase state machine.

[0013] As a further improvement of the present invention, step 3 further includes: Step 30: Input the set of evidence fragments EF = {ef_i} from Step 2, and the constraint configuration, which includes: a time rule set R. time Reachability rules / models R reach Stage state machine M stage ; Step 31: Organize the evidence fragments into a multi-relationship graph and construct a security event association graph. The association graph includes entity nodes and event nodes, as well as edges connecting the nodes. The edges include: entity-event edges, which represent the participation relationship between entities and events; and event-event edges, which represent candidate association relationships between events. The candidate association relationships are generated after judging event pairs based on preset association rules. Step 32: Based on the security event association graph in Step 31, output the Top-N candidate attack chains C = {chain} j}, each chain j Includes: node / fragment sequence seq The associated edges and their types between adjacent segments seq Which constraints are hit / violated? hit Conflict edge list edges Missing item list items Chain scoring score .

[0014] As a further improvement of the present invention, in step 4, the query includes entity anchors, time windows, and constraint hit items, and the retrieval scope includes one or more of the following: same entity context logs, same session and connection traffic, same account authentication trajectory and MFA records, related asset topology and access control policies, and historical similar cases and disposal results. The evidence index record includes an evidence index generated by candidate chain nodes, evidence group categories, and evidence selection and compression strategies, wherein... The evidence index generated by the candidate chain node includes: evidence source or evidence type, original record location information, time range, complete verification information, and binding relationship with the candidate chain; The evidence group categories include supporting evidence, conflicting evidence, and missing evidence. Supporting evidence refers to evidence that satisfies the temporal consistency, entity consistency, and reachability consistency of candidate chain edges. Conflicting evidence refers to evidence that has a computable conflict with the candidate chain, including temporal mutual exclusion, entity mutual exclusion, and reachability conflict. Missing evidence refers to evidence types or fields that were not retrieved from the preceding evidence template for candidate chain edges. The evidence selection and compression strategy includes: calculating priority scores for evidence and selecting evidence to enter the evidence package under a preset maximum context budget, wherein the priority score = key edge relevance + constraint hit weight + temporal proximity + source credibility − duplication penalty. When the budget score is exceeded, the system retains the original text of the first priority evidence and the statistical summary of the second priority evidence.

[0015] As a further improvement of the present invention, in step 5, the reconstruction of the candidate attack chain includes: summarizing the attack steps and causal relationships by stage, and marking the evidence sources corresponding to each step; the multi-source consistency verification includes: pointing out mutually corroborating evidence and conflict points; the confidence and uncertainty include: providing the confidence level and its basis; the supplementary evidence suggestion includes: clarifying the types and targets of evidence that need to be queried and collected in the next step; the draft disposal suggestion includes: generating graded disposal suggestions and key points of impact assessment.

[0016] As a further improvement of the present invention, in step 7, the preconditions for the handling orchestration operation are: the link confidence is greater than or equal to a first preset threshold, the critical edge coverage is greater than or equal to a second preset threshold, and there are no unexplained reachability conflict edges; the first preset threshold and the second preset threshold are configurable policy parameters; the input parameters used to determine whether the preconditions are met include at least: the number of missing evidence items, the critical edge coverage, the conflict intensity type, and the consistency verification pass flag; The constraints that must be followed in the execution and scheduling of actions include: Action cascade control: perform low-disturbance actions first, followed by high-disturbance actions; Rollback and Timeout: Rollback occurs when an action fails or has an unexpected impact. Whitelist / Exemption and Approval: Approval or manual confirmation is required for key business assets and specific accounts.

[0017] The present invention also discloses an attack event correlation analysis and judgment system based on a large model, comprising: a memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when called by the processor.

[0018] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0019] The beneficial effects of this invention are: 1. ATT&CK-based phase evolution constraint attack chain construction: can significantly improve the accuracy of cross-source event correlation and reduce noise; through tactical / technical annotation and superimposed constraints such as phase sequence, time series and network reachability, weakly related fragments are filtered out, so that the correlation logic analysis is upgraded from fields to phases, and the output of candidate attack chains that are more consistent with the attack process.

[0020] 2. Enhanced evidence package for targeted retrieval around candidate attack chains: This can improve the relevance and traceability of the input and enhance the verifiability of the conclusions; supplement contextual evidence such as the topology of the same entity / account / session / asset, with key entities / sessions in the chain as the center; the evidence is organized into packages by source, timestamp, and index, which facilitates verification and reproduction and reduces interference from irrelevant context.

[0021] 3. Staged reasoning output with evidence binding in large-scale models: This can reduce misjudgments and improve the efficiency of manual review. The model is required to reconstruct the attack chain in stages and bind evidence indexes to each judgment point, while outputting conflict points, confidence levels, and sources of uncertainty; it provides supplementary evidence suggestions for "gaps," transforming the judgment from a conclusion-based description into an evidence-driven verifiable report.

[0022] 4. Structured orchestration and closed-loop learning linkage: Reduce false alarms and maintenance costs while ensuring controllable response; transform the judgment results into structured objects and generate risk levels; set thresholds, approvals, action cascading and rollback barriers on the handling side; at the same time, accumulate the review conclusions and handling effects into a case library, and update the search index and rule templates in reverse so that the system capabilities can be continuously optimized with operation. Attached Figure Description

[0023] Figure 1 This is a schematic diagram showing the module composition and connection relationship of the attack event correlation analysis and judgment system based on a large model according to the present invention. Detailed Implementation

[0024] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0025] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0026] This invention uses the "candidate attack chain (including constraint hit items)" as the core object of the entire process, thereby driving retrieval aggregation, evidence organization, LLM reasoning, and disposal orchestration. The candidate attack chain is jointly generated by three types of constraints: chronological order, reachability (network / permission / access control), and stage evolution. Constraint hit items are bound to evidence indexes to form a reproducible evidence package. The LLM output needs to be backfilled into the structured fields of this core object (supporting / conflicting / missing sets, confidence sources, supplementary evidence tasks, and triggering conditions), and the guardrail module performs hierarchical actions based on evidence completeness and conflict level. This invention provides a method and system for attack event correlation analysis and judgment based on a large model. The functional modules and detailed operation flow of the system are described below. A closed-loop linkage is formed through a unified data and control interface. The schematic diagram of the system's module composition and connection relationship is shown below. Figure 1 As shown.

[0027] 1. Multi-source data access module (S1) This module is used to access raw data from sources such as network traffic probes, boundary and internal security devices, host and application auditing, identity authentication, and asset management. It supports batch / real-time access and provides data source identifiers, collection timestamps, and integrity verification information for subsequent processing. This module ensures the completeness and traceability of evidence input, providing a foundation for cross-source correlation. In this invention, the multi-source data access module S1 is not simply an "archive," but serves as the basis for the "evidence reproducibility index" and "evidence citation constraints" of subsequent S4 / S5, thereby supporting an "auditable, traceable, and verifiable" chain of evidence.

[0028] 2. Standardization and Entity Resolution Module (S2) This module is used to parse fields, align times, and normalize multi-source data, and extract unified entities (such as assets, accounts, processes, sessions, files, URLs / domains, policy hits, alarm types, etc.) and their relationships (such as "login to", "access", "generate", "download", "connect", "blocked by policy", etc.) to form structured "evidence fragments". This module elevates the "field set" that can only be retrieved to a unified semantic foundation that can be associated and computed.

[0029] The extracted results are not simple "standardized events," but rather evidence fragments generated for subsequent candidate attack chains. The extraction process requires explicit inclusion of the following: Unified Entity ID (can be merged across sources); Relationship type (can be used for graph traversal); Evidence strength / quality field (used for S3 scoring and S4 priority calculation); The above serves as the input for the subsequent constraint graph traversal "computability".

[0030] 3. Evidence Graph Construction and Attack Chain Modeling Module (S3) Based on the semantic entities and relationships output by S2, an "evidence graph" is constructed. After constructing the evidence graph, attack phase evolution constraints are introduced to link and denoise event fragments. Attack phase labels and phase sequence relationships are expressed and constrained using the MITREATT&CK tactical system. Simultaneously, time series, reachability constraints (e.g., network segments, access control policies, identity and permission relationships), and behavioral phase constraints (e.g., authentication before access, localization before lateral movement) are combined to initially screen, denoise, and logically combine event fragments, forming candidate attack chains (event chains), specifically including: Step 30: Input the set of evidence fragments EF = {ef_i} from Step 2, and the three types of constraint configurations: the time rule set R. time Reachability rules / models R reach Stage state machine M stage ; Step 31: Organize the evidence fragments into a multi-relationship graph and construct a security event association graph. The nodes can be in two layers: entity nodes (account / host / session / process...) + event nodes (ef); edges: entity-event: for example, account -> ef (participant), host -> ef; event-event: candidate association edges (generated by rules: same session / same process tree / same connection 5-tuple / same account behavior within a short period of time, etc.). Step 32: Based on the security event association graph from Step 31, output the Top-N candidate attack chains C = {chain} j}, each chain j Includes: node / fragment sequence seq The associated edges and their types between adjacent segments seq Which constraints are hit / violated? hit Conflict edge list edges Missing item list items Chain scoring score .

[0031] In another preferred embodiment of the present invention, a Cyber ​​Kill Chain model may also be used. In yet another embodiment, an internally customized tactical phase system or an industry / enterprise customized phase state machine may also be used, for example, with state transition constraints based on a customized phase sequence such as "authentication → execution → lateral movement → privilege escalation → discovery → collection → dissemination".

[0032] This module upgrades the traditional "time window aggregation" to "constrained link combination", avoiding the direct feeding of full logs into the large model.

[0033] The generation of candidate attack chains is not based on aggregation within a single time window, but rather satisfies at least the following conditions simultaneously: a) Time sequence constraint: The occurrence times of adjacent actions in the candidate chain satisfy a preset sequence logic, that is, a time window and directional rules are defined for each edge (adjacent evidence fragment), such as "authentication event must be earlier than session access event" and "process start must be earlier than network connection event". If the sequence is violated or the maximum time window is exceeded, the action is eliminated. b) Reachability constraint: Determines whether there is a reachable path between entities.

[0034] Network reachability determination Among them, network reachability generates a "reachability matrix / reachable path" based on asset partitioning, routing / security domains, ACL / firewall policies, and micro-segmentation policies. For example, using the reachability matrix: for each pair of security domains (zone_i, zone_j), pre-compute reach_matrix[i][j]∈ {allow, deny, conditional}, where conditional indicates that it is related to port / protocol / identity conditions.

[0035] Accessibility determination Accessibility is generated based on the authorization relationships between accounts, roles, permissions, and resources, and the session authentication context. Specifically, an authorization graph is constructed with nodes: account, role / group, resource, and action; edges: account→role (membership relationship), role→resource (authorization), and resource→action (set of allowed actions). The authorization graph is queried to check if (account_id, resource_id, action_type, t) contains a direct authorization or role-based authorization record. If it exists, "Allow" is output; if an explicit denial record exists, "Disallow" is output; if authorization data is missing or fields cannot be matched, "Unknown" is output. "Unknown" is not used as a hard rejection condition, but only for link scoring demotion or generating supplementary verification prompts (e.g., "Missing authorization information, it is recommended to supplement with work orders / access logs").

[0036] Access control consistency determination Access control consistency means that if evidence indicates that access has occurred, but the policy and topology determine that it is unreachable / unauthorized within the same time frame, then the edge is marked as a "reachability conflict edge", and the link confidence is reduced or the output is a conflicting link to be verified.

[0037] Observe evidence such as whether "access successful" is displayed in logs / traffic / audit (e.g., successful login, connection established, successful file read, etc.), and obtain control policy conclusions: network reachability (allowed / denied / unknown) and (optional) permission reachability (allowed / denied / unknown).

[0038] If observational evidence indicates successful access and the control policy conclusion is "forbidden" (network forbidden, or permission forbidden), then the associated edge is marked as a "reachability conflict edge"; in other cases (allowed / unknown), it is not marked as conflict, but only used for scoring (e.g., if unknown, confidence is reduced); conflict edges are not directly deleted (configurable), but are added to the conflict list of the candidate chain. edges The list will prompt for supplementary certification and review in subsequent S4 / S5.

[0039] c) Stage Evolution Constraints: The behavioral stages in the chain must satisfy the evolutionary relationship of "authentication / initial access → execution → lateral / access → external connection". Specifically, each evidence fragment is mapped to an ATT&CK tactical label, and a stage state machine and a set of allowed stage transitions are predefined. Adjacent evidence fragments in the candidate chain must satisfy the allowed transitions; otherwise, they are directly eliminated. That is, according to the set stage evolution rule base, if it belongs to a clearly prohibited rule, then the adjacent evidence fragment is eliminated. If the label is missing (e.g., no external connection label), then supplementary evidence is needed to confirm the stage corresponding to the evidence.

[0040] Using alarm triggering nodes or high-risk entities as seeds, a constraint graph traversal is performed to generate multiple candidate chains. A link score is calculated for each candidate chain, thereby outputting the candidate chains and their structured representations. 1) Constraint hit score (phase transition hit, time consistency, reachability consistency); 2) Evidence quality score (data source credibility, field completeness, and duplicate penalty); 3) Coverage of key edges (e.g., whether key edges such as lateral movement / external connections are covered by supporting evidence).

[0041] The constraint graph traversal includes: under the premise of satisfying hard constraints, expanding layer by layer with a preset maximum chain length L and branch limit B, and retaining the Top-K paths of each layer according to the link score for further expansion; finally, the Top-N candidate chains and their conflict edges / gap items are obtained.

[0042] Assuming that for a candidate chain, the system scores it from 0 to 5 points based on four core dimensions (example, implementation not limited): 1. Strength of evidence: 4 points (supported by EDR and identity logs, with relatively complete fields) 2. Time Consistency: 5 points (All adjacent segments are within a reasonable window and are in the correct orientation) 3. Reachability Consistency: 3 points (most are allowed, but there is 1 edge with "unknown reachability") 4. Consistency of stage evolution: 4 points (the stage transitions are basically consistent, but there is one uncertain label). The system sums the four items to get the base score: 4 + 5 + 3 + 4 = 16.

[0043] 4. Retrieval Enhanced Evidence Aggregation Module (S4) This module is used to perform "chain-driven targeted retrieval enhancement and aggregation" on candidate attack chains formed by S3. Specifically, it retrieves context logs of the same entity, traffic related to the same session, authentication traces of the same account, related asset topology and access control information, historical similar cases and handling results from a unified storage system. The retrieval results are then organized into a "large-scale model-accessible evidence package" based on a timeline and entity graph. This module builds large-scale model reasoning on traceable evidence, thereby improving the objectivity of attack event analysis. When a retrieval is triggered, the system constructs a query: generating a retrieval query for each node / edge of the candidate attack chain in S3. The query includes at least the entity anchor (account / asset / session / process / domain, etc.), a time window (extending Δt centered on the event times at both ends of the link edge), and constraint hit items (e.g., corresponding reachability determination criteria, stage labels). The retrieval scope includes, but is not limited to: context logs of the same entity, traffic of the same session / connection, authentication traces and MFA records of the same account, related asset topology and access control policies, and historical similar cases and handling results. An evidence index record is generated for each retrieved piece of evidence to ensure the traceability and reproducibility of the evidence.

[0044] The final evidence package includes at least (and is not limited here): a) Evidence index generated by candidate chain node: source or evidence type, original record location information, time range, complete verification information (such as digest / hash or signature, or its referenced fields), and binding relationship with candidate chain.

[0045] b) Three groupings: “Support / Conflict / Missing”: Supporting evidence refers to evidence that satisfies the temporal consistency, entity consistency, and reachability consistency of candidate chain edges; Conflicting evidence refers to evidence that has a computable conflict with the candidate chain, and the conflict includes at least: temporal mutual exclusion (mutual exclusion of the same account in different locations / multiple terminals at the same time), entity mutual exclusion (inconsistent session ID / process tree), and reachability conflict (policy / topology determines that it is unreachable but the log shows that it has been visited); Missing evidence refers to evidence types or fields that were not retrieved in the “pre-evidence template” for candidate chain edges, such as “suspected external transmission” lacking compression and packaging traces, and “lateral movement” lacking credential usage or remote execution traces; These three groupings enable large models to perform consistency checks.

[0046] c) Evidence Selection and Compression Strategy: Within a preset maximum context budget (token), evidence is prioritized and selected for inclusion in the evidence package. The priority score is calculated as: Key Edge Relevance + Constraint Hit Weight + Temporal Proximity + Source Credibility − Repeatability Penalty. When the budget is exceeded, the system retains: the original text of high-priority evidence + statistical summaries of low-priority evidence (quantity, type distribution, time span, representative sample index) to ensure auditable and reproducible analysis, while reducing inference drift caused by irrelevant information.

[0047] 5. Large-scale model analysis and correlation reasoning module (S5) To ensure the verifiability and auditability of the analysis, the system imposes an "evidence citation constraint" on the output of the large model: the model must cite a set of evidence indexes for each attack step / causal judgment. If an evidence index cannot be cited, the judgment must be marked as "uncertain / hypothetical" and cannot be triggered by the action conditions. S5 must at least verify and output the following: 1) Attack chain reconstruction: Summarize possible attack steps and causal relationships by stage, and mark the source of evidence for each step; 2) Multi-source consistency verification: Identify corroborating evidence and points of conflict (e.g., inconsistencies between accounts logging in from two different locations at the same time, or discrepancies between host logs and network traffic); 3) Confidence Level and Uncertainty: Provide the confidence level of the assessment and its basis (which evidence supports the assessment, and which evidence is missing); 4) Suggestions for supplementary evidence: Clarify the types and objectives of the evidence to be searched / collected in the next step; 5) Draft disposal recommendations: Generate tiered disposal recommendations and key points for impact assessment (but do not implement them directly).

[0048] The process of determining the node reference evidence index is as follows: 1. Input / Output Structure Constraints: The LLM output must contain structured fields (JSON / table are both acceptable), and each conclusion must include an evidence_id. 2. Traverse every attack step node in the candidate attack chain (for each attack step). 1) Check if evidence_ids_support is not empty; 2) Verify whether evidence_id exists in the current evidence package EvidenceIndex; 3) Verify whether the evidence_id matches the entity / time window of the step (e.g., the entity of the evidence record must contain the key entity of the step, and the time must fall within the time window of the step). 4) If any step fails, remove that step from the list of “triggerable actions”; if a step is used to handle a trigger condition (e.g., “confirm lateral movement”) but the evidence citation verification fails, then the trigger condition is deemed invalid.

[0049] The large-scale model analysis not only outputs conclusions but also structured fields linked to those conclusions: the evidence index set, conflicting evidence set, missing evidence set, and the reason tag for triggering supplementary evidence suggestions for each attack stage. This ensures the analysis results are verifiable and auditable. Furthermore, the system performs consistency checks on the structured fields (time consistency, reachability consistency, and conflict interpretation completeness). If a check fails, the event object is marked as requiring review and its confidence level is lowered, preventing it from passing and triggering S7 high-risk actions.

[0050] 6. Structured Conclusion Implementation and Risk Scoring Module (S6) The S6 module transforms the large model text output into platform-arrangeable, statistically analyzeable, and auditable data. First, it converts the natural language analysis results output by S5 into structured objects: event ID, set of involved entities, attack stage labels, key evidence index, confidence level, scope of impact, list of suggested actions, conditions requiring manual confirmation, etc. When calculating risk scores and disposal levels, the core input features are “evidence completeness (number of missing items / coverage of key edges)”, “conflict intensity (number and type of conflicting evidence)”, and “whether consistency verification passes”. These features are combined with asset importance, business dependence, and disposal costs to generate risk scores and disposal levels, making disposal explicitly subject to evidence quality constraints.

[0051] 7. Arrangement and Safety Barrier Module (S7) This S7 module performs disposal orchestration based on the risk score and disposal level output by S6 (preconditions: link confidence ≥ threshold and critical edge coverage ≥ threshold, and no unexplained reachability conflict edges. The threshold is a configurable strategy parameter, and the input for the precondition judgment includes at least: number of missing items, critical edge coverage, conflict intensity type, and consistency verification pass flag). Unlike traditional fixed scripts, this S7 module introduces "guardrail constraints," meaning that the following constraints must be followed when performing disposal orchestration: 1) Action cascading control: First perform low-disturbance actions (rate limiting / secondary verification / isolation of sessions), then perform high-disturbance actions (isolation of hosts / banning accounts); 2) Rollback and Timeout: A rollback can be performed if an action fails or has an unexpected impact; 3) Whitelist / Exemption and Approval: Approval or manual confirmation is required for key business assets and specific accounts.

[0052] When high-impact assets exist and lack supporting evidence involving "legality verification" or time-exclusive conflicts, manual confirmation is required before any action can be taken. The S7 module improves automation while preventing large model outputs from being directly used for high-risk actions.

[0053] 8. Closed-loop learning and rule / model evolution module (S8) This is used to form a structured summary of manual review conclusions, handling results, reasons for false alarms, and whether supplementary certificates are valid, creating a safety knowledge base and case library, and updating the retrieval index of S4, the prompt word templates / constraint rules of S5, and the structured mapping rules of S6.

[0054] Update S4 (retrieval index and priority): 1. If key evidence in a certain type of case always comes from a certain data source / field, then increase the weight of that data source.

[0055] 2. Convert the common features of useful_evidence_ids into a retrieval query template (entity anchor + time window + field).

[0056] 3. Establish "negative sample features" for false alarm patterns, which can be used to reduce the weight of false alarms during retrieval or add them to the mandatory checklist of "legitimate evidence".

[0057] Update S5 (cue word template / constraint rules): 1. If a certain type of misjudgment occurs frequently (e.g., mistaking a legitimate batch copy for external transmission), then add a mandatory check item to the prompt, such as: "Does a work order / change order evidence index exist? If not, it must be listed as missing evidence."

[0058] 2. Convert manually confirmed "conflict interpretations" into conflict handling rules (e.g., prioritize checking VPN egress NAT when time is mutually exclusive).

[0059] Update S6 (structured mapping rules): Analyze which fields are most effective at distinguishing between genuine attacks and false positives, and adjust the weights accordingly: 1. Weighting of missing item types (missing "legality verification" has a higher weighting for key assets).

[0060] 2. Conflict type weight (time mutual exclusion > slight field inconsistency).

[0061] This module enables the system's capabilities to continuously improve with operation, reducing long-term manual maintenance costs.

[0062] Implementation Case: Abnormal Account Login Leads to Lateral Access and Suspected External Linking and Spread A company's security operations system received data from multiple sources within the same time period: the authentication / VPN logs showed that account U successfully logged in from an abnormal location; the host audit of terminal H1 showed that a suspicious script process started and initiated an internal connection; the access logs of file server H2 showed that abnormal batch file readings came from H1; and the DNS / proxy logs showed that H2 generated abnormal uplink traffic to the external domain name D1.

[0063] The system accesses the aforementioned data according to S1, retaining the source identifier, timestamp, and integrity verification information. According to S2, the system parses and aligns the data by time, extracting unified entities and relationships to form evidence fragments: entities include account U, assets H1 / H2, domain name D1, process P, session S, etc.; relationships include "U logs in", "H1 generates P", "P connects to H2", "U accesses H2 file", "H2 connects to D1", etc. According to S3, the system constructs an evidence graph based on the evidence fragments, and performs denoising and combination under constraints of time series, network reachability, and behavioral stages, forming a candidate attack chain C1: abnormal login (U) → suspicious execution of H1 (P) → H1 accesses H2 and abnormally reads → H2 externally links to D1 suspected external transmission. According to S4, the system retrieves and enhances supplementary context around C1, forming an evidence package: U's historical login baseline and MFA trajectory, H1 process tree summary, H2 file access scope summary, whether D1 is whitelisted / historically relevant, asset importance, and access control information, and generates a traceable index for each supplementary piece of evidence. The system, according to S5, invokes the large model to perform semantic analysis on the evidence package: outputting a phased reconstruction of the attack chain and progressively referencing evidence indexes; pointing out multi-source consistency and potential conflict points; providing confidence levels and uncertainties (e.g., lack of evidence regarding the existence of legitimate maintenance work orders); providing supplementary evidence suggestions (e.g., supplementing H2 compression / packaging traces and more complete external link summaries); and generating a draft of tiered disposal suggestions (not directly executed). The system, according to S6, translates the large model's analysis results into a structured event object E1 (event ID, set of involved entities, phase label, key evidence index, confidence level, scope of impact, suggested actions, conditions requiring manual confirmation, etc.), and calculates risk scores and disposal levels based on asset importance and disposal costs. The system, according to S7, executes orchestration based on disposal levels and guardrail constraints: prioritizing low-disruption actions (e.g., terminating suspicious sessions, triggering secondary verification / temporary freezing for account U, restricting H2's external links to D1); requiring manual confirmation / approval for critical assets or high-disruption actions (e.g., isolating H2, banning accounts), setting timeout and rollback strategies, and recording a full audit. The system will save the final manual review conclusion and the handling results according to S8.

[0064] This information is used to create case entries (reasons for real attacks / false alarms, combinations of key evidence, effective action sequences, and the success rate of supplementary evidence, etc.) and to update the search index, prompt word templates / constraint rules, and structured mapping rules to improve the efficiency and consistency of subsequent analysis of similar events.

[0065] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for correlation analysis and judgment of attack events based on a large model, characterized in that, include: Step 1, Multi-source data access: Access raw data from multiple data sources and generate corresponding data source identifiers, collection timestamps and integrity verification information for each piece of raw data accessed; Step 2, Standardization and Entity Parsing: The multi-source data is parsed, time-aligned, and standardized. Unified entities and their relationships are extracted from the processed data as evidence fragments for generating subsequent candidate attack chains. The extraction results include: unified entity ID, relationship type, and evidence strength and quality fields. Step 3, Evidence Graph Construction and Attack Chain Modeling: Based on the unified entities and their relationships output in Step 2, determine the semantic roles and semantic relationships of each unified entity, construct the evidence graph, and introduce attack stage evolution constraints to link and denoise the evidence fragments. The attack phase labels and the sequence of phases are expressed and constrained by a pre-defined attack phase model. At the same time, the event segments are initially screened, denoised and logically combined by combining time series constraints, reachability constraints and behavioral phase evolution constraints to form candidate attack chains. Step 4, Retrieve Enhanced Evidence Aggregation: Generate a retrieval query based on the attribute information of each node and / or edge of the candidate attack chain formed in Step 3, and generate an evidence index record for each retrieved piece of evidence; Step 5, Large Model Analysis and Correlation Reasoning: For each attack step or causal judgment, the large model must reference the corresponding evidence index set. If it cannot reference it, the judgment is marked as uncertain or hypothetical, and no action should be triggered. The content verified and output in this step includes: candidate attack chain reconstruction, multi-source consistency verification, confidence and uncertainty, supplementary evidence suggestions and draft action suggestions. Step 6, Implementation of Structured Conclusions and Risk Scoring: The natural language analysis results output in Step 5 are transformed into structured objects. When calculating risk scores and disposal levels, evidence completeness, conflict intensity, and consistency verification are used as core input features. Combined with asset importance, business dependence, and disposal costs, risk scores and disposal levels are generated, making disposal explicitly subject to evidence quality constraints. Step 7, Arrangement of treatment and safety barriers: Perform treatment arrangement based on the risk score and treatment level output in Step 6; Step 8, Closed-loop learning and rule / model evolution: Form a structured summary and store it in the security knowledge base and case library, and update the retrieval index of step 4, the prompt word template and constraint rules of step 5, and the structured mapping rules of step 6.

2. The attack event correlation analysis and judgment method according to claim 1, characterized in that, In step 1, the data source includes network traffic probes, perimeter security devices, internal security devices, host audit logs, application audit logs, identity authentication systems, and asset management systems.

3. The attack event correlation analysis and judgment method according to claim 1, characterized in that, In step 3, the time series constraint includes: the occurrence time of adjacent behaviors in the candidate attack chain must meet the preset sequential logic, that is, the adjacent evidence fragments define time windows and directional rules. If the sequential order is violated or the maximum time window is exceeded, the adjacent evidence fragments are removed. The reachability constraints include: network reachability, permission reachability, and access control consistency. The reachability constraints are used to determine whether there is a reachable path between entities. The stage evolution constraints include: mapping each evidence fragment to a corresponding attack stage label or attack technique label, predefining a stage state machine and a set of allowed stage transitions, and requiring adjacent evidence fragments in the candidate attack chain to satisfy the allowed transitions, otherwise the adjacent evidence fragments are directly eliminated.

4. The attack event correlation analysis and judgment method according to claim 3, characterized in that, The network reachability includes: generating a reachability matrix or reachable paths based on asset partitioning information, routing or security domain information, ACL or firewall policies, and micro-segmentation policies; The accessibility of permissions includes: constructing an authorization graph based on the authorization relationship between accounts, roles, permissions, and resources and the session authentication context; querying the authorization graph to see if there are direct authorization or role authorization records; if there are direct authorization or role authorization records, output "allow"; if there are explicit denial records, output "disallow"; if authorization data is missing or fields cannot be matched, output "unknown"; where "unknown" is not used as a hard veto condition, but only for link scoring demotion or generating supplementary certificate prompts. The access control consistency includes: if evidence indicates that access has occurred, but the policy and topology determine that it is unreachable or without permission within the same time frame, then the edge is marked as a reachability conflict edge, and the link confidence is reduced or output as a conflicting link to be verified. Specifically, this includes: Observational evidence, determined based on logs, network traffic, or audit data; Obtain the control policy conclusion corresponding to the access request. The control policy conclusion includes network reachability result and permission reachability result. The network reachability result includes allowed, prohibited, or unknown. The permission reachability result includes allowed, prohibited, or unknown. Compare the actual access result with the control policy conclusion. Determine whether the access control is consistent based on the comparison result. If observational evidence indicates successful access and the control policy conclusion is prohibition, then the associated edge is marked as a reachability conflict edge; edges that are allowed or unknown are not marked as conflict edges and are only used for scoring; conflicted edges are not directly deleted but are added to the conflict list of candidate attack chains. edges The list will prompt for supplementary certification and review in subsequent steps.

5. The attack event correlation analysis and judgment method according to claim 1, characterized in that, Step 3 also includes: Using alarm triggering nodes or high-risk entities as seeds, constraint graph traversal is performed to generate multiple candidate attack chains. A link score is calculated for each candidate attack chain, thereby outputting the candidate attack chain and its structured representation. The structured representation of the candidate attack chain includes: constraint hit score, evidence quality score, and key edge coverage. The constraint graph traversal includes: under the premise of satisfying time series constraints, reachability constraints and behavioral stage constraints, expanding layer by layer with a preset maximum chain length L and branch upper limit B, and retaining the Top-K part of the path in each layer according to the link score for further expansion, finally obtaining the Top-N candidate attack chains and their conflict edge / gap item list.

6. The attack event correlation analysis and judgment method according to claim 1, characterized in that, Step 3 also includes: The preset attack phase model is either the MITRE ATT&CK tactical system, the Cyber ​​Kill Chain model, or a predefined phase state machine.

7. The attack event correlation analysis and judgment method according to claim 1, characterized in that, Step 3 also includes: Step 30: Input the set of evidence fragments EF = {ef_i} from Step 2, and the constraint configuration, which includes: a time rule set R. time Reachability rules / models R reach Stage state machine M stage ; Step 31: Organize the evidence fragments into a multi-relationship graph and construct a security event association graph. The association graph includes entity nodes and event nodes, as well as edges connecting the nodes. The edges include: entity-event edges, which represent the participation relationship between entities and events; and event-event edges, which represent candidate association relationships between events. The candidate association relationships are generated after judging event pairs based on preset association rules. Step 32: Based on the security event association graph from Step 31, output the Top-N candidate attack chains C = {chain} j }, each chain j Includes: node / fragment sequence seq The associated edges and their types between adjacent segments seq Which constraints are hit / violated? hit Conflict edge list edges Missing item list items Chain scoring score .

8. The attack event correlation analysis and judgment method according to claim 1, characterized in that, In step 4, the query includes entity anchors, time windows, and constraint hits. The retrieval scope includes one or more of the following: the same entity context log, the same session and connection traffic, the same account authentication trajectory and MFA record, related asset topology and access control policies, and historical similar cases and disposal results. The evidence index record includes an evidence index generated by candidate chain nodes, evidence group categories, and evidence selection and compression strategies, wherein... The evidence index generated by the candidate chain node includes: evidence source or evidence type, original record location information, time range, complete verification information, and binding relationship with the candidate chain; The evidence group categories include supporting evidence, conflicting evidence, and missing evidence. Supporting evidence refers to evidence that satisfies the temporal consistency, entity consistency, and reachability consistency of candidate chain edges. Conflicting evidence refers to evidence that has a computable conflict with the candidate chain, including temporal mutual exclusion, entity mutual exclusion, and reachability conflict. Missing evidence refers to evidence types or fields that were not retrieved from the preceding evidence template for candidate chain edges. The evidence selection and compression strategy includes: calculating priority scores for evidence and selecting evidence to enter the evidence package under a preset maximum context budget, wherein the priority score = key edge relevance + constraint hit weight + temporal proximity + source credibility - duplication penalty. When the budget score is exceeded, the system retains the original text of the first priority evidence and the statistical summary of the second priority evidence.

9. The attack event correlation analysis and judgment method according to claim 1, characterized in that, In step 5, the reconstruction of the candidate attack chain includes: summarizing the attack steps and causal relationships by stage, and marking the source of evidence corresponding to each step; the multi-source consistency verification includes: pointing out mutually corroborating evidence and conflict points; the confidence and uncertainty include: providing the confidence level and its basis; the supplementary evidence suggestion includes: clarifying the types and targets of evidence that need to be queried and collected in the next step; the draft disposal suggestion includes: generating graded disposal suggestions and key points of impact assessment.

10. The attack event correlation analysis and judgment method according to claim 1, characterized in that, In step 7, the prerequisites for the handling orchestration operation are: the link confidence is greater than or equal to the first preset threshold, the critical edge coverage is greater than or equal to the second preset threshold, and there are no unexplained reachability conflict edges. The first preset threshold and the second preset threshold are configurable strategy parameters; The input parameters used to determine whether the pre-execution conditions are met include at least: the number of missing evidence items, the coverage of key edges, the type of conflict intensity, and the consistency verification pass flag; The constraints that must be followed in the execution and scheduling of actions include: Action cascade control: perform low-disturbance actions first, followed by high-disturbance actions; Rollback and Timeout: Rollback occurs when an action fails or has an unexpected impact. Whitelist / Exemption and Approval: Approval or manual confirmation is required for key business assets and specific accounts.

11. A system for correlation analysis and judgment of attack events based on a large model, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method according to any one of claims 1-10 when invoked by the processor.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-10 when invoked by a processor.

Images