Security event processing method and apparatus and electronic device

Abstract

Provided in the present application are a security event processing method and apparatus and an electronic device, which are used for improving security event processing efficiency. The method comprises: acquiring a log to be processed and, on the basis of said log, generating a prompt text; inputting the prompt text into a security processing model and, on the basis of the security processing model, performing processing suggestion analysis on the prompt text, so as to determine a security event processing suggestion for said log, the security processing model being a trained large model that has been fine-tuned. Because the present application uses the trained large model that has been fine-tuned to analyze said log so as to obtain the security event processing suggestion corresponding to said log, there is no need for a human to determine the security event processing suggestion corresponding to said log, thereby improving security event processing efficiency.

Description

A security event processing method, device and electronic equipment

[0001] Cross-reference to Related Applications

[0002] The present application claims priority to the Chinese Patent Application No. 202410796372.3, filed on June 19, 2024, and entitled "A Security Event Processing Method, Device and Electronic Equipment", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application relates to the technical field of network security, and in particular to a security event processing method, device and electronic equipment. BACKGROUND

[0004] A network security event refers to a situation that may pose potential harm to a system, data, user or organization occurring in a computer network or information system. These events can be triggered by various reasons, including malicious behavior, system failure, vulnerability exploitation, unauthorized access and other abnormal network activities. In the prior art, the alarm reported by the device is often handled by manual processing to block the occurrence of network security events, but the efficiency of manual processing is low. SUMMARY

[0005] The present application provides a security event processing method, device and electronic equipment to improve the efficiency of security event processing.

[0006] In a first aspect, the present application provides a security event processing method, which comprises:

[0007] Obtaining a to-be-processed log;

[0008] Generating a prompt text according to the to-be-processed log;

[0009] Inputting the prompt text into a security handling model, performing handling suggestion analysis on the prompt text based on the security handling model, and determining a security event processing suggestion corresponding to the to-be-processed log; the security handling model is a large model trained through fine-tuning.

[0010] Since the present application embodiment processes the to-be-processed log after obtaining the to-be-processed log, a prompt text that can be input into a security handling model is obtained, so that the security handling model analyzes the prompt file and outputs a security event processing suggestion corresponding to the to-be-processed log. Manual analysis of the to-be-processed log to determine the security event processing suggestion corresponding to the to-be-processed log is not required, thereby improving the processing efficiency of the security event.

[0011] An optional implementation includes generating a prompt text based on the log to be processed, comprising:

[0012] The key fields of the log to be processed are extracted to obtain the key fields in the log to be processed; the key fields include source IP information and attack type.

[0013] The key fields are matched with data in the knowledge base to obtain matching results; the knowledge base includes a threat intelligence knowledge base and a response strategy knowledge base.

[0014] The prompt text is generated based on the matching results.

[0015] Since the embodiments of this application can mine prior knowledge in an external knowledge base based on key fields in the log to be processed, the prompt text can be enriched, thereby increasing the prompts for the security handling model and helping the security handling model output more reliable and targeted handling suggestions.

[0016] An optional implementation involves matching the key fields with data in the knowledge base, including:

[0017] The source IP information is matched with the threat intelligence in the threat intelligence knowledge base to determine the threat information corresponding to the source IP information;

[0018] The attack type is matched with the rules in the handling strategy knowledge base to determine the handling recommendations corresponding to the attack type.

[0019] Because the embodiments of this application can mine prior knowledge of known information in the logs to be processed through threat intelligence knowledge base and handling strategy knowledge base, the security handling model’s understanding of attacks can be improved.

[0020] An optional implementation includes generating the prompt text based on the matching result, comprising:

[0021] If the matching result is a failure, then the prompt text is generated based on the log to be processed and the prompt words; or,

[0022] If the matching result is successful, the prompt word is updated according to the threat information corresponding to the source IP information and / or the handling suggestions corresponding to the attack type, and the prompt text is generated according to the updated prompt word.

[0023] An optional implementation includes updating the prompt word based on the threat information corresponding to the source IP information and / or the handling suggestions corresponding to the attack type, including:

[0024] The prompt word is updated based on the threat information corresponding to the source IP information to obtain a first prompt word; and / or,

[0025] The prompt word is updated based on the handling suggestions corresponding to the attack type to obtain a second prompt word.

[0026] An optional implementation includes generating the prompt text based on the updated prompt words, comprising:

[0027] The prompt text is generated based on the updated prompt words and the logs to be processed.

[0028] An optional implementation method is to train the security handling model in the following way:

[0029] Obtain a sample dataset, wherein any sample data in the sample dataset includes the prompt word, the labeled log, and the security event handling suggestions corresponding to the labeled log;

[0030] The large-scale model is trained based on the fine-tuning algorithm and the sample dataset to obtain the security handling model.

[0031] One optional implementation is that obtaining the sample dataset includes:

[0032] Determine the prompt words corresponding to the safety handling model;

[0033] Obtain the labeled logs, which are normal protection logs, missed alarm logs, or false alarm logs;

[0034] Obtain the security incident handling recommendations for the marked log settings;

[0035] The sample dataset is generated based on the prompt words, the labeled logs, and the security incident handling suggestions corresponding to the labeled logs.

[0036] Secondly, embodiments of this application provide a security incident handling device, comprising:

[0037] The acquisition unit is used to acquire logs to be processed.

[0038] The generation unit is used to generate prompt text based on the log to be processed;

[0039] The analysis unit is used to input the prompt text into the security handling model, analyze the prompt text based on the security handling model, and determine the security event handling suggestions for the log to be processed; the security handling model is a large model that has been fine-tuned and trained.

[0040] Thirdly, embodiments of this application provide an electronic device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and when the computer program is executed by the processor, it implements the security event handling method as described in the first aspect.

[0041] Fourthly, embodiments of this application also provide a computer storage medium storing computer program instructions, which, when executed on a computer, cause the computer to perform the security event handling method as described in the first aspect.

[0042] The technical effects of any of the implementation methods in the second to fourth aspects can be found in the technical effects of the corresponding implementation methods in the first aspect, and will not be repeated here. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 is a schematic diagram of a security incident handling scenario provided in an embodiment of this application;

[0045] Figure 2 is a flowchart illustrating a security incident handling method provided in an embodiment of this application;

[0046] Figure 3 is a schematic diagram of the process of training a safety handling model according to an embodiment of this application;

[0047] Figure 4 is a complete flowchart of a security incident handling method provided in an embodiment of this application;

[0048] Figure 5 is a structural schematic diagram of a security event handling device provided in an embodiment of this application;

[0049] Figure 6 is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0051] The following explains some of the terms that appear in the text:

[0052] Prompt words: These are commonly used in the training process of large models as input to the large model. In this embodiment, prompt text composed of prompt words is used as the input to the large model.

[0053] The word “exemplary” as used below means “serving as an example, embodiment, or illustration.” Any embodiment illustrated as an “exemplary” need not be construed as superior to or better than other embodiments.

[0054] The terms "first" and "second" used in this document are for descriptive purposes only and should not be construed as indicating relative importance or implying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0055] Figure 1 illustrates a security event handling scenario provided by an embodiment of this application. As shown in Figure 1, the scenario includes a security device console and a security device.

[0056] Security devices are used to protect web applications. These security devices can be Web Application Firewalls (WAF) security devices.

[0057] The security device control console is used to control security devices and adjust the hit rules within them.

[0058] In some embodiments, security devices can classify and detect traffic logs using sampling rule matching or machine learning. When a security device detects vulnerabilities or attacks, it can report these to the security device console. To prevent cybersecurity incidents, operators can handle the alerts reported by the security device through the security device console. However, manual handling requires analyzing the alerts reported by the security device, determining the appropriate handling method, and then processing the cybersecurity incident based on the determined method, resulting in low efficiency in security incident handling.

[0059] To address the aforementioned problems, this application provides a security incident handling method, apparatus, and electronic device. The method includes: acquiring a log to be processed; generating a prompt text based on the log; inputting the prompt text into a security handling model; and performing a handling suggestion analysis on the prompt text based on the security handling model to determine security incident handling suggestions for the log to be processed. The security handling model is a large model that has undergone fine-tuning and training. This application embodiment, when handling security incidents from logs to be processed, can directly output security incident handling suggestions corresponding to the logs to be processed through a large model, allowing users to directly handle security incidents based on these suggestions, thereby improving the efficiency of security incident handling.

[0060] In one embodiment, the security event handling method provided in this application can be executed by a server, or by other electronic devices (such as computers) with certain computing capabilities for security event handling, or by a client installed on a terminal device in collaboration with the server. The following embodiments illustrate this security event handling method using a server as an example. As shown in Figure 2, the security event handling method provided in this application includes the following steps:

[0061] S201: Get logs to be processed.

[0062] This application embodiment can obtain protection logs from a security device as logs to be processed. The security device can be a WAF security device, and the logs to be processed can be WAF daily protection logs. For example, the logs to be processed include, but are not limited to: request Uniform Resource Locator (URL), identifier, source IP information, HTTP request method, request headers, user agent, WAF rule triggering information, attack type, and whether it was blocked.

[0063] For example, the log to be processed obtained in this embodiment of the application can be a WAF alarm log, which records an HTTP request blocked by the firewall. The alarm log is shown below:

[0064] GET / css / custom / milk.css? v=2018.11.26 HTTP / 1.1 / / This is the request line, indicating that this is an HTTP GET request for the resource / css / custom / milk.css, with a version lookup parameter v=2018.11.26. HTTP / 1.1 refers to the HTTP protocol version used.

[0065] trace_id:d1ecacfb-b2b8-41fd-b781-176f187794cf / / This is a trace identifier used to uniquely identify this request within the system, facilitating tracing or debugging issues across multiple system or log files.

[0066] lua_sigids:200003279 / / This represents the ID number of the triggered WAF rule. The WAF may use Lua scripts to define and execute security rules.

[0067] `lua_req_status: blocked` indicates that the request has been blocked by the WAF, usually because the request is considered malicious or violates security policies.

[0068] User-Agent:Mozilla / 5.0 (Windows NT 6.2; rv:30.0)Gecko / 20150101 Firefox / 32.0 360Spider 360Spider / / This is the user agent string for the request, identifying the type of client making the request. The user agent here suggests the request appears to have been made through the Firefox browser, but the inclusion of "360Spider" likely indicates it's a web crawler.

[0069] Accept-Encoding: gzip, deflate, br / / Indicates the compression formats supported by the client, including gzip, deflate, and Brotli.

[0070] Accept: text / css, * / *; q = 0.1 / / The client declares the types of content it is willing to accept, with priority over CSS files.

[0071] Connection: keep-alive / / ​​Indicates that the client wants to keep the connection open so that it can send more requests.

[0072] Host: www.beian.gov.cn / / Requested target hostname

[0073] Accept-Language: en-US,en; q=0.9,zh-CN; q=0.8,zh; q=0.7 / / List of languages ​​accepted by the client, sorted in order of priority.

[0074] Sec-Fetch-Site:same-origin / / The site relationship of the request. Here it is same-origin, which means that the request and the server are in the same domain.

[0075] Sec-Fetch-Mode:no-cors / / Secure fetch mode; no-cors indicates that the request does not need to comply with the CORS (Cross-Origin Resource Sharing) policy.

[0076] Sec-Fetch-Dest:style / / The target of this request is to retrieve style resources (CSS)

[0077] Referer:[URL] / / Represents the URL of the original page that triggered the request.

[0078] Cookie: [cookie details] / / Contains the cookie data sent with this request, typically used for authentication or session management.

[0079] X-Forwarded-For:101.199.125.254 / / An HTTP extension header used to identify the client's original IP address, which is crucial for understanding and tracing the origin of the request.

[0080] Content-Length: 0 / / Indicates the length of the HTTP request body; 0 indicates no body.

[0081] S202: Generate a prompt text based on the logs to be processed.

[0082] In some embodiments, due to the high training cost of the security handling model and the certain delay in the knowledge update speed, this application embodiment considers combining an external knowledge base to mine prior knowledge of known information in the logs to be processed, thereby improving the security handling model's awareness of newer attacks and enabling the security handling model to output more targeted suggestions.

[0083] Therefore, embodiments of this application can extract key fields from the logs to be processed, obtaining the key fields in the logs. These key fields include source IP information and attack type. For example, embodiments of this application can determine the attack category corresponding to a hit rule based on the hit rules in the logs to be processed.

[0084] This application embodiment can also match key fields with data in a knowledge base to obtain matching results. The knowledge base includes a threat intelligence knowledge base and a response strategy knowledge base.

[0085] As an example, this application embodiment can match source IP information with threat intelligence in a threat intelligence knowledge base to determine the threat information corresponding to the source IP information. For instance, this application embodiment can interact with the threat intelligence knowledge base through an Application Programming Interface (API) call to obtain the threat information corresponding to the source IP information from the threat intelligence knowledge base. This application embodiment can determine whether the source IP information successfully matches the threat intelligence in the threat intelligence knowledge base based on the threat information. For example, the data structure of the threat information corresponding to the source IP information obtained from the threat intelligence knowledge base in this application embodiment is shown in Table 1 below:

[0086] Table 1: Data Structure of Threat Information

[0087] Specifically, when the malice in the threat information is determined to be unknown, this embodiment of the application can determine that the source IP information has not successfully matched the threat intelligence in the threat intelligence knowledge base. Conversely, when the malice in the threat information is determined to be malicious, this embodiment of the application can determine that the source IP information has successfully matched the threat intelligence in the threat intelligence knowledge base.

[0088] This application embodiment can also match attack types with handling suggestions in the handling strategy knowledge base to determine the handling suggestion corresponding to the attack type. For example, when a handling suggestion corresponding to an attack type is determined from the handling strategy knowledge base, it can be determined that the attack type and the handling suggestion in the handling strategy knowledge base have successfully matched. As another example, when no handling suggestion corresponding to an attack type is determined from the handling strategy knowledge base, it can be determined that the attack type and the handling suggestion in the handling strategy knowledge base have failed to match.

[0089] After obtaining the matching result, this embodiment of the application can generate prompt text based on the matching result. The prompt text may include prompt words, or it may include prompt words and pending logs. For example, this embodiment of the application can generate prompt text in the following ways.

[0090] Method 1: Matching result is a failure.

[0091] This application embodiment can generate prompt text based on the log to be processed and prompt words. The prompt words can be pre-defined. For example, this application embodiment can concatenate the log to be processed and the prompt words together to obtain the prompt text.

[0092] For example, the prompt could be: "Determine if there are any threats in the following WAF device protection logs. If so, please identify the attack type and provide handling suggestions."

[0093] Method 2: Matching result is successful.

[0094] This application embodiment can update the prompt words based on the threat information corresponding to the source IP information and / or the handling suggestions corresponding to the attack type. This application embodiment can also generate prompt text based on the updated prompt words. For example, this application embodiment can also generate prompt text based on the updated prompt words and pending logs.

[0095] In this embodiment, a successful match can be categorized into three cases: the first is a successful match between the source IP information and the threat intelligence in the threat intelligence knowledge base; the second is a successful match between the attack type and the handling suggestions in the handling strategy knowledge base; and the third is a successful match between the source IP information and the threat intelligence in the threat intelligence knowledge base, and also a successful match between the attack type and the handling suggestions in the handling strategy knowledge base. The generation process of the prompt text will be explained below based on each of these three cases.

[0096] In the first scenario, this embodiment of the application can update the prompt word based on the threat information corresponding to the source IP information to obtain the first prompt word. This embodiment of the application can then concatenate the first prompt word with the log to be processed to obtain the prompt text.

[0097] For example, in this embodiment of the application, when it is determined that the source IP is a malicious IP and there is a threat attack, the prompt word is updated according to the threat information corresponding to the source IP information to obtain a first prompt word that can indicate that the source IP has an attack behavior.

[0098] For example, when the prompt message is "Determine if the following WAF device protection logs contain threats. If so, please specify the attack type and provide handling suggestions," this embodiment optimizes the prompt message to a first prompt message when it is determined that the source IP is a malicious IP and contains threatening attack behavior. The first prompt message could be: "The source IP of this log has been compared with the threat intelligence database, and historical behaviors such as XX attacks have been detected. Based on the known information, please analyze the following WAF logs and provide handling suggestions."

[0099] The second scenario: In this embodiment, the prompt word can be updated based on the handling suggestions corresponding to the attack type to obtain a second prompt word. This embodiment can concatenate the second prompt word with the log to be processed to obtain the prompt text. For example, if the prompt word is "Determine if the following WAF device protection logs contain threats; if so, please identify the attack type and provide handling suggestions," this embodiment can optimize the prompt word into a second prompt word based on the handling suggestions corresponding to the attack behavior. The second prompt word can be as follows:

[0100] "This log entry violates the WAF's XXX rule and has been identified as a Cross-Site Scripting (XSS) attack. Common handling suggestions include:"

[0101] 1. Filter the required parameters before submitting the form or passing URL parameters.

[0102] 2. Filter user input: Check if there is any illegal content in the user input.

[0103] Based on the information above, please analyze the following WAF logs and provide suggestions for handling the issue.

[0104] The third scenario: This embodiment of the application can update the prompt words based on the threat information corresponding to the source IP information to obtain a first prompt word. This embodiment of the application can also update the prompt words based on the handling suggestions corresponding to the attack type to obtain a second prompt word. This embodiment of the application can concatenate the first and second prompt words together to obtain the prompt text. For example, this embodiment of the application can also concatenate the first prompt word, the second prompt word, and the log to be processed together to obtain the prompt text.

[0105] S203: Input the prompt text into the security handling model, analyze the prompt text based on the security handling model, and determine the security event handling recommendations for the log to be processed.

[0106] The security handling model is a large model that has been fine-tuned and trained. In this embodiment, the security handling model can be a Suggestion Generate Chat (SG-CHAT). For example, the large model can be an open-source large model, such as ChatGLM2 or Tongyi Qianwen.

[0107] In some embodiments, after obtaining security event handling suggestions for the logs to be processed, this application embodiment can directly display the security event handling suggestions via API. For example, this application embodiment can display the security event handling suggestions in the security device or on the security device's console. This allows operators to perform further operations based on the displayed security event handling suggestions, empowering the security device and improving security event handling efficiency. Furthermore, when the logs to be processed are missed or false alarm logs, this application embodiment can also help operators modify WAF rules in a timely manner by displaying security event handling suggestions, improving the WAF's protection performance and the security of the protected system itself.

[0108] In some embodiments, as shown in FIG3, the security handling model of this application can be obtained in the following ways:

[0109] Step 1: Construct the sample dataset. Each sample data point in the sample dataset includes a prompt word, an labeled log, and corresponding security incident handling suggestions. For example, the sample data consists of three parts: instruction, input, and output. The instruction represents the prompt command, corresponding to the prompt word in the sample data; the input represents the text, corresponding to the labeled log in the sample data; and the output represents the returned result, corresponding to the security incident handling suggestions in the sample data.

[0110] This application embodiment can, in conjunction with a security application background, construct a security domain dataset, i.e., a sample dataset, using technologies such as log collection and distributed web crawling. The security domain dataset includes security device protection logs, security event descriptions, and online forum data. The online forum data can be data from forum websites that have been processed to provide handling suggestions obtained from outside the security device.

[0111] For example, embodiments of this application can be combined with WAF application scenarios, allowing users to determine the prompt words corresponding to the security handling model. Embodiments of this application can also be combined with WAF application scenarios, allowing security experts to annotate the acquired WAF logs to obtain annotated logs. Embodiments of this application can also allow security experts to set security event handling suggestions for the annotated logs. For example, security experts can divide the acquired WAF logs into three categories: normal protection logs, missed detection logs, and false alarm logs. Security experts can also set corresponding security event handling suggestions for the annotated logs. For example, for normal protection logs, embodiments of this application can combine security expert opinions to collect corresponding security event handling suggestions for each type of attack. These security event handling suggestions include the handling of the currently accessing IP and system optimization measures that can be taken to deal with the attack, for operators' reference. For false alarm logs, the security event handling suggestions include WAF hit rules, reminding operators to optimize the corresponding WAF rules to reduce the false alarm rate. For missed detection logs, the security event handling suggestions include the attack type, reminding operators to optimize the corresponding WAF rules to reduce the missed detection rate. This application embodiment can generate a sample dataset based on the determined prompt words, labeled logs, and security event handling suggestions corresponding to the labeled logs.

[0112] For example, the normal protection logs in the sample dataset obtained in this application embodiment can be as follows:

[0113] {

[0114] "instruction": "Determine if the following WAF device protection logs contain threats. If so, identify the attack type and provide handling recommendations."

[0115] "input":"GET / css / custom / milk.css?v=2018.11.26HTTP / 1.1……",

[0116] "output":"Based on this log, the WAF device has blocked an obvious SQL injection attempt because the attacker tried to execute a malicious SQL query. The recommended course of action is as follows:"

[0117] 1. Analyze the source IP address: 135.181.74.27. If it is on a blacklist or associated with previous malicious activity, further monitoring or blocking may be necessary.

[0118] 2. Use parameterized queries: Parameterized queries are a type of prepared query that separates parameters from SQL statements, allowing the program to execute parameter values ​​separately from SQL statements, thus avoiding SQL injection attacks.

[0119] 3. Filter input data: Filter all special characters entered by users, such as semicolons and single quotes, to prevent attackers from injecting malicious SQL code.

[0120] 4. Use stored procedures: Stored procedures can make SQL statements more secure. They can store SQL statements on the server instead of sending them directly on the client, thus effectively preventing SQL injection attacks.

[0121] 5. Use secure interfaces: Using secure programming interfaces can effectively improve database security and prevent SQL injection attacks.

[0122] 6. Regularly audit the database: Regularly audit the database to detect SQL injection attacks and take timely remedial measures.

[0123] }

[0124] For example, the false alarm logs in the sample dataset obtained in this embodiment of the application can be as follows:

[0125] {

[0126] "instruction": "Determine if the following WAF device protection logs contain threats. If so, identify the attack type and provide handling recommendations."

[0127] "input":"GET / favicon.ico HTTP / 1.1\\r\\ntrace_id:……",

[0128] "output":"According to this log, the WAF device has blocked a request for the / favicon.ico file because it may be considered a potential threat. However, under normal circumstances, a favicon.ico request should not be considered a security threat."

[0129] "

[0130] }

[0131] For example, the missed detection logs in the sample dataset obtained in this embodiment of the application can be as follows:

[0132] {

[0133] "instruction": "Determine if the following WAF device protection logs contain threats. If so, identify the attack type and provide handling recommendations."

[0134] "input":"GET / favicon.ico HTTP / 1.1\\r\\ntrace_id:……",

[0135] "output":"According to this log, the WAF device allowed a request to retrieve a property file, which may have involved illegal or malicious data access. Recommended actions may include:"

[0136] 1. Analyze the source IP address: If it is on a blacklist or associated with previous malicious activity, further monitoring or blocking may be necessary.

[0137] 2. Update WAF rules: Based on the analysis results, it may be necessary to update WAF rules to better identify and block potential unauthorized data access attempts.

[0138] 3. It is important to emphasize that attempts to obtain sensitive data or attribute files are generally malicious and may involve unauthorized data access. Therefore, while the blocking action of the WAF device is effective, further analysis and processing are still needed to ensure security. If this is a genuine security incident, then collaborating with security experts to take appropriate measures is crucial.

[0139] }

[0140] Step 2: Based on the fine-tuning algorithm and sample dataset, train the large model to obtain the safety handling model.

[0141] Among them, the fine-tuning algorithm can be Freeze, P-Tuning, Lora, etc.

[0142] This application embodiment can convert sample data in a sample dataset into Q&A instruction data that a large model can understand. For example, this application embodiment can concatenate prompts from security domain data and labeled logs together as Q instruction data, and use the security event handling corresponding to the labeled logs as A instruction data.

[0143] This application embodiment can divide the transformed sample dataset into a test set, a training set, and a validation set. The division ratio can be 7:2:1 (test set: training set: validation set). This application embodiment can fine-tune a large model based on the transformed sample dataset and a fine-tuning algorithm to obtain a security handling model. For example, this application embodiment can use p-tuning v2 mode to fine-tune the large model, retraining some downstream task parameters of the large model using the transformed sample dataset, finally obtaining a trained security handling model. The obtained security handling model possesses more prior knowledge about security events compared to the base large model, and performs better in executing the security event handling suggestion generation task. The fine-tuning training method for the large model in this application embodiment is a prior art method for fine-tuning large models, and will not be elaborated further here.

[0144] In this embodiment of the application, a large model is fine-tuned and trained by constructing a sample dataset containing prompt words, labeled logs, and security event handling suggestions corresponding to the labeled logs, to obtain a security handling model that can directly generate security event handling suggestions.

[0145] After the security handling model is trained, this embodiment of the application can also perform the task of generating security event handling opinions corresponding to the logs to be processed based on the security handling model. As shown in Figure 3, this embodiment of the application can perform the above task by executing steps three and four.

[0146] Step 3: Update the prompt words in the prompt text by combining them with an external knowledge base.

[0147] As shown in Figure 3, the external knowledge base includes a threat intelligence knowledge base and a response strategy knowledge base. This embodiment of the application can match the source IP information in the logs to be processed with the threat intelligence in the threat intelligence knowledge base. Upon successful matching, the prompt word is updated to the first prompt word based on the threat information corresponding to the source IP information. This embodiment of the application can also match the attack type in the logs to be processed with the response suggestions in the response strategy knowledge base. Upon successful matching, the prompt word is updated to the second prompt word based on the response suggestion corresponding to the attack type. Thus, this embodiment of the application can generate prompt text based on the optimized first and second prompt words.

[0148] Step 4: Analyze the prompt text using the security handling model and output security incident handling suggestions.

[0149] In this embodiment, prompt text can be input into the security handling model, and security incident handling suggestions can be obtained based on the security handling model.

[0150] After receiving security incident handling recommendations, this embodiment can also display the recommendations on the security device and its control panel. Additionally, this embodiment can also display the security incident handling recommendations to operations personnel, enabling them to take further action on the security device based on these recommendations.

[0151] Based on the above, the embodiments of this application can supplement the known information in the log to be processed by combining external knowledge bases, assist the security handling model in making better judgments, and output more targeted security incident handling suggestions, thereby improving the efficiency of security incident handling.

[0152] In some embodiments, as shown in FIG4, this application provides a complete flowchart of a security event handling method. As shown in FIG4, the method includes the following steps:

[0153] S401: Get logs to be processed.

[0154] Among them, the logs to be processed can be WAF protection logs.

[0155] S402: Extract key fields from the logs to be processed to obtain source IP information and attack type.

[0156] S403: Match the source IP information with threat intelligence in the threat intelligence knowledge base to determine the threat information corresponding to the source IP information.

[0157] S404: Determine whether the match is successful based on the threat information corresponding to the source IP information; if yes, proceed to step S405; if no, proceed to step S408.

[0158] S405: Update the prompt word based on the threat information corresponding to the source IP information to obtain the first prompt word.

[0159] S406: Match the attack type with the handling recommendations in the handling strategy knowledge base to determine if the match is successful; if yes, proceed to step S407; if no, proceed to step S408.

[0160] S407: Update the prompt word according to the handling suggestion corresponding to the attack type to obtain the second prompt word.

[0161] S408: Generate prompt text.

[0162] Specifically, when S408 is reached via steps S405 and S407, a prompt text is generated based on the pending log, the first prompt word, and the second prompt word. For example, when S408 is reached via steps S405 and S406, a prompt text is generated based on the pending log and the first prompt word. Similarly, when S408 is reached via steps S404 and S407, a prompt text is generated based on the pending log and the second prompt word. Again, when S408 is reached via steps S404 and S406, a prompt text is generated based on the pending log and the prompt word.

[0163] S409: Input the prompt text into the security handling model, analyze the prompt text based on the security handling model, and obtain the security event handling opinion corresponding to the log to be processed.

[0164] S410: Present security incident handling recommendations to operations personnel.

[0165] For example, embodiments of this application may display security incident handling suggestions in a security device or a security device console, so that operators can take further action based on the displayed security incident handling suggestions.

[0166] Based on the above, after obtaining the log to be processed, this application embodiment can mine prior knowledge of the known information in the log to be processed through the threat intelligence knowledge base and the handling strategy knowledge base to update the prompt words and enrich the prompt text. This can improve the security handling model's understanding of attacks and help the security handling model output more reliable and targeted handling suggestions, thereby improving the efficiency of security incident handling.

[0167] Based on the same inventive concept as the security incident handling method shown in Figure 2, this application also provides a security incident handling device, which can be deployed in a terminal device. Since this device corresponds to the security incident handling method of this application, and the principle by which this device solves the problem is similar to that of the method, the implementation of this device can refer to the implementation of the above method, and repeated details will not be elaborated further.

[0168] Figure 5 shows a schematic diagram of a security event processing device provided in an embodiment of this application. As shown in Figure 5, the security event processing device includes: an acquisition unit 501, a generation unit 502, and an analysis unit 503; wherein,

[0169] Acquisition unit 501 is used to acquire logs to be processed;

[0170] The generation unit 502 is used to generate a prompt text based on the log to be processed;

[0171] Analysis unit 503 is used to input the prompt text into the security handling model, analyze the prompt text based on the security handling model, and determine the security event handling suggestions for the log to be processed; the security handling model is a large model that has been fine-tuned and trained.

[0172] In an optional embodiment, the generation unit 502 is specifically used for:

[0173] The key fields of the log to be processed are extracted to obtain the key fields in the log to be processed; the key fields include source IP information and attack type.

[0174] The key fields are matched with data in the knowledge base to obtain matching results; the knowledge base includes a threat intelligence knowledge base and a response strategy knowledge base.

[0175] The prompt text is generated based on the matching results.

[0176] In an optional embodiment, the generation unit 502 is specifically used for:

[0177] The source IP information is matched with the threat intelligence in the threat intelligence knowledge base to determine the threat information corresponding to the source IP information;

[0178] The attack type is matched with the handling suggestions in the handling strategy knowledge base to determine the handling suggestion corresponding to the attack type.

[0179] In an optional embodiment, the generation unit 502 is specifically used for:

[0180] If the matching result is a failure, then the prompt text is generated based on the log to be processed and the prompt words; or,

[0181] If the matching result is successful, the prompt word is updated according to the threat information corresponding to the source IP information and / or the handling suggestions corresponding to the attack type, and the prompt text is generated according to the updated prompt word.

[0182] In an optional embodiment, the generation unit 502 is specifically used for:

[0183] The prompt word is updated based on the threat information corresponding to the source IP information to obtain a first prompt word; and / or,

[0184] The prompt word is updated based on the handling suggestions corresponding to the attack type to obtain a second prompt word.

[0185] In an optional embodiment, the generation unit 502 is specifically used for:

[0186] The prompt text is generated based on the updated prompt words and the logs to be processed.

[0187] In one optional embodiment, the security handling model is trained in the following manner:

[0188] Obtain a sample dataset, wherein any sample data in the sample dataset includes the prompt word, the labeled log, and the security event handling suggestions corresponding to the labeled log;

[0189] The large model is trained based on the fine-tuning algorithm and the sample dataset to obtain the security handling model.

[0190] In one optional embodiment, obtaining the sample dataset includes:

[0191] Determine the prompt words corresponding to the safety handling model;

[0192] Obtain the labeled logs, which are normal protection logs, missed alarm logs, or false alarm logs;

[0193] Obtain security incident handling recommendations for the labeled logs;

[0194] The sample dataset is generated based on the prompt words, the labeled logs, and the security incident handling suggestions corresponding to the labeled logs.

[0195] Corresponding to the embodiments of the security incident handling method described above, this application also provides an electronic device. This electronic device can be a server, or a terminal device such as a mobile terminal or computer.

[0196] The electronic device includes at least a memory for storing data and a processor for data processing. The processor for data processing can be implemented using a microprocessor, CPU, GPU (Graphics Processing Unit), DSP, or FPGA. The memory stores operation instructions, which can be computer-executable code, to implement the various steps in the industrial quality inspection method described in this application.

[0197] Figure 6 is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. As shown in Figure 6, the electronic device 100 in this embodiment includes: a processor 101, a display 102, a memory 103, an input device 106, a bus 105, and a communication module 104. The processor 101, memory 103, input device 106, display 102, and communication module 104 are all connected through the bus 105, which is used for data transmission between the processor 101, memory 103, display 102, communication module 104, and input device 106.

[0198] The memory 103 can be used to store software programs and modules, such as the program instructions / modules corresponding to the security event handling method in this embodiment. The processor 101 executes various functional applications and data processing of the electronic device 100 by running the software programs and modules stored in the memory 103, such as the security event handling method provided in this embodiment. The memory 103 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs of at least one application, etc.; the data storage area may store data created based on the use of the electronic device 100 (such as logs to be processed and related data such as trained security handling models). In addition, the memory 103 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0199] The processor 101 is the control center of the electronic device 100. It connects various parts of the electronic device 100 via the bus 105 and various interfaces and lines. It performs various functions of the electronic device 100 and processes data by running or executing software programs and / or modules stored in the memory 103 and calling data stored in the memory 103. Optionally, the processor 101 may include one or more processing units, such as a CPU, GPU, digital processing unit, etc.

[0200] The processor 101 can display the security event handling suggestions corresponding to the log to be processed to the user via the display 102.

[0201] The processor 101 can also connect to the network via the communication module 104 to obtain logs to be processed.

[0202] Input device 106 is mainly used to obtain user input operations, and the input device 106 may also be different depending on the electronic device. For example, when the electronic device is a computer, the input device 106 can be an input device such as a mouse or keyboard; when the electronic device is a smartphone, tablet computer, or other portable device, the input device 106 can be a touch screen.

[0203] This application also provides a computer storage medium storing computer-executable instructions for implementing the security event handling method described in any embodiment of this application.

[0204] In some possible implementations, various aspects of the industrial quality inspection method provided in this application can also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to cause the computer device to execute the steps of the security event handling method according to the various exemplary embodiments of this application described above. For example, the computer device can execute the flow of the security event handling method with steps S201 to S203 as shown in FIG2.

[0205] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0206] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A security event handling method, characterized by, The method comprises: obtaining a to-be-processed log; generating a prompt text according to the to-be-processed log; inputting the prompt text into a security handling model, performing handling suggestion analysis on the prompt text based on the security handling model, and determining a security event handling suggestion for the to-be-processed log. The security handling model is a large model trained through fine-tuning.

2. The method of claim 1, wherein, The method of generating a prompt text according to the to-be-processed log comprises: performing key field extraction on the to-be-processed log to obtain key fields in the to-be-processed log; the key fields include source IP information and attack type; matching the key fields with data in a knowledge base to obtain a matching result; the knowledge base includes a threat intelligence knowledge base and a handling strategy knowledge base; generating the prompt text according to the matching result.

3. The method of claim 2, wherein, The method of matching the key fields with data in a knowledge base comprises: matching the source IP information with threat intelligence in the threat intelligence knowledge base to determine threat information corresponding to the source IP information; matching the attack type with handling suggestions in the handling strategy knowledge base to determine handling suggestions corresponding to the attack type.

4. The method of claim 3, wherein, The method of generating the prompt text according to the matching result comprises: if the matching result is a matching failure, generating the prompt text according to the to-be-processed log and a prompt word; or if the matching result is a matching success, updating the prompt word according to the threat information corresponding to the source IP information and / or the handling suggestions corresponding to the attack type, and generating the prompt text according to the updated prompt word.

5. The method of claim 4, wherein, The method of updating the prompt word according to the threat information corresponding to the source IP information and / or the handling suggestions corresponding to the attack type comprises: updating the prompt word according to the threat information corresponding to the source IP information to obtain a first prompt word; and / or updating the prompt word according to the handling suggestions corresponding to the attack type to obtain a second prompt word.

6. The method of claim 5, wherein, The method of generating the prompt text according to the updated prompt word comprises: generating the prompt text according to the updated prompt word and the to-be-processed log.

7. The method according to any one of claims 1 to 6, characterized in that, The security handling model is trained in the following manner: obtaining a sample data set, wherein each sample data in the sample data set includes a prompt word, a labeled log, and a security event handling suggestion corresponding to the labeled log; training the large model according to a fine-tuning algorithm and the sample data set to obtain the security handling model.

8. The method of claim 7, wherein, The method of obtaining a sample data set comprises: determining a prompt word corresponding to the security handling model; obtaining a labeled log, wherein the labeled log is a normal protection log, a missed report log, or a false positive log; obtaining a security event handling suggestion set for the labeled log; generating the sample data set according to the prompt word, the labeled log, and the security event handling suggestion corresponding to the labeled log.

9. An electronic device, comprising: The device comprises a memory and a processor, and the memory stores a computer program executable on the processor, and when the computer program is executed by the processor, the method in any one of claims 1-8 is implemented.

10. A computer-readable storage medium having stored therein a computer program, characterized in that, The computer program, when executed by a processor, implements the method of any one of claims 1-8.

Images