A security alarm research and judgment method based on large model positive and negative evidence collaborative reasoning

Abstract

The application discloses a kind of based on big model positive and negative evidence collaborative reasoning's safety alarm research and judge method, it is related to network security technical field, including: reading the security alarm to be judged and security behavior to be taken in, according to the security alarm to be judged to form alarm to be taken in range, and according to the relationship of taking in and time sequence position from alarm to be taken in range selects first security behavior fragment and second security behavior fragment, calculates fragment to be taken in quantity and fragment interval quantity;Reading behavior to be taken in reference input, first security behavior fragment and second security behavior fragment are matched with behavior to be taken in reference input, form the reference function unit between them.The application establishes the analysis relationship between the front and rear security behavior fragments around the security alarm to be judged, so that alarm object, behavior content, behavior fragment time sequence and intermediate behavior reference content can be organized and compared in the same research and judge process, which can provide clearer evidence source and taking in boundary for security event correlation research and judgment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model. Background Technology

[0002] During security operations, security devices, host agents, network probes, identity authentication systems, and log platforms continuously generate security alerts and activity logs. To determine whether a security alert belongs to a specific security event, it is usually necessary to perform correlation analysis by combining behavioral segments such as login, access, execution, connection, and permission changes before and after the alert occurs, and further determine the sequential relationship of these behavioral segments in terms of objects, behavioral content, and timing. This type of analysis process not only depends on the alert itself, but also on the sequential correspondence between security behavioral segments and the attribution relationship between objects such as accounts, hosts, sessions, and network connections. In actual data acquisition environments, there may be time intervals, acquisition delays, acquisition interruptions, incomplete acquisition coverage, and some behavioral content not being acquired in the behavior records before and after the alarm. For intermediate behavioral content that does not appear between two acquired behavioral segments, it cannot be simply interpreted as the behavior not occurring, nor should it be directly supplemented by inference. If the acquisition conditions of the corresponding segments of missing content are not distinguished, it is easy to mix missing records of different natures into the same judgment process in the subsequent correlation analysis, making it difficult to distinguish the evidentiary role of missing records under observable conditions from those under unobservable conditions. As large-scale models are used to assist in the interpretation of security alerts, evidence organization, and event analysis, the security alert analysis process can utilize large-scale models to generate alert description records and evidence organization texts. However, when introducing large-scale models to explain positive and negative evidence, it is still necessary to first form structured constraints on the collected behaviors, missing content, observable states, and unobservable states. If missing content is directly used as the basis for completion or as reverse evidence input into the analysis process without being distinguished by observability, the description records generated by the large-scale model may not accurately reflect the underlying collection conditions. Therefore, this invention proposes a security alert analysis method based on collaborative reasoning of positive and negative evidence using large-scale models. Summary of the Invention

[0003] The purpose of this invention is to provide a security alarm judgment method based on collaborative reasoning of positive and negative evidence in a large model, so as to solve the problems mentioned in the background art.

[0004] This invention can be achieved through the following technical solution: a security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, comprising: Step 1: Read the safety alarms and safety behavior acceptance inputs to be analyzed, form the alarm acceptance range based on the safety alarms to be analyzed, and select the first safety behavior segment and the second safety behavior segment from the alarm acceptance range according to the acceptance relationship and time sequence position, and calculate the segment acceptance quantity and segment interval quantity. Step 2: Read the behavior acceptance reference input, match the first safety behavior segment and the second safety behavior segment with the behavior acceptance reference input to form a reference action unit between the two, obtain the collected intermediate behavior segments from the alarm acceptance range within the time period corresponding to the segment interval, and form the intermediate behavior gap quantity by comparing the coverage of the reference action unit with the collected intermediate behavior segments. Step 3: When the gap amount of intermediate behavior is greater than the preset gap threshold, determine the missing segment based on the uncovered receiving position in the reference action unit, and write the uncovered receiving position in the reference action unit and its corresponding intermediate behavior reference content into the missing reference unit. Step 4: For the missing reference unit in the missing segment, read the acquisition capability input, calculate the acquisition continuity, behavior adaptation, acquisition coverage and reporting timeliness, determine the lowest value after normalization of the four as the observability permission quantity, and compare the observability permission quantity with the preset observability threshold to form observable missing result or unobservable missing result. Step 5: When Step 4 produces observable missing results, perform fill-in prohibition on the missing reference unit and generate fill-in prohibition results; when Step 4 produces unobservable missing results, perform missing proof disallowance on the missing segment and generate missing proof disallowance results, and output security event correlation analysis results.

[0005] A further technical improvement of the present invention is that the method for selecting the first safety behavior segment and the second safety behavior segment in step one includes: Based on the safety alarms to be analyzed, the alarm occurrence time is determined. Using the alarm occurrence time as the boundary, the safety behavior segments within the alarm coverage area that occur before the alarm occurrence time are formed into a front candidate sequence, and the safety behavior segments within the alarm coverage area that occur after the alarm occurrence time are formed into a back candidate sequence. For each security behavior segment in the preceding and following candidate sequences, an object attribution quantity is formed based on the attribution relationship between each security behavior segment and the security alarm to be analyzed, and a behavior association quantity is formed based on the behavior inheritance relationship between each security behavior segment and the security alarm to be analyzed. The object attribution quantity and the behavior association quantity are normalized and synthesized into a candidate inheritance quantity. A temporal adjacency quantity is formed based on the temporal adjacency relationship of each safety behavior segment relative to the time of alarm occurrence; In the preceding and following candidate sequences, candidates are first sorted from highest to lowest according to their acceptance volume. If the acceptance volumes are the same, candidates are sorted from highest to lowest according to their temporal adjacency. The first safe behavior segment in each sequence is then determined as the first safe behavior segment and the second safe behavior segment.

[0006] A further technical improvement of the present invention is that the method for forming the reference unit in step two includes: Read the behavior inheritance reference input, match the behavior content corresponding to the first safety behavior segment and the behavior content corresponding to the second safety behavior segment with the behavior inheritance reference input respectively, and form the previous matching result and the next matching result; If the current position matching result and the subsequent position matching result belong to the same behavior succession relationship, and the succession order of the previous position matching result in the behavior succession relationship is earlier than that of the subsequent position matching result, then the succession type corresponding to the behavior succession relationship is determined as the segment succession type. In the same behavior succession relationship, extract the intermediate behavior reference content that is located between the previous matching result and the subsequent matching result in the succession order to form an intermediate behavior reference relationship; According to the succession order in the intermediate behavior reference relationship, the intermediate behavior reference content is configured to the succession position corresponding to the segment interval, forming a reference action unit.

[0007] A further technical improvement of the present invention is that the method for forming the intermediate behavior gap in step two includes: Based on the intermediate behavior reference content in the reference unit, the collected intermediate behavior segments are judged to correspond to the behavior content within the time period corresponding to the segment interval, and the collected intermediate behavior segments that meet the behavior content correspondence judgment are determined as content-corresponding segments. Based on the collection sequence of the corresponding content segments and the succession order in the reference function unit, the sequential succession of the corresponding content segments is determined; When the content segment satisfies the sequential succession judgment, the succession position corresponding to the content segment in the reference unit is marked as covered; When the collected intermediate behavior segment is not identified as the content corresponding segment, or the content corresponding segment does not meet the sequential succession judgment, the corresponding succession position in the reference unit remains uncovered. The intermediate behavior gap quantity is formed based on the degree of occupancy of the uncovered receiving position in the reference action unit.

[0008] A further technical improvement of the present invention is that the method for forming the missing reference unit in step three includes: When the gap in the intermediate behavior is greater than the preset gap threshold, the uncovered state in the reference action unit will be taken as the missing acceptance position. Read the intermediate behavior reference content, the order of succession, and the corresponding position in the fragment interval corresponding to the missing succession position; The continuity of missing acceptance positions is judged according to the acceptance order. Missing acceptance positions with continuous acceptance order are grouped into the same missing acceptance group, and missing acceptance positions whose acceptance order is separated by the acceptance position that is already covered are grouped into different missing acceptance groups. Based on the corresponding positions of each missing connection position in the same missing connection group within the segment interval, a corresponding missing segment is formed. Write the intermediate behavior reference content, succession order, and missing section corresponding to the same missing successor group into the same missing reference unit.

[0009] A further technical improvement of the present invention is that the method for reading and acquiring data from missing reference units in step four includes: For each missing reference unit, based on the missing segment, intermediate behavior reference content, and missing connection position corresponding to the missing reference unit, the following are selected from the data collection capability input: data collection capability content that corresponds to the collection time period of the missing segment, data collection capability content that corresponds to the behavior collection of the intermediate behavior reference content, data collection capability content that corresponds to the coverage of the missing connection position, and data collection capability content that corresponds to the arrival of the collection result of the missing segment. These are then collected into data collection capability segments. Based on the missing segments, the operational states related to acquisition start-up, acquisition interruption, and acquisition resumption in the acquisition capability segments are separated into time periods to form acquisition operation segments; Based on the intermediate behavior reference content and the missing receiving position, the adaptation status related to the range of collectable safe behaviors and the coverage of receiving positions in the collection capability segment is separated to form behavior collection adaptation segment. Based on the missing segments and the arrival time of the acquisition results, the transmission states related to the order of arrival of the acquisition results in the acquisition capability segments are separated to form acquisition transmission segments; The data collection operation segment, behavior data collection adaptation segment, and data collection transmission segment are associated with the same missing reference unit. The data collection operation segment is used to determine the data collection continuity, the behavior data collection adaptation segment is used to determine the behavior adaptation and data collection coverage, and the data collection transmission segment is used to determine the reporting timeliness.

[0010] A further technical improvement of the present invention is that the method for calculating the observability allowable quantity in step four includes: The effective acquisition time period is determined by the time periods corresponding to acquisition start, acquisition interruption and acquisition resumption in the acquisition operation segment. The effective acquisition time period is compared with the missing segment, and the acquisition continuity is formed according to the proportion of the missing segment covered by the effective acquisition time period. The content of safe behaviors that can be collected in the behavior collection adaptation segment is compared with the intermediate behavior reference content, and the degree of behavior adaptation is formed according to the proportion of the intermediate behavior reference content that forms a corresponding relationship in the missing reference unit. The corresponding connection positions that support coverage in the behavior acquisition adaptation segment are compared with the missing connection positions, and the acquisition coverage is formed according to the proportion of the missing connection positions that form a corresponding relationship in the missing reference unit. The arrival time of the acquisition results in the acquisition and transmission segment is compared with the preset reporting allowable time corresponding to the missing segment. The reporting timeliness is formed according to the proportion of the missing take-up position corresponding to the acquisition results that are not later than the preset reporting allowable time in the missing reference unit. The continuity of data collection, the degree of behavioral adaptation, the degree of data collection coverage, and the timeliness of reporting are normalized respectively, and the lowest value after normalization is determined as the observability permit of the missing reference unit.

[0011] A further technical improvement of the present invention is that the method for determining the observability allowable quantity in step four includes: For the same missing reference unit, the degree of continuity of data collection, the degree of behavioral adaptation, the degree of data collection coverage, and the degree of reporting timeliness are used as the set of permitted components; According to the preset lower limit and preset upper limit of each license component in the license component set, each license component is mapped to the same license value range according to the range occupancy relationship, thus forming a normalized license component set; The normalized license component with the lowest value is selected from the set of normalized license components, and the value of the normalized license component with the lowest value is determined as the observability license quantity of the missing reference unit. The collection continuity, behavior adaptation, collection coverage, or reporting timeliness corresponding to the lowest normalized license component is determined as the source of license restriction; when there are multiple lowest normalized license components, the degree corresponding to each of the multiple lowest normalized license components is determined as the source of license restriction. The observability license quantity and the source of the license restriction are associated with and saved with the missing reference unit.

[0012] Compared with the prior art, the present invention has the following beneficial effects: This invention establishes a sequential analysis relationship between preceding and subsequent security behavior segments around the security alarm to be analyzed, enabling the alarm object, behavior content, behavior segment sequence, and intermediate behavior reference content to be organized and compared in the same analysis process. Compared with the method of judging based on a single alarm or a single behavior segment, this method can provide clearer evidence sources and boundaries for the analysis of security event correlations, making it easier to trace the behavior segments on which the correlation was established or not. Furthermore, when intermediate behavioral content is missing, this invention further distinguishes the observable conditions of the missing content by combining the continuity of collection, the collectability of the behavior, the coverage location, and the timeliness of reporting, so that the evidentiary role of the missing content in subsequent analysis matches its collection conditions; for missing content that has observable conditions but is not covered, its inferred filling is restricted; for missing segments that do not have observable conditions, their use as reverse evidence that the behavior did not occur is restricted; thereby, the bias in the use of evidence caused by collection gaps, reporting delays, or insufficient collection scope can be reduced. On the other hand, this invention structurally stores the results of the prohibition of missing evidence, the prohibition of missing evidence, positive behavioral evidence, and the event association status, and can generate an analysis explanation record by the security alarm analysis model. This processing method enables the event association status to be formed by a structured judgment process, rather than being directly determined by the security alarm analysis model, while retaining the ability of the model to explain the evidence content and constraint content. This helps security operations personnel to obtain the basis of the results, the missing processing status, and the boundaries of the use of positive and negative evidence when viewing the alarm analysis results. Attached Figure Description

[0013] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0014] Figure 1 This is a schematic diagram of the method logic of the present invention. Detailed Implementation

[0015] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided.

[0016] Please see Figure 1 As shown, this invention provides a security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, including: Step 1: Read the safety alarms and safety behavior acceptance inputs to be analyzed, form the alarm acceptance range based on the safety alarms to be analyzed, and select the first safety behavior segment and the second safety behavior segment from the alarm acceptance range according to the acceptance relationship and time sequence position, and calculate the segment acceptance quantity and segment interval quantity. Specifically, in this embodiment, the security alarms to be analyzed and the security behavior acceptance inputs are read. The security alarms to be analyzed include alarm identifiers, alarm occurrence times, alarm object identifiers, and alarm behavior content. The security behavior acceptance inputs include several security behavior segments, each of which stores a segment identifier, segment start time, segment end time, behavior object identifier, and behavior content. The security behavior acceptance inputs also include forward acceptance duration, backward acceptance duration, object attribution determination relationship, behavior acceptance determination relationship, adjacency duration, preset acceptance synthesis relationship, segment acceptance quantity synthesis relationship, corresponding values ​​of object attribution results, corresponding values ​​of behavior acceptance results, preset lower and upper limits of values ​​corresponding to object attribution quantity and behavior association quantity, and acceptance value ranges used to form candidate acceptance quantities. Both forward and backward acceptance durations are non-negative time quantities, and neither is simultaneously zero; the adjacency duration is a time quantity greater than zero. Object attribution can be configured as an object attribution table, which stores the correspondence between accounts, hosts, sessions, and network connections. Behavior assignment can be configured as a behavior assignment table, which stores the sequential correspondence between preceding behaviors, triggering behaviors, response behaviors, and subsequent extended behaviors for different alarm types. The object attribution table converts behavior object identifiers and alarm object identifiers into comparable object correspondences, while the behavior assignment table converts behavior content and alarm behavior content into comparable behavior assignment results.

[0017] Centered on the alarm occurrence time, a forward boundary is determined according to the forward acceptance duration, and a backward boundary is determined according to the backward acceptance duration. The time period between the forward and backward boundaries is defined as the alarm acceptance range. Security behavior segments from the security behavior acceptance input are read, and security behavior segments whose time periods from the start to the end of the segment intersect with the alarm acceptance range are retained within the alarm acceptance range. In this embodiment, the alarm acceptance range corresponding to the security alarm to be analyzed includes security behavior segments located before and after the alarm occurrence time.

[0018] For safety behavior segments retained within the alarm acceptance range, they are classified according to the order of their start time, end time, and alarm occurrence time. Safety behavior segments whose end time is no later than the alarm occurrence time and whose start time is earlier than the alarm occurrence time are written into the first candidate sequence; safety behavior segments whose start time is no earlier than the alarm occurrence time and whose end time is later than the alarm occurrence time are written into the second candidate sequence. Safety behavior segments whose start time is earlier than the alarm occurrence time and whose end time is later than the alarm occurrence time, as well as safety behavior segments whose start and end times are both equal to the alarm occurrence time, are not written into the first or second candidate sequences but remain within the alarm acceptance range for subsequent retrieval of collected intermediate behavior segments.

[0019] For each safety behavior segment in the preceding and following candidate sequences, its behavior object identifier is read, and the behavior object identifier and the alarm object identifier of the safety alarm to be analyzed are substituted into the object attribution table for lookup. If there is a corresponding entry in the object attribution table that corresponds to both the behavior object identifier and the alarm object identifier, an object attribution result is formed; if there is no corresponding entry in the object attribution table that corresponds to both the behavior object identifier and the alarm object identifier, an object unattributed result is formed. According to the corresponding value of the object attribution result, the values ​​corresponding to the object attribution result and the object unattributed result are read to obtain the object attribution quantity of the safety behavior segment. The object attribution quantity is a dimensionless value and is associated with and stored with the segment identifier of the safety behavior segment.

[0020] After establishing the object attribution quantity, the behavior content of the same security behavior segment is read, and this behavior content is substituted into the behavior inheritance table along with the alarm behavior content of the security alarm to be analyzed. If a corresponding sequential item exists in the behavior inheritance table, and the behavior content of the security behavior segment belongs to the preceding behavior, triggering behavior, response behavior, or subsequent extended behavior within that sequential item, a behavior inheritance result is formed. If no corresponding sequential item exists in the behavior inheritance table, or the behavior content of the security behavior segment does not fall into the corresponding sequential item, a behavior non-inherited result is formed. Based on the corresponding values ​​of the behavior inheritance result, the values ​​corresponding to the behavior inheritance result and the behavior non-inherited result are read to obtain the behavior association quantity of the security behavior segment. The behavior association quantity is a dimensionless value and is associated with and stored with the segment identifier of the security behavior segment.

[0021] After the object attribution quantity and behavior association quantity are formed, the preset lower and upper limits of the object attribution quantity, as well as the preset lower and upper limits of the behavior association quantity, are read. The preset upper limit of the object attribution quantity is greater than its preset lower limit, and the preset upper limit of the behavior association quantity is greater than its preset lower limit. The lower and upper limits of the acceptance value interval are read, and the upper limit of the acceptance value is made greater than the lower limit. The object attribution quantity is subtracted from the preset lower limit of the object attribution quantity to obtain the object attribution offset. The preset upper limit of the object attribution quantity is subtracted from the preset lower limit of the object attribution quantity to obtain the object attribution value span. The ratio of the object attribution offset to the object attribution value span is multiplied by the span of the acceptance value interval, and then added to the lower limit of the acceptance value to obtain the mapped object attribution quantity. Behavior association quantities are mapped to the same acceptance value interval in the same way to obtain the mapped behavior association quantities.

[0022] The preset assignment relationship stores the occupancy ratios corresponding to object ownership and behavior association. The mapped object ownership is multiplied by its corresponding occupancy ratio to form the object assignment component; the mapped behavior association is multiplied by its corresponding occupancy ratio to form the behavior assignment component; the object assignment component and the behavior assignment component are then added together to form the candidate assignment quantity for the security behavior segment. The candidate assignment quantity is a dimensionless value and is associated with and stored as a segment identifier for the corresponding security behavior segment.

[0023] After candidate adjacency quantities are formed, temporal adjacency quantities are generated for the same security behavior segment. For a security behavior segment in the preceding candidate sequence, the time interval between its end time and the alarm occurrence time is read; for a security behavior segment in the following candidate sequence, the time interval between its start time and the alarm occurrence time is read. This time interval is compared with the adjacency duration; when the time interval is not greater than the adjacency duration, the difference between the adjacency duration and the time interval is calculated first, and then the difference is divided by the adjacency duration to obtain the temporal adjacency quantity; when the time interval is greater than the adjacency duration, the temporal adjacency quantity is set to zero. Both the time interval and the adjacency duration are time quantities, and the temporal adjacency quantity is a dimensionless value, which is associated with and stored with the segment identifier of the corresponding security behavior segment.

[0024] In the leading candidate sequence, security behavior segments are sorted from highest to lowest based on their acceptance count. If the acceptance counts are the same, they are sorted from highest to lowest based on their temporal adjacency. If both the acceptance count and temporal adjacency are the same, they are sorted by segment identifier order, and the security behavior segment at the top of the sorted list is designated as the first security behavior segment. The same sorting method is used in the following candidate sequences, and the security behavior segment at the top of the sorted list is designated as the second security behavior segment. When the segment identifier is a numerical value, the segment identifier order is determined from smallest to largest; when the segment identifier is a character, the segment identifier order is determined according to the character encoding order. The determined first and second security behavior segments are then associated and saved with their respective segment identifiers, segment start times, segment end times, behavior object identifiers, behavior content, candidate acceptance counts, and temporal adjacency counts.

[0025] After determining the first and second security behavior segments, the candidate acceptance quantities associated with each segment are read, and segment acceptance quantities are formed according to the segment acceptance quantity synthesis relationship. In this embodiment, the segment acceptance quantity synthesis relationship is configured as a low-value acceptance rule, which determines the lower value among the candidate acceptance quantities corresponding to the first and second security behavior segments as the segment acceptance quantity. The segment acceptance quantity is associated with and saved for the first and second security behavior segments. The end time of the first security behavior segment and the start time of the second security behavior segment are read, and the time period between them is determined as the segment interval. The segment interval is associated with and saved for the first and second security behavior segments.

[0026] The segment identifiers of the first and second safety behavior segments are associated and saved with the segment interval. Subsequently, when retrieving collected intermediate behavior segments from the alarm coverage range within the time period corresponding to the segment interval, records with the same segment identifier as the first or second safety behavior segment are excluded. The segment coverage is read along with the first and second safety behavior segments when forming the subsequent security event correlation analysis results.

[0027] Step 2: Read the behavior acceptance reference input, match the first safety behavior segment and the second safety behavior segment with the behavior acceptance reference input to form a reference action unit between the two, obtain the collected intermediate behavior segments from the alarm acceptance range within the time period corresponding to the segment interval, and form the intermediate behavior gap quantity by comparing the coverage of the reference action unit with the collected intermediate behavior segments. Specifically, taking advantage of the first security behavior segment, second security behavior segment, segment acceptance quantity, segment interval quantity, and alarm acceptance range already formed and associated and saved in the aforementioned embodiments, this step reads the behavior acceptance reference input. The behavior acceptance reference input includes several behavior acceptance relationships. Each behavior acceptance relationship stores an acceptance relationship identifier, acceptance type, and behavior reference items arranged in the acceptance order. Each behavior reference item stores behavior reference content, acceptance order position, and corresponding conditions for the behavior content. Both the behavior content and the behavior reference content include a behavior name, behavior object type, and behavior action type. The corresponding conditions for the behavior content store conditions for consistency in behavior name, consistency in behavior object type, and consistency in behavior action type. The behavior acceptance reference input can be pre-formed from security incident handling rules, attack behavior chain configurations, or behavior sequence records in historical confirmed events.

[0028] After reading the behavior content of the first safety behavior segment, it is matched against the behavior reference items in the behavior succession reference input. During matching, the behavior name, behavior object type, and behavior action type in the behavior content and the behavior reference content are compared. When the behavior name, behavior object type, and behavior action type matching conditions stored in the behavior content's corresponding conditions are all met, the behavior reference item is used as the matching item for the first safety behavior segment, forming the preceding matching result. The preceding matching result stores the succession relationship identifier, succession type, succession order position, and the corresponding behavior reference content. The second safety behavior segment is matched against the behavior succession reference input in the same way, forming the following matching result.

[0029] If the first safety behavior segment fails to form a preceding match result, or the second safety behavior segment fails to form a following match result, the reference action unit is set as an empty record, and a "match not formed" marker is stored in this empty record. Simultaneously, the intermediate behavior gap is set to zero. When the reference action unit is set as an empty record, this empty record is associated with and stored with the intermediate behavior gap; subsequent steps treat the intermediate behavior gap as zero and do not form missing segments or missing reference units based on this empty record. When the same safety behavior segment can match multiple behavior reference items, behavior reference items whose behavior content matches the behavior name, behavior object type, and behavior action type in the behavior reference content are retained first. If multiple matching items still exist, they are first sorted according to the order of the succession relationship identifier, then sorted according to the position of the succession order. If the succession relationship identifier is a numerical value, the order is determined by ascending numerical values; if the succession relationship identifier is a character, the order is determined by the character encoding order. The behavior reference item at the top of the sorted list is retained, ensuring that the preceding and following match results have a unique corresponding content.

[0030] After the preceding and following matching results are formed, the corresponding inheritance relationship identifiers and inheritance order positions are read. If they belong to the same inheritance relationship identifier, and the inheritance order position of the preceding matching result is earlier than that of the following matching result, the behavior inheritance relationship corresponding to this inheritance relationship identifier is determined as the same behavior inheritance relationship between the first and second safe behavior segments, and the inheritance type in this behavior inheritance relationship is determined as the segment inheritance type. If they do not belong to the same inheritance relationship identifier, or the inheritance order position of the preceding matching result is not earlier than that of the following matching result, the reference action unit is formed as an empty record, and a mark indicating that the inheritance relationship is not established is stored in the empty record. At the same time, the intermediate behavior gap is determined to be zero; subsequent steps will treat the intermediate behavior gap as a zero value and will not form missing segments and missing reference units based on this empty record.

[0031] In a defined sequence of actions, the action reference items whose sequence order is between the preceding and following matching results are read. The action reference content within these items is identified as intermediate action reference content, and intermediate action reference relationships are formed from first to last according to the sequence order. The intermediate action reference relationship stores the segment sequence type, intermediate action reference content, and its sequence order. If no intermediate action reference content exists between the preceding and following matching results, the reference unit is set as an empty record, and an empty intermediate reference marker is stored in this empty record. Simultaneously, the intermediate action gap is set to zero. Subsequent steps treat this intermediate action gap as zero and do not form missing segments or missing reference units based on this empty record. If intermediate action reference content exists, the sequence position is configured according to the segment interval.

[0032] The starting point of the segment interval is the end time of the first safety behavior segment, and the ending point is the start time of the second safety behavior segment. Based on the number of intermediate behavior reference contents, the segment interval is divided into consecutive succession positions corresponding to the number of positions, and each succession position is mapped one-to-one with the succession order position in the intermediate behavior reference relationship according to chronological order. Each succession position stores the position order, position start and end times, intermediate behavior reference content, succession order position, and coverage status; the initial value of the coverage status is uncovered. These succession positions and their corresponding intermediate behavior reference contents form a reference action unit, which is associated and stored with the first safety behavior segment, the second safety behavior segment, the segment succession type, and the segment interval.

[0033] In this embodiment, if the behavior continuation reference input stores the occupancy ratio of the continuation position corresponding to the intermediate behavior reference content, then the occupancy ratio of the continuation position corresponding to each intermediate behavior reference content is read, and the segment interval is divided into the corresponding start and end times according to the proportion of each continuation position occupancy ratio in the sum of all continuation position occupancy ratios; if the sum of all continuation position occupancy ratios is zero, or if the behavior continuation reference input does not store the continuation position occupancy ratio, then equal-length continuation positions are configured according to the number of intermediate behavior reference content. This process does not change the one-to-one correspondence between intermediate behavior reference content and continuation order position.

[0034] Within the time period corresponding to the segment interval, the collected intermediate behavior segments are retrieved from the alarm acceptance range. During retrieval, the safety behavior segments retained within the alarm acceptance range are read, and records with the same segment identifier as the first or second safety behavior segment are excluded. Among the remaining safety behavior segments, those whose time period from the segment's start time to its end time intersects with the segment interval are identified as collected intermediate behavior segments. When a collected intermediate behavior segment is a continuous behavior segment, its inclusion in the corresponding acceptance location is determined by whether its coverage time period intersects with the start and end times of the acceptance location. When a collected intermediate behavior segment is an instantaneous behavior segment, its acquisition time is determined by whether it falls within the start and end times of the corresponding acceptance location. The segment's start time is used as the acquisition sequence determination time for collected intermediate behavior segments. When multiple collected intermediate behavior segments have the same start time, the acquisition sequence is determined according to the segment identifier order.

[0035] After the collected intermediate behavior segments are formed, the behavior content is determined based on the intermediate behavior reference content in the reference unit. The intermediate behavior reference content is read in the order of the receiving positions in the reference unit, and the behavior content of the collected intermediate behavior segments is substituted into the corresponding behavior content correspondence conditions for comparison. Collected intermediate behavior segments that meet the correspondence conditions and fall into the corresponding receiving position are considered as the content corresponding segments for that receiving position. When multiple content corresponding segments exist for the same receiving position, they are read in the order of collection time from earliest to latest. Collected intermediate behavior segments that do not meet the behavior content correspondence conditions or do not fall into the corresponding receiving position are not considered as the content corresponding segments for that receiving position, and the coverage status in the reference unit is not updated.

[0036] Continue to determine the sequential connection of content segments. Read each connection position from first to last according to the connection order. If a content segment exists at the current connection position, read the corresponding content segment sequentially according to the acquisition time sequence. For the first connection position, if the read content segment falls within the start and end times of that connection position, update the coverage status of that connection position from uncovered to covered. For non-first connection positions, first search for connection positions preceding the current connection position that are already covered. If a previous covered connection position exists, use the acquisition time of the content segment corresponding to that previous covered connection position as the sequence reference time. If no previous covered connection position exists, use the start time of the segment interval as the sequence reference time. If the acquisition time of the read content segment is not earlier than the sequence reference time, and the content segment falls within the start and end times of the current connection position, update the coverage status of the current connection position from uncovered to covered. The content fragment that has already been used to update the coverage status of a certain successor position will no longer be used to update the coverage status of other successor positions; if there is no content fragment corresponding to the current successor position, or if none of the corresponding content fragments meet the sequential succession judgment, the coverage status of the successor position will remain uncovered.

[0037] After determining the coverage status of each receiving position in the reference unit, the receiving positions in the uncovered state are read, and the intermediate behavior gap quantity is formed based on the occupancy degree of the uncovered receiving positions in the reference unit. In this embodiment, the time length corresponding to the receiving position is preferentially used as the receiving position occupancy quantity. The occupancy quantities of the uncovered receiving positions are added together to obtain the uncovered occupancy quantity, and the occupancy quantities of all receiving positions in the reference unit are added together to obtain the total reference occupancy quantity. When the total reference occupancy quantity is greater than zero, the ratio of the uncovered occupancy quantity to the total reference occupancy quantity is determined as the intermediate behavior gap quantity. When the total reference occupancy quantity is equal to zero, the number of receiving positions is used as the occupancy quantity, and the ratio of the number of uncovered receiving positions to the total number of receiving positions in the reference unit is determined as the intermediate behavior gap quantity. The intermediate behavior gap quantity is associated and saved with the reference unit, the segment interval quantity, and the collected intermediate behavior segments for subsequent determination of whether missing segments and missing reference units need to be formed.

[0038] Step 3: When the gap amount of intermediate behavior is greater than the preset gap threshold, determine the missing segment based on the uncovered receiving position in the reference action unit, and write the uncovered receiving position in the reference action unit and its corresponding intermediate behavior reference content into the missing reference unit. Specifically, this step first reads the record status of the reference action unit. When the reference action unit is an empty record, the gap threshold table is not read, no missing segment or missing reference unit is formed, and the missing non-triggered flag is associated with and saved with the reference action unit. When the reference action unit is a non-empty record, the gap amount of the intermediate row is read, and the preset gap threshold used for comparison with the gap amount of the intermediate row is read.

[0039] The behavior acceptance reference input pre-stores a gap threshold table. Each record in the gap threshold table includes the acceptance type, the range of acceptance location quantity, the number of historical samples, the preset quantile ratio, and the preset gap threshold. The number of historical samples is the number of historical confirmed security event samples used to form this record. The preset quantile ratio is a value greater than 0 and not greater than 1. In this embodiment, it is set to 0.8, which is used to determine the reading order after sorting the historical gap quantities.

[0040] The gap threshold table is formed from historically confirmed security event samples before this method is executed. These samples are read from historical alarm handling records, which store alarm identifiers, security event identifiers, handling confirmation results, and security behavior segments associated with those security event identifiers. Historical alarm handling records where the handling confirmation result indicates a security event are read, and security behavior segments under the same security event identifier that occur before and after the alarm, as well as the collected intermediate behavior segments between them, are used as historically confirmed security event samples. These samples include the preceding and following security behavior segments that have been confirmed to belong to the same security event, as well as the collected intermediate behavior segments between them.

[0041] For the same type of acceptance, the preceding security behavior segments, subsequent security behavior segments, and collected intermediate behavior segments in the historical confirmed security event samples are read. Following the same method used in the aforementioned embodiments to form reference action units and intermediate behavior gap quantities, the historical reference action units and historical gap quantities corresponding to the historical confirmed security event sample are formed. If a historical confirmed security event sample results in an empty record when forming a historical reference action unit, or if it does not form a segment acceptance type, total number of acceptance positions, or historical gap quantity, then the historical confirmed security event sample is not written into the statistical set of the gap threshold table, and no corresponding gap threshold record is generated.

[0042] When the historical reference unit is a non-empty record, the total number of its receiving positions is read, and the historical gap is calculated. When all receiving positions in the historical reference unit are occupied with equal length, the historical gap is the ratio of the number of uncovered receiving positions to the total number of receiving positions. When all receiving positions in the historical reference unit are occupied according to a ratio, the historical gap is the ratio of the number of uncovered receiving positions to the total number of receiving positions. The historical gap and the intermediate behavior gap are within the same dimensionless value range.

[0043] The range of acceptance locations is formed based on the total number of acceptance locations in the historical reference units. Under the same acceptance type, historical reference units with the same total number of acceptance locations are grouped into the same range of acceptance locations, with both the lower and upper limits of this range being the total number of acceptance locations. Historical gaps of the same acceptance type whose total number of acceptance locations falls within the same range are sorted from smallest to largest, and the reading order is determined according to a preset quantile ratio; the reading order is the rounded-up value of the product of the historical sample count and the preset quantile ratio. The historical gap count corresponding to this reading order is read and determined as the preset gap threshold for that acceptance type and that range of acceptance locations. If there are no historical confirmed security event samples that can be written into the gap threshold table under the same acceptance type, the preset gap threshold for that acceptance type is set to zero.

[0044] When a missing segment needs to be determined in the current reference unit, the segment continuation type and the total number of continuation positions associated with that reference unit are read. A record with the same continuation type and a total number of continuation positions falling within the corresponding continuation position range is searched in the gap threshold table, and the preset gap threshold in that record is read. If no corresponding record is found, the preset gap threshold for the current reference unit is set to zero. The preset gap threshold is used to compare with the current intermediate behavior gap amount. When the intermediate behavior gap amount is not greater than the preset gap threshold, no missing segment or missing reference unit is formed, and the missing non-triggered marker is associated with and saved to the reference unit. When the intermediate behavior gap amount is greater than the preset gap threshold, missing continuation positions, missing continuation groups, missing segments, and missing reference units are formed for the uncovered parts in the reference unit.

[0045] When the gap in intermediate behavior exceeds a preset gap threshold, the coverage status of each receiving position in the reference unit is read, and the receiving positions with an uncovered coverage status are identified as missing receiving positions. The missing receiving position inherits the position order, start and end times, intermediate behavior reference content, and receiving order position already saved in the reference unit. Specifically, the start and end times indicate the corresponding position of the missing receiving position within the segment interval, the receiving order position is used to subsequently determine whether adjacent missing content is continuous, and the intermediate behavior reference content serves as the source of content written into the missing reference unit.

[0046] After determining the missing continuation positions, each missing continuation position is read from first to last according to the continuation order. When the first missing continuation position is read, the current missing continuation group is formed, and the missing continuation position is written into the current missing continuation group. When reading the next missing continuation position, its continuation order position is compared with the continuation order position of the last missing continuation position in the current missing continuation group; if the two continuation order positions are consecutive, the next missing continuation position is written into the current missing continuation group. If the two continuation order positions are not consecutive, the current missing continuation group is terminated, and a new missing continuation group is formed with the next missing continuation position. Each missing continuation group saves the continuation order position, position order, start and end times of the position, and corresponding intermediate behavior reference content of the missing continuation positions within the group.

[0047] After a missing successor group is formed, a missing segment is created based on the corresponding position of the missing successor position within the group in the segment interval. The start time of the earliest successor position in the same missing successor group is read as the starting point of the missing segment; the end time of the latest successor position is read as the ending point of the missing segment. The time interval from the starting point to the ending point is determined as the missing segment corresponding to that missing successor group. If a missing successor group includes only one missing successor position, the missing segment is directly formed using the start and end times of that missing successor position.

[0048] After the missing segment is formed, the missing connection positions corresponding to the same missing connection group, the intermediate behavior reference content corresponding to each missing connection position, the connection order position corresponding to each missing connection position, and the missing segment are written into the same missing reference unit. The missing reference unit is then associated and saved with the reference action unit, the segment interval, and the intermediate behavior gap. The missing reference unit formed in this way records the part in the reference action unit that is not covered by the collected intermediate behavior segments and is continuous in the connection order; the uncovered content separated by covered connection positions is written into different missing reference units.

[0049] Step 4: For the missing reference unit in the missing segment, read the acquisition capability input, calculate the acquisition continuity, behavior adaptation, acquisition coverage and reporting timeliness, determine the lowest value after normalization of the four as the observability permission quantity, and compare the observability permission quantity with the preset observability threshold to form observable missing result or unobservable missing result. Specifically, building upon the missing reference units, missing segments, missing connection positions, intermediate behavior reference content, and connection order positions already established in the aforementioned embodiments, this step reads the acquisition capability input for each missing reference unit to determine whether the missing content corresponding to that missing reference unit has observable conditions within the missing segment. If no missing reference unit was formed in the aforementioned embodiments, the acquisition capability input is not read, and no observability permit is formed.

[0050] This step processes a single missing reference unit, without re-evaluating whether the receiving location is covered or re-forming the missing segment. The acquisition capability input consists of the acquisition source configuration record, acquisition operation record, and acquisition result reporting record. The acquisition source configuration record determines the effective period of the acquisition source configuration, the collectable content of safe behaviors, the coverage location, and the allowed reporting duration; the acquisition operation record determines the activation, interruption, and resumption of the acquisition source; and the acquisition result reporting record determines the time of acquisition result generation and arrival. After being filtered by acquisition period, compared by behavior content, compared by receiving location, and compared by arrival time, the acquisition capability input forms the acquisition capability segment corresponding to the current missing reference unit.

[0051] For the currently missing reference unit, its missing segment is read, and the time range for the acquisition capability input is limited by the missing segment. The effective time period of the configuration in the acquisition source configuration record is read, and the intersection of the effective time period and the missing segment is compared. If there is an intersection, the acquisition source configuration record is retained, and the retained acquisition source configuration record is determined as a candidate acquisition configuration. If there is no intersection, the acquisition source configuration record is not included in the observability determination of the current missing reference unit. The candidate acquisition configuration refers to the acquisition source configuration record that can still be used for the determination of the current missing reference unit after being filtered by the missing segment time period.

[0052] After the candidate collection configuration is formed, the intermediate behavior reference content in the currently missing reference unit is read and compared with the safe behavior collectable content in the candidate collection configuration. Both the intermediate behavior reference content and the safe behavior collectable content include behavior name, behavior object type, and behavior action type. When all three items are consistent, the safe behavior collectable content is determined as supported collection content, and a behavior collection correspondence is formed between the candidate collection configuration and the intermediate behavior reference content; when any of the three items are inconsistent, no behavior collection correspondence is formed, and the corresponding intermediate behavior reference content is retained as uncorresponding.

[0053] Subsequently, the missing take-up position in the current missing reference unit is read, and a set of missing position identifiers for coverage comparison is formed. The reference action unit associated with the missing reference unit to which the missing take-up position belongs is read, along with the first security behavior segment, the second security behavior segment, and the security alarm to be analyzed associated with that reference action unit. The behavior object identifiers of the first security behavior segment, the second security behavior segment, and the alarm object identifier of the security alarm to be analyzed are read, and these object identifiers are substituted into the object attribution table in the aforementioned embodiment for lookup. If the object attribution table contains an object, session, host, or network connection record corresponding to the behavior object type of the intermediate behavior reference content, the object identifier, session identifier, host identifier, or network connection identifier in that record is read and written into the missing position identifier set of the missing take-up position.

[0054] If no corresponding record is found in the object attribution table, the object type corresponding to the alarm object identifier in the security alarm to be analyzed is read. If the object type corresponding to the alarm object identifier is object, session, host, or network connection, the alarm object identifier is written into the missing location identifier set as the object identifier, session identifier, host identifier, or network connection identifier, respectively; if no object type corresponding to the alarm object identifier is read, the alarm object identifier is written into the missing location identifier set as the object identifier.

[0055] The coverage location in the candidate collection configuration stores the coverage object identifier, coverage session identifier, coverage host identifier, or coverage network connection identifier. The same identifier in the coverage location is compared with the set of missing location identifiers; if a matching identifier exists, the coverage location is determined as a supported coverage location, and a coverage correspondence is established between the candidate collection configuration and the missing location; if no matching identifier exists, no coverage correspondence is established, and the uncovered status of the missing location is retained.

[0056] After completing the comparison of the collection period, behavior content, and receiving location, the collection result reporting record is read and mapped to the current missing reference unit. The collection result reporting record saves the collection source identifier, collection behavior content, collection object location, collection result generation time, and collection result arrival time. During mapping, the collection source identifier in the collection result reporting record is compared with the collection source identifier in the candidate collection configuration; if they match, the collection behavior content is further compared with the intermediate behavior reference content in the current missing reference unit; if the behavior name, behavior object type, and behavior action type of the collection behavior content all match a certain intermediate behavior reference content, a content mapping is established between the collection result reporting record and the intermediate behavior reference content. The collection object location is further compared with the missing location identifier set; if any similar identifier among the object identifier, session identifier, host identifier, or network connection identifier in the collection object location matches a similar identifier in the missing location identifier set, a location mapping is established between the collection result reporting record and the corresponding missing receiving location. If the time of data collection results generation falls within the missing segment, and simultaneously forms a consistent data source identifier, content mapping, and location mapping, the data collection result reporting record is written into the data collection capability segment corresponding to the current missing reference unit; if the above conditions are not met simultaneously, the data collection capability segment is not written.

[0057] The candidate acquisition configuration, the corresponding acquisition operation record, and the already written acquisition result reporting record together form the acquisition capability segment corresponding to the currently missing reference unit. The corresponding acquisition operation record is identified by the acquisition source identifier: read the acquisition operation record whose acquisition source identifier matches the candidate acquisition configuration, and read the most recent acquisition operation status record before the start of the missing segment, as well as the acquisition start record, acquisition interruption record, and acquisition recovery record within the missing segment. This acquisition capability segment is used to subsequently form the acquisition operation segment, behavior acquisition adaptation segment, and acquisition transmission segment, respectively.

[0058] After the data acquisition capability segment is formed, a data acquisition operation segment is created based on the missing segment, the effective time period of the candidate data acquisition configuration, and the data acquisition operation record. For the same data acquisition source, the effective time period of its corresponding candidate data acquisition configuration is read, and the intersection of the effective time period and the missing segment is determined as the available time period. If the available time period is empty, no start data acquisition time period is formed for that data acquisition source. If the available time period is not empty, the most recent data acquisition operation status record of that data acquisition source before the start of the missing segment, as well as the data acquisition start record, data acquisition interruption record, and data acquisition recovery record within the missing segment, are read.

[0059] If the most recent data collection status record before the start of the missing segment is in an "on" state, the start of the missing segment is used as the reference time for starting operation. If a data collection start record is read within the missing segment, the start time in that record is used as the reference time for starting operation. Data collection interruption records after the reference time are read. If an interruption record exists, the period between the reference time and the interruption time is defined as the start operation period. If no subsequent interruption record is read, the period between the reference time and the end of the missing segment is defined as the start operation period. Data collection recovery records after interruption records are read. If a recovery record exists, the period between the interruption time and the recovery time is defined as the recovery operation period. If no recovery record is read, the period between the interruption time and the end of the missing segment is defined as the recovery operation period. If a next interruption record exists after the recovery time, the period between the recovery time and the next interruption time is defined as the start operation period. If no next interruption record exists after the recovery time, the period between the recovery time and the end of the missing segment is defined as the start operation period.

[0060] The intersection of the enabled runtime segment and the configured available time segment is determined as the enabled data collection period, and the intersection of the interrupted runtime segment and the configured available time segment is determined as the interrupted data collection period. The data collection source identifier, the configured available time segment, the enabled data collection period, and the interrupted data collection period are written into the data collection runtime segment. The data collection runtime segment is used to determine the continuity of data collection.

[0061] For the same data collection capability segment, a behavior collection adaptation segment is formed based on intermediate behavior reference content and missing continuation positions. The security behavior data collection content that has already formed a behavior collection correspondence is read and written as supporting data collection content; the coverage positions that have already formed a coverage correspondence are read and written as supporting coverage positions. The supporting data collection content and supporting coverage positions together constitute the behavior collection adaptation segment; the supporting data collection content is used to calculate the behavior adaptation degree, and the supporting coverage positions are used to calculate the collection coverage degree.

[0062] For the same data acquisition capability segment, acquisition transmission segments are formed based on missing sections and the order in which acquisition results arrive. The acquisition result reporting records already written into the acquisition capability segment are read, along with the generation and arrival times of the acquisition results. The acquisition source configuration record stores a reporting allowable duration table. Each record in the reporting allowable duration table includes an acquisition source identifier, a security behavior content identifier, and a reporting allowable duration. The security behavior content identifier is formed by combining the behavior name, behavior object type, and behavior action type. The reporting allowable duration is a time quantity greater than zero, in seconds. For the same acquisition result reporting record, its acquisition source identifier and acquisition behavior content are read, and a security behavior content identifier is formed based on the acquisition behavior content. A record with both the same acquisition source identifier and the same security behavior content identifier is searched in the reporting allowable duration table, and the reporting allowable duration in that record is read as the preset reporting allowable duration. If no record with the same security behavior content identifier is found, the default reporting allowable duration corresponding to that acquisition source identifier is read. If the default reporting allowable duration is still not read, the unified reporting allowable duration stored in the acquisition capability input is read. Add the preset reporting allowance duration to the time when the data collection result is generated to form the preset reporting allowance time. Write the time when the data collection result is generated, the time when the data collection result arrives, the preset reporting allowance time, the intermediate behavior reference content corresponding to the content mapping, and the missing continuation position corresponding to the location mapping into the data collection and transmission segment.

[0063] After the data acquisition segment is formed, the continuity of the acquisition is calculated. The start and interruption periods of the acquisition segment are read, and the remaining portion of the start period after deducting the interruption period is determined as a candidate valid acquisition period. When candidate valid acquisition periods from multiple acquisition sources overlap, each candidate valid acquisition period is first trimmed to the missing segment, and then the overlapping portions are merged according to time sequence, with the overlapping portion counted only once, to obtain the valid acquisition period. The valid acquisition period is compared with the missing segment to obtain the duration of the valid acquisition period covering the missing segment; this coverage duration is then divided by the total duration of the missing segment to form the acquisition continuity. When the total duration of the missing segment is zero, the acquisition continuity is determined to be zero. The acquisition continuity is a dimensionless value.

[0064] The behavior fit degree is formed based on the supporting content to be collected in the behavior collection fit segment. Each intermediate behavior reference content in the currently missing reference unit is read, and the supporting content to be collected is compared with each intermediate behavior reference content one by one; the intermediate behavior reference content that forms a behavior collection correspondence is recorded as collectable content. The number of collectable content is divided by the total number of intermediate behavior reference content to form the behavior fit degree. When the total number of intermediate behavior reference content is zero, the behavior fit degree is set to zero. The behavior fit degree is a dimensionless value.

[0065] The acquisition coverage is determined based on the supporting coverage positions in the behavior acquisition adaptation segment. Each missing position in the current missing reference unit is read, and each supporting coverage position is compared with a missing position; missing positions that form a coverage correspondence are recorded as coverable positions. The number of coverable positions is divided by the total number of missing positions to determine the acquisition coverage. When the total number of missing positions is zero, the acquisition coverage is set to zero. The acquisition coverage is a dimensionless value.

[0066] The reporting timeliness is determined based on the arrival time of the acquisition results in the acquisition and transmission segment. For each missing catchment location, the acquisition result reporting records that form a location mapping with that missing catchment location are read, and the arrival time of the acquisition results and the preset allowable reporting time are read from each record. If at least one acquisition result reporting record has an arrival time no later than the corresponding preset allowable reporting time, the missing catchment location is recorded as a timely reporting location. The same missing catchment location is counted as a timely reporting location only once. If all acquisition result reporting records that form a location mapping with that missing catchment location are later than the corresponding preset allowable reporting time, or if no corresponding acquisition result reporting record is read, then the missing catchment location is not recorded as a timely reporting location. The number of timely reporting locations is divided by the total number of missing catchment locations to form the reporting timeliness. If the total number of missing catchment locations is zero, or if no acquisition result arrival time is read in the acquisition and transmission segment, the reporting timeliness is determined to be zero. The reporting timeliness is a dimensionless value.

[0067] After the continuity of data collection, the degree of behavioral adaptation, the degree of data collection coverage, and the timeliness of reporting are determined, these four factors are used as the set of permitted components for the currently missing reference unit. All four permitted components are proportional values, with a preset lower limit of 0 and a preset upper limit of 1 for each. The lower limit of the permitted value range is 0, and the upper limit is 1. For any permitted component, the difference between subtracting the corresponding preset lower limit and dividing by the difference between the preset upper and lower limits yields the normalized result for that permitted component. The four normalized results form the set of normalized permitted components.

[0068] The lowest value among the normalized license components is selected and identified as the observability license quantity for the currently missing reference unit. If the lowest value corresponds to collection continuity, collection continuity is identified as the source of the license restriction; if it corresponds to behavior adaptation, behavior adaptation is identified as the source of the license restriction; if it corresponds to collection coverage, collection coverage is identified as the source of the license restriction; if it corresponds to reporting timeliness, reporting timeliness is identified as the source of the license restriction. If multiple lowest value normalized license components exist, the corresponding degree quantities for these normalized license components are all identified as sources of license restrictions. The observability license quantity and the source of the license restriction are associated and stored with the currently missing reference unit.

[0069] A preset observability threshold is used to compare with the observability allowable quantity, and the comparison result determines whether the result is observable or unobservable. The observability threshold table is stored in the acquisition capability input. Each record in the observability threshold table includes the segment continuation type, the number of historical samples, the allowable quantile ratio, and the preset observability threshold. The allowable quantile ratio is a value greater than 0 and not greater than 1, and is pre-saved along with the observability threshold table. It is used to determine the reading order after sorting the historical observability allowable quantities corresponding to the same segment continuation type.

[0070] The observability threshold table is formed from historical missing data samples before this method is executed. These samples are read from historical alarm handling records, which store the security event identifier, missing reference unit, data acquisition capability input, manual confirmation result, and handling confirmation result. Historical alarm handling records where the handling confirmation result indicates a security event has occurred, and the manual confirmation result indicates that the corresponding missing reference unit can be used as the basis for missing data determination, are used as historical missing data samples. Manual confirmation results are only used to screen historical missing data samples before this method is executed; they do not participate in the calculation of the observability allowable quantity of the current missing reference unit, nor do they participate in the formation of the current observable or unobservable missing results.

[0071] For the same segment type, following the same method used in this step to determine the continuity of data collection, behavioral adaptation, data collection coverage, reporting timeliness, and observability allowance, calculate the historical observability allowance corresponding to the historical missing data determination samples. Sort the historical observability allowances under the same segment type from smallest to largest, and determine the reading order according to the allowance quantile ratio; the reading order is the rounded-up value of the product of the number of historical samples and the allowance quantile ratio. Read the historical observability allowance corresponding to this reading order and determine it as the preset observability threshold for that segment type. If there are no historical missing data determination samples under the same segment type, determine the midpoint of the allowance value range as the preset observability threshold for that segment type.

[0072] When the observability of a missing reference unit needs to be determined, the reference unit associated with the missing reference unit is read. Based on the segment continuation type associated with that reference unit, a record with the same segment continuation type is searched in the observability threshold table, and the preset observability threshold in that record is read. If no corresponding record is found, the midpoint of the permitted value range is determined as the preset observability threshold. The observability permitted value is compared with the preset observability threshold. If the observability permitted value is not less than the preset observability threshold, an observable missing result is formed, and this result is associated with and saved to the current missing reference unit. If the observability permitted value is less than the preset observability threshold, an unobservable missing result is formed, and this result is associated with and saved to the current missing reference unit. Subsequent steps, after reading the observable or unobservable missing result, execute either fill-in prohibition or missing proof disabling, respectively.

[0073] Step 5: When the observability determination result is an observable missing result, perform fill-in prohibition on the missing reference unit and form a fill-in prohibition result; when the observability determination result is an unobservable missing result, perform missing proof of contradiction prohibition on the missing segment and form a missing proof of contradiction prohibition result, and output the security event correlation analysis result. Specifically, this step reads the observability determination result generated in step four, and performs a fill-in prohibition on missing reference units or a missing proof disabling on missing segments based on the observability determination result. Then, it outputs the security event correlation analysis result. The observability determination result includes observable missing results and unobservable missing results.

[0074] This step does not regenerate missing reference units, re-separate data acquisition capability segments, or recalculate data acquisition continuity, behavior adaptation, data acquisition coverage, reporting timeliness, or observability limits. For missing reference units that have already generated observable or unobservable missing results in the aforementioned embodiments, the associated and saved missing segments, missing connection positions, intermediate behavior reference content, connection order positions, observability limits, and sources of restriction are directly read as inputs for this step to perform fill-in prohibition or missing evidence disabling. If the missing reference unit has saved a missing reference unit identifier, the missing reference unit identifier is read; if the missing reference unit has not saved a missing reference unit identifier, the alarm identifier of the security alarm to be analyzed, the start point of the missing segment, the end point of the missing segment, and the earliest connection position in the connection order of the missing reference unit are read. The above content is combined to form the current missing reference unit identifier and associated with and saved with the missing reference unit.

[0075] This step first establishes a sequence of prohibited fill-in results and a sequence of prohibited missing evidence results, and initially sets both to empty sequences. If a missing reference unit has already been formed in the aforementioned embodiments, it is read from the beginning of the segment in the fragment interval; if the segment beginnings are the same, it is read from the order of sequence in the missing reference units. If only one missing reference unit is formed, it is read according to the same reading rule. For each missing reference unit read, the observability determination result associated with that missing reference unit is read, and a corresponding prohibited fill-in result or prohibited missing evidence result is formed based on the observability determination result; when a prohibited fill-in result is formed, it is written into the prohibited fill-in result sequence; when a prohibited missing evidence result is formed, it is written into the prohibited missing evidence result sequence. If no missing reference unit is formed in the aforementioned embodiments, but a missing non-triggered flag is formed, the prohibited fill-in result sequence and the prohibited missing evidence result sequence remain empty sequences.

[0076] For missing reference units where observable missing results are read, fill-in is prohibited. Specifically, the intermediate behavior reference content, missing continuation position, continuation order position, and missing segment in the missing reference unit are read. A fill-in status field is written into the missing reference unit, and the fill-in status field is set to "fill-in prohibited". After the fill-in status field is set to "fill-in prohibited", the intermediate behavior reference content corresponding to the missing reference unit is not extracted from the behavior continuation reference input as a speculative fill-in behavior fragment, the intermediate behavior reference content is not written into the collected intermediate behavior fragment, no fill-in fragment identifier is generated to replace the missing reference unit, and the filled behavior chain is not used as positive behavior evidence.

[0077] After the completion prohibition is executed, a completion prohibition result is generated. The completion prohibition result saves the missing reference unit identifier, missing segment, missing successor position, intermediate behavior reference content, successor order position, observability permission quantity, permission restriction source, and completion prohibition flag. The completion prohibition flag is used to mask the speculative completion content corresponding to the missing reference unit when forming subsequent security event correlation analysis results.

[0078] For missing reference units where unobservable missing results are read, a missing evidence disabling procedure is performed. Specifically, the missing segment, missing continuation position, intermediate behavior reference content, observability permission quantity, and permission restriction source corresponding to the missing reference unit are read. A disproving evidence usage status field corresponding to the missing segment is written into the missing reference unit, and this field is set to disabled. After the disproving evidence usage status field is disabled, a missing evidence disproving record corresponding to the missing segment is not generated, the missing segment is not used as reverse evidence that the corresponding intermediate behavior did not occur, and the correlation between the first security behavior segment, the second security behavior segment, and the security alarm to be analyzed is not weakened based on the missing segment.

[0079] After the "Disable Missing Evidence" action is executed, a "Disable Missing Evidence" result is generated. This result stores the missing reference unit identifier, the missing segment, the missing continuation position, the intermediate behavior reference content, the observability permission quantity, the permission restriction source, and the disproving evidence flag. The disproving evidence flag is used to mask the missing evidence corresponding to the missing segment when subsequently forming security event correlation analysis results.

[0080] After forming the sequence of prohibited results for filling gaps and the sequence of prohibited results for missing evidence, the following are read: the security alarm to be analyzed, the first security behavior segment, the second security behavior segment, the segment acceptance quantity, and the segment interval quantity. The recording status of the reference action unit is also read. When the reference action unit is a non-empty record, the covered acceptance positions and the collected intermediate behavior segments are read. When the reference action unit is an empty record, the covered acceptance positions and the collected intermediate behavior segments are set to empty sequences. A positive behavioral evidence set is formed from the security alarm to be analyzed, the first security behavior segment, the second security behavior segment, the segment acceptance quantity, the segment interval quantity, the reference action unit, the covered acceptance positions, and the collected intermediate behavior segments. The positive behavioral evidence set stores the object attribution quantity, behavioral correlation quantity, candidate acceptance quantity, and segment acceptance quantity between the security alarm to be analyzed and the first and second security behavior segments, and also stores the coverage status of the collected intermediate behavior segments over the acceptance positions in the reference action unit.

[0081] Read the sequence of prohibited fill-in results. If the prohibited fill-in result sequence is empty, set the fill-in constraint set to empty; if the prohibited fill-in result sequence is not empty, write the missing reference unit identifier, missing segment, intermediate behavior reference content, succession order position, and prohibited fill-in flag into the fill-in constraint set. The fill-in constraint set is used to record intermediate behavior reference content that must not be used as fill-in for segments of intermediate behavior that have already occurred.

[0082] Read the sequence of missing evidence-refutable results. If the sequence is empty, set the set of evidence-refutable constraints to empty; if it is not empty, write the missing reference unit identifier, missing section, intermediate action reference content, restricted source of permission, and evidence-refutable flag into the set of evidence-refutable constraints. The set of evidence-refutable constraints records missing sections that cannot be used as intermediate actions and have not generated reverse evidence.

[0083] After the supplementary constraint set and the counter-evidence constraint set are formed, the effective coverage ratio used to form the security event association judgment result is calculated. When the reference action unit is an empty record, the effective coverage ratio is set to 1. When the reference action unit is not an empty record, all the accepting positions in the reference action unit are read, and the missing accepting positions in the missing counter-evidence disallowed result sequence are also read. The accepting positions in the reference action unit are matched with the missing accepting positions in the missing counter-evidence disallowed result sequence; if the accepting order and position order are consistent, the accepting position is determined as the counter-evidence disallowed accepting position. The counter-evidence disallowed accepting position is not used as the denominator of the effective coverage ratio. For the remaining accepting positions, their coverage status is read; accepting positions with a coverage status of covered are written as valid covered positions, and accepting positions with a coverage status of uncovered and not determined as counter-evidence disallowed accepting positions are written as valid uncovered positions. The effective covered occupancy is obtained by adding the occupancy amounts of the effectively covered locations, and the effective reference occupancy is obtained by adding the occupancy amounts of the effectively covered locations and the effectively uncovered locations. When the effective reference occupancy is greater than zero, the ratio of the effective covered occupancy to the effective reference occupancy is determined as the effective coverage ratio; when the effective reference occupancy is equal to zero, the effective coverage ratio is determined as 1. The occupancy of the receiving location adopts the same occupancy determination method as when forming the gap amount of the intermediate behavior in the aforementioned embodiments.

[0084] The behavior acceptance reference input includes a pre-saved association judgment condition table. Each record in the association judgment condition table includes the fragment acceptance type, the lower limit of fragment acceptance quantity, and the lower limit of coverage ratio; both the lower limit of fragment acceptance quantity and the lower limit of coverage ratio are dimensionless values ​​greater than or equal to 0 and less than or equal to 1. The association judgment condition table is formed from historical alarm handling records before the execution of this method. Historical alarm handling records whose handling confirmation results indicate a security event are read. Following the same method used in the aforementioned embodiments to form the fragment acceptance quantity and effective coverage ratio, the historical fragment acceptance quantity and historical effective coverage ratio are calculated. For the same fragment acceptance type, the historical fragment acceptance quantities are sorted from smallest to largest, and the reading order is determined according to a preset association quantile ratio. The corresponding historical fragment acceptance quantity is read as the lower limit of the fragment acceptance quantity. The historical effective coverage ratios are sorted from smallest to largest, and the reading order is determined according to a preset association quantile ratio. The corresponding historical effective coverage ratio is read as the lower limit of the coverage ratio. The preset association quantile ratio is a value greater than 0 and not greater than 1, and is pre-saved along with the association judgment condition table. If there are no historical alarm handling records under the same segment acceptance type, the lower limit of segment acceptance volume will be set as the midpoint value of the acceptance value range, and the lower limit of coverage ratio will be set as 0.

[0085] When forming a security incident association assessment result, the record status of the reference unit is read. If the reference unit is a non-empty record and has been associated with a segment acceptance type, the segment acceptance type is read, and a record with the same segment acceptance type is searched in the association judgment condition table. The lower limit of segment acceptance quantity and the lower limit of coverage ratio in that record are read. If the reference unit is an empty record, no segment acceptance type is read, or no record with the same segment acceptance type is found, the lower limit of segment acceptance quantity is set to the midpoint of the acceptance value range, and the lower limit of coverage ratio is set to 0. The segment acceptance quantity is compared with the lower limit of segment acceptance quantity, and the effective coverage ratio is compared with the lower limit of coverage ratio. If the segment acceptance quantity is not less than the lower limit of segment acceptance quantity, and the effective coverage ratio is not less than the lower limit of coverage ratio, the event association status is determined to be an established association result; if the segment acceptance quantity is less than the lower limit of segment acceptance quantity, or the effective coverage ratio is less than the lower limit of coverage ratio, the event association status is determined to be an unestablished association result.

[0086] Once the event association status is established, a security event association assessment result is generated. The security event association assessment result saves the security alarm identifier to be assessed, the first security behavior segment identifier, the second security behavior segment identifier, the segment coverage, the effective coverage ratio, the sequence of prohibited results for filling gaps, the sequence of prohibited results for missing evidence of disinformation, the set of constraints for filling gaps, the set of constraints for disinformation of disinformation, and the event association status. When there are missing reference units, the security event association assessment result also saves the observability permission quantity and the source of permission restriction associated with each missing reference unit.

[0087] In one implementation, after the security event correlation analysis results are formed, the positive behavioral evidence set, the supplementary constraint set, the counter-evidence constraint set, the effective coverage ratio, the event correlation status, and the security event correlation analysis results are input into the security alarm analysis model. The security alarm analysis model can adopt a deployed general-purpose language model, a network security alarm description model, or a text generation model in the security operations platform; this model receives structured analysis description request records through a preset input interface and generates analysis description records based on the evidence fields and constraint fields therein.

[0088] The analysis and explanation request record includes the security alarm identifier to be analyzed, the first security behavior segment identifier, the second security behavior segment identifier, segment coverage, effective coverage ratio, supplementary constraint set, counter-evidence constraint set, and event association status. After reading the analysis and explanation request record, the security alarm analysis big data model generates an analysis and explanation record. The analysis and explanation record stores the security alarm identifier to be analyzed, the cited positive behavioral evidence, supplementary constraint content, counter-evidence prohibited content, event association status, and analysis and explanation text.

[0089] The system reads the security alarm identifiers to be analyzed from the analysis description record and compares them with the security alarm identifiers to be analyzed in the security event association analysis results. If they match, the analysis description record is saved in association with the security event association analysis results. If they do not match, or if the analysis description record is not read, it is not saved. The saved status of the analysis description record does not change the already formed event association status, nor does it change the output of the security event association analysis results.

[0090] When outputting the results of security event correlation analysis, the system associates and saves the results of successful or unsuccessful correlation with the security alarms to be analyzed, and outputs the corresponding sequence of supplementary prohibited results and the sequence of prohibited results for missing evidence. If a missing reference unit exists, the system reads the observability permit quantity and the source of permit restrictions associated with each missing reference unit and outputs them along with the security event correlation analysis results; if no missing reference unit is formed, the observability permit quantity and the source of permit restrictions are not output.

[0091] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, characterized in that, include: Step 1: Read the safety alarms and safety behavior acceptance inputs to be analyzed, form the alarm acceptance range based on the safety alarms to be analyzed, and select the first safety behavior segment and the second safety behavior segment from the alarm acceptance range according to the acceptance relationship and time sequence position, and calculate the segment acceptance quantity and segment interval quantity. Step 2: Read the behavior acceptance reference input, match the first safety behavior segment and the second safety behavior segment with the behavior acceptance reference input to form a reference action unit between the two, obtain the collected intermediate behavior segments from the alarm acceptance range within the time period corresponding to the segment interval, and form the intermediate behavior gap quantity by comparing the coverage of the reference action unit with the collected intermediate behavior segments. Step 3: When the gap amount of intermediate behavior is greater than the preset gap threshold, determine the missing segment based on the uncovered receiving position in the reference action unit, and write the uncovered receiving position in the reference action unit and its corresponding intermediate behavior reference content into the missing reference unit. Step 4: For the missing reference unit in the missing segment, read the acquisition capability input, calculate the acquisition continuity, behavior adaptation, acquisition coverage and reporting timeliness, determine the lowest value after normalization of the four as the observability permission quantity, and compare the observability permission quantity with the preset observability threshold to form observable missing result or unobservable missing result. Step 5: When Step 4 produces observable missing results, perform fill-in prohibition on the missing reference unit and generate fill-in prohibition results; when Step 4 produces unobservable missing results, perform missing proof disallowance on the missing segment and generate missing proof disallowance results, and output security event correlation analysis results.

2. The security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, as described in claim 1, is characterized in that... The method for selecting the first and second safety behavior segments in step one includes: Based on the safety alarms to be analyzed, the alarm occurrence time is determined. Using the alarm occurrence time as the boundary, the safety behavior segments within the alarm coverage area that occur before the alarm occurrence time are formed into a front candidate sequence, and the safety behavior segments within the alarm coverage area that occur after the alarm occurrence time are formed into a back candidate sequence. For each security behavior segment in the preceding and following candidate sequences, an object attribution quantity is formed based on the attribution relationship between each security behavior segment and the security alarm to be analyzed, and a behavior association quantity is formed based on the behavior inheritance relationship between each security behavior segment and the security alarm to be analyzed. The object attribution quantity and the behavior association quantity are normalized and synthesized into a candidate inheritance quantity. A temporal adjacency quantity is formed based on the temporal adjacency relationship of each safety behavior segment relative to the time of alarm occurrence; In the preceding and following candidate sequences, candidates are first sorted from highest to lowest according to their acceptance volume. If the acceptance volumes are the same, candidates are sorted from highest to lowest according to their temporal adjacency. The first safe behavior segment in each sequence is then determined as the first safe behavior segment and the second safe behavior segment.

3. The security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, as described in claim 1, is characterized in that... The method for forming the reference unit in step two includes: Read the behavior inheritance reference input, match the behavior content corresponding to the first safety behavior segment and the behavior content corresponding to the second safety behavior segment with the behavior inheritance reference input respectively, and form the previous matching result and the next matching result; If the current position matching result and the subsequent position matching result belong to the same behavior succession relationship, and the succession order of the previous position matching result in the behavior succession relationship is earlier than that of the subsequent position matching result, then the succession type corresponding to the behavior succession relationship is determined as the segment succession type. In the same behavior succession relationship, extract the intermediate behavior reference content that is located between the previous matching result and the subsequent matching result in the succession order to form an intermediate behavior reference relationship; According to the succession order in the intermediate behavior reference relationship, the intermediate behavior reference content is configured to the succession position corresponding to the segment interval, forming a reference action unit.

4. The security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, as described in claim 3, is characterized in that... The methods for generating the intermediate behavior gap in step two include: Based on the intermediate behavior reference content in the reference unit, the collected intermediate behavior segments are judged to correspond to the behavior content within the time period corresponding to the segment interval, and the collected intermediate behavior segments that meet the behavior content correspondence judgment are determined as content-corresponding segments. Based on the collection sequence of the corresponding content segments and the succession order in the reference function unit, the sequential succession of the corresponding content segments is determined; When the content segment satisfies the sequential succession judgment, the succession position corresponding to the content segment in the reference unit is marked as covered; When the collected intermediate behavior segment is not identified as the content corresponding segment, or the content corresponding segment does not meet the sequential succession judgment, the corresponding succession position in the reference unit remains uncovered. The intermediate behavior gap quantity is formed based on the degree of occupancy of the uncovered receiving position in the reference action unit.

5. The security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, as described in claim 4, is characterized in that... The method for forming missing reference cells in step three includes: When the gap in the intermediate behavior is greater than the preset gap threshold, the uncovered state in the reference action unit will be taken as the missing acceptance position. Read the intermediate behavior reference content, the order of succession, and the corresponding position in the fragment interval corresponding to the missing succession position; The continuity of missing acceptance positions is judged according to the acceptance order. Missing acceptance positions with continuous acceptance order are grouped into the same missing acceptance group, and missing acceptance positions whose acceptance order is separated by the acceptance position that is already covered are grouped into different missing acceptance groups. Based on the corresponding positions of each missing connection position in the same missing connection group within the segment interval, a corresponding missing segment is formed. Write the intermediate behavior reference content, succession order, and missing section corresponding to the same missing successor group into the same missing reference unit.

6. The security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, as described in claim 5, is characterized in that... Step four includes the following methods for reading and acquiring data from missing reference units: For each missing reference unit, based on the missing segment, intermediate behavior reference content, and missing connection position corresponding to the missing reference unit, the following are selected from the data collection capability input: data collection capability content that corresponds to the collection time period of the missing segment, data collection capability content that corresponds to the behavior collection of the intermediate behavior reference content, data collection capability content that corresponds to the coverage of the missing connection position, and data collection capability content that corresponds to the arrival of the collection result of the missing segment. These are then collected into data collection capability segments. Based on the missing segments, the operational states related to acquisition start-up, acquisition interruption, and acquisition resumption in the acquisition capability segments are separated into time periods to form acquisition operation segments; Based on the intermediate behavior reference content and the missing receiving position, the adaptation status related to the range of collectable safe behaviors and the coverage of receiving positions in the collection capability segment is separated to form behavior collection adaptation segment. Based on the missing segments and the arrival time of the acquisition results, the transmission states related to the order of arrival of the acquisition results in the acquisition capability segments are separated to form acquisition transmission segments; The data collection operation segment, behavior data collection adaptation segment, and data collection transmission segment are associated with the same missing reference unit. The data collection operation segment is used to determine the data collection continuity, the behavior data collection adaptation segment is used to determine the behavior adaptation and data collection coverage, and the data collection transmission segment is used to determine the reporting timeliness.

7. The security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, as described in claim 6, is characterized in that... The method for calculating the observability allowance in step four includes: The effective acquisition time period is determined by the time periods corresponding to acquisition start, acquisition interruption and acquisition resumption in the acquisition operation segment. The effective acquisition time period is compared with the missing segment, and the acquisition continuity is formed according to the proportion of the missing segment covered by the effective acquisition time period. The content of safe behaviors that can be collected in the behavior collection adaptation segment is compared with the intermediate behavior reference content, and the degree of behavior adaptation is formed according to the proportion of the intermediate behavior reference content that forms a corresponding relationship in the missing reference unit. The corresponding connection positions that support coverage in the behavior acquisition adaptation segment are compared with the missing connection positions, and the acquisition coverage is formed according to the proportion of the missing connection positions that form a corresponding relationship in the missing reference unit. The arrival time of the acquisition results in the acquisition and transmission segment is compared with the preset reporting allowable time corresponding to the missing segment. The reporting timeliness is formed according to the proportion of the missing take-up position corresponding to the acquisition results that are not later than the preset reporting allowable time in the missing reference unit. The continuity of data collection, the degree of behavioral adaptation, the degree of data collection coverage, and the timeliness of reporting are normalized respectively, and the lowest value after normalization is determined as the observability permit of the missing reference unit.

8. The security alarm assessment method based on collaborative reasoning of positive and negative evidence using a large model, as described in claim 1, is characterized in that... The methods for determining the observability allowable quantity in step four include: For the same missing reference unit, the degree of continuity of data collection, the degree of behavioral adaptation, the degree of data collection coverage, and the degree of reporting timeliness are used as the set of permitted components; According to the preset lower limit and preset upper limit of each license component in the license component set, each license component is mapped to the same license value range according to the range occupancy relationship, thus forming a normalized license component set; The normalized license component with the lowest value is selected from the set of normalized license components, and the value of the normalized license component with the lowest value is determined as the observability license quantity of the missing reference unit. The collection continuity, behavior adaptation, collection coverage, or reporting timeliness corresponding to the lowest normalized license component is determined as the source of license restriction; when there are multiple lowest normalized license components, the degree corresponding to each of the multiple lowest normalized license components is determined as the source of license restriction. The observability license quantity and the source of the license restriction are associated with and saved with the missing reference unit.

Images