An event handling strategy intelligent recommendation method and system

Abstract

The application discloses an event treatment strategy intelligent recommendation method and system, the method comprises the following steps: S1: event traceability evidence collection, obtaining the basic data of the target network and node, and analyzing the historical state information of the target object of the sensing event; S2: treatment intention identification, identifying the security element information of the event according to the original data and analysis data in the event traceability evidence collection stage, and then understanding the event treatment strategy intention; S3: treatment strategy recommendation, adopting a hybrid recommendation method based on ontology and collaborative filtering, first converting the event treatment demand into a standardized event treatment intention description through a formal description method, then converting and decomposing the event treatment intention into specific treatment strategy commands through feature recognition, and finally combining the strategy knowledge base to generate a specific security strategy template recognizable by equipment, realizing intelligent configuration from demand to specific strategy. The safety event treatment strategy recommendation is accurate, fast and continuously optimized.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to an intelligent recommendation method and system for incident handling strategies. Background Technology

[0002] With the rapid development of technologies such as cloud computing, the Internet of Things, and 5G, IT architecture and service models are constantly changing, and the network environment is becoming increasingly large and complex. This has led to numerous problems in the current network environment: multiple security vulnerabilities exist in core hardware and software infrastructure, backdoors are increasingly pre-installed in network devices, and threats against networks and information systems are becoming increasingly tool-based, automated, and organized. Against this backdrop, enterprises have strengthened their security awareness and deployed security equipment to protect data and information systems. While this approach has reduced security threats to some extent, it has also brought new problems: security equipment is increasingly becoming "isolated" and operating independently, generating security alarms and incidents with large volumes of data and high false alarm rates. For security operations and maintenance personnel, handling security alerts and incidents often relies on expert experience to provide specific response strategies. During security incident handling, it's also necessary to coordinate technical, network, environmental, and human resources. Based on the detailed response strategy, multiple security zones within the assigned network must be managed and maintained, and the strategies for various security protection devices must be configured and checked. Especially when facing various network emergencies, emergency policy adjustments are often required, a process that is quite time-consuming. Over-reliance on the on-site response capabilities of security operations and maintenance personnel often leads to missed opportunities to resolve problems immediately, causing temporary business interruptions and affecting business connectivity. However, in large-scale, complex networks, security protection devices are numerous and varied, and security policy configurations are complex and diverse. Even the defense policy configuration for the same security protection device may differ and have different emphases depending on the scenario. The accuracy of security device policy configuration has a significant impact on network accessibility, business information system access, and data security.

[0003] As security incident handling strategies become increasingly granular, on the one hand, more security resources need to be involved, and on the other hand, higher requirements are placed on the professional capabilities of security management and maintenance personnel. With the occurrence of a large number of security alarms and incidents, the generation and configuration of incident handling strategies are labor-intensive and human operation is prone to errors. These oversights will leave opportunities for attackers.

[0004] Meanwhile, with the development of artificial intelligence and information technology, network attack methods are also showing a trend towards intelligence. This has prompted network security protection systems to use intelligent means to promptly detect problems, quickly adjust strategies, and implement precise responses. Research on network security incident handling strategies is gradually moving from relying on expert experience to automation and intelligence. Various methods for automatically generating and verifying incident handling strategies based on rule matching, experience statistics, and event analysis have emerged. However, in network security incidents, the adaptability and suitability of incident handling strategies to defense targets still need to be further improved. Summary of the Invention

[0005] The purpose of this invention is to overcome the problems of existing technologies. This invention discloses an intelligent recommendation method and system for incident handling strategies. It is based on the ATT&CK technical and tactical knowledge framework and the D3FEND network security countermeasures knowledge framework, and integrates data from five dimensions: attack, asset, vulnerability, intelligence and incident handling strategy, to construct a network security defense knowledge graph.

[0006] A method and system for recommending security incident handling strategies based on a network security defense knowledge graph describes the relationships between network security incidents and target vulnerabilities, vulnerabilities and attack methods, attack methods and handling strategies, and handling strategies and defense measures. This approach integrates the knowledge graph as a semantically rich dataset with strong logical reasoning capabilities into the security incident handling strategy recommendation generation process, which not only enhances the semantic information of the data but also further improves the accuracy of the recommendations.

[0007] When dealing with cybersecurity alerts and incidents, intelligent methods are used to identify security element information related to the incident. Based on the incident handling strategy, the security element information related to the cybersecurity incident and their correlation, the system can accurately, quickly and continuously optimize the security incident handling strategy recommendation. This assists security operations personnel in quickly handling cybersecurity incidents and responding to various cybersecurity threats in a timely and efficient manner, solving problems such as poor timeliness of cybersecurity incident handling and inefficient utilization of multiple resources.

[0008] The objective of this invention is achieved through the following technical solution:

[0009] An intelligent recommendation method for event handling strategies includes the following steps:

[0010] S1: Event tracing and evidence collection

[0011] The system acquires basic data on target networks and nodes through active detection, passive monitoring, and proxy collection, including node information, traffic information, topology information, threat information, and intelligence information, and analyzes the historical state information of the target objects in the perception event.

[0012] S2: Action Intent Recognition

[0013] Based on the raw and analyzed data from the incident tracing and evidence collection phase, the security elements of the incident are identified to understand the intent of the incident handling strategy.

[0014] S3: Recommended handling strategy

[0015] A hybrid recommendation method based on ontology and collaborative filtering is adopted. First, the event handling requirements are transformed into standardized event handling intent descriptions through formal description methods. Then, the event handling intents are decomposed into specific handling policy commands through feature recognition. Finally, a specific security policy template that can be recognized by the device is generated by combining the policy knowledge base, so as to realize intelligent configuration from requirements to specific policies.

[0016] According to a preferred embodiment, in step S1, the node information includes: status and configuration information of host terminals, servers, security protection devices, network devices, etc., and obtains online status, process and service startup status, fingerprint characteristics of hardware platforms and operating systems, resource usage and policy configuration details of security protection equipment through active packet detection combined with terminal security protection agent software;

[0017] The traffic information includes mirrored traffic acquired by the switch or traffic data collected by traffic probes;

[0018] The topology information is obtained by actively sending packets and sniffing, combined with terminal security protection agent software, and in conjunction with network devices, acquiring physical connection data and analyzing the physical topology of the target network of the event.

[0019] The threat information is obtained by collecting alarm data from terminals, servers, network devices, application systems, and security protection devices, summarizing, integrating, and analyzing the data to obtain threat information from terminal and device nodes, including attacks, vulnerabilities, viruses, abnormal behaviors, faults, and weak passwords.

[0020] The intelligence information includes technical threat intelligence information, which is collected through web crawling or manual input.

[0021] According to a preferred embodiment, step S2 includes:

[0022] S21: Data collection and labeling, collecting a set of sample data for training and evaluating the intent recognition model, the sample data including various different cybersecurity incidents and incident handling strategy labels;

[0023] S22: Security element extraction. First, the event is preprocessed, mainly including text cleaning, word segmentation, stop word removal, and text structuring of the event sample. Then, by extracting the security element feature information of the network security event sample and related information, the network security event is transformed into a vector representation so that the computer can process and analyze it.

[0024] S23: Model training and selection. In the identification of policy intent, various machine learning algorithms are used to build models and learn the relationship between policy intent and input cybersecurity incident samples through training data.

[0025] According to a preferred embodiment, in step S22, feature extraction is performed using the bag-of-words model, TF-IDF, and word embedding.

[0026] According to a preferred embodiment, in step S23, the machine learning algorithm includes: Naive Bayes algorithm, support vector machine algorithm, and decision tree algorithm.

[0027] According to a preferred embodiment, step S3 includes: extracting features from network security events and modeling event information by comparing the features of potential vulnerabilities, abnormal behaviors, and security alarms of the target objects in the network security defense knowledge graph.

[0028] The similarity and confidence scores of the handling strategies are calculated based on the attack method weights and event feature information of the event information to obtain a recommendation list. Then, based on the event recommendation handling strategy template and event security element information, the information is filtered using content-based and collaborative filtering techniques. After being sorted in descending order of similarity, the recommended handling strategies are obtained.

[0029] According to a preferred embodiment, the intelligent recommendation method for event handling strategies further includes step S4: performance evaluation and optimization.

[0030] The effectiveness and reliability of the recommended handling strategies for cybersecurity incidents are verified. The fuzzy comprehensive evaluation method is used to quantify, unify, and standardize the evaluation indicators. The analytic hierarchy process is used to determine the weight values ​​of each indicator. Finally, a comprehensive weighted method is used to establish a comprehensive performance evaluation model to evaluate the effectiveness of the recommended handling strategies.

[0031] According to a preferred embodiment, step S4 specifically includes:

[0032] S41: Establish an evaluation index system, and determine specific evaluation indexes for incident handling effectiveness based on the accuracy of recommended handling strategies, the effectiveness of handling strategy implementation, the timeliness of incident handling, and human evaluation.

[0033] The evaluation indicator system also supports dynamic adjustment, providing a visual configuration interface to dynamically adjust indicators by adding and removing them;

[0034] S42: Before establishing the evaluation model, the indicators are first quantified and normalized. Quantitative indicators are statistically analyzed based on the collected data. Non-quantitative indicators are quantified and converted into quantitative indicators. Finally, a weight coefficient is given for each evaluation indicator.

[0035] S43: By using fuzzy comprehensive evaluation, indicator unification, data standardization and analytic hierarchy process, the preprocessing of the defense action effectiveness evaluation indicator data establishes the weight coefficient of each indicator, and finally obtains the action effectiveness evaluation value by linear weighted summation.

[0036] S44: Statistical analysis of incident handling effectiveness evaluation, including target effectiveness evaluation analysis and historical effectiveness evaluation analysis;

[0037] For target effectiveness assessment and analysis, the lower the effectiveness assessment value, the worse the defensive action is, and the ability to handle the event should be increased; the higher the value, the better the defensive action is.

[0038] Historical performance evaluation analysis compares and analyzes the performance of multiple events from multiple dimensions with the same elements and the same handling effect. The results of the comparative analysis are presented visually, which can evaluate the effectiveness of the handling strategy for handling cybersecurity events.

[0039] On the other hand, the present invention also discloses:

[0040] An intelligent recommendation system for incident handling strategies is provided, wherein the intelligent recommendation system for incident handling strategies is generated by employing the aforementioned intelligent recommendation method for incident handling strategies.

[0041] According to a preferred embodiment, the architecture of the intelligent recommendation system for event handling strategies includes:

[0042] A data collection layer configured to collect data related to network security incidents;

[0043] The processing layer is configured to perform cleaning, deduplication, standardization, and formatting on the basic data information obtained by the acquisition layer. After processing, relevant entities and their relationships are extracted from multi-source heterogeneous network security data to complete the one-to-one mapping from the network security defense knowledge graph data layer to the pattern layer.

[0044] Analysis layer, configured to recommend treatment strategies and optimize effectiveness evaluation;

[0045] The presentation layer is configured to use graphical visualization tools to visualize the knowledge graph, show the relevance and hierarchical structure of cybersecurity incident information, and assist security management and maintenance personnel in making decisions.

[0046] The aforementioned main solution of the present invention and its various further alternative solutions can be freely combined to form multiple solutions, all of which are solutions that can be adopted and are claimed by the present invention. Those skilled in the art, after understanding the solution of the present invention, will realize that there are many combinations based on existing technology and common knowledge, all of which are technical solutions to be protected by the present invention, and will not be exhaustively listed here.

[0047] The beneficial effects of this invention are:

[0048] This invention is based on network security incident tracing and evidence collection, and constructs a network security defense knowledge graph. When recommending handling strategies, it uses intelligent methods to closely link the strategy with the security elements related to the incident. This enables more accurate location of security threats in the target environment of the incident, and coordinates with security protection devices to block attacks. It achieves accurate, rapid, and intelligent recommendation and continuous optimization of security protection strategies, and assists security operation and maintenance personnel in responding to various network security threats in a timely and efficient manner. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the intelligent recommendation method model for security incident handling strategies of the present invention;

[0050] Figure 2 A schematic diagram of a knowledge graph ontology model for cybersecurity defense;

[0051] Figure 3 This is a schematic diagram of the technical architecture of the intelligent recommendation system for security incident handling strategies of the present invention;

[0052] Figure 4 This is a schematic diagram of the intelligent recommendation process for security incident handling strategies of the present invention;

[0053] Figure 5 This is a diagram illustrating data collection for cybersecurity incidents.

[0054] Figure 6 This is a schematic diagram illustrating strategy recommendations based on the intent of incident handling using a defense knowledge graph. Detailed Implementation

[0055] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.

[0056] It should be noted that similar reference numerals and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. It should be pointed out that, unless otherwise specified, the structures, connections, positional relationships, power source relationships, etc., involved in this invention are all things that those skilled in the art can understand without creative effort based on existing technology.

[0057] Example 1

[0058] refer to Figure 1 As shown in the figure, an intelligent recommendation method for event handling strategies is presented. It mainly includes four stages: event tracking and tracing, handling intent identification, strategy generation and recommendation, and effectiveness evaluation and optimization. The four stages constitute a dynamic, closed-loop system model, reflecting the characteristics of intelligent recommendation: accurate response and continuous optimization.

[0059] 1) Tracing the source of the incident and collecting evidence

[0060] Through various methods such as active detection, passive listening, and proxy data collection, such as Figure 5 As shown, basic network and node data are acquired, including node information, traffic information, topology information, threat information, and intelligence information. Historical state information of the target objects in the perceived event is also analyzed, including:

[0061] a) Node information, including the status and configuration information of host terminals, servers, security protection devices, network devices, etc., is obtained by actively sending packets to probe and combining terminal security protection agent software to obtain online status, process and service startup status, asset fingerprint characteristics such as hardware platform and operating system, resource usage, and policy configuration details of security protection equipment.

[0062] b) Traffic information, which is obtained through mirrored traffic from switches or traffic probes, and further analyzed to sort out the session relationships between nodes.

[0063] c) Topology information: Physical connection data is obtained by actively sending packets and sniffing, combined with terminal security protection agent software, and network devices are linked to collect and analyze the physical topology of the target network of the event.

[0064] d) Threat information: By collecting alarm data from terminals, servers, network devices, application systems, security protection devices, etc., and summarizing, integrating and analyzing the data, threat information from terminals, devices and other nodes, including attacks, vulnerabilities, viruses, abnormal behavior, faults, weak passwords, etc., is obtained.

[0065] e) Intelligence information, mainly technical threat intelligence information, is mainly collected through methods such as web crawling or manual data entry, and is used for correlation analysis.

[0066] 2) Identification of the intent behind the handling strategy

[0067] Based on the raw and analyzed data from the incident tracing and evidence collection phase, the security elements of the incident are identified to understand the intent of the incident response strategy. This mainly includes the following steps:

[0068] a) Data collection and labeling: A set of sample data needs to be collected for training and evaluating the intent recognition model. These samples should include various network security incidents and incident handling policy labels, such as labeling policies such as restricting network access, disconnecting the network, shutting down, and restarting for incidents of unauthorized network access.

[0069] b) Security element extraction: In identifying the intent of the handling strategy, it is necessary to transform the text of cybersecurity incidents into a form that computers can understand. First, the incidents are preprocessed, mainly including text cleaning, word segmentation, stop word removal, and text structuring of the incident samples. Then, security element feature information is extracted from the cybersecurity incident samples and related information. Commonly used feature extraction methods include bag-of-words model, TF-IDF, and word embedding. These methods can transform cybersecurity incidents into vector representations so that computers can process and analyze them.

[0070] c) Model Training and Selection: In identifying the intent behind a policy action, various machine learning algorithms can be used to build the model, such as Naive Bayes, Support Vector Machines, and Decision Trees. These algorithms can learn the relationship between intent and input cybersecurity event samples through training data. When selecting a classification model, metrics such as accuracy and recall need to be considered. If the model performance is not ideal, it can be improved by adjusting parameters and increasing training data.

[0071] 3) Recommended treatment strategies

[0072] The recommendation method for cybersecurity incident handling strategies adopts a hybrid recommendation approach based on ontology and collaborative filtering, as illustrated in the diagram below. Figure 6As shown, the event handling requirements are first transformed into standardized event handling intent descriptions through formal description methods. Then, the event handling intents are decomposed into specific handling strategy commands through feature recognition. Finally, a specific security policy template that can be recognized by the device is generated by combining the policy knowledge base, so as to realize intelligent configuration from requirements to specific policies.

[0073] This process requires feature extraction of cybersecurity events, event information modeling based on the characteristics of potential vulnerabilities, abnormal behaviors, and security alerts of the target objects in the cybersecurity defense knowledge graph, similarity and confidence scores of handling strategies based on the attack method weights and event feature information of the event information, resulting in a recommendation list. Then, based on the event recommendation handling strategy template and event security element information, the information is filtered using content-based and collaborative filtering techniques, and the recommended handling strategies are obtained after being sorted in descending order of similarity.

[0074] 4) Performance evaluation optimization

[0075] Due to the complexity of network structures and the diversity of threat attacks, the strategies of security protection equipment frequently change. Sometimes, the recommended handling strategies for different cybersecurity incidents, when applied to security equipment, can lead to redundancy and conflicts in equipment strategies, or even cause the security equipment to fail, triggering a series of major cybersecurity incidents.

[0076] Therefore, it is necessary to verify the effectiveness and reliability of the recommended handling strategies for cybersecurity incidents during actual operation. An effectiveness evaluation index system should be established from dimensions such as the effectiveness of cybersecurity incident handling, the effectiveness of security protection equipment strategies, and human evaluation. The fuzzy comprehensive evaluation method should be used to quantify, unify, and standardize the evaluation indicators. The analytic hierarchy process (AHP) should be used to determine the weight values ​​of each indicator. Finally, a comprehensive weighted method should be used to establish a comprehensive effectiveness evaluation model to achieve the effectiveness evaluation of the recommended handling strategies. The specific process is as follows:

[0077] a) Establish an evaluation indicator system. This system forms the basis for assessing the effectiveness of cybersecurity incident response strategies. Only by establishing a reasonable evaluation model and indicator system can the effectiveness of incident response be effectively evaluated, and evaluation suggestions be provided based on the data to better guide cybersecurity incident response. The specific incident response effectiveness evaluation indicator system should be determined based on factors such as the accuracy of recommended response strategies, the effectiveness of strategy implementation, the timeliness of incident response, and human evaluation. Furthermore, the system should support dynamic adjustment of evaluation indicators, providing a visual configuration interface. Indicators can be dynamically adjusted by adding and removing them. Adjusting the evaluation indicator set will change the effectiveness evaluation result value.

[0078] b) Before establishing the evaluation model, the indicators need to be quantified and normalized. Quantitative indicators include the number of security log alerts before and after incident handling, the number of vulnerabilities patched, the number of viruses removed, and the number of attacks blocked. Non-quantitative indicators include system availability and data backup and recovery levels. Quantitative indicators can be statistically analyzed based on the collected data. Non-quantitative indicators need to be quantified and converted into quantitative indicators. Evaluation levels and corresponding quantitative values ​​can be set for non-quantitative indicators, such as a fuzzy evaluation set of five levels: very high, high, average, low, and very low, with corresponding quantitative values ​​of 5, 4, 3, 2, and 1. Non-quantitative indicators are generally evaluated manually. Then, these indicator values ​​are normalized and standardized, converting all processed indicator data into data within the [0,1] interval. Finally, a weight coefficient is given for each evaluation indicator.

[0079] c) Through a series of methods, including fuzzy comprehensive evaluation, indicator standardization, data standardization, and analytic hierarchy process (AHP), the preprocessing of the defense action effectiveness evaluation indicator data has been determined, and the weight coefficient of each indicator has been established. The final effectiveness evaluation value is obtained using a linear weighted summation method.

[0080] d) Statistical analysis of incident response effectiveness, including effectiveness assessment analysis and historical effectiveness assessment analysis. For target effectiveness assessment analysis, the effectiveness assessment value is analyzed; the lower the value, the worse the defensive action, and the greater the need to strengthen the incident response capability; the higher the value, the better the defensive action. Historical effectiveness assessment analysis mainly compares and analyzes the effectiveness of multiple incident responses from multiple dimensions, such as the same factors and the same response results. The comparative analysis results are visualized, which can assess the effectiveness of response strategies for handling cybersecurity incidents.

[0081] This invention is based on network security incident tracing and evidence collection, and constructs a network security defense knowledge graph. When recommending handling strategies, it uses intelligent methods to closely link the strategy with the security elements related to the incident. This enables more accurate location of security threats in the target environment of the incident, and coordinates with security protection devices to block attacks. It achieves accurate, rapid, and intelligent recommendation and continuous optimization of security protection strategies, and assists security operation and maintenance personnel in responding to various network security threats in a timely and efficient manner.

[0082] Example 2

[0083] Based on Example 1, this example discloses an intelligent recommendation system for incident handling strategies. The intelligent recommendation system for incident handling strategies uses the intelligent recommendation method for incident handling strategies described in Example 1 to generate security incident handling strategies.

[0084] Preferably, the architecture of the intelligent recommendation system for event handling strategies includes:

[0085] 1) Data Acquisition Layer: Collects data related to network security incidents, such as... Figure 4 As shown, alarm data from the boundary, host, and application sides is collected through data acquisition interface services. Network interconnection session relationships are monitored through traffic collection such as mirroring. In particular, historical full traffic data is provided for attack behaviors and network failures, and packet analysis and file restoration are performed. Policy configuration and log alarm information of security protection devices are collected through dedicated interfaces, and their running status and topology information are collected through endpoint security protection agent software. Threat intelligence information, such as blacklist / whitelist databases, attack code databases, and vulnerability information databases, is collected through methods such as Internet crawling and manual data import.

[0086] 2) Processing layer: Based on the basic data information obtained from the collection layer, including threat intelligence, malicious code samples, abnormal traffic, asset vulnerabilities, asset network topology, alarm log information, etc., the data is cleaned, deduplicated, standardized, and formatted. After processing, the data is extracted using information extraction technology to extract relevant entities and their relationships from multi-source heterogeneous network security data, completing a one-to-one mapping from the network security defense knowledge graph data layer to the pattern layer.

[0087] 3) Analysis layer: contains Figure 1 The model's functions, such as recommending handling strategies and optimizing effectiveness, firstly extract security element information of cybersecurity incidents, such as network attack methods, affected asset scope, asset vulnerabilities, asset attacks, and asset viruses. Secondly, a pre-trained classification model is used to classify cybersecurity incidents and obtain corresponding incident handling strategy templates. Then, the security element information of cybersecurity incidents and incident handling strategy templates are combined to obtain incident handling recommendation strategy information, which is then transformed into knowledge graph query statements to obtain incident handling recommendation strategies. Finally, evaluation metrics such as recall and precision are used to evaluate the effectiveness and reliability of the recommended incident handling strategies.

[0088] 4) Presentation Layer: The knowledge graph is visualized using graphical visualization tools to show the relevance and hierarchical structure of cybersecurity incident information, including the presentation of information such as assets, vulnerabilities, attacks, alerts, intelligence, and handling strategies. This assists security management and maintenance personnel in making decisions, helping users better understand the entire process of a security incident, quickly understand cybersecurity incident and threat intelligence information, and recommend cybersecurity incident handling strategies for rapid response, thereby improving the work efficiency of security operations and maintenance personnel.

[0089] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An intelligent recommendation method for event handling strategies, characterized in that, The intelligent recommendation method for event handling strategies includes the following steps: S1: Event tracing and evidence collection The system acquires basic data on target networks and nodes through active detection, passive monitoring, and proxy collection, including node information, traffic information, topology information, threat information, and intelligence information, and analyzes the historical state information of the target objects in the perception event. S2: Action Intent Recognition Based on the raw and analyzed data from the incident tracing and evidence collection phase, the security elements of the incident are identified to understand the intent of the incident handling strategy. S3: Recommended handling strategy A hybrid recommendation method based on ontology and collaborative filtering is adopted. First, the event handling requirements are transformed into standardized event handling intent descriptions through formal description methods. Then, the event handling intents are decomposed into specific handling policy commands through feature recognition. Finally, a specific security policy template that can be recognized by the device is generated by combining the policy knowledge base, so as to realize intelligent configuration from requirements to specific policies. Step S4: Performance evaluation and optimization. The effectiveness and reliability of the recommended handling strategies for cybersecurity incidents are verified. The fuzzy comprehensive evaluation method is used to quantify, unify and standardize the evaluation indicators. The analytic hierarchy process is used to determine the weight values ​​of each indicator. Finally, the comprehensive weighted method is used to establish a comprehensive performance evaluation model to evaluate the effectiveness of the recommended handling strategies. Step S4 specifically includes: S41: Establish an evaluation index system, and determine specific evaluation indexes for event handling effectiveness based on the accuracy of recommended handling strategies, the effectiveness of handling strategy implementation, the timeliness of event handling, and human evaluation. The evaluation indicator system also supports dynamic adjustment, providing a visual configuration interface to dynamically adjust indicators by adding and removing them; S42: Before establishing the evaluation model, the indicators are first quantified and normalized. Quantitative indicators are statistically analyzed based on the collected data. Non-quantitative indicators are quantified and converted into quantitative indicators. Finally, a weight coefficient is given for each evaluation indicator. S43: By using fuzzy comprehensive evaluation, indicator unification, data standardization and analytic hierarchy process, the preprocessing of the defense action effectiveness evaluation indicator data establishes the weight coefficient of each indicator, and finally obtains the action effectiveness evaluation value by linear weighted summation. S44: Statistical analysis of incident handling effectiveness evaluation, including target effectiveness evaluation analysis and historical effectiveness evaluation analysis; For target effectiveness assessment and analysis, the lower the effectiveness assessment value, the worse the defensive action is, and the ability to handle the event should be increased; the higher the value, the better the defensive action is. Historical performance evaluation analysis compares and analyzes the performance of multiple events from multiple dimensions with the same elements and the same handling effect. The results of the comparative analysis are presented visually, which can evaluate the effectiveness of the handling strategy for handling cybersecurity events.

2. The intelligent recommendation method for event handling strategies as described in claim 1, characterized in that, In step S1, the node information includes: status and configuration information of host terminals, servers, security protection devices, and network devices. Online status, process and service startup status, fingerprint characteristics of hardware platforms and operating systems, resource usage, and policy configuration details of security protection equipment are obtained through active packet detection combined with terminal security protection agent software. The traffic information includes mirrored traffic acquired by the switch or traffic data collected by traffic probes; The topology information is obtained by actively sending packets and sniffing, combined with terminal security protection agent software, and in conjunction with network devices, acquiring physical connection data and analyzing the physical topology of the target network of the event. The threat information is obtained by collecting alarm data from terminals, servers, network devices, application systems, and security protection devices, summarizing, integrating, and analyzing the data to obtain threat information from terminal and device nodes, including attacks, vulnerabilities, viruses, abnormal behaviors, faults, and weak passwords. The intelligence information includes technical threat intelligence information, which is collected through web crawling or manual input.

3. The intelligent recommendation method for event handling strategies as described in claim 1, characterized in that, Step S2 includes: S21: Data collection and labeling, collecting a set of sample data for training and evaluating the intent recognition model, the sample data including various different cybersecurity incidents and incident handling strategy labels; S22: Security element extraction. First, the event is preprocessed, including text cleaning, word segmentation, stop word removal, and text structuring of the event sample. Then, by extracting the security element feature information of the network security event sample and related information, the network security event is transformed into a vector representation so that the computer can process and analyze it. S23: Model training and selection. In the identification of policy intent, various machine learning algorithms are used to build models and learn the relationship between policy intent and input cybersecurity incident samples through training data.

4. The intelligent recommendation method for event handling strategies as described in claim 3, characterized in that, In step S22, feature extraction is performed using the bag-of-words model, TF-IDF, and word embedding.

5. The intelligent recommendation method for event handling strategies as described in claim 3, characterized in that, In step S23, the machine learning algorithms include: Naive Bayes algorithm, Support Vector Machine algorithm, and Decision Tree algorithm.

6. The intelligent recommendation method for event handling strategies as described in claim 3, characterized in that, Step S3 includes: extracting features from network security events and modeling event information by comparing the features of potential vulnerabilities, abnormal behaviors, and security alarms of the target objects in the network security defense knowledge graph. The similarity and confidence scores of the handling strategies are calculated based on the attack method weights and event feature information of the event information to obtain a recommendation list. Then, based on the event recommendation handling strategy template and event security element information, the information is filtered using content-based and collaborative filtering techniques. After being sorted in descending order of similarity, the recommended handling strategies are obtained.

7. An intelligent recommendation system for event handling strategies, characterized in that, The intelligent recommendation system for incident handling strategies uses the intelligent recommendation method for incident handling strategies as described in any one of claims 1 to 6 to generate security incident handling strategies.

8. The intelligent recommendation system for event handling strategies as described in claim 7, characterized in that, The architecture of the intelligent recommendation system for event handling strategies includes: A data collection layer configured to collect data related to network security incidents; The processing layer is configured to clean, deduplicate, standardize, and format the data based on the basic data information obtained by the acquisition layer. After processing, relevant entities and their relationships are extracted from multi-source heterogeneous network security data to complete the one-to-one mapping from the network security defense knowledge graph data layer to the pattern layer. Analysis layer, configured to recommend treatment strategies and optimize effectiveness evaluation; The presentation layer is configured to use graphical visualization tools to visualize the knowledge graph, show the relevance and hierarchical structure of cybersecurity incident information, and assist security management and maintenance personnel in making decisions.

Images