Case matching-based network security operation aid decision-making method, system and device

The invention discloses a network security operation auxiliary decision-making method, system and device based on case matching, and the method comprises the steps: firstly obtaining a case of a network security operation practice, extracting a case description, and carrying out the word segmentation and text cleaning, and generating a decision-making case corpus; constructing a training set based on the decision-making case corpus, and training to obtain an auxiliary decision-making model; and finally, extracting event description from the target event, performing word segmentation processing to generate corpora, calculating the similarity between all decision case corpora and the event description of the target event based on the auxiliary decision model, performing similarity correction, and selecting a plurality of decision cases with the highest similarity after correction as an auxiliary decision basis. According to the method and the system, safety operation experience accumulated by safety experts in