Security orchestration, control, and automated handling methods for multiple device types

Abstract

The present invention proposes a security orchestration, control and automated disposal method for various types of equipment, which belongs to the industrial Internet environment and includes the following steps: obtaining equipment information; based on this information, classifying and identifying the equipment, and establishing an equipment asset list; building a security orchestration platform that integrates multiple security tools and control measures; formulating corresponding security policies and control rules on the platform for different types of equipment to form a policy library; using the security orchestration platform, deploying and configuring corresponding security monitoring modules for each type of equipment according to the policy library, and monitoring the equipment operation status and network behavior in real time; when the monitoring module detects a potential security threat, the platform automatically matches the corresponding policy; based on the matching policy, the platform coordinates and triggers the automated disposal process, and orchestrates the execution of security disposal operations. Through this method, it is possible to achieve security management and automated disposal of various devices, and improve the security and response capabilities of the industrial Internet environment.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet technology and relates to security orchestration, management and automation methods for various types of equipment. Background Art

[0002] In the existing technology, the device security management in the industrial Internet environment mainly relies on various independent security tools and measures. These tools include firewalls, intrusion detection systems, anti-virus software, and manually performed security updates and patch management. These independent tools usually need to be configured and managed separately, and the lack of a unified security orchestration platform increases the complexity of security management. At the same time, the existing security policies and control rules are mostly static configurations, which are difficult to dynamically adjust according to changes in device types and operating environments.

[0003] In addition, there are some major problems with existing technologies. First, various security tools and measures are independent of each other and lack a unified integrated platform, resulting in inefficient security management. Second, manual configuration and management of security measures is not only time-consuming and labor-intensive, but also prone to errors, increasing potential security risks. In addition, static security policies and control rules cannot cope with dynamically changing security threats, making it difficult to achieve real-time monitoring and automated disposal of device operating status and network behavior. Summary of the invention

[0004] In response to the above problems, this application proposes a security orchestration, control and automated disposal method for various types of equipment, which can realize the security management and automated disposal of various devices, and improve the security and response capabilities of the industrial Internet environment.

[0005] This application provides security orchestration, control, and automated disposal methods for various types of devices, including:

[0006] Obtain device information in an industrial Internet environment, the device information including: device type, operating system, and firmware version;

[0007] Based on the acquired equipment information, classify and identify the equipment and establish an equipment asset list;

[0008] Building a security orchestration platform that integrates multiple security tools and controls;

[0009] For different types of equipment in the equipment asset list, formulate corresponding security policies and control rules on the security orchestration platform to form a policy library;

[0010] Using the security orchestration platform, according to the policy library, deploy and configure the corresponding security monitoring module for each type of device to achieve real-time monitoring of the device operation status and network behavior; when the security monitoring module detects a potential security threat, the security orchestration platform automatically matches the corresponding policy in the policy library;

[0011] Based on the matching policies, the security orchestration platform coordinates and triggers the automated disposal process, orchestrating the following security disposal operations:

[0012] Implement isolation measures for specific equipment in the equipment asset list;

[0013] Push matching firmware updates based on device information;

[0014] Automatically adjust security configuration based on device type.

[0015] Furthermore, the obtaining of device information in the industrial Internet environment includes:

[0016] Deploy network scanning probes in the industrial Internet environment and use them to discover devices in the network;

[0017] Use protocol identification technology to determine the communication protocol type of the device;

[0018] Based on the protocol type, execute the corresponding information collection instructions to obtain device information;

[0019] Establish a device information database to store and update the collected device information.

[0020] Furthermore, based on the acquired device information, the devices are classified and identified, and a device asset list is established, including:

[0021] Conduct a preliminary classification based on device type;

[0022] Based on the operating system version, firmware version and the results of the preliminary classification, further subdivision and classification are performed;

[0023] Assigning a unique identifier to each device;

[0024] Record the physical location and network topology location of the device;

[0025] Generate and maintain a detailed device information profile for each device, including device type, operating system version, firmware version, physical location, network location, and unique identifier.

[0026] Furthermore, the construction of the security orchestration platform includes:

[0027] Integrate multiple security tools and controls;

[0028] Provides a unified management interface for users to configure, monitor and manage various security tools and control measures;

[0029] Configure an automated task scheduler to automatically perform security checks, updates, and response tasks based on predefined policies and rules;

[0030] Integrated log management and analysis modules to centrally collect and store log data from various security tools and devices, and support analysis of real-time and historical data;

[0031] Set up an alarm and notification system to automatically generate alarms and notify relevant personnel when abnormal behavior or security threats are detected.

[0032] Furthermore, the security tools and control measures include:

[0033] Intrusion detection systems and intrusion prevention systems, which monitor and detect abnormal behavior and potential threats in network traffic in real time;

[0034] Firewalls, which provide rule-based access control to protect networks and devices from unauthorized access;

[0035] Anti-virus and anti-malware tools to detect and remove viruses and malware from your device;

[0036] Data encryption tools to protect sensitive data in transit and storage;

[0037] Multi-factor authentication system to enhance device and user authentication security;

[0038] Behavioral analytics tools that use data analysis techniques to identify and respond to abnormal device behavior and network activity.

[0039] Furthermore, for different types of devices in the device asset list, corresponding security policies and control rules are formulated on the security orchestration platform to form a policy library, including:

[0040] Formulate an initial security policy based on the device type, wherein the initial security policy includes access control, data transmission encryption, and abnormal behavior detection;

[0041] Develop targeted patch management and update strategies based on the device's operating system and firmware version to ensure that the device always runs the latest security version;

[0042] Set different security levels and emergency response measures based on the role and importance of the device in the network;

[0043] Define security rules for specific data sensitivity and device connectivity, including data transfer restrictions, encryption requirements, and access logging.

[0044] Furthermore, the security orchestration platform is used to deploy and configure corresponding security monitoring modules for each type of device according to the policy library to achieve real-time monitoring of device operation status and network behavior, including:

[0045] Install a customized security monitoring module on each type of device, adapted to the device's operating system and firmware version;

[0046] Configure the monitoring module to collect real-time data on device operation status, including CPU usage, memory usage, disk activity, and network connection status; and analyze the device's network behavior in real time, monitor inbound and outbound traffic, and detect abnormal traffic patterns and suspicious network activities.

[0047] Furthermore, the security orchestration platform is used to deploy and configure corresponding security monitoring modules for each type of device according to the policy library to achieve real-time monitoring of device operation status and network behavior, and also includes:

[0048] Use encryption technology to protect monitoring data transmitted from devices to the security orchestration platform to ensure that the data is not tampered with or stolen during transmission;

[0049] Aggregate monitoring data to the security orchestration platform for centralized analysis, and use predefined security policies and control rules for real-time anomaly detection;

[0050] Set up an alarm mechanism. When the monitoring module detects abnormal behavior or potential threats, it will immediately notify the security orchestration platform and generate a detailed alarm report.

[0051] Furthermore, when the security monitoring module detects a potential security threat, the security orchestration platform automatically matches the corresponding policy in the policy library, including:

[0052] According to the following formula (1), the importance index DI of the device that detects potential security threats is calculated:

[0053] ;

[0054] in, It is the key functional factor of the equipment; The data sensitivity of the device; is the device connectivity, w1, w2, w3 are weight coefficients; and To adjust the parameters;

[0055] According to the following formula (2), the threat severity TS is evaluated:

[0056] ;

[0057] in, is the false alarm probability; is the vulnerability impact; is the attack indicator strength; To adjust the parameters;

[0058] According to the following formula (3), the strategy effectiveness PE is calculated based on historical data:

[0059] ;

[0060] in, For the The success rate of the strategy applied; and are the time decay parameter and stability adjustment parameter respectively; is the number of historical applications;

[0061] According to the following formula (4), the strategy matching score SMS is calculated:

[0062] ;

[0063] in, is the weight coefficient and satisfies and To adjust the parameters;

[0064] SMS sorts the policies in the policy library according to the policy matching scores, selects the policy with the highest score as the matching policy, and orchestrates the execution of the automated disposal process.

[0065] Furthermore, the security orchestration, control and automated handling method for multiple types of devices also includes:

[0066] The security orchestration platform records the process of security disposal operations and generates detailed security incident reports including device information, trigger reasons, and measures taken.

[0067] The beneficial effects of the technical solution provided by this application include:

[0068] By obtaining device information in the industrial Internet environment, including device type, operating system, and firmware version, accurate classification and identification of devices are achieved, and a systematic equipment asset list is established.

[0069] The built security orchestration platform integrates multiple security tools and control measures, making security management more efficient and centralized.

[0070] Corresponding security policies and control rules are formulated on the platform for different types of devices, forming a flexible and dynamic policy library. By deploying and configuring corresponding security monitoring modules on the security orchestration platform, real-time monitoring of device operating status and network behavior can be achieved.

[0071] When the monitoring module detects a potential security threat, the platform automatically matches the corresponding strategy, coordinates and triggers the automated disposal process, and performs isolation measures, pushes firmware updates, and adjusts security configurations. This approach significantly improves the automation of device security management, reduces manual intervention and errors, improves the timeliness and effectiveness of responding to security threats, and overall enhances the security and reliability of the industrial Internet environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 It is a flowchart of a security orchestration, control and automated handling method for multiple device types provided in the first embodiment of the present application. DETAILED DESCRIPTION

[0073] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0074] The first embodiment of the present application provides a method for security orchestration, control and automated handling for multiple types of devices, the process of which is as follows: Figure 1 As shown, the following steps are included:

[0075] Step S101: Obtain device information in the industrial Internet environment, including device type, operating system, and firmware version.

[0076] This step is now described in detail:

[0077] First, the system needs a tool that can scan and identify all connected devices in the network. This tool can be a dedicated network scanning software or a functional module integrated in the security orchestration platform. The scanning tool communicates with each device through network protocols (such as SNMP, ICMP, ARP, etc.) to collect basic device information. Network scanning usually includes the following steps: First, the scanning tool scans all IP addresses in the network to identify which IP addresses are active. For each active IP address, the scanning tool will try to communicate with the device through multiple network protocols to obtain detailed information about the device.

[0078] The device type information can be obtained by querying the device's network interface information or through the device's management information base (MIB). For example, the SNMP protocol allows the scanning tool to query the device's MIB and return information such as the device type. For devices that do not support SNMP, the scanning tool can try to obtain the device type information through the device's HTTP, HTTPS, SSH and other service interfaces.

[0079] The acquisition of operating system information also depends on the communication with the device. For devices that support SNMP, the operating system version information can be directly queried through the SNMP protocol. For devices that do not support SNMP, scanning tools can use service fingerprinting technology to infer the operating system type and version based on the services opened by the device and the characteristics of the returned network packets. For example, tools such as nmap can be used to perform operating system fingerprinting, thereby inferring the operating system and version running on the device.

[0080] Obtaining firmware version information is more challenging. For some devices, the firmware version can be obtained by querying a specific OID (object identifier) ​​through SNMP. For other devices, it may be necessary to obtain the firmware version information through the device's management interface (such as the Web management interface, SSH interface, etc.). The scanning tool may need to simulate logging into these management interfaces to capture and parse the firmware version information returned by the device.

[0081] In the process of collecting device information, it is crucial to ensure the accuracy and completeness of the data. Therefore, the system should have a repeated verification function to ensure that the collected device information is accurate through multiple scans and cross-verifications. The information obtained from each scan should be stored in a central database for subsequent processing and analysis. The database should be designed as an efficient and scalable structure to cope with the management needs of a large number of devices in the industrial Internet environment.

[0082] In addition, to ensure the security of information collection, all communications with the device should use encrypted protocols such as HTTPS, SSH, etc. to prevent information from being stolen or tampered with during transmission. The system should also record the time and source of each information collection for traceability and auditing.

[0083] To summarize, the implementation of step S101 includes the following specific operations: using a network scanning tool to scan all IP addresses in the network and identify active devices; communicating with the device through SNMP, HTTP, HTTPS, SSH and other protocols to obtain device type, operating system and firmware version information; using operating system fingerprint recognition technology to infer the device operating system version; simulating logging into the device management interface to obtain firmware version information; storing the collected device information in a central database, and ensuring the security of information transmission through encryption protocols.

[0084] More specifically, obtaining device information in the industrial Internet environment includes:

[0085] First, deploy network scanning probes in the industrial Internet environment. These probes can be dedicated hardware devices or software modules installed on existing network devices or servers. Network scanning probes should be deployed in key locations that can cover the entire industrial Internet network to ensure that all devices connected to the network can be discovered. During the deployment process, the network topology and device distribution should be considered to select the best deployment points to achieve comprehensive network coverage. Once the network scanning probes are deployed, the next step is to use these probes to scan the network. Network scanning probes communicate with devices in the network by sending probe packets (such as ICMP, ARP, SNMP requests, etc.) to discover the existence of devices. The probes collect preliminary information about the devices, such as IP addresses, MAC addresses, etc. With this basic information, the network scanning probe can build a preliminary list of all devices in the network.

[0086] Next, use protocol identification technology to determine the communication protocol type of each device. Protocol identification technology identifies the type of communication protocol used by the device by analyzing the characteristics of the data packet returned by the device. For example, by analyzing the SNMP data packet responded by the device, it can be determined whether the device supports the SNMP protocol; by analyzing the HTTP or HTTPS response, it can be identified whether the device provides a Web service interface. Commonly used protocol identification technologies include deep packet inspection (DPI), protocol fingerprinting, and port scanning. These technologies are used in combination to accurately identify the type of communication protocol used by the device.

[0087] After determining the communication protocol type of the device, execute the corresponding information collection instructions based on the protocol type to obtain more detailed device information. For example, for devices that support the SNMP protocol, you can send an SNMP GET request to obtain detailed information about the device, such as device type, operating system version, firmware version, device model, etc. For devices that support HTTP / HTTPS, you can send an HTTP GET request to obtain the device's Web management interface information and parse the device details. For devices that support industrial protocols such as Modbus and BACnet, you can send corresponding protocol instructions to obtain the device's operating status and configuration information.

[0088] In order to ensure the security and integrity of information collection, all information collection instructions should be transmitted in encrypted form to prevent the information from being stolen or tampered with during transmission. In addition, the security policies of the network and equipment should be followed during information collection to avoid interference with the normal operation of the equipment. The frequency and method of sending information collection instructions should be optimized according to the device type and network conditions to ensure the real-time nature of the information without causing network congestion or equipment overload.

[0089] The collected device information needs to be stored and managed. To this end, a device information database is established to store and update the collected device information. The device information database should be designed as a structured database, such as a relational database or a NoSQL database, to support efficient data storage, query and update operations. The database structure should include basic device information (such as IP address, MAC address), detailed information (such as device type, operating system version, firmware version) and status information (such as operating status, last update time). The database should have an automatic update mechanism to ensure that when the network scanning probe collects new device information, the records in the database can be updated in a timely manner.

[0090] The security of the database is also a key consideration. The device information database should be configured with access control policies so that only authorized users and system modules can access and operate the database. The database should be backed up regularly to prevent data loss, and a logging function should be set up to record all access and operations to the database for easy auditing and troubleshooting.

[0091] Through the above detailed steps, network scanning probes can be deployed in the industrial Internet environment, and the communication protocol type of the device can be determined using protocol identification technology. Based on the protocol type, corresponding information collection instructions can be executed, and a device information database can be established to store and update the collected device information. In this way, device information in the industrial Internet environment can be fully and accurately acquired and managed, providing basic data support for subsequent security orchestration, control, and automated disposal.

[0092] Step S102: Based on the acquired device information, classify and identify the devices and create a device asset list.

[0093] Here is a detailed description of this step:

[0094] First, the device information obtained from step S101 is stored in a central database. This database needs to have a well-structured design to facilitate subsequent classification and retrieval operations. The device information should include the device type, operating system, firmware version, and any other relevant device feature data, such as the physical location and network topology location of the device.

[0095] Next, the device information needs to be preprocessed. This step includes data cleaning and standardization to ensure the consistency and accuracy of all device information. For example, the operating system and firmware version information is converted into a unified format and any duplicate or redundant data records are removed. After the preprocessing is completed, the device information can be classified according to the predefined classification rules.

[0096] Device classification can be based on a variety of criteria, including but not limited to device type, operating system version, and firmware version. For example, device types can be divided into sensors, actuators, controllers, computing devices, etc. Operating system version and firmware version can also be used to further subdivide device categories, such as different versions of Windows systems, different versions of Linux systems, and various specialized firmware versions.

[0097] To implement device classification, the system can use a classification algorithm or a rule-based classification approach. For example, a set of classification rules can be written that define how to classify a device based on its device information. A rule can include a conditional expression such as "if the device type is sensor and the operating system is Linux, then classify it as a Linux sensor device." These rules can be implemented in the system as scripts or rule engines to automatically perform device classification.

[0098] At the same time as classification, each device needs to be identified. Each device should be assigned a unique identifier (UID), such as the device's MAC address, serial number, or a unique ID generated by the system. This unique identifier will be used to track and manage the status and changes of the device throughout its life cycle.

[0099] After classification and identification, this information needs to be organized into a device asset list. The device asset list should be stored in the form of a database table, with each record corresponding to a device, including all the classification information and unique identifier of the device. The device asset list should also support fast retrieval and query to facilitate subsequent security policy formulation and monitoring.

[0100] To further enhance the usefulness of the equipment inventory, additional metadata can be added, such as the physical location of the equipment, network topology location, owner information, and maintenance records. These metadata help to manage and maintain the equipment more effectively in actual operations.

[0101] Finally, the equipment asset list should have the ability to be dynamically updated and maintained. As new equipment is added, old equipment is eliminated, and the status of existing equipment changes, the equipment asset list needs to be updated in a timely manner. You can set up a regular scanning and update mechanism, or update the equipment asset list instantly through an event trigger mechanism when the equipment information changes.

[0102] In summary, the implementation of step S102 includes preprocessing, classifying and identifying the device information obtained from step S101, and establishing a structured and retrievable device asset list, while ensuring that the list has the ability to be dynamically updated and maintained.

[0103] More specifically, the device assets list is established by classifying and identifying the devices based on the acquired device information, including:

[0104] First, the device information obtained in step S101 is used to perform preliminary classification according to device type. These device types include but are not limited to sensors, actuators, controllers, gateways, computers, and network devices. The preliminary classification can be based on basic attributes of the device, such as manufacturer information, device function, and device purpose. Through this preliminary classification, the devices can be roughly grouped, thereby simplifying the subsequent subdivision classification process.

[0105] After completing the preliminary classification, further subdivision is required based on the operating system version, firmware version, and the results of the preliminary classification. This step provides a more refined classification based on the operating system version and firmware version of the device. First, analyze the operating system version of each device, such as different versions of Windows, Linux, real-time operating system (RTOS), etc. Then, combine the device's firmware version information to subdivide the device. For example, the same type of device may run different versions of firmware, and these different firmware versions may affect the security and functional characteristics of the device. Therefore, the subdivision classification will further divide the devices into smaller groups based on the operating system and firmware version for more accurate management and control.

[0106] After classification, each device needs to be assigned a unique identifier (UID). The unique identifier can be the device's MAC address, serial number, or a unique ID generated by the system. This identifier is used to uniquely identify each device in the system, ensuring that each device can be accurately identified and tracked during management and monitoring. The generation and allocation process of the unique identifier needs to ensure its global uniqueness to avoid conflicts and duplications.

[0107] At the same time, record the physical location and network topology location of each device. The physical location refers to the installation location of the device in the actual physical space, such as the specific location, floor, and room of the production workshop. The network topology location refers to the location of the device in the network structure, such as the connected switch port, subnet information, and adjacent devices. The information of the physical location and network topology location helps to quickly locate the device when a problem occurs, and perform troubleshooting and maintenance.

[0108] Generating and maintaining detailed device information files for each device is an important next step. The device information file should include the following: device type, operating system version, firmware version, physical location, network location, and unique identifier. The device type records the preliminary classification results of the device, the operating system version and firmware version record the software environment of the device, the physical location and network location record the installation and network connection of the device, and the unique identifier is used to uniquely identify the device. The device information file should be stored in the device information database in a structured manner to ensure the integrity and retrievability of the information.

[0109] In order to maintain the accuracy and timeliness of device information, the device information archive needs to be updated and maintained regularly. When the operating system version, firmware version or physical location of the device changes, the system should automatically or manually update the corresponding information archive. In addition, device information should be checked regularly to ensure that the data in the device information archive is consistent with the actual device status.

[0110] Step S103: construct a security orchestration platform, which integrates multiple security tools and control measures.

[0111] Building a security orchestration platform is a key step to ensure that the entire system can operate effectively. To achieve this goal, a series of detailed and clear operations are required to ensure that the platform can integrate multiple security tools and control measures and provide a unified management and control interface.

[0112] First, you need to select the right hardware and software infrastructure to support the efficient operation of the security orchestration platform. The hardware infrastructure should include high-performance servers, network equipment, and storage systems to ensure that the platform can handle a large amount of device information and security events. The software infrastructure needs to select the appropriate operating system, database management system, and middleware to ensure the reliability, scalability, and security of the platform.

[0113] After the hardware and software infrastructure is ready, the platform needs to be installed and configured. First, install the operating system and necessary basic software, such as database management systems and middleware. Next, install and configure the core software of the security orchestration platform, including the security management console, policy management module, monitoring and analysis module, etc. These software modules should be able to work together to provide comprehensive security management functions.

[0114] Integrating multiple security tools and control measures is a core step in building a security orchestration platform. First, you need to select and install various security tools, such as intrusion detection systems (IDS), intrusion prevention systems (IPS), firewalls, anti-virus software, and data encryption tools. Each security tool has its own unique functions and configuration requirements, so it needs to be installed and configured according to specific needs. For example, firewalls need to be configured with access control rules, intrusion detection systems need to be configured with monitoring rules and alarm policies, and anti-virus software needs to regularly update the virus database.

[0115] When installing and configuring security tools, you need to ensure that these tools can be seamlessly integrated with the security orchestration platform. This can be achieved by using standard interfaces and protocols such as RESTful API, SNMP, and Syslog to enable communication and data exchange between different security tools. For example, firewalls and intrusion detection systems can be configured to send monitoring data to the security orchestration platform through the SNMP protocol for centralized analysis and processing.

[0116] Building a security orchestration platform also requires providing a unified management and control interface so that users can easily manage and control various security tools and control measures. This interface should include a security management console that provides centralized management capabilities for all integrated security tools. Users can use the security management console to view device status, monitor security events, configure security policies and rules, and perform various security operations. The security management console should have a good user interface design, provide an intuitive graphical interface and easy-to-use operation procedures.

[0117] In order to ensure the efficient operation of the security orchestration platform, it is also necessary to configure and optimize the performance and security of the platform. This includes configuring load balancing and failover mechanisms to ensure that the platform can maintain stable operation under high load and failure conditions. It is also necessary to configure access control and permission management of the security orchestration platform to ensure that only authorized users can access and operate the platform's functions. Security measures such as multi-factor authentication and role-based access control (RBAC) can be used to enhance the security of the platform.

[0118] In addition, building a security orchestration platform also requires regular maintenance and updates to ensure that the platform can cope with ever-changing security threats and technological developments. Regularly check and update the platform's software version, patches, and configurations to ensure that the platform is always in optimal condition. At the same time, regular security audits and assessments are conducted to identify and fix potential security vulnerabilities and risks.

[0119] Through the above detailed and clear steps, a security orchestration platform can be built that integrates multiple security tools and control measures to provide comprehensive security management and control functions to ensure the security of equipment in the industrial Internet environment.

[0120] More specifically, building a security orchestration platform includes:

[0121] Integrate multiple security tools and control measures. Building a security orchestration platform first requires integrating multiple security tools and control measures. This process starts with selecting the appropriate platform infrastructure, including hardware and software environments. In terms of hardware, high-performance servers and storage devices need to be configured to handle large amounts of security data and perform complex security analysis. In terms of software, the operating system and database management system should be able to support high concurrency and high reliability.

[0122] Once the infrastructure is ready, you can start integrating various security tools and control measures. These tools include intrusion detection systems (IDS), intrusion prevention systems (IPS), firewalls, anti-virus software, data encryption tools, multi-factor authentication systems, and behavioral analysis tools. Each tool has specific installation and configuration requirements, which need to be configured in detail according to the documentation provided by the vendor. Make sure these tools are compatible with other components of the platform and can communicate through standard interfaces (such as API, SNMP, Syslog, etc.).

[0123] To ensure efficient operation of the system, intrusion detection systems and intrusion prevention systems should monitor and detect abnormal behaviors and potential threats in network traffic in real time. Firewalls need to protect networks and devices from unauthorized access based on predefined access control rules. Anti-virus and anti-malware tools are used to detect and remove viruses and malware from devices. Data encryption tools are responsible for protecting sensitive data in transmission and storage. Multi-factor authentication systems enhance the authentication security of devices and users to ensure that only authorized users can access the system. Behavioral analysis tools use data analysis technology to identify and respond to abnormal device behaviors and network activities, and timely detect and respond to potential threats by analyzing device and network behavior patterns.

[0124] The platform also needs to provide a unified management interface that allows users to configure, monitor and manage various security tools and control measures. This interface should be designed to be intuitive and easy to use, usually including a web-based control panel that users can access through a browser. The management interface needs to support various operations, such as adding and removing security policies, monitoring device status, viewing security events and logs, etc. In order to achieve these functions, the interface backend needs to be integrated with the interfaces of various security tools to ensure real-time synchronization and display of data.

[0125] Configuring an automated task scheduler is another critical step. The scheduler is used to automatically perform security checks, updates, and response tasks based on predefined policies and rules. The task scheduler needs to be able to support scheduled tasks and event-driven tasks. For example, a scheduled scan task can be executed every night to perform a comprehensive scan of the network; an event-driven task is triggered immediately when a security threat is detected. The scheduler needs to be highly reliable and flexible and can be adjusted according to actual needs.

[0126] The integrated log management and analysis module is designed to centrally collect and store log data from various security tools and devices, and support analysis of real-time and historical data. The log management system needs to be configured with a log collector to aggregate the log data generated by all security tools into a central repository. The storage of log data needs to adopt efficient compression and indexing technology to support fast retrieval and analysis. The analysis module uses big data analysis technology to analyze log data in real time, identify potential security threats and abnormal behaviors, and generate detailed reports.

[0127] Setting up an alert and notification system is also a critical step. When abnormal behavior or security threats are detected, the system needs to be able to automatically generate alerts and notify relevant personnel. The alert system needs to be configured with flexible alert rules that can be customized according to threat type, severity, and device type. Notification methods include email, SMS, instant messaging, etc. to ensure that relevant personnel can receive alert information in a timely manner and take appropriate measures. The alert information needs to include a detailed description of the threat, information about the affected device, and recommended disposal measures.

[0128] Through the above detailed operation steps, you can build a security orchestration platform that integrates multiple security tools and control measures, provide a unified management interface, configure an automated task scheduler, integrate log management and analysis modules, and set up an alarm and notification system, thereby realizing security orchestration, control and automated disposal for multiple device types.

[0129] Step S104: For different types of devices in the device asset list, formulate corresponding security policies and control rules on the security orchestration platform to form a policy library to provide effective security management for different types of devices in the device asset list. The following is a detailed description of this step:

[0130] First, based on the classification information in the device asset list, it is necessary to determine the security requirements and risk characteristics of each device type. This step includes analyzing the role of each device type in the network, the sensitivity of the data it processes, and the potential threats it faces. For example, sensor devices may mainly face the risk of data tampering, while controller devices may face more complex remote intrusion and manipulation risks. Through such analysis, a preliminary list of security requirements can be developed for each device type.

[0131] Next, start developing corresponding security policies and management rules based on the security requirements of each device type. Security policies should include access control policies, data protection policies, intrusion detection and defense policies, etc. Access control policies specify which devices and users can access specific device resources and under what conditions access is allowed. For example, a strict access control policy can be developed for controller devices, allowing only users with multi-factor authentication to access. Data protection policies include measures such as data encryption, data integrity verification, and data backup to protect the data processed by the device from unauthorized access or tampering.

[0132] Intrusion detection and prevention strategies should include detection and defense measures for various types of attacks that devices may face. For example, abnormal traffic detection rules can be formulated for sensor devices to detect and block possible DDoS attacks; operational behavior analysis rules can be formulated for controller devices to identify and block abnormal control instructions. All these strategies and rules should be customized and optimized according to the characteristics of the device type.

[0133] After developing security policies and control rules, they need to be compiled into the policy library of the security orchestration platform. The policy library should have structured data storage and retrieval capabilities to efficiently store and manage a large number of security policies and rules. Each policy and rule should contain detailed definitions and instructions, including applicable device types, specific security measures, trigger conditions, and execution steps. For example, a data encryption policy for sensor devices may include: enabling the AES-256 encryption algorithm on sensor devices, all transmitted data must be encrypted, and the encryption key must be changed regularly.

[0134] In order to ensure the dynamic and flexible nature of the policy library, a policy update and maintenance mechanism needs to be set up. Security threats and device environments are constantly changing, and security policies and control rules also need to be adjusted and updated in a timely manner. Policies and rules in the policy library can be regularly reviewed and evaluated, and updated and optimized based on the latest security intelligence and device operation status. At the same time, the security orchestration platform should have the automation function of policy push and execution. When the policies in the policy library are updated, the new policies can be automatically deployed to the corresponding devices and ensure their effective execution.

[0135] In addition, the policy library should have version control and audit functions to track and manage historical versions and change records of policies. This helps to trace back and analyze problems when they occur, find the root cause of the problem and take corresponding measures.

[0136] During the implementation process, the developed security policies and control rules should be rigorously tested and verified to ensure their effectiveness and reliability. Policies and rules can be tested in a simulated environment to evaluate their performance in various attack scenarios, and adjusted and optimized based on the test results.

[0137] In summary, the implementation of step S104 includes determining the security requirements of each device type, formulating corresponding security policies and management rules, incorporating them into the policy library of the security orchestration platform, and setting up a policy update and maintenance mechanism, while ensuring the effectiveness and reliability of the policy.

[0138] More specifically, for different types of devices in the device asset list, corresponding security policies and control rules are formulated on the security orchestration platform to form a policy library, including:

[0139] First, develop an initial security policy based on the device type. The initial security policy should cover access control, data transmission encryption, and abnormal behavior detection. The access control policy specifies which users or devices can access specific resources and under what conditions access is allowed. To achieve this, you can configure role-based access control (RBAC) to grant access rights based on the role of the user or device. The data transmission encryption policy ensures that data transmitted between devices is always encrypted to prevent unauthorized interception and tampering. Common encryption technologies include SSL / TLS encryption, IPsec encryption, etc. The abnormal behavior detection policy sets rules and algorithms to monitor the behavior of devices, identify and respond to abnormal activities. For example, machine learning algorithms can be used to analyze the historical behavior patterns of devices to detect and alert behaviors that deviate from normal patterns.

[0140] The key next step is to develop targeted patch management and update strategies based on the device's operating system and firmware version to ensure that the device is always running the latest security version. Each device's operating system and firmware version may have different security vulnerabilities, so a specific patch management strategy needs to be developed to ensure that the device is always running the latest security version. This includes regularly scanning the device's operating system and firmware version, identifying devices that need to be updated, and automatically pushing the corresponding security patches and update packages. The platform should be configured with an update management module that can communicate with the device vendor's update server, download the latest patches and update packages, and push them to the device according to the predetermined update plan. In order to reduce the impact of updates on device operation, you can set an update window period to perform update operations when the device load is low.

[0141] Another important aspect of ensuring network security is to set different security levels and emergency response measures according to the role and importance of the device in the network. The role and importance of the device in the network determine the security protection level and emergency response measures it needs. For example, core gateway devices and controller devices are usually critical to the stability and security of the network, and require higher security levels and more stringent emergency response measures. These measures include regularly backing up configuration data, configuring redundant devices and links, setting stricter access control and monitoring policies, etc. In an emergency, the platform should be able to quickly switch to backup devices or links to ensure the continued operation of the network.

[0142] Defining security rules for specific data sensitivity and device connectivity is an important part of the policy library. Data sensitivity refers to the confidentiality and importance of the data processed by the device. Data of different sensitivities require different protection measures. For devices that process highly sensitive data, stricter data transmission restrictions and encryption requirements should be set to ensure the confidentiality and integrity of data during transmission. Device connectivity refers to the degree of connection between a device and other devices. Devices with high connectivity often face more security threats and require stronger security protection. For example, network isolation rules can be set to isolate high-risk devices in controlled network areas and limit their direct communication with other devices. Access logging is another important security rule. By recording the access and operation logs of the device, it can be traced and analyzed after a security incident occurs, find the root cause of the problem and take corresponding protective measures.

[0143] Through these detailed operation steps, corresponding security policies and control rules can be formulated on the security orchestration platform to form a comprehensive policy library. This policy library can provide customized security protection measures for different types of devices in the device asset list to ensure the overall security of the network and devices.

[0144] Step S105: Using the security orchestration platform, according to the policy library, deploy and configure the corresponding security monitoring module for each type of device to achieve real-time monitoring of the device operation status and network behavior; when the security monitoring module detects a potential security threat, the security orchestration platform automatically matches the corresponding policy in the policy library. The following is a detailed description of this step:

[0145] First, the security orchestration platform needs to extract security monitoring requirements for each type of device from the policy library. These monitoring requirements include device operating status parameters and network behavior indicators that need to be monitored, such as CPU usage, memory usage, disk activity, network traffic, port access records, etc. The monitoring requirements for each type of device will vary depending on its type and function, so they need to be customized according to the device classification information in the device asset list.

[0146] Next, select and deploy appropriate security monitoring modules. These modules can be specialized monitoring software or hardware devices that collect the device's operating status and network behavior data. When installing and configuring the monitoring module, you need to ensure that it is compatible with the target device's operating system and firmware version and does not negatively impact the device's normal operation. The specific deployment process includes installing a monitoring software agent on the device or configuring a monitoring hardware device in the network path. The monitoring software agent should be configured to run automatically when the device starts and send monitoring data to the security orchestration platform at regular intervals.

[0147] After installing and configuring the monitoring module, a series of initialization and calibration operations are required. First, the monitoring module should be connected and registered with the security orchestration platform to ensure that the platform can identify and manage all monitoring modules. The registration process may require providing the device's unique identifier and authentication information to verify the legitimacy of the device. Then, the monitoring module needs to be configured to collect and transmit data according to the requirements in the policy library. The configuration process includes setting the data collection frequency, data transmission protocol, and encryption method. Data transmission should use a secure protocol such as TLS or IPsec to ensure the confidentiality and integrity of the data during transmission.

[0148] After configuration is complete, the monitoring module begins to collect device operating status and network behavior data in real time and transmits the data to the security orchestration platform. After the platform receives the data, it processes and analyzes it in real time through the built-in analysis engine. The analysis engine uses pre-set security policies and rules to compare and evaluate the collected data to identify potential security threats and abnormal behaviors. For example, if the monitoring module detects a sudden and significant increase in the CPU usage of the device, or abnormal port access requests appear in the network traffic, the analysis engine will determine whether these behaviors constitute potential threats based on the rules in the policy library.

[0149] When the security monitoring module detects a potential security threat, the security orchestration platform automatically matches the corresponding policy in the policy library. The matching process includes selecting the most appropriate response strategy based on the threat type, device type, and monitoring data. The platform will call the predefined policy matching algorithm to evaluate the priority and applicability of multiple candidate policies, and finally select the optimal policy for disposal. After the matching is completed, the platform will generate a series of automated disposal instructions and trigger the subsequent automated disposal process.

[0150] In addition, the security orchestration platform should also provide real-time alarm and notification functions. When the monitoring module detects a serious security threat, the platform should immediately send an alarm notification to the security manager and provide a detailed threat analysis report. The alarm notification can be sent in a variety of ways, including email, SMS, instant messaging tools, etc. The threat analysis report should include a detailed description of the threat, the affected device information, preliminary disposal suggestions, etc., to help security managers take necessary countermeasures in a timely manner.

[0151] Through the above detailed operation steps, the security orchestration platform can realize real-time monitoring and automated security management of various types of equipment, effectively improving the overall security in the industrial Internet environment.

[0152] More specifically, the security orchestration platform deploys and configures corresponding security monitoring modules for each type of device based on the policy library to achieve real-time monitoring of device operating status and network behavior, including:

[0153] First, a customized security monitoring module needs to be installed on each type of device. This process is used to determine the operating system and firmware version of each device to ensure that the installed monitoring module is compatible with the device's existing software environment. To this end, monitoring modules that adapt to various operating systems and firmware versions need to be developed or selected. These modules can be lightweight software agents that are installed on the device to collect and transmit monitoring data in real time. The installation process can be automated through remote deployment tools to ensure efficient and accurate deployment of monitoring modules on a large number of devices.

[0154] After installation, these monitoring modules must be configured to collect real-time data on the device's operating status. This data includes, but is not limited to, CPU usage, memory usage, disk activity, and network connection status. The monitoring module needs to be configured to collect this data regularly and perform preliminary analysis and processing on the device. For example, you can set it to collect CPU usage and memory usage once a minute, and perform data aggregation and filtering locally to reduce the amount of data transmitted. For monitoring network behavior, the module needs to analyze the device's inbound and outbound traffic in real time, identify and record all network connections, and detect abnormal traffic patterns and suspicious network activities. Abnormal traffic patterns can include sudden large amounts of data transmission, frequent connection request failures, unauthorized port access, etc.

[0155] After configuration, the security monitoring module starts running and collecting data. To ensure the security of the monitoring data, encryption technology must be used to protect the data transmitted from the device to the security orchestration platform to ensure that the data is not tampered with or stolen during transmission. Common encryption technologies include TLS (Transport Layer Security) and IPsec (Internet Protocol Security), which can ensure that the data is not tampered with or stolen during transmission. The monitoring module encrypts the collected data and transmits it to the security orchestration platform through a secure network connection.

[0156] On the security orchestration platform, a mechanism for data aggregation and analysis needs to be set up. After the platform receives the encrypted data, it first decrypts and verifies it to ensure the integrity and authenticity of the data. The platform then stores the monitoring data in a centralized database for subsequent analysis and processing. The security orchestration platform should have efficient data processing capabilities, be able to quickly analyze large amounts of real-time data, and perform real-time anomaly detection using predefined security policies and control rules. The platform uses a variety of data analysis techniques, such as statistical analysis, behavioral analysis, and machine learning algorithms, to detect abnormal patterns and potential threats in device operating status and network behavior in real time.

[0157] To ensure timely response to abnormal behavior and potential threats, an alarm mechanism needs to be set up. When the monitoring module detects abnormal behavior or potential threats, an alarm message is immediately sent to the security orchestration platform. After receiving the alarm, the platform generates a detailed alarm report based on the predefined alarm rules and notifies the relevant security personnel. The alarm report should include a detailed description of the abnormal behavior, the affected device information, a preliminary risk assessment, and recommended countermeasures. Notification methods can include email, SMS, instant messaging tools, etc. to ensure that security personnel can receive the alarm information in a timely manner and take appropriate measures.

[0158] Through the above detailed operation steps, you can use the security orchestration platform to deploy and configure the corresponding security monitoring module for each type of equipment according to the policy library, monitor the equipment operation status and network behavior in real time, ensure the security of data transmission, and set up an effective alarm mechanism. These steps ensure comprehensive and real-time security monitoring of devices in the industrial Internet environment, which helps to timely discover and respond to various security threats.

[0159] Furthermore, when the security monitoring module detects a potential security threat, the security orchestration platform automatically matches the corresponding policy in the policy library, including:

[0160] When the security monitoring module detects a potential security threat, it first needs to calculate the importance index (DI) of the device that detected the potential security threat. The importance index is a quantitative indicator to evaluate the importance of the device in the overall system and is used to determine the priority of the device in the disposal process. Formula (1) is used to calculate the importance index of the device:

[0161] ;

[0162] In this formula, the meanings of various parameters and coefficients and their acquisition methods are as follows:

[0163] CF (Critical Function Factor): Indicates the criticality of the function performed by the device in the system. This value can be determined by the functional description of the device and its role in the system. For example, a device that controls a critical production process will have a higher CF value. The CF can be obtained by expert evaluation or calculation based on historical data.

[0164] DR (Data Sensitivity): Indicates the sensitivity of the data processed by the device. Data sensitivity can be determined by the type of data processed by the device and the confidentiality level of the data. Devices that process sensitive information or personal data will have a higher DR value. The method of obtaining DR can include data classification and classification process.

[0165] DC (Device Connectivity): Indicates the density of connections between a device and other devices, that is, the importance of the device in the network topology. Devices with high connectivity play a pivotal role in the network. The DC value can be calculated using network topology analysis tools.

[0166] w1, w2, w3 (weight coefficients): These coefficients are used to adjust the influence of CF, DR and DC on the final importance index. The weight coefficients can be set through historical data analysis and expert evaluation.

[0167] a and b (adjustment parameters): These parameters are used to adjust the impact of the nonlinear part of the formula to ensure the rationality and effectiveness of the calculation results. Parameters a and b can be adjusted through optimization algorithms or experimental data.

[0168] After calculating the importance index (DI), the next step is to assess the severity of the threat (TS). Formula (2) is used to assess the severity of the threat:

[0169] ;

[0170] In this formula, the meanings of various parameters and coefficients and their acquisition methods are as follows:

[0171] FP (False Positive Probability): Indicates the false positive probability of threat detection. This value can be obtained by analyzing historical detection data and threat type statistics. The lower the FP value, the more credible the threat.

[0172] VI (Vulnerability Impact): Indicates the potential impact of a vulnerability on devices and systems. The V1 value can be obtained through vulnerability scoring systems (such as CVSS) or expert evaluation.

[0173] Al (Attack Index Intensity): Indicates the intensity of the currently detected attack activity. The Al value can be obtained through real-time monitoring data analysis, such as abnormal traffic, attack frequency, etc.

[0174] c (tuning parameter): used to adjust the nonlinear part of the vulnerability impact to ensure that the impact of the VI is reasonable. The c value can be adjusted through optimization algorithms or experimental data.

[0175] Next, the effectiveness (PE) of the strategy is calculated based on historical data. Formula (3) is used to calculate the effectiveness of the strategy:

[0176] ;

[0177] In this formula, the meanings of various parameters and coefficients and their acquisition methods are as follows:

[0178] (No. Success rate of strategy application each time): indicates the success rate of each strategy application, which can be obtained by recording the effect statistics after each strategy application.

[0179] and (Time decay parameters and stability adjustment parameters): used to adjust the time weight and stability impact of the historical success rate to ensure that newer data has a greater impact on the calculation results. These parameters can be adjusted through optimization algorithms or experimental data.

[0180] (Historical Application Times): Indicates the historical application times of the strategy used for calculation.

[0181] Finally, the strategy matching score (SMS) is calculated. Formula (4) is used to calculate the strategy matching score:

[0182] ;

[0183] In this formula, the meanings of various parameters and coefficients and their acquisition methods are as follows:

[0184] (Weight coefficients): These coefficients are used to adjust the influence of DI, TS and PE on the final strategy matching score, satisfying The weighting coefficients can be set through historical data analysis and expert evaluation.

[0185] (Adjustment parameters): used to adjust the nonlinear effects of various parts in the formula to ensure reasonable calculation results. These parameters can be adjusted through optimization algorithms or experimental data.

[0186] Through the above detailed steps, the importance index (DI), threat severity (TS), policy effectiveness (PE) and policy matching score (SMS) of the device can be calculated, and the policies in the policy library can be sorted according to the policy matching score. The policy with the highest score is selected as the matching policy, and the automated disposal process is orchestrated and executed.

[0187] Step S106: Based on the matching strategy, the security orchestration platform coordinates and triggers the automated handling process, and orchestrates and executes a series of security handling operations to ensure the security and stability of the system. Specifically, the steps include:

[0188] Isolate specific devices in the device asset list. When the security orchestration platform matches a policy that is appropriate for the current threat, the platform first generates specific automated disposal instructions. These instructions include isolating specific devices, pushing matching firmware updates, and automatically adjusting security configurations based on device types. The platform coordinates the execution of these instructions through a central control module to ensure that each operation is carried out in sequence and seamlessly.

[0189] Implementing isolation measures is a critical step in the disposal process. The security orchestration platform first isolates the threatened device through network devices (such as switches and routers) or directly through firewall rules. The platform issues instructions to cut off the device's communication with other network nodes to prevent the threat from spreading. Specific actions may include modifying firewall rules to deny all inbound and outbound traffic from the device, or adjusting switch port settings to isolate the device to a controlled network area. These operations need to be monitored in real time to ensure that the device has indeed been successfully isolated and readjusted when necessary.

[0190] After the device is isolated, the platform pushes the matching firmware update based on the device information. This step requires the latest firmware versions of various devices to be prepared in advance and stored in a secure update server. The security orchestration platform transmits the update package to the threatened device through a secure communication channel. After the device receives the update package, it will automatically update according to the platform's instructions. The update process includes downloading the firmware, verifying integrity, backing up the current configuration, installing the update, and restarting the device. The platform needs to monitor the entire update process to ensure that all steps are completed smoothly, and take remedial measures when the update fails, such as re-pushing the update or rolling back to the previous firmware version.

[0191] Automatically adjusting security configurations based on device type is also a key step. The platform will refer to the predefined configuration templates in the policy library and automatically adjust the security settings of the device based on the specific type of device and current security requirements. These settings may include access control lists (ACLs), security policy groups, logging levels, encryption settings, etc. The platform sends configuration commands to the device through a secure management interface (such as SNMP, SSH, or a dedicated API). After the device receives the configuration command, it will make corresponding adjustments. The platform needs to monitor the execution of these adjustments in real time to ensure that all configuration changes are applied correctly and to perform verification and validation when necessary.

[0192] The entire disposal process requires a strict monitoring and feedback mechanism. The security orchestration platform should record the execution status and results of each step and generate detailed logs and reports. These logs and reports not only help track every detail of the disposal process, but also provide data support for subsequent audits and analysis. If any abnormal situation occurs during the execution process, the platform should generate an alarm in time and notify the relevant security personnel to take further manual intervention measures.

[0193] Through the above detailed operation steps, the security orchestration platform can effectively coordinate and trigger the automated disposal process, execute isolation measures, firmware updates and security configuration adjustments for specific devices, thereby improving the overall security in the industrial Internet environment.

[0194] Furthermore, the security orchestration, control and automated handling method for multiple types of devices also includes:

[0195] The security orchestration platform records the process of security disposal operations and generates detailed security incident reports including device information, trigger reasons, and measures taken.

[0196] When the security orchestration platform detects a potential security threat and starts the automated disposal process, the first thing to do is to record the entire disposal operation in real time. This process starts when the security monitoring module detects abnormal behavior, and all related operations and events need to be recorded in detail. The record content includes the trigger reason, a specific description of the detected abnormal behavior, the affected device information, the current status of the device, and the specific measures taken.

[0197] The platform needs to have a logging system to achieve this function. The logging system should have a high-precision timestamp function to ensure that each operation step can be accurately recorded in chronological order. All records should be stored in a central database for subsequent analysis and auditing. The database needs to be highly reliable and secure to prevent data loss or tampering.

[0198] After detecting abnormal behavior, the security orchestration platform generates and executes a series of automated disposal instructions based on the corresponding policies in the policy library. These instructions include, but are not limited to: isolation measures for affected devices, firmware updates, and adjustments to security configurations. The generation and execution process of each instruction needs to be recorded. The records include the specific content of the instruction, the execution time, the execution results, and the state changes of the device during the execution process.

[0199] At the same time, the platform should be able to capture and record any manual intervention operations. For example, during the automated disposal process, if security personnel find that additional manual operations are required, such as adjusting security policies or directly intervening in device operations, these manual operations also need to be recorded in detail. The manual intervention record should include the identity of the operator, the specific operation content, the operation time, and the reason for the operation.

[0200] After completing all the disposal operations, the security orchestration platform needs to generate a detailed security incident report. This report should fully cover the entire incident handling process, from the detection of abnormal behavior to the final completion of the disposal operation. The report should include: detailed information about the affected device (such as device type, operating system version, firmware version, physical location and network location), description of the detected abnormal behavior, triggering reasons, detailed description of each measure taken in the automated disposal process, records of manual intervention operations, and the timeline of the entire disposal process.

[0201] To ensure the completeness and traceability of the report, the security incident report should also include references or attachments to all relevant log records. These log records provide detailed operational details and chronological order to facilitate post-event analysis and auditing. In addition, the report should be generated in a structured format to facilitate rapid retrieval and analysis when needed. Common formats include PDF documents, spreadsheets, or database entries.

[0202] After the report is generated, the relevant security managers and system administrators should be automatically notified to ensure that they can understand the handling of the security incident in a timely manner and take necessary follow-up measures. The notification method can include email, SMS or instant messaging. Security incident reports should be stored in a dedicated security incident database, and appropriate access control permissions should be set to ensure that only authorized personnel can view and download reports.

[0203] A second embodiment of the present application provides an electronic device, the electronic device comprising:

[0204] processor;

[0205] The memory is used to store a program, and when the program is read and executed by the processor, the program executes the security orchestration, management and automation disposal method for multiple device types provided in the first embodiment of the present application.

[0206] The third embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the security orchestration, management and automation disposal method for multiple device types provided in the first embodiment of the present application is executed.

[0207] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A security orchestration, control and automated handling method for various types of devices, characterized in that: include: Obtain device information in an industrial Internet environment, the device information including: device type, operating system, and firmware version; Based on the acquired equipment information, classify and identify the equipment and establish an equipment asset list; Building a security orchestration platform that integrates multiple security tools and controls; For different types of equipment in the equipment asset list, formulate corresponding security policies and control rules on the security orchestration platform to form a policy library; Using the security orchestration platform, according to the policy library, deploy and configure the corresponding security monitoring module for each type of device to achieve real-time monitoring of the device operation status and network behavior; when the security monitoring module detects a potential security threat, the security orchestration platform automatically matches the corresponding policy in the policy library; including: According to the following formula (1), the importance index DI of the device that detects potential security threats is calculated: ； in, It is the key functional factor of the equipment; The data sensitivity of the device; is the device connectivity, w1, w2, w3 are weight coefficients; and To adjust the parameters; According to the following formula (2), the threat severity TS is evaluated: ； in, is the false alarm probability; is the vulnerability impact; is the attack indicator strength; To adjust the parameters; According to the following formula (3), the strategy effectiveness PE is calculated based on historical data: ； in, For the The success rate of the strategy applied; and are the time decay parameter and stability adjustment parameter respectively; is the number of historical applications; According to the following formula (4), the strategy matching score SMS is calculated: ； in, is the weight coefficient and satisfies and To adjust the parameters; SMS sorts the policies in the policy library according to the policy matching scores, selects the policy with the highest score as the matching policy, and orchestrates the execution of the automated disposal process; Based on the matching policies, the security orchestration platform coordinates and triggers the automated disposal process, orchestrating the following security disposal operations: Implement isolation measures for the equipment in the equipment asset list; Push matching firmware updates based on device information; Automatically adjust security configuration based on device type.

2. The method for security orchestration, control and automated handling for multiple types of devices according to claim 1 is characterized in that: The obtaining of device information in the industrial Internet environment includes: Deploy network scanning probes in the industrial Internet environment and use them to discover devices in the network; Use protocol identification technology to determine the communication protocol type of the device; Based on the protocol type, execute the corresponding information collection instructions to obtain device information; Establish a device information database to store and update the collected device information.

3. The method for security orchestration, control and automated handling for multiple types of devices according to claim 1 is characterized in that: The device assets list is established by classifying and identifying the devices based on the acquired device information, including: Conduct a preliminary classification based on device type; Based on the operating system version, firmware version and the results of the preliminary classification, further subdivision and classification are performed; Assigning a unique identifier to each device; Record the physical location and network topology location of the device; Generate and maintain a detailed device information profile for each device, including device type, operating system version, firmware version, physical location, network location, and unique identifier.

4. The method for security orchestration, control and automated handling for multiple types of devices according to claim 1, characterized in that: The construction of the security orchestration platform includes: Integrate multiple security tools and controls; Provides a unified management interface for users to configure, monitor and manage various security tools and control measures; Configure an automated task scheduler to automatically perform security checks, updates, and response tasks based on predefined policies and rules; Integrated log management and analysis modules to centrally collect and store log data from various security tools and devices, and support analysis of real-time and historical data; Set up an alarm and notification system to automatically generate alarms and notify relevant personnel when abnormal behavior or security threats are detected.

5. The method for security orchestration, control and automated handling for multiple types of devices according to claim 4 is characterized in that: The security tools and controls include: Intrusion detection systems and intrusion prevention systems, which monitor and detect abnormal behavior and potential threats in network traffic in real time; Firewalls, which provide rule-based access control to protect networks and devices from unauthorized access; Anti-virus and anti-malware tools to detect and remove viruses and malware from your device; Data encryption tools to protect sensitive data in transit and storage; Multi-factor authentication system to enhance device and user authentication security; Behavioral analytics tools that use data analysis techniques to identify and respond to abnormal device behavior and network activity.

6. The method for security orchestration, control and automated handling for multiple types of devices according to claim 1, characterized in that: For different types of devices in the device asset list, corresponding security policies and control rules are formulated on the security orchestration platform to form a policy library, including: Formulate an initial security policy based on the device type, wherein the initial security policy includes access control, data transmission encryption, and abnormal behavior detection; Develop targeted patch management and update strategies based on the device's operating system and firmware version to ensure that the device always runs the latest security version; Set different security levels and emergency response measures based on the role and importance of the device in the network; Define security rules for data sensitivity and device connectivity, including data transfer restrictions, encryption requirements, and access logging.

7. The method for security orchestration, control and automated handling for multiple types of devices according to claim 1, characterized in that: The security orchestration platform is used to deploy and configure corresponding security monitoring modules for each type of device according to the policy library to achieve real-time monitoring of device operation status and network behavior, including: Install a customized security monitoring module on each type of device, adapted to the device's operating system and firmware version; Configure the monitoring module to collect real-time data on device operation status, including CPU usage, memory usage, disk activity, and network connection status; and analyze the device's network behavior in real time, monitor inbound and outbound traffic, and detect abnormal traffic patterns and suspicious network activities.

8. The method for security orchestration, control and automated handling for multiple types of devices according to claim 7, characterized in that: The security orchestration platform is used to deploy and configure corresponding security monitoring modules for each type of device according to the policy library to achieve real-time monitoring of the device operation status and network behavior, and also includes: Use encryption technology to protect monitoring data transmitted from devices to the security orchestration platform to ensure that the data is not tampered with or stolen during transmission; Aggregate monitoring data to the security orchestration platform for centralized analysis, and use predefined security policies and control rules for real-time anomaly detection; Set up an alarm mechanism. When the monitoring module detects abnormal behavior or potential threats, it will immediately notify the security orchestration platform and generate a detailed alarm report.

9. The method for security orchestration, control and automated handling for multiple types of devices according to claim 1, characterized in that: Also includes: The security orchestration platform records the process of security disposal operations and generates detailed security incident reports including device information, trigger reasons, and measures taken.

Images