A method, apparatus and related device for automatic generation of security event reports

Abstract

This invention relates to the field of network security technology and provides a method, apparatus, and related equipment for automatically generating security incident reports. The method includes: receiving multi-source security incident evidence and objectifying it to obtain a security evidence set; constructing an event relationship structure and generating a candidate sentence element set; receiving a target role requesting access to the report, performing legality verification on each candidate sentence element in the candidate sentence element set to obtain a legal sentence element set; obtaining the responsibility problem set corresponding to the target role, and filtering the minimum sufficient coverage sentence element set by solving an optimization objective function with constraints; for candidate sentence elements that fail legality verification, performing a constrained security degradation operation to prevent illusions according to preset degradation rules to obtain degraded sentence elements; arranging the minimum sufficient coverage sentence element set and the degraded sentence elements, and outputting a security incident report. This invention achieves a unified multi-objective of automation, intelligence, and compliance controllability in security operation reporting.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, and related equipment for automatically generating security incident reports. Background Technology

[0002] Currently, security incident reports are typically compiled based on raw logs, alarms, and forensic information generated by security information and incident management systems and various endpoint detection and response devices. The mainstream workflow generally includes: the system receives alarm data from multiple sources of security devices such as perimeter firewalls, host devices, and traffic probes through deployed log collection probes, and performs structured extraction and feature cleaning on these heterogeneous raw logs; key fields are used to merge and correlate scattered alarm events to identify potential anomalies or attack sequences; security analysts retrieve raw security data matching their permissions from the backend forensic database according to pre-defined role-based access control policies; finally, analysts fill in the text using preset static rule templates or reused historical reports, compiling the manually sorted and summarized events into a security incident report for management, compliance reviewers, or frontline operations personnel.

[0003] Existing technical solutions all focus on the access, cleaning, and retrieval of underlying data, without establishing a mapping between each independent statement in the output report and the original evidence set it supports. Furthermore, in the process of fusing multiple pieces of evidence at different access levels, real-time mathematical verification of the intersection of access sets is lacking. When faced with complex attack chains or scenarios with missing evidence, the report content cannot effectively trace back to the original evidence, easily becoming mixed with unfounded illusions and incomplete information, leading to failed review and tracing. Simultaneously, the failure to accurately verify the access boundaries of target roles during multi-source evidence fusion easily results in unauthorized disclosure of sensitive data, severely impacting the report's compliance, controllability, and practical value in complex security scenarios. Summary of the Invention

[0004] This invention provides a method, apparatus, and related equipment for automatically generating security incident reports, which addresses the issues of low compliance controllability and practical utilization value of reports in complex security scenarios.

[0005] The first aspect of this invention provides a method for automatically generating security incident reports, comprising: Receive multi-source security event evidence and objectify it to obtain a set of security evidence; Based on the temporal and entity relationships in the security evidence set, an event relationship structure is constructed, and a candidate sentence element set is generated based on the event relationship structure. The candidate sentence element set consists of multiple candidate sentence elements, each of which includes text content, the supporting original security evidence set, semantic type, and visible permission domain label. The target role that receives the request to access the report performs a legality verification on each candidate sentence element in the candidate sentence element set to obtain a legal sentence element set; obtains the responsibility problem set corresponding to the target role, and selects the minimum sufficient coverage sentence element set from the legal sentence element set by solving the optimal objective function with constraints; For candidate sentence elements that fail the legality verification, a constrained and safe degradation operation to prevent hallucinations is performed according to the preset degradation rules to obtain the degraded sentence elements; The minimum fully covered sentence set and the downgraded sentence set are arranged to generate and output a security incident report for the target role to access.

[0006] Optionally, generating a candidate sentence set based on the event relationship structure includes: Based on the entity nodes and relation edges in the event relationship structure, a preset semantic template is matched; the semantic template includes factual sentence templates, inference sentence templates, and suggestion sentence templates. Based on the matched semantic template, the entity nodes and relation edges in the event relation structure are instantiated, semantic slots are filled, and initial candidate sentence elements are generated. Calculate the visible permission domain label for each initial candidate sentence element, where the visible permission domain label is the intersection of the access control lists of all original evidence in the original security evidence set supporting the candidate sentence element; Based on the different sets of original security evidence supporting the candidate sentence element, or the different values ​​of the semantic slots filled in the text content, the initial candidate sentence element is defined as a different candidate sentence element, forming a set of candidate sentence elements.

[0007] Optionally, the legality verification includes evidence traceability verification, which includes: Obtain the original set of security evidence for the candidate sentence elements; Determine whether there is original evidence in the original security evidence set that supports the candidate sentence element; If so, the candidate sentence element is determined to be verifiable through traceable evidence; If not, the candidate sentence element is determined to have failed the evidence traceability verification.

[0008] Optionally, the validity verification also includes cross-role permission consistency verification, which includes: Obtain the access control list of each original piece of evidence in the original security evidence set supporting the candidate sentence element; Calculate the intersection of each of the access control lists, and determine whether the intersection completely contains the permission set of the target role; If so, the candidate sentence element is determined to have passed the cross-role permission consistency verification; If not, the candidate sentence element is determined to have failed the cross-role permission consistency verification.

[0009] Optionally, performing legality verification on each candidate sentence element in the candidate sentence element set includes: When the candidate sentence element passes both the evidence traceability verification and the cross-role permission consistency verification, the candidate sentence element is determined to have passed the legality verification. When the candidate sentence element fails the evidence traceability verification or fails the cross-role permission consistency verification, it is determined that the candidate sentence element has failed the legality verification.

[0010] Optionally, obtaining the set of responsibility issues corresponding to the target role, and selecting the minimum fully covered set of sentence elements from the set of legal sentence elements by solving an optimization objective function with constraints, includes: For each candidate sentence element in the set of legal sentence elements, a decision variable and a coverage indicator variable are set; the decision variable is used to indicate whether to adopt the candidate sentence element, and the coverage indicator variable is used to indicate whether the candidate sentence element can answer the corresponding question in the set of responsibility questions. Obtain the upper limit of the cognitive burden budget and the lower limit of the minimum value contribution for the target role; An optimization objective function is constructed and solved to minimize the sum of the costs of the number of all adopted candidate sentence elements; the optimization objective function simultaneously satisfies the constraints of full problem coverage, cognitive budget, and lower limit of value contribution when solving.

[0011] Optionally, for candidate sentence elements that fail the validity verification, a constrained security degradation operation to prevent hallucinations is performed according to preset degradation rules to obtain degraded sentence elements, including: If a missing evidence stream is detected in the original security evidence supporting a candidate sentence element that has failed the legality verification, then unfounded narrative completion is rejected, and constrained graph completion is performed based on the constructed event relationship structure. The confidence scores of the candidate sentence elements that failed the legality verification are compared with the preset deletion threshold, anonymization interval, and confirmation interval. If the confidence score is lower than the deletion threshold, the candidate sentence element is marked as invalid and is considered to be removed. If the confidence score is within the anonymization range, then anonymization is performed on the entity in the candidate sentence element; If the confidence score is within the unconfirmed range, the candidate sentence element is converted into a form with an uncertainty label or a form requiring manual confirmation. If the confidence score is higher than the upper limit of the interval to be confirmed and the candidate sentence element fails the legality verification, then the entity in the candidate sentence element is anonymized and the candidate sentence element is converted into a form that requires manual confirmation, resulting in a downgraded sentence element.

[0012] Optionally, the step of arranging the minimum sufficient coverage set of sentence elements and the downgraded sentence elements to generate and output a security incident report for the target role to access includes: When compiling and generating a security incident report, a machine-readable tracing credential is bound to each sentence element in the security incident report; the tracing credential records the timestamps and hash values ​​of each original piece of evidence in the original security evidence set supporting the corresponding sentence element, so as to support the penetration jump from the security incident report to the corresponding original security evidence based on the tracing credential.

[0013] A second aspect of the present invention provides an automatic security incident report generation apparatus, comprising: The security evidence set determination module is used to receive multi-source security event evidence and perform object-oriented processing to obtain a security evidence set. The candidate sentence element set generation module is used to construct an event relationship structure based on the time relationship and entity relationship in the security evidence set, and generate a candidate sentence element set based on the event relationship structure. The candidate sentence element set consists of multiple candidate sentence elements, each of which includes text content, supporting original security evidence set, semantic type and visible permission domain label. The module for determining the set of legal sentence elements and the set of minimum sufficient coverage sentence elements is used to receive the target role requesting access to the report, perform legality verification on each candidate sentence element in the candidate sentence element set to obtain the set of legal sentence elements; obtain the set of responsibility issues corresponding to the target role, and filter out the set of minimum sufficient coverage sentence elements from the set of legal sentence elements by solving the optimization objective function with constraints; The downgraded sentence element determination module is used to perform a constrained and safe downgrade operation to prevent hallucinations for candidate sentence elements that fail the legality verification, according to preset downgrade rules, and obtain downgraded sentence elements; The security incident report output module is used to arrange the minimum sufficient coverage sentence set and the degraded sentence set to generate and output a security incident report for the target role to access.

[0014] A third aspect of the present invention provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute computer programs to implement the automatic generation method of security incident reports as described above.

[0015] As can be seen from the above technical solutions, the present invention has the following advantages: This invention achieves structured aggregation of massive alarm and forensic data by objectifying multi-source heterogeneous security event evidence and constructing an event relationship structure based on time and entity relationships. It decomposes report content into candidate sentence elements and binds each element with text content, supporting original evidence set, semantic type, and visibility permission domain label, providing clear underlying evidence support for the report content. Before generating the report, a strict legality verification mechanism for the target role is introduced. By verifying the legality of candidate sentence elements and their supporting evidence set, non-compliant expressions are effectively blocked. Simultaneously, by obtaining the target role's responsibility problem set and solving it with constraints using an optimization objective function, the minimum sufficient coverage sentence element set covering the responsibility problems is selected. This significantly improves the system's security, compliance, and controllability. While ensuring full coverage of core issues, it reduces unnecessary redundant information and significantly lowers the cognitive load on target roles. For candidate sentence elements that fail legality verification, it introduces constrained security degradation and constrained graph completion, and uses preset degradation rules to perform security processing on low-credibility content, effectively improving the robustness and credibility of the report in complex security scenarios. By logically arranging and outputting the minimum sufficient coverage sentence element set and degradation sentence elements, it integrates the technical effects of the above stages into one, ultimately generating a security incident report with high auditability, strict permission compliance, concise key points, and anti-illusion capabilities. This achieves the unification of multiple objectives in security operation reporting, including automation, intelligence, and compliance controllability. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an automatic generation method for security incident reports according to the present invention. Figure 2 This is a schematic diagram of the process of constructing the event relationship structure and generating a candidate sentence set in this invention; Figure 3 This is a flowchart illustrating the process of solving the objective function and selecting the minimum fully covered sentence element set in this invention. Figure 4 This is a flowchart illustrating the process of performing a constrained safety degradation operation to obtain a downgraded sentence element in this invention. Detailed Implementation

[0017] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “corresponding to,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0018] The implementation method in this embodiment can be implemented in a system, on a server, or on a terminal; no specific limitation is made. The method in this application will be described below from the perspective of system implementation. Please refer to... Figure 1 The automatic generation method for security incident reports provided in this application includes the following steps: S1. Receive multi-source security event evidence and objectify it to obtain a set of security evidence; In this implementation, the system receives log data streams generated by various security devices, endpoint management systems, and asset management systems deployed within the enterprise through a standard data acquisition interface. The acquisition interface can be implemented using standard methods such as system log service interfaces, message queues, or application programming interfaces. Multiple sources of security event evidence include network access logs and threat alert data generated by the perimeter firewall, host process execution records and sensitive registry modification records monitored by the endpoint detection and response system, and business host attribute information recorded by the human resources and asset management system.

[0019] In specific application scenarios, the system may receive the following raw security evidence: Evidence 1 comes from a firewall device, recording high-frequency connections initiated from internal addresses to malicious external addresses; Evidence 2 comes from an endpoint detection and response system, recording sensitive registry modifications performed by processes on the host; Evidence 3 comes from a human resources asset management system, recording the responsible person and device security level attributes of the host. Based on the received raw security evidence, the system parses the raw logs, transforming heterogeneous logs from different data sources into a unified data format; according to preset extraction rules, it uniformly extracts core fields such as timestamps, source addresses, destination addresses, operation actions, and entity attribution from the formatted logs; it logically associates and encapsulates evidence from different sources within the same time window targeting the same event entity, eliminating redundant information to form a standardized set of security evidence, providing a data foundation for subsequently constructing an event relationship structure.

[0020] S2. Based on the temporal and entity relationships in the security evidence set, construct an event relationship structure and generate a candidate sentence element set based on the event relationship structure. The candidate sentence element set consists of multiple candidate sentence elements, each of which includes text content, the supporting original security evidence set, semantic type, and visible permission domain label. The system extracts timestamp information and related entity information from the security evidence set to construct an event relationship structure. Key hosts, users, processes, and IP addresses appearing in the security evidence set are considered entity nodes. The temporal sequence between different pieces of evidence is used as temporal relationship edges, and the association between different pieces of evidence in attack logic or asset attributes is used as semantic relationship edges, thus forming a directed event relationship graph structure containing multiple relationships. For example, in a specific application scenario, the system uses host Host as the core entity node, connecting evidence 2 (registry modification) and evidence 1 (external connection initiation) in chronological order to form a temporal logic graph that includes modifying the registry before initiating an external connection. Simultaneously, evidence 3 connects host Host to Zhang San in the finance department, forming a complete structure containing entity attribute links. Please refer to [link to relevant documentation]. Figure 2 After constructing the event relationship structure, the system performs the following specific steps to generate a candidate sentence set based on the entity nodes, relationship edges, and link logic in the structure: S21. Based on the entity nodes and relation edges in the event relationship structure, match the preset semantic templates; the semantic templates include factual sentence templates, inference sentence templates, and suggestion sentence templates; The system pre-constructs a semantic template library containing various semantic templates to map underlying nodes and edges into human-understandable textual expressions. Factual templates are used to generate deterministic descriptions based on existing and observable security evidence; inference templates are used to generate uncertain analytical descriptions based on partial evidence and logical deduction; and suggestion templates are used to generate action recommendations based on evidence assessment. During the matching process, the system compares entity nodes and temporal relationship edges in the event relationship structure with each semantic template to identify the template that best fits the current topology.

[0021] S22. Based on the matched semantic template, instantiate the entity nodes and relation edges in the event relation structure, fill the semantic slots, and generate initial candidate sentence elements; After matching a suitable semantic template, the system fills the specific entity nodes and relationship edges in the event relationship structure into the preset semantic slots of the semantic template, thus instantiating the template. For example, the semantic template may contain host entity slots, action entity slots, target network entity slots, etc. The system will fill the specific host identifier, specific operation action, specific address, etc., identified in the event relationship structure into the corresponding slots, thereby generating specific initial candidate sentence elements with clear actual referents. In this process, the system matches and instantiates each event relationship link. Since an event relationship link may have multiple semantic level logical connections, a link may generate multiple initial candidate sentence elements.

[0022] S23. Calculate the visible permission domain label for each initial candidate sentence element. The visible permission domain label is the intersection of the access control lists of all original evidence in the original security evidence set supporting the candidate sentence element. When calculating the visibility permission domain label, the access control lists of all original security evidence supporting the candidate suffix are extracted, and the intersection of these access control lists is taken. The specific calculation formula is as follows: in: Indicates candidate sentence elements Visible permission field tags, Indicates supporting candidate sentence elements The original set of security evidence, Represents a set The single original evidence in Original evidence The system uses the access control list. After the intersection operation, the system uses the result as the visibility permission domain label for the candidate sentence element. If the intersection operation result is an empty set, it means that the original evidence combination supporting the sentence element is too sensitive and lacks a unified visible role. Therefore, the candidate sentence element is marked as having no visible role for subsequent security downgrade processing.

[0023] S24. Based on the different sets of original security evidence supporting the candidate sentence element, or the different values ​​of the semantic slots filled in the text content, the initial candidate sentence element is defined as a different candidate sentence element, forming a set of candidate sentence elements.

[0024] When forming the final candidate sentence element set, the system classifies the initial candidate sentence elements according to predefined criteria. These criteria include two dimensions: first, if two initial candidate sentence elements have different sets of supporting original security evidence, they are classified as different candidate sentence elements; second, if the sets of supporting evidence are the same, but the semantic slot values ​​filled in the text content are different, they are also classified as different candidate sentence elements. The system will strictly adhere to these criteria, removing duplicates and grouping eligible sentence elements into the candidate sentence element set.

[0025] S3. Receive the target role that requests to access the report, perform legality verification on each candidate sentence element in the candidate sentence element set to obtain a legal sentence element set; obtain the responsibility problem set corresponding to the target role, and select the minimum sufficient coverage sentence element set from the legal sentence element set by solving the optimal objective function with constraints; The target roles are user entities with different access levels or responsibilities, such as junior security operations personnel, senior security analysts, or chief information security officers. Before generating the final report, the system must perform rigorous legality verification on each candidate element in the candidate element set. Legality verification specifically includes two dimensions: evidence traceability verification and cross-role permission consistency verification. The system executes the following judgment rules to determine whether a candidate element passes legality verification: 1. When a candidate sentence element passes both the evidence traceability verification and the cross-role permission consistency verification, the candidate sentence element is deemed to have passed the legality verification. 2. If a candidate sentence element fails the evidence traceability verification or fails the cross-role permission consistency verification, the candidate sentence element is deemed to have failed the legality verification.

[0026] Specifically, the pass condition for legality verification is an "AND" logic: a sentence element is considered valid only if both the source of the evidence is traceable and the current role has the authority to view it are simultaneously satisfied. The fail condition is an "OR" logic: if either of the verification conditions is not met, the sentence element is deemed to have failed legality verification. All candidate sentence elements that pass legality verification together constitute the set of valid sentence elements, providing a compliant material pool for subsequent optimization screening.

[0027] In this embodiment, the traceability verification of evidence includes the following: 1. Obtain the original set of security evidence for candidate sentence elements; 2. Determine whether there is original evidence in the original security evidence set that supports the candidate sentence element; 3. When there is original evidence supporting the candidate sentence element, the candidate sentence element is determined to be verifiable through traceable evidence. 4. If there is no original evidence to support the candidate sentence element, the candidate sentence element is determined to have failed the evidence traceability verification.

[0028] Specifically, the core purpose of traceable evidence verification is to prevent unfounded fabrications that deviate from real data during report generation. When performing this verification, the system first extracts the set of supporting original security evidence bound to the candidate sentence element itself. If at least one piece of genuine original security evidence exists in this set, it indicates that the text content of the candidate sentence element is generated based on actual collected security logs or alarms, possessing a genuine traceable source, and is therefore deemed to have passed verification. Conversely, if the set of supporting original security evidence for the sentence element is empty, it indicates that the text content of the sentence element lacks actual underlying data support, suggesting a large-scale model illusion or artificial fabrication, and is therefore deemed to have failed verification.

[0029] In this embodiment, cross-role permission consistency verification includes the following: 1. Obtain the access control list of each original piece of evidence in the original security evidence set supporting the candidate sentence element; 2. Calculate the intersection of each access control list and determine whether the intersection completely contains the permission set of the target role; 3. When the set of permissions for the target role is included, the candidate sentence element is determined to have passed the cross-role permission consistency verification; 4. If the set of permissions for the target role is not included, the candidate sentence element is determined to have failed the cross-role permission consistency verification.

[0030] Specifically, the core purpose of cross-role permission consistency verification is to prevent unauthorized data leakage during the generation of narratives through multi-evidence fusion. During verification, the system first obtains the access control lists (ACLs) of all original evidence in the supporting evidence set for the candidate sentence element, and then calculates the intersection of these ACLs. This intersection represents the common permission domain that allows shared access to all original evidence behind the sentence element. Next, the system compares this intersection with the current permission set of the target role. If the intersection completely includes the target role's permission set, it means the target role has permission to access all underlying data upon which the sentence element depends, and the verification passes. If the intersection does not completely include the target role's permission set, the sentence element is deemed to pose an unauthorized risk to the current target role and fails verification. This mechanism effectively intercepts unauthorized disclosures that may occur in subsequent reports.

[0031] Please see Figure 3 Solve the objective function and select the minimum fully covered sentence element set, including the following: S31. For each candidate sentence element in the set of valid sentence elements, set a decision variable and a coverage indicator variable; the decision variable is used to indicate whether to adopt the candidate sentence element, and the coverage indicator variable is used to indicate whether the candidate sentence element can answer the corresponding question in the set of responsibility questions; The decision variable, used in the mathematical model, indicates whether the final generated report adopts the current candidate sentence element. This variable is binary, with a value of 1 indicating adoption and a value of 0 indicating rejection. The coverage indicator variable is used to pre-calculate whether the text content of the current candidate sentence element semantically covers a specific question in the target role responsibility question set. This variable is also binary, with a value of 1 indicating that the sentence element can answer the corresponding question and a value of 0 indicating that it cannot.

[0032] S32. Obtain the upper limit of the cognitive burden budget and the lower limit of the minimum value contribution for the target role; Because different target roles have varying information reception capabilities and responsibilities in security incident reporting, the system obtains the cognitive burden budget ceiling and minimum value contribution floor for each target role. The cognitive burden budget ceiling is the maximum amount of report content set by the system for the current role, used to strictly control the length of the output report and prevent redundant information beyond the user's processing capacity. The minimum value contribution floor ensures that the final report, after being compressed, still possesses the necessary core information quality, avoiding the loss of content with practical analytical value due to excessive simplification.

[0033] S33. Construct and solve an optimization objective function that minimizes the sum of the costs of the number of all adopted candidate sentence elements; the optimization objective function simultaneously satisfies the problem coverage constraint, the cognitive budget constraint, and the lower limit constraint of value contribution when solving the problem.

[0034] The system constructs and solves an optimization objective function with three constraints. The mathematical expression of the optimization objective function is as follows: in: The aforementioned decision variables are used to indicate whether to adopt candidate sentence elements; The quantity cost of this candidate sentence element can be specifically represented as the text character length of the candidate sentence element in this embodiment. The goal of finding this minimum value is to select the most concise expression from a large number of valid sentence elements.

[0035] The objective function must satisfy the following three constraint equations simultaneously when solving: The problem's full coverage constraint is calculated using the following formula: in: The aforementioned coverage indicator variable is used to indicate whether the candidate sentence element can answer the first question in the set of responsibility questions. There are several issues. This constraint requires that for each issue in the responsibility problem set, there must be at least one adopted candidate sentence element that can semantically cover it.

[0036] The cognitive budget constraint is calculated using the following formula: in: The cognitive burden cost corresponding to the candidate sentence element is determined by the length of the text characters of the sentence element itself and the number of entities involved in the sentence element; This is the upper limit of the cognitive burden budget for the current target role. This constraint requires that the total cognitive burden cost of all adopted candidate sentence elements must not exceed the cognitive tolerance range of the target role.

[0037] The lower limit constraint on value contribution is calculated using the following formula: in: The value contribution of the candidate sentence element is determined by the confidence score of the candidate sentence element and its relevance score to the target role. This is the minimum value contribution required for the target role. This constraint aims to ensure that the final selected report content, while meeting the requirements for conciseness and authorization compliance, still possesses sufficient informational value to effectively support the role's decision-making.

[0038] The system solves the above-mentioned constrained optimization objective function through linear programming, thereby accurately extracting the minimum fully covered sentence set from the set of legal sentence elements.

[0039] S4. For candidate sentence elements that fail the legality verification, perform a constrained and safe degradation operation to prevent hallucinations according to the preset degradation rules to obtain the degraded sentence elements; Please see Figure 4 The implementation process includes the following: S41. If a missing evidence stream is detected in the original security evidence supporting a candidate sentence element that has failed the legality verification, then unfounded narrative completion is rejected, and constrained graph completion is performed based on the constructed event relationship structure. Specifically, for candidate sentence elements that fail the legitimacy verification, the system must first check the completeness of their underlying supporting evidence. If a missing evidence stream is detected in the original security evidence supporting the candidate sentence element, the system refuses to use the large language model for unfounded narrative free completion. Instead, it strictly performs constrained graph completion based on the graph topology information in the event relationship structure constructed in the aforementioned steps. This graph completion process includes: the system using temporal interval analysis methods or querying the knowledge graph of known attack patterns to locate disconnected subgraph regions or temporal breakpoints in the event relationship structure; secondly, performing triple verification of the candidate completion region based on topological constraints, temporal constraints, and tactical constraints; and finally, the system adds a missing confidence factor to the completed sentence element to ensure that the logical deduction process is based on the underlying graph data and is auditable.

[0040] S42. Compare the confidence scores of candidate sentence elements that fail the legality verification with the preset deletion threshold, anonymization interval, and interval to be confirmed; Specifically, the preset downgrade rules consist of a system-preset deletion threshold, an anonymization range, and a range to be confirmed. Before calculating the confidence score of a candidate sentence element that fails the legality verification, the system first obtains the original security evidence set for that candidate sentence element. If the original security evidence set is empty, the system directly sets the confidence score of that candidate sentence element to 0 and proceeds to the subsequent comparison with the deletion threshold. If the original security evidence set is not empty, the confidence score is calculated according to the following formula. : in: This is the original security evidence subset supporting the candidate sentence element; For set The credibility score for each piece of original evidence is calculated based on the historical reliability of the evidence source and the freshness of the data. To ensure evidence coverage, through The total number of pieces of evidence in the current sentence is divided by the total number of pieces of evidence in the entire event chain. This is used to measure the completeness of the evidence chain on which the current sentence is based.

[0041] S43. If the confidence score is lower than the deletion threshold, the candidate sentence element is marked as invalid and is considered to be removed; S44. If the confidence score is in the anonymization range, then anonymize the entities in the candidate sentence element. S45. If the confidence score is in the unconfirmed range, the candidate sentence element is converted into a form with an uncertainty label or a form that requires manual confirmation. S46. If the confidence score is higher than the upper limit of the interval to be confirmed and the candidate sentence element fails the legality verification, then the entity in the candidate sentence element is anonymized and transformed into a form that requires manual confirmation, resulting in a downgraded sentence element.

[0042] The preset deletion threshold, anonymization interval, and confirmation interval are derived from manually annotated data of historical annotated sample security event reports through receiver operating characteristic (ROC) curve analysis. Through the aforementioned statistical learning, the system achieves an optimal balance between precision and recall in the overall evaluation metrics. In a preferred embodiment, the deletion threshold is set to 0.10, the anonymization interval to [0.10, 0.35), and the confirmation interval to [0.35, 0.60].

[0043] If confidence score If the value is below the deletion threshold, it indicates that the evidence reliability of this sentence element is extremely low and there is a serious risk of distortion. The system marks it as invalid and removes it. The text content of such sentence elements will not be included in the final report compilation. If the confidence score is... If a sentence element is within the anonymization range, it indicates that the overall logic of the sentence element has a certain degree of rationality, but the specific entity information it contains is too sensitive. Therefore, the system performs anonymization replacement on the specific entities in the candidate sentence element, forming an anonymized sentence element. If the confidence score... If the sentence element is in the "pending confirmation" range, it indicates that the logical deduction of this sentence element has some rationality, but the underlying evidence is not yet sufficient. The system will convert it into a form with an uncertainty label, or into a form requiring manual confirmation. If the confidence score... If a candidate sentence element exceeds the upper limit of the pending confirmation range, but fails the legitimacy verification (e.g., the confidence level of an inference-type sentence element does not reach its corresponding preset threshold, or the cross-role permission consistency verification fails), the system strictly adheres to the principles of preventing unauthorized access and preventing illusions. It anonymizes the entities within the candidate sentence element and transforms it into a form requiring manual confirmation to preserve high-value but restricted information while ensuring security and compliance. After the above-mentioned judgment and degradation operation based on preset degradation rules, the system outputs a set of degraded sentence elements. Although these degraded sentence elements fail the strict legitimacy verification, they can provide limited reference information for decision-making within a controllable range.

[0044] S5. Arrange the minimum sufficient coverage set of sentence elements and the downgraded sentence elements to generate and output a security incident report for the target role to access.

[0045] In this embodiment, when compiling and generating a security incident report, a machine-readable tracing credential is bound to each sentence element in the security incident report; the tracing credential records the timestamps and hash values ​​of each original piece of evidence in the original security evidence set that supports the corresponding sentence element, so as to support the penetration jump from the security incident report to the corresponding original security evidence based on the tracing credential.

[0046] Specifically, the system merges the minimum sufficient coverage sentence set obtained from the solution with the downgraded sentence elements after downgrading, and then sorts and arranges the two in a unified manner according to the target role's responsibility logic and the timeline of the event. When generating a security incident report, each sentence element in the security incident report is bound to a machine-readable tracing credential; the tracing credential records the timestamps and hash values ​​of each original piece of evidence in the original security evidence set supporting the corresponding sentence element, so as to support the penetration jump from the security incident report to the corresponding original security evidence based on the tracing credential.

[0047] To verify the effectiveness, robustness, and multi-role adaptability of the technical solution of this invention in a real and complex industrial environment, the following simulation experiment was conducted.

[0048] 1. Simulation experimental environment and data settings: This experiment simulates the complete lifecycle of an advanced persistent threat (APS) attack on a large multinational financial institution. The time span was set to 45 consecutive days. The system was connected to 12 types of data sources, including perimeter firewalls, web application firewalls, traffic analysis devices, endpoint security protection, identity authentication systems, and email gateways. A total of 150 million real-world traffic logs were injected, and malicious evidence chains related to this attack were embedded in them through a specific script. These chains included the complete attack stages, such as phishing email delivery, credential theft, lateral movement, and data packaging and transmission. A total of 4,520 pieces of original evidence related to the attack were obtained.

[0049] Regarding environmental complexity constraints, the experimental data contained three dimensions of complex noise: first, false alarms caused by high concurrent traffic from normal business operations; second, log timestamp clock drift caused by cross-time zone devices, simulating a maximum time difference deviation of 200 milliseconds; and third, a complex organizational structure tree with permissions, including eight different permission roles such as senior executives, business personnel, analysts at various levels of the security operations center, and network operations personnel.

[0050] 2. Preset system parameters: In the preferred embodiment of this simulation experiment, the confidence threshold for factual sentence elements is preset to 0.90, the confidence threshold for inference sentence elements is 0.75, and the narrative consistency threshold is 0.85. Regarding the cognitive burden budget limit, the Chief Information Security Officer is set to high-density and streamlined, only allowed to output macro-level impact and loss mitigation suggestions, with the cognitive burden budget limit set at 500 information units; the Security Operations Center Level 2 Analyst is set to higher permissions, allowed to output detailed commands and process trees, with their cognitive burden budget limit set at 2500 information units.

[0051] 3. Experimental procedures and intermediate results: Evidence Extraction and Graph Construction: The system successfully extracted 4,520 strongly relevant pieces of evidence from massive logs. When dealing with missing evidence streams, such as when a host failed to upload endpoint protection logs due to network outages, the system triggered a constrained graph completion mechanism, rather than fabricating evidence out of thin air using a large model. By analyzing the traffic graphs of adjacent routers, the system inferred the internal communication behavior of the out-of-network host, ultimately constructing a large event relationship graph containing 850 entity nodes and 3,400 edges.

[0052] Candidate sentence element generation: Based on the above graph, the system initially generated 1250 candidate sentence elements, covering factual actions, attribution inferences and handling suggestions.

[0053] Verification and optimization solution: Taking the target role of network operations and maintenance personnel as an example, their responsibility question set includes "What IP address ranges are affected?" and "What external command and control domains need to be blocked?".

[0054] In the legitimacy verification process, for cross-role permission consistency verification, the system intercepted 315 candidate sentence elements containing user-sensitive data payloads. When substituting these into the optimization objective function, the system aimed to minimize the sum of the costs associated with adopting sentence elements, while strictly adhering to constraints such as full problem coverage and cognitive budget constraints (the total cognitive burden caused by sentence element text length and entity number must not exceed the target role's budget limit). Ultimately, the algorithm precisely extracted the minimum sufficiently covering sentence element set containing only 18 sentence elements from the remaining 935 legitimate sentence elements.

[0055] Anti-illusion downgrade execution: In the experiment, it was observed that there was an inference candidate sentence element attributing the attacker's identity to a specific hacker group. Because the supporting original evidence consisted of only two conflicting threat intelligence reports, the confidence score was 0.68 (lower than the preset confidence threshold of 0.75 for inference sentence elements). The system strictly followed the preset downgrade rules, refusing to output it directly, and instead converting it into a downgraded form with an uncertainty label, marking it as requiring manual confirmation.

[0056] 4. Comparison of Results and Analysis of Experimental Phenomena: This simulation experiment selected two mainstream existing solutions as comparison objects. Solution A is a basic large language model solution, which directly concatenates alarm logs and inputs them into a general large language model, prompting the generation of a summary report; Solution B is a traditional rule-based solution, namely a security information and event management report generation tool based on static rule templates.

[0057] The specific quantitative comparison data is shown in Table 1 below: In terms of preventing hallucinations: When faced with streams of evidence lacking information, such as hosts with network outages, Solution A, due to its reliance on the free generation of large language models, generates unsubstantiated descriptions, resulting in a hallucination rate of 14.5%. This invention, by performing constrained graph completion and security degradation operations, strictly suppresses the hallucination rate to below 0.1%, and each output segment carries a machine-readable hash traceability credential, achieving 100% traceability of the generated content.

[0058] Regarding cross-role privilege escalation interception: Due to the lack of fine-grained object-based access control list verification in Scheme A and Scheme B, their permission violation leakage rates reached 22.0% and 18.0%, respectively. This invention enforces the verification of cross-role permission consistency formulas, successfully increasing the cross-role privilege escalation interception rate to 100%, ensuring the absolute security of sensitive financial payloads.

[0059] In terms of cognitive load and value contribution: In a CSO (Chief Information Security Officer) executive reporting scenario, Solution B output a 45-page mechanical indicator report, resulting in an extremely high cognitive load. This invention, however, by solving an optimization objective function, compresses the report into a mere one-page summary while ensuring 100% coverage of core issues. This not only significantly reduces cognitive load by 85% but also achieves a value contribution score of 9.6, far surpassing other comparative solutions.

[0060] In summary, this simulation experiment fully demonstrates that the technical solution of this invention can effectively suppress the illusion of large models and strictly ensure the compliance of enterprise data access rights in real large-scale attack and defense scenarios. At the same time, it can dynamically tailor the optimal report content according to the responsibilities of different positions, and has extremely high practical application value.

[0061] Furthermore, an embodiment of the automatic generation device for security incident reports according to the present invention includes the following: The security evidence set determination module is used to receive multi-source security event evidence and perform object-oriented processing to obtain a security evidence set. The candidate sentence set generation module is used to construct an event relationship structure based on the time relationship and entity relationship in the security evidence set, and generate a candidate sentence set based on the event relationship structure. The candidate sentence set consists of multiple candidate sentence elements, each of which includes text content, supporting original security evidence set, semantic type and visible permission domain label. The module for determining the set of legal sentence elements and the minimum sufficient coverage set of sentence elements is used to receive the target role requesting access to the report, perform legality verification on each candidate sentence element in the candidate sentence element set to obtain the set of legal sentence elements; obtain the set of responsibility issues corresponding to the target role, and filter out the minimum sufficient coverage set of sentence elements from the set of legal sentence elements by solving the optimization objective function with constraints; The downgraded sentence element determination module is used to perform a constrained and safe downgrade operation to prevent hallucinations for candidate sentence elements that fail the legality verification, according to preset downgrade rules, and obtain downgraded sentence elements; The security incident report output module is used to arrange the minimum sufficient coverage sentence set and the degradation sentence set to generate and output a security incident report for the target role to access.

[0062] For specific limitations regarding the device, please refer to the limitations of the method above, which will not be repeated here. Each module in the above device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0063] Furthermore, the present invention provides an electronic device comprising: Memory, used to store computer programs; A processor for executing computer programs to implement the method for automatically generating security incident reports as described above.

[0064] It is understood that those skilled in the art can combine various implementation methods in the above embodiments under the guidance of the above examples to obtain technical solutions with multiple implementation methods.

[0065] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for automatically generating security incident reports, characterized in that, include: Receive multi-source security event evidence and objectify it to obtain a set of security evidence; Based on the temporal and entity relationships in the security evidence set, an event relationship structure is constructed, and a candidate sentence element set is generated based on the event relationship structure. The candidate sentence element set consists of multiple candidate sentence elements, each of which includes text content, the supporting original security evidence set, semantic type, and visible permission domain label. The target role that receives the request to access the report performs a legality verification on each candidate sentence element in the candidate sentence element set to obtain a legal sentence element set; obtains the responsibility problem set corresponding to the target role, and selects the minimum sufficient coverage sentence element set from the legal sentence element set by solving the optimal objective function with constraints; For candidate sentence elements that fail the legality verification, a constrained and safe degradation operation to prevent hallucinations is performed according to the preset degradation rules to obtain the degraded sentence elements; The minimum fully covered sentence set and the downgraded sentence set are arranged to generate and output a security incident report for the target role to access.

2. The automatic generation method for security incident reports according to claim 1, characterized in that, The generation of a candidate sentence metaset based on the event relationship structure includes: Based on the entity nodes and relation edges in the event relationship structure, a preset semantic template is matched; the semantic template includes factual sentence templates, inference sentence templates, and suggestion sentence templates. Based on the matched semantic template, the entity nodes and relation edges in the event relation structure are instantiated, semantic slots are filled, and initial candidate sentence elements are generated. Calculate the visible permission domain label for each initial candidate sentence element, where the visible permission domain label is the intersection of the access control lists of all original evidence in the original security evidence set supporting the candidate sentence element; Based on the different sets of original security evidence supporting the candidate sentence element, or the different values ​​of the semantic slots filled in the text content, the initial candidate sentence element is defined as a different candidate sentence element, forming a set of candidate sentence elements.

3. The automatic generation method for security incident reports according to claim 1, characterized in that, The legality verification includes evidence traceability verification, which includes: Obtain the original set of security evidence for the candidate sentence elements; Determine whether there is original evidence in the original security evidence set that supports the candidate sentence element; If so, the candidate sentence element is determined to be verifiable through traceable evidence; If not, the candidate sentence element is determined to have failed the evidence traceability verification.

4. The automatic generation method for security incident reports according to claim 3, characterized in that, The legality verification also includes cross-role permission consistency verification, which includes: Obtain the access control list of each original piece of evidence in the original security evidence set supporting the candidate sentence element; Calculate the intersection of each of the access control lists, and determine whether the intersection completely contains the permission set of the target role; If so, the candidate sentence element is determined to have passed the cross-role permission consistency verification; If not, the candidate sentence element is determined to have failed the cross-role permission consistency verification.

5. The automatic generation method for security incident reports according to claim 4, characterized in that, The step of performing legality verification on each candidate sentence element in the candidate sentence element set includes: When the candidate sentence element passes both the evidence traceability verification and the cross-role permission consistency verification, the candidate sentence element is determined to have passed the legality verification. When the candidate sentence element fails the evidence traceability verification or fails the cross-role permission consistency verification, it is determined that the candidate sentence element has failed the legality verification.

6. The method for automatically generating security incident reports according to claim 1, characterized in that, The process of obtaining the set of responsibility issues corresponding to the target role, and selecting the minimum fully covered set of sentence elements from the set of legal sentence elements by solving an optimization objective function with constraints, includes: For each candidate sentence element in the set of legal sentence elements, a decision variable and a coverage indicator variable are set; the decision variable is used to indicate whether to adopt the candidate sentence element, and the coverage indicator variable is used to indicate whether the candidate sentence element can answer the corresponding question in the set of responsibility questions. Obtain the upper limit of the cognitive burden budget and the lower limit of the minimum value contribution for the target role; An optimization objective function is constructed and solved to minimize the sum of the costs of the number of all adopted candidate sentence elements; the optimization objective function simultaneously satisfies the constraints of full problem coverage, cognitive budget, and lower limit of value contribution when solving.

7. The method for automatically generating security incident reports according to claim 1, characterized in that, For candidate sentence elements that fail the legality verification, a constrained and secure degradation operation to prevent hallucinations is performed according to preset degradation rules to obtain degraded sentence elements, including: If a missing evidence stream is detected in the original security evidence supporting a candidate sentence element that has failed the legality verification, then unfounded narrative completion is rejected, and constrained graph completion is performed based on the constructed event relationship structure. The confidence scores of the candidate sentence elements that failed the legality verification are compared with the preset deletion threshold, anonymization interval, and confirmation interval. If the confidence score is lower than the deletion threshold, the candidate sentence element is marked as invalid and is considered to be removed. If the confidence score is within the anonymization range, then anonymization is performed on the entity in the candidate sentence element; If the confidence score is within the unconfirmed range, the candidate sentence element is converted into a form with an uncertainty label or a form requiring manual confirmation. If the confidence score is higher than the upper limit of the interval to be confirmed and the candidate sentence element fails the legality verification, then the entity in the candidate sentence element is anonymized and the candidate sentence element is converted into a form that requires manual confirmation, resulting in a downgraded sentence element.

8. The method for automatically generating security incident reports according to claim 1, characterized in that, The step of arranging the minimum fully covered sentence element set and the downgraded sentence elements to generate and output a security incident report for the target role to access includes: When compiling and generating a security incident report, a machine-readable tracing credential is bound to each sentence element in the security incident report; the tracing credential records the timestamps and hash values ​​of each original piece of evidence in the original security evidence set supporting the corresponding sentence element, so as to support the penetration jump from the security incident report to the corresponding original security evidence based on the tracing credential.

9. An automatic security incident report generation device, characterized in that, The automatic generation method for security incident reports according to any one of claims 1 to 8 includes: The security evidence set determination module is used to receive multi-source security event evidence and perform object-oriented processing to obtain a security evidence set. The candidate sentence element set generation module is used to construct an event relationship structure based on the time relationship and entity relationship in the security evidence set, and generate a candidate sentence element set based on the event relationship structure. The candidate sentence element set consists of multiple candidate sentence elements, each of which includes text content, supporting original security evidence set, semantic type and visible permission domain label. The module for determining the set of legal sentence elements and the set of minimum sufficient coverage sentence elements is used to receive the target role requesting access to the report, perform legality verification on each candidate sentence element in the candidate sentence element set to obtain the set of legal sentence elements; obtain the set of responsibility issues corresponding to the target role, and filter out the set of minimum sufficient coverage sentence elements from the set of legal sentence elements by solving the optimization objective function with constraints; The downgraded sentence element determination module is used to perform a constrained and safe downgrade operation to prevent hallucinations for candidate sentence elements that fail the legality verification, according to preset downgrade rules, and obtain downgraded sentence elements; The security incident report output module is used to arrange the minimum sufficient coverage sentence set and the degraded sentence set to generate and output a security incident report for the target role to access.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing a computer program to implement the automatic generation method for security incident reports as described in any one of claims 1 to 8.

Images