Cooperative emergency response SOAR script recommendation method based on natural language

Abstract

The invention discloses a collaborative emergency response SOAR script recommendation method based on a natural language. The method comprises the steps that three attributes of people, relation and content are extracted from a sentence in chat content of a combat room, and data standardization processing is carried out; a text pre-training model BERT is used as a text encoder, and text content in a specific use scene is concerned differently and mapped into word vectors; constructing a standard script library, and performing mask training on the model by adopting a script step prediction algorithm to enable the model to mine potential internal relations of each workflow step in a script; a collaborative filtering algorithm is used to carry out event correlation degree feature matching, collaborative work of another dimension is realized, and an SOAR script scheme is recommended; the scheme has the characteristics of spoken chat content, information fragmentation and the like of a combat room, and can quickly and accurately transfer the SOAR script and timely cope with a security event.

Description

technical field [0001] The invention relates to the field of network security recommendation method processing, in particular to a natural language-based collaborative emergency response SOAR script recommendation method. Background technique [0002] In recent years, in the field of network security, SOAR (Security Orchestration, Automation and Response, security orchestration and automated response) has become the key research direction of many enterprises and organizations. In the process of network security emergency response, it is necessary to arrange and combine a series of workflows into scripts for emergency response to security incidents. The scripted working mode runs through the whole process of the SOAR system. When a security event is triggered, the script will run in the SOAR system in an automated form to solve the corresponding security threat. Through scripted means, the response time in the face of network security threats will be greatly shortened and th...

AI Technical Summary

Problems solved by technology

There is a lack of exploration of the underlying internal laws between scripts and the steps that constitute the script;

[0005] (2) For unknown security threats, more human collaboration is required to analyze and judge incidents. The personnel in the war room have different job responsibilities, and the importance of analysis and judgment and language expression are different, making it difficult for traditional natural language processing models to capture these threats. Meaningful Features of an Unstructured Language

Images