Attack Chain Reconstruction Method Based on LLM Prior-Knowledge Guidance and Heterogeneous Graph Reasoning
In the face of multi-stage and cross-device complex network attacks, reconstructing the complete attack link from massive heterogeneous security logs is the core problem of security operation. In the existing methods, the traditional graph model lacks a deep understanding of the semantics of alerts, and large language...