Cybersecurity Incident Analysis Methods and Intelligent Analysis Systems

Abstract

A cybersecurity incident analysis method, implemented by an intelligent analysis system, includes the following steps: (A) determining whether to retrieve at least one target cybersecurity knowledge data based on an analysis request prompt and a knowledge base retrieval prompt; (B) when it is determined that retrieval is required, retrieving the at least one target cybersecurity knowledge data; (C) determining whether to invoke at least one target cybersecurity tool based on the analysis request prompt, a tool description, and a tool retrieval prompt; (D) when it is determined that invocation is required, invoking the cybersecurity tool for each target and obtaining a tool execution result; and (E) based on the analysis request prompt, the at least one target cybersecurity knowledge data, and the at least one tool execution result, using a large language model to obtain an analysis result related to the cybersecurity incident to be analyzed.

Claims

1. A cybersecurity incident analysis method, applicable to analyzing a cybersecurity incident to be analyzed and implemented by an intelligent analysis system, wherein the intelligent analysis system stores a cybersecurity knowledge dataset, runs a large language model, and has multiple cybersecurity tools to be invoked, the cybersecurity knowledge dataset includes multiple cybersecurity knowledge data to be retrieved, and the cybersecurity incident analysis method includes the following steps: (A) determining whether to obtain at least one target cybersecurity knowledge data from the cybersecurity knowledge dataset based on an analysis request prompt indicating the cybersecurity incident to be analyzed and a knowledge base retrieval prompt related to retrieving the cybersecurity knowledge dataset; (B) when it is determined that the at least one target cybersecurity knowledge data needs to be obtained, obtaining the at least one target cybersecurity knowledge data; (C) determining whether to invoke at least one target cybersecurity tool from the cybersecurity tool to be invoked based on the analysis request prompt, a tool description data, and a tool retrieval prompt related to retrieving the cybersecurity tool to be invoked, wherein the tool description data includes functional information indicating the functions provided by the cybersecurity tool to be invoked; (D) When it is determined that the at least one target needs to invoke the cybersecurity tool, invoke the cybersecurity tool for each target to obtain a tool execution result; and (E) Based on the analysis request prompt, the cybersecurity knowledge data retrieved by the at least one target and the execution result of the at least one tool, use the large language model to obtain an analysis result related to the cybersecurity event to be analyzed.

2. The cybersecurity incident analysis method as described in claim 1 further includes the following steps after step (E): (F) generating an analysis report related to the cybersecurity incident to be analyzed based on a preset format template, a format prompt, and the analysis result.

3. The cybersecurity incident analysis method as described in claim 1 further includes the following steps before step (A): (G) After receiving a cybersecurity knowledge document, the cybersecurity knowledge document is divided into multiple knowledge segments; (H) For each knowledge segment, the knowledge segment is converted into a knowledge vector data; (I) The knowledge vector data corresponding to the cybersecurity knowledge document is added to the retrieved cybersecurity knowledge data set.

4. The cybersecurity incident analysis method as described in claim 1, wherein, In step (A), the cybersecurity knowledge data to be retrieved includes device log knowledge information related to the logs of cybersecurity devices, monitoring rule knowledge information related to cybersecurity monitoring rules, workflow knowledge information related to cybersecurity analysis workflow, and cybersecurity response knowledge information related to cybersecurity incident handling and response.

5. The cybersecurity incident analysis method as described in claim 1, wherein, In step (C), the cybersecurity tool awaiting invocation includes a comparison tool for comparing an attack method with offensive strategies, techniques and common sense, an external intelligence query tool for querying the reputation rating of an attack source, a historical trajectory investigation tool for accessing the historical activity records of an attack endpoint, and a joint defense tool for integrating with cybersecurity equipment to jointly defend against an attack.

6. An intelligent analysis system, suitable for analyzing a cybersecurity event to be analyzed, comprising: a storage module storing a retrieval cybersecurity knowledge dataset, the retrieval cybersecurity knowledge dataset including multiple cybersecurity knowledge records to be retrieved; and a processing module signal-connected to the storage module, running a large language model and having multiple built-in cybersecurity tools to be invoked; wherein, The processing module determines whether to retrieve at least one target cybersecurity knowledge data from the pending cybersecurity knowledge data based on an analysis request prompt indicating the cybersecurity event to be analyzed and a knowledge base retrieval prompt related to retrieving the cybersecurity knowledge data set. When it is determined that the at least one target cybersecurity knowledge data needs to be retrieved, the processing module retrieves the at least one target cybersecurity knowledge data. Furthermore, based on the analysis request prompt, a tool description, and a tool retrieval prompt related to retrieving the pending cybersecurity tool, the processing module determines whether to invoke at least one target cybersecurity tool from the pending cybersecurity tool. The tool description includes functional information indicating the functions provided by the pending cybersecurity tool. When it is determined that the at least one target cybersecurity tool needs to be invoked, for each target cybersecurity tool, the processing module invokes the target cybersecurity tool to obtain a tool execution result. Based on the analysis request prompt, the at least one target cybersecurity knowledge data, and the at least one tool execution result, the processing module uses the large language model to obtain an analysis result related to the cybersecurity event to be analyzed.

7. The intelligent analysis system as described in claim 6, wherein, The processing module also generates an analysis report related to the cybersecurity incident to be analyzed, based on a preset format template, a format prompt, and the analysis results.

8. The intelligent analysis system as described in claim 6 further includes a communication module that is signal-connected to the processing module, wherein, After receiving each piece of cybersecurity knowledge data to be retrieved via the communication module, the processing module adds the cybersecurity knowledge data to the cybersecurity knowledge data set.

9. The intelligent analysis system as described in claim 6, wherein, The cybersecurity knowledge data to be retrieved includes equipment log information related to cybersecurity equipment logs, monitoring rule information related to cybersecurity monitoring rules, workflow information related to cybersecurity analysis workflows, and cybersecurity response information related to cybersecurity incident handling and response.

10. The intelligent analysis system as described in claim 6, wherein, The cybersecurity tool awaiting invocation includes a comparison tool for comparing an attack method with offensive strategies, techniques, and common sense; an external intelligence query tool for querying the reputation rating of an attack source; a historical trajectory investigation tool for accessing the historical activity records of an attack endpoint; and a joint defense tool for integrating with cybersecurity equipment to jointly defend against an attack.

Images