security-platform/test-data/sample-alerts.csv at main

Files

T

brunoandClaude 842fa8dbe5 feat: 完整AI SOC分析师平台 - LLM集成与前后端优化

本次提交包含完整的AI SOC（Security Operations Center）分析师平台，支持本地大模型和Claude API集成，实现端到端的安全威胁分析。

## 🚀 主要功能

### 后端架构 (FastAPI)
- **多源数据接入**: 支持JSON/CSV格式安全告警数据上传
- **智能预处理**: 基于YAML配置的字段映射和实体提取
- **图分析引擎**: NetworkX驱动的攻击链图构建和分析
- **评分系统**: 实体和子图的多维度风险评分算法
- **LLM集成**: 支持多提供商(Claude、OpenAI、本地模型)的智能报告生成
- **API接口**: 完整的RESTful API (Swagger文档: /docs)

### 前端界面 (Vue 3 + TypeScript)
- **拖拽上传**: 支持拖拽上传和实时预览
- **管道分析**: 可视化的数据处理管道状态
- **智能报告**: 动态生成的威胁分析报告和可视化
- **响应式设计**: 适配桌面和移动端的现代UI

### LLM智能分析
- **多模型支持**: qwen3(8B/32B)、deepseek-r1(70B)、Claude 4等
- **超时优化**: 分层超时配置(120s-600s)适配不同模型规模
- **内容清理**: 自动过滤模型思考过程，输出专业分析报告
- **中文优化**: 针对中文安全分析场景的prompt工程

## 🛠️ 技术栈

**后端**: FastAPI + SQLAlchemy + NetworkX + 多LLM提供商
**前端**: Vue 3 + TypeScript + Naive UI + Tailwind CSS + Vite
**数据处理**: YAML配置 + JSONPath表达式
**部署**: Docker支持 + 环境变量配置

## 🐛 修复的关键问题

1. **LLM超时问题**: 实现前后端分层超时配置，支持大模型长时间推理
2. **报告格式化**: 修复Markdown渲染和换行符显示问题
3. **数据映射**: 统一前后端字段命名和数据结构映射
4. **时间格式**: 修复时间戳解析和中文本地化显示
5. **思考标签清理**: 自动过滤qwen模型的<think>标签

## 📊 测试数据

包含完整的多阶段APT攻击场景测试数据:
- 钓鱼邮件 → 恶意软件执行 → C2通信
- 云凭证窃取 → 资源探测 → 横向渗透
- 后门用户创建 → 权限提升 → 容器控制

## 🔧 开发工具

- **模型切换**: switch_model.py 支持快速切换本地LLM模型
- **超时测试**: test_llm_timeout.py 验证不同模型性能
- **依赖安装**: install_llm_deps.py 自动安装LLM依赖

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

2025-09-06 06:56:09 +08:00

1.8 KiB

Raw Permalink Blame History

1	event_time	alert_type	severity	attack_stage	attack_scenario	description	source_ip	target_ip	user	host
2	2025-07-19T10:05:23.451Z	phishing.malware_execution	high	initial_access,execution	Phishing attachment executed malware, set autorun and connected to C2	User executed a masqueraded PDF executable via browser, created autorun registry entry, and established C2 connection.		103.216.154.99	[email protected]	WIN-01-7A3B
3	2025-07-19T10:17:58.120Z	credential_access.aksk_exfil	high	credential_access,exfiltration	Endpoint stole AliCloud AK/SK and exfiltrated	Credential access on host reading AliCloud credential file containing AK/SK and cloud account identifiers, followed by outbound transfer.		103.216.154.99	ming.zhang	WIN-01-7A3B
4	2025-07-19T10:22:15Z	cloud.discovery.describe	medium	discovery	Cloud resource enumeration (DescribeInstances)	DescribeInstances call on Alibaba Cloud ECS using the compromised identity to enumerate assets.	185.163.209.22		ming.zhang
5	2025-07-19T10:35:47Z	cloud.persistence.backdoor_user	high	persistence	Create backdoor user for persistent access	A new cloud user backdoor_admin was created under the same account by ming.zhang, indicating persistence setup.	45.76.218.17		ming.zhang
6	2025-07-19T10:52:31Z	cloud.privilege_abuse.kubeconfig_download	high	credential_access,lateral_movement	Download KubeConfig to pivot into Kubernetes	Backdoor user downloaded Kubernetes kubeconfig; certificate subject ties to the victim identity, enabling higher-privilege access.	209.133.78.45		backdoor_admin
7	2025-07-19T11:15:00Z	k8s.exec.remote_control	critical	execution	Container command execution via exec in production	Certificate identity used to exec into production pod; actual user resolved to backdoor_admin, confirming interactive command execution.	77.77.77.77		[email protected]	nginx-pod

1.8 KiB Raw Permalink Blame History

1.8 KiB

Raw Permalink Blame History