Network security event script development method and device and storage medium

Abstract

The invention relates to the technical field of network security, and discloses a network security event script development method and device and a storage medium, and the method comprises the steps: obtaining a corresponding attack scene, a defense strategy and a development node from a preset script material library; running a preset development model, inputting the attack scene, the defense strategy, the node type, the node function and the development node into the development model, and generating a trial version event script; and verifying the defense effect of the trial version event script through script trial operation, dynamically replacing the development node based on a verification result, and outputting a formal version event script. The device and the storage medium correspond to the method. Through the closed-loop design of development model construction, intelligent script generation, multi-dimensional defense evaluation and dynamic replacement optimization, the problems of high manual dependence, low response speed, one-sided defense effect and the like in traditional network security script development are solved, and the automation level, real-time adaptability and resource efficiency of network security event response are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and specifically to a network security event scenario development method, device, and storage medium. Background Art

[0002] Cybersecurity incident scripts, based on a combination of various security emergency response actions, automate emergency response work in a scripted manner, accelerating threat response and disposal. However, it is not difficult to find that existing cybersecurity incident scripts are all manually developed and generated, which is unable to adapt to the current explosive growth of cybersecurity needs.

[0003] For example, Chinese patent application number CN202111480376.3 discloses a method, apparatus, device, and readable storage medium for arranging a security network script. The method includes receiving an action node setting instruction for script arrangement; querying and outputting all available action nodes in a pre-built experience database based on the action node type and action node function contained in the action node setting instruction, and outputting scoring data and precautions for each available action node; receiving an action node selection instruction, and arranging a script based on the selected action nodes contained in the action node selection instruction. However, this technology cannot achieve independent development of cybersecurity incident scripts.

[0004] Therefore, there is an urgent need for an independent development technology for network security scripts. Summary of the Invention

[0005] The purpose of this application is to provide a network security event scenario development method, device and storage medium to solve the problems of poor development efficiency and high labor cost in the existing solutions proposed in the above background technology.

[0006] To achieve the above objectives, this application discloses the following technical solutions:

[0007] In a first aspect, the present application discloses a method for developing a cybersecurity incident scenario, the method comprising the following steps:

[0008] S1: Based on the script development requirements, the corresponding attack scenarios, defense strategies, and development nodes are obtained from the preset script material library. The attack scenarios and defense strategies are generated by extracting the features in the requirements through natural language processing technology and matching them;

[0009] S2: Running a preset development model, inputting the attack scenario, the defense strategy, the node type, the node function, and the development node into the development model to generate a trial event scenario; wherein the development model is trained using historical network security events and corresponding constraints, wherein the constraints include node combination rules and defense strategy optimization logic;

[0010] S3: Verify the defense effect of the trial version of the event script through a trial run of the script, dynamically replace the development node based on the verification result until the defense effect meets the preset threshold, and output the official version of the event script.

[0011] Preferably, S3 also includes: after outputting the official version of the event script, feeding back the official version of the event script and the corresponding attack scenario, defense strategy and development node to the script material library, and updating the training data set of the development model through the incremental learning algorithm.

[0012] Preferably, in S1, acquiring the attack scenario specifically includes:

[0013] S111: Using natural language processing technology to extract attack scenario features in the script development requirements, matching and screening script material libraries based on the attack scenario features and having a similarity with the attack scenario features greater than a preset threshold SC THR The attack scenario set is used to calculate the matching weight of each attack scenario through the weighted average algorithm;

[0014] S112: Select the attack scenario with the highest matching weight as the final output.

[0015] Preferably, in S1, obtaining the defense strategy specifically includes:

[0016] S121: Extracting defense strategy features from the script development requirements, matching and generating the first defense strategy;

[0017] S122: Based on the acquired attack scenario features, a second defense strategy is matched and generated;

[0018] S123: Integrate the first defense strategy and the second defense strategy to calculate the comprehensive defense strategy weight W defense , Among them, C1 and C2 are the coverage of the first defense strategy and the second defense strategy respectively, β1 and β2 are the historical success rate weights of the first defense strategy and the second defense strategy respectively, and A m is the attack scenario matching degree, and γ is the matching degree weight.

[0019] Preferably, in S2, the development model is trained by historical network security events and corresponding constraints, specifically including:

[0020] S211: Collect historical network security events and corresponding constraints, and build a constraint expert database;

[0021] S212: Input the constraint expert database into the deep reinforcement learning model and train the model using the improved Q-Learning algorithm to enable the model to autonomously combine and develop nodes based on defense strategies and node types. The improved Q-Learning algorithm introduces an adaptive adjustment factor λ to optimize the balance between exploration and exploitation. The calculation method is: Among them, E success is the number of events successfully executed, E total is the total number of events;

[0022] S213: Use historical data to verify the validity of the script output by the model. When the accuracy of the script output by the model in the test set is ≥90%, the model is solidified as a development model.

[0023] Preferably, in S2, the generation of the trial version event script specifically includes:

[0024] S221: Input the defense strategy, the node type, and the node function into the development model, generate N candidate scenarios through a combination algorithm, and evaluate each candidate scenario using a comprehensive score calculation formula. The comprehensive score calculation formula is: Among them, S candidate is the calculated comprehensive score, T e is the node execution efficiency, D c is the defense coverage, A m is the attack scenario matching degree;

[0025] S222: Select the best candidate script as the trial version event script.

[0026] Preferably, in S3, verifying the defense effect of the trial version event script through a script trial run specifically includes:

[0027] S311: Simulate attack scenarios in a simulation environment and record the defense response time, false alarm rate, missed alarm rate, and resource consumption of the pilot event scenario.

[0028] S312: Calculate the defense effect evaluation value E threshold , Among them, T r is the response time, F a is the false alarm rate, L o is the false negative rate, R u For resource utilization.

[0029] Preferably, in S3, the dynamic replacement of the development node based on the verification result until the defense effect meets a preset threshold specifically includes:

[0030] S321: Calculate the replacement priority P based on the difference ΔE between the defense effect evaluation value and the preset value replace , Among them, C cost is the node replacement cost, I node is the node importance coefficient;

[0031] S322: Replace the development nodes in descending order of replacement priority until the defense effect evaluation value is not less than a preset threshold.

[0032] In a second aspect, the present application discloses a network security incident scenario development device, applicable to the network security incident scenario development method described above, comprising:

[0033] The material acquisition module is configured to: based on the script development requirements, obtain the corresponding attack scenarios, defense strategies and development nodes from the preset script material library. The attack scenarios and defense strategies are generated by extracting the features in the requirements through natural language processing technology and matching them;

[0034] The trial version generation module is configured to: run a preset development model, input the attack scenario, the defense strategy, the node type, the node function, and the development node into the development model, and generate a trial version event script; wherein the development model is trained using historical network security events and corresponding constraints, wherein the constraints include node combination rules and defense strategy optimization logic;

[0035] The official version generation module is configured to: verify the defense effect of the trial version event script through a script trial run, dynamically replace the development node based on the verification result until the defense effect meets the preset threshold, and output the official version event script.

[0036] In a third aspect, the present application discloses a computer-readable storage medium on which a computer program capable of being processed is stored. When the computer program is executed by the processor, the network security incident script development method described above is implemented.

[0037] Beneficial Effects: The cybersecurity incident scenario development method, device, and storage medium of this application utilize the obtained defense strategy to obtain node types and node functions, providing a data foundation for matching development nodes. Through the development nodes and development models, a trial version of the incident scenario is autonomously generated, reducing manual intervention. Furthermore, a trial run of the trial version of the incident scenario provides data reference for generating the official version of the incident scenario. Finally, the automated generation of cybersecurity incident scenarios is achieved, optimizing the efficiency and quality of cybersecurity incident scenario development. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 A flowchart of the method for developing a network security incident scenario provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The following is a clear and complete description of the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0041] In this document, the term "comprising" is intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0042] In a first aspect, this embodiment provides a Figure 1 The cybersecurity incident playbook development method shown includes the following steps:

[0043] S1: Based on the script development requirements, the corresponding attack scenarios, defense strategies, and development nodes are obtained from the preset script material library. The attack scenarios and defense strategies are generated by extracting the features in the requirements through natural language processing technology and matching them;

[0044] S2: Running a preset development model, inputting the attack scenario, the defense strategy, the node type, the node function, and the development node into the development model to generate a trial event scenario; wherein the development model is trained using historical network security events and corresponding constraints, wherein the constraints include node combination rules and defense strategy optimization logic;

[0045] S3: Verify the defense effect of the trial version of the event script through a trial run of the script, dynamically replace the development node based on the verification result until the defense effect meets the preset threshold, and output the official version of the event script.

[0046] In the above-mentioned step S1, the input includes original data and user requirements, wherein the original data includes a preset script material library (attack scenario description, defense strategy text, node type list), which is used for natural language query requirements corresponding to the script development, so as to obtain the attack scenarios, defense strategies and development nodes corresponding to the user requirements.

[0047] In step S1, the development requirements can be increased by adding time range, industry type, etc., so that users can develop more accurately based on the script.

[0048] For example, a user enters text such as "emergency response to phishing email attacks" or "detection of intranet lateral movement attacks" and obtains the attack scenarios, defense strategies, and development nodes corresponding to the text through query.

[0049] In step S2, the query output result of S1 is input into the development model. The training data of the development model is based on historical network security events and is developed by learning node combination rules (such as the "vulnerability scanning" node must take precedence over the "patch repair") and policy optimization logic (such as minimizing the false alarm rate) and other conditional constraints.

[0050] Outputs a pilot event script by generating a script skeleton based on input features and optimizing the node sequence.

[0051] After configuring the trial version of the event script in a trial operation environment, attack traffic is injected to observe the script execution effect, such as the defense success rate and false alarm rate; and performance indicators such as response delay and resource usage are collected; if the defense effect does not reach the threshold, the inefficient nodes are replaced, and iterative optimization is carried out until the defense effect meets the preset threshold, and the iteration is stopped, and the official version of the event script is output.

[0052] This approach reduces manual intervention by developing intelligent model construction and a dynamic replacement mechanism, automating the entire process from script generation to optimization and lowering labor costs. Furthermore, through defense effectiveness evaluation and node replacement during the pilot phase, defense strategies can be dynamically adjusted to rapidly respond to changing attack scenarios and enhance defense capabilities against unknown threats.

[0053] Specifically

[0054] In this embodiment, in S1, acquiring the attack scenario specifically includes:

[0055] S111: Using natural language processing technology to extract attack scenario features in the script development requirements, matching and screening script material libraries based on the attack scenario features and having a similarity with the attack scenario features greater than a preset threshold SC THR (e.g. 85%) attack scenario set, and calculate the matching weight of each attack scenario using a weighted average algorithm;

[0056] S112: Select the attack scenario with the highest matching weight as the final output.

[0057] Furthermore, obtaining the defense strategy specifically includes:

[0058] S121: Extract the defense strategy features in the script development requirements, match and generate the first defense strategy;

[0059] S122: Based on the acquired attack scenario features, a second defense strategy is matched and generated;

[0060] S123: Integrate the first defense strategy and the second defense strategy to calculate the comprehensive defense strategy weight W defense ,

[0061] in:

[0062] C1 and C2 are the coverage of the first and second defense strategies, respectively. The coverage indicates the breadth of attack types or scenarios that a defense strategy can handle. For example, a defense strategy may cover three types: "DDoS attack," "ransomware," and "APT attack," and its coverage is 3. The acquisition of coverage can be: (1) Extracting metadata from the script library: Each defense strategy has metadata stored in the script library, including its applicable attack type, scenario label, and defense scope. For example: Defense strategy A's metadata - applicable attack types: DDoS, ransomware; scenario label: high-traffic attack, data encryption ransomware; coverage C = 2 (number of types) or C = 4 (number of labels). (2) Quantifying coverage: Define the coverage measurement method according to the requirements, such as C = the number of attack types covered by the defense strategy.

[0063] β1 and β2 are the historical success rate weights of the first and second defense strategies, respectively. The historical success rate weights reflect the effectiveness of the defense strategies in historical events and are used to weight their priorities. The historical success rate weights can be obtained by: (1) Statistical historical data: extract the historical usage records of the defense strategies from the script library; (2) calculate the historical success rate; (3) convert to weights: use exponential function or linear scaling to convert the success rate to weight.

[0064] A m Attack scenario matching measures the adaptability of the defense strategy to the current attack scenario, ensuring the consistency between the strategy and the threat type. It can be calculated using the cosine similarity algorithm.

[0065] γ is the matching weight, which is used to balance the priority of attack scenario matching and other parameters (coverage, historical success rate). It can be determined through security expert evaluation or A / B testing.

[0066] In this embodiment, in S2, the development model is trained based on historical network security events and corresponding constraints, specifically including:

[0067] S211: Collect historical network security events and corresponding constraints, and build a constraint expert database;

[0068] S212: Input the constraint expert library into the deep reinforcement learning model and train the model using the improved Q-Learning algorithm, so that the model has the ability to autonomously combine and develop nodes based on defense strategies and node types. The improved Q-Learning algorithm is the core training method of the deep reinforcement learning model, and the deep reinforcement learning model (such as DQN) is the specific implementation carrier of the improved Q-Learning algorithm. The improved Q-Learning algorithm introduces an adaptive adjustment factor λ to optimize the balance between exploration and exploitation, which is calculated as follows: Among them, E success is the number of events successfully executed, E total is the total number of events; in this way, by dynamically adjusting the exploration probability, invalid exploration is reduced and training efficiency is improved. For example, when the proportion of successful events is high, λ increases, and the model is more inclined to use known effective strategies; otherwise, exploration is increased. In the DQN framework, the improved Q-Learning algorithm is implemented in the following ways: neural network approximation of Q value: using a deep neural network (such as DNN) instead of the Q value table, inputting the state s, and outputting the Q value of all actions a; introducing an adaptive adjustment factor λ, based on the statistics of successful events during training, dynamically adjusting the exploration strategy;

[0069] S213: Use historical data to verify the validity of the script output by the model. When the accuracy of the script output by the model in the test set is ≥90%, the model is solidified as a development model.

[0070] Traditional Q-Learning typically has a fixed or linearly decaying exploration rate. By configuring the improved Q-Learning algorithm and dynamically adjusting λ based on successful events during training, we avoid over-exploration or premature convergence. Furthermore, the introduction of λ reduces the Q-value oscillation problem caused by random exploration in traditional Q-Learning. Combined with the target network mechanism of DQN, it further stabilizes the training process. By combining the improved Q-Learning algorithm with a deep reinforcement learning model, we address the shortcomings of traditional Q-Learning in high-dimensional states and dynamic exploration, significantly improving the automation level and defense effectiveness of cybersecurity incident scenario development.

[0071] Furthermore, in S2, the generation of the trial version event script specifically includes:

[0072] S221: Input the defense strategy, the node type, and the node function into the development model, generate N candidate scenarios through a combination algorithm, and evaluate each candidate scenario using a comprehensive score calculation formula. The comprehensive score calculation formula is: Among them, S candidate The comprehensive score calculated for a candidate script is used to quantitatively evaluate the overall effectiveness of each candidate script. The higher the comprehensive score, the better the candidate script performs in terms of execution efficiency, coverage, and scenario adaptability, and should be preferred as the trial version event script. e The node execution efficiency can be obtained by any method in the existing technology. It is used to measure the speed and resource consumption of each defense node in the scenario to complete the task. The smaller the value (such as the shorter the time), the higher the efficiency. c Defense coverage can be obtained by any of the existing technologies to measure the breadth of attack types or scenarios that the script can cope with. The larger the value, the wider the coverage. m Attack scenario matching measures the adaptability of the defense strategy to the current attack scenario, ensuring the consistency between the strategy and the threat type. It can be calculated using the cosine similarity algorithm.

[0073] S222: Select the best candidate scenario as the trial event scenario. The selection of the trial event scenario can be any of the following methods:

[0074] (1) Direct selection method: select S candidate The highest-ranking script will be selected as a pilot script;

[0075] (2) Threshold screening method: Set S candidate The threshold (such as ≥0.8) is set, only the scripts that meet the criteria are retained, and the scripts with the highest scores are selected from them.

[0076] (3) Multi-objective optimization: Combine the reward function and S candidate As the reward value, the optimal scenario is selected through reinforcement learning.

[0077] Through the above trial version of the event script generation steps, the script generation is automated and intelligent, which significantly improves the efficiency and actual effect of network security event script development. candidate Multi-dimensional evaluation (execution efficiency, coverage, and matching) avoids the one-sidedness of a single indicator and ensures that the generated trial scripts achieve the optimal balance in efficiency, coverage, and scenario adaptability.

[0078] In this embodiment, in S3, verifying the defense effect of the trial version event script through a trial run of the script specifically includes:

[0079] S311: Simulate attack scenarios in a simulation environment and record the defense response time, false alarm rate, missed alarm rate, and resource consumption of the pilot event scenario.

[0080] S312: Calculate the defense effect evaluation value E threshold , The higher the defense effectiveness evaluation value, the better the script performs in the following dimensions: Response time: The faster the defense action is executed, the higher the score; False alarm rate: The lower the frequency of false triggering of defense, the higher the score; False negative rate: The lower the frequency of not detecting real attacks, the higher the score; Resource utilization: The more efficient the use of resources (CPU, memory, etc.) during the defense process, the higher the score. r The shorter the response time, the faster the attack will be contained, which can reduce the actual loss. a The lower the false alarm rate, the more accurate the defense system is, thus avoiding the waste of resources or loss of user trust caused by false alarms. o The lower the false negative rate, the more effective the defense system is in detecting real attacks and avoiding losses caused by successful attacks. u Resource utilization. The higher the resource utilization, the lower the defense system's consumption of computing resources, bandwidth, etc. when responding to attacks, and the more stable it can operate in the long term.

[0081] By designing a defense effectiveness evaluation value, we comprehensively quantify the performance of the scenario. This overcomes the one-sidedness of the traditional approach, which focuses solely on a single metric. For example, a scenario with a fast response time but a very high false positive rate may be mistakenly judged as effective. It also achieves a dynamic balance: for example, in resource-constrained scenarios, response time requirements can be appropriately relaxed, but the false negative rate must not exceed the standard. Furthermore, the calculation formula for the defense effectiveness evaluation value integrates response time, false positive rate, false negative rate, and resource utilization into a single metric. This multiplication relationship ensures the "short board effect," avoids one-sided optimization, and ensures the objectivity and comparability of defense effectiveness. This allows cybersecurity teams to quickly determine whether the scenario meets the requirements and optimize weak links, significantly improving defense efficiency.

[0082] Furthermore, in S3, the development node is dynamically replaced based on the verification result until the defense effect meets the preset threshold, specifically including:

[0083] S321: Calculate the replacement priority P based on the difference ΔE between the defense effect evaluation value and the preset value replace , Among them, C costThe node replacement cost refers to the total resource consumption required to replace a defense node, including hardware costs, software licensing fees, manual configuration time, system downtime losses, etc. It can be obtained through any method in the existing technology (such as resource model, critical path analysis). node The node importance coefficient measures the criticality of the node in the defense scenario. The larger the value, the more important it is. It can be obtained through any method in the existing technology (such as resource model and critical path analysis).

[0084] S322: Replace the development nodes in descending order of replacement priority until the defense effect evaluation value is not less than the preset threshold, that is, after replacing the nodes, the defense effect evaluation value (defense effect comprehensive index) reaches the preset minimum value. The specific standards can be, for example: response time: in the simulation environment, the average response time of the defense action must be ≤ the preset value (such as 5 seconds); false alarm rate and false negative rate: must be ≤ the preset threshold respectively (such as false alarm rate ≤ 5%, false negative rate ≤ 10%); resource utilization: must be ≥ the preset value (such as CPU utilization ≥ 80%). Comprehensive threshold: E calculated by formula threshold Need to be ≥ the preset value (such as 0.7).

[0085] Through the above-mentioned verification of breeding effects and dynamic replacement of development nodes, dynamic optimization of multi-dimensional parameters is achieved, high-importance, low-cost nodes are replaced first, and waste of resources caused by blind replacement is avoided, achieving the optimal balance between defense effect and cost, and solving the problems of "replacement blindness" and "indicator one-sidedness" in traditional methods.

[0086] In this embodiment, S3 also includes: after outputting the official version of the event script, feeding back the official version of the event script and the corresponding attack scenario, defense strategy and development node to the script material library, and updating the training data set of the development model through the incremental learning algorithm to improve the generalization ability of subsequent script development.

[0087] In summary, the network security incident scenario development method of this embodiment includes a closed-loop design of development model construction, intelligent scenario generation, multi-dimensional defense assessment, and dynamic replacement optimization. It solves the problems of high manual dependence, slow response speed, and one-sided defense effect in traditional network security scenario development, and significantly improves the automation level, real-time adaptability, and resource efficiency of network security incident response.

[0088] In a second aspect, this embodiment provides a network security event scenario development device applicable to the network security event scenario development method described above, including:

[0089] The material acquisition module is configured to: based on the script development requirements, obtain the corresponding attack scenarios, defense strategies and development nodes from the preset script material library. The attack scenarios and defense strategies are generated by extracting the features in the requirements through natural language processing technology and matching them;

[0090] The trial version generation module is configured to: run a preset development model, input the attack scenario, the defense strategy, the node type, the node function, and the development node into the development model, and generate a trial version event script; wherein the development model is trained using historical network security events and corresponding constraints, wherein the constraints include node combination rules and defense strategy optimization logic;

[0091] The official version generation module is configured to: verify the defense effect of the trial version event script through a script trial run, dynamically replace the development node based on the verification result until the defense effect meets the preset threshold, and output the official version event script.

[0092] It should be noted that the network security event scenario development device of this embodiment corresponds to the aforementioned network security event scenario development method. Therefore, the specific content of the device (including but not limited to specific technical means and technical effects) can be referred to the records in the aforementioned method, and this text will not go into details here.

[0093] In a third aspect, this embodiment provides a computer-readable storage medium storing a computer program that can be processed by a processor. When the computer program is executed by the processor, the network security incident scenario development method described above is implemented.

[0094] Similarly, it should be noted that the computer-readable storage medium of this embodiment corresponds to the aforementioned network security incident script development method. Therefore, the specific content of the computer-readable storage medium (including but not limited to technical effects) can be referred to the records in the aforementioned method, and this text will not go into details here.

[0095] In the embodiments provided herein, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code, or any appropriate combination thereof. For hardware implementation, the processor can be implemented in one or more of the following units: an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a processor, a controller, a microcontroller, a microprocessor, other electronic units designed to implement the functions described herein, or a combination thereof. For software implementation, part or all of the processes of the embodiments can be completed by instructing the relevant hardware through a computer program. When implemented, the above program can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein the communication media include any medium that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a computer can access. The computer-readable storage medium can include, but is not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer.

[0096] Finally, it should be noted that the above is only a preferred embodiment of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent replacements for some of the technical features therein. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for developing a cybersecurity incident scenario, characterized in that: The method comprises the following steps: S1: Based on the script development requirements, the corresponding attack scenarios, defense strategies, and development nodes are obtained from the preset script material library. The attack scenarios and defense strategies are generated by extracting the features in the requirements through natural language processing technology and matching them; S2: Running a preset development model, inputting the attack scenario, the defense strategy, the node type, the node function, and the development node into the development model to generate a trial event scenario; wherein the development model is trained using historical network security events and corresponding constraints, wherein the constraints include node combination rules and defense strategy optimization logic; S3: Verify the defense effect of the trial version of the event script through a trial run of the script, dynamically replace the development node based on the verification result until the defense effect meets the preset threshold, and output the official version of the event script.

2. The method for developing a cybersecurity incident scenario according to claim 1, wherein: The S3 also includes: after outputting the official version of the event script, feeding back the official version of the event script and the corresponding attack scenario, defense strategy and development node to the script material library, and updating the training data set of the development model through the incremental learning algorithm.

3. The method for developing a cybersecurity incident scenario according to claim 1, wherein: In S1, acquiring the attack scenario specifically includes: S111: Using natural language processing technology to extract attack scenario features in the script development requirements, matching and screening script material libraries based on the attack scenario features and having a similarity with the attack scenario features greater than a preset threshold SC THR The attack scenario set is used to calculate the matching weight of each attack scenario through the weighted average algorithm; S112: Select the attack scenario with the highest matching weight as the final output.

4. The method for developing a cybersecurity incident scenario according to claim 3, wherein: In S1, obtaining the defense strategy specifically includes: S121: Extract the defense strategy features in the script development requirements, match and generate the first defense strategy; S122: Based on the acquired attack scenario features, a second defense strategy is matched and generated; S123: Integrate the first defense strategy and the second defense strategy to calculate the comprehensive defense strategy weight W defense , Among them, C1 and C2 are the coverage of the first defense strategy and the second defense strategy respectively, β1 and β2 are the historical success rate weights of the first defense strategy and the second defense strategy respectively, and A m is the attack scenario matching degree, and γ is the matching degree weight.

5. The method for developing a cybersecurity incident scenario according to claim 1, wherein: In S2, the development model is trained through historical network security events and corresponding constraints, specifically including: S211: Collect historical network security events and corresponding constraints, and build a constraint expert database; S212: Input the constraint expert database into the deep reinforcement learning model and train the model using the improved Q-Learning algorithm to enable the model to autonomously combine and develop nodes based on defense strategies and node types. The improved Q-Learning algorithm introduces an adaptive adjustment factor λ to optimize the balance between exploration and exploitation. The calculation method is: Among them, E success is the number of events successfully executed, E total is the total number of events; S213: Use historical data to verify the validity of the script output by the model. When the accuracy of the script output by the model in the test set is ≥90%, the model is solidified as a development model.

6. The method for developing a cybersecurity incident scenario according to claim 5, wherein: In S2, the generation of the trial version event script specifically includes: S221: Input the defense strategy, the node type, and the node function into the development model, generate N candidate scenarios through a combination algorithm, and evaluate each candidate scenario using a comprehensive score calculation formula. The comprehensive score calculation formula is: Among them, S candidate is the calculated comprehensive score, T e is the node execution efficiency, D c is the defense coverage, A m is the attack scenario matching degree; S222: Select the best candidate script as the trial version event script.

7. The method for developing a cybersecurity incident scenario according to claim 1, wherein: In S3, the verification of the defense effect of the trial version event script through the script trial run specifically includes: S311: Simulate attack scenarios in a simulation environment and record the defense response time, false alarm rate, missed alarm rate, and resource consumption of the pilot event scenario. S312: Calculate the defense effect evaluation value E threshold , Among them, T r is the response time, F a is the false alarm rate, L o is the false negative rate, R u For resource utilization.

8. The method for developing a cybersecurity incident scenario according to claim 7, wherein: In S3, the development node is dynamically replaced based on the verification result until the defense effect meets the preset threshold, specifically including: S321: Calculate the replacement priority P based on the difference ΔE between the defense effect evaluation value and the preset value replace , Among them, C cost is the node replacement cost, I node is the node importance coefficient; S322: Replace the development nodes in descending order of replacement priority until the defense effect evaluation value is not less than a preset threshold.

9. A network security incident scenario development device, applicable to the network security incident scenario development method according to any one of claims 1 to 8, characterized in that: include: The material acquisition module is configured to: based on the script development requirements, obtain the corresponding attack scenarios, defense strategies and development nodes from the preset script material library. The attack scenarios and defense strategies are generated by extracting the features in the requirements through natural language processing technology and matching them; The trial version generation module is configured to: run a preset development model, input the attack scenario, the defense strategy, the node type, the node function, and the development node into the development model, and generate a trial version event script; wherein the development model is trained using historical network security events and corresponding constraints, wherein the constraints include node combination rules and defense strategy optimization logic; The official version generation module is configured to: verify the defense effect of the trial version event script through a script trial run, dynamically replace the development node based on the verification result until the defense effect meets the preset threshold, and output the official version event script.

10. A computer-readable storage medium having stored thereon a computer program capable of being processed, characterized in that: When the computer program is executed by the processor, the network security incident script development method according to any one of claims 1 to 8 is implemented.

Images