A security event defense handling script generation system for SOAR and a method thereof

Abstract

The application provides a security event defense handling script generation system for SOAR and a method thereof, the system comprising a database module, a security event acquisition module, a strategy mapping module, an action mapping module and a script arrangement module, wherein the database module comprises a first mapping module and a second mapping module; the strategy mapping module is used to obtain a defense strategy of a security event to be processed according to a mapping relationship in the first mapping module; the action mapping module is used to obtain a defense action of the defense strategy of the security event to be processed according to a mapping relationship in the second mapping module; the script arrangement module is used to provide the defense strategy and the defense action obtained by the strategy mapping module and the action mapping module to a user in a visual option mode for selection, and generate a defense handling script for the finally selected defense action. The application can greatly reduce the arrangement difficulty, improve the quality and efficiency of script generation.

Description

Technical Field

[0001] This application relates to the field of information security technology, specifically to a security incident defense and response script generation system and method for SOAR. Background Technology

[0002] In the field of information security, incident handling involves a complex process, including multiple stages such as investigation, evidence collection, hardening, defense, and countermeasures. This requires security analysts to possess high levels of expertise in security analysis to complete the task. Security Orchestration, Automation, and Response (SOAR) systems emerged to address this problem by formalizing security analysts' experience into automated scripts that can be reused, thereby improving the efficiency of security incident handling and lowering the barrier to entry for security analysis. However, the automated script orchestration function provided by security orchestration and automated response systems, like the correlation analysis rules in log analysis systems, still requires manual orchestration. Security events are diverse, and various analysis scenarios differ, making it difficult to provide general scripts with high coverage or large, complex scripts capable of handling complex scenarios. As a result, security orchestration and automated response systems often can only handle extremely simple single-step tasks or provide only a small number of effective general scripts that match the user's real-world scenarios. A large number of scripts still need to be manually edited on-site by the user. During manual editing, the process reverts to relying entirely on the analyst's personal experience to complete the task, which still cannot lower the skill threshold required for users. The edited scripts also lack portability and are often only applicable to local scenarios. Summary of the Invention

[0003] To address this issue, this application provides a security incident defense and response script generation system for SOAR, comprising a database module, a security incident acquisition module, a policy mapping module, an action mapping module, and a script arrangement module, wherein:

[0004] The database module includes a first mapping module and a second mapping module. The first mapping module includes the mapping relationship between security events and defense strategies in the existing security event defense strategy knowledge system. The second mapping module includes the mapping relationship between defense strategies and defense actions in SOAR.

[0005] The security event acquisition module is used to parse the log information of the security events to be processed and convert it into the standardized security event format defined by SOAR;

[0006] The policy mapping module is used to obtain the defense policy for the security event to be processed according to the mapping relationship in the first mapping module;

[0007] The action mapping module is used to obtain the defense actions of the defense strategy for the security event to be processed according to the mapping relationship in the second mapping module;

[0008] The script arrangement module is used to provide users with choices of defense strategies and defense actions obtained by the strategy mapping module and action mapping module in a visual manner, and to generate a defense response script for the finally selected defense action.

[0009] Preferably, the first mapping module includes a defense strategy matrix, which includes the mapping relationship between security event IDs and textual descriptions of defense strategies in the security event defense strategy knowledge system.

[0010] Preferably, the existing knowledge system for security incident defense strategies consists of the ATT&CK knowledge system, the CAPEC knowledge system, and the D3FEND knowledge system.

[0011] Preferably, the system also includes a script service module, which converts the defense response script into a defense response script that supports multiple versions of SOAR through an adapter for defense actions, and provides it for download.

[0012] This application also provides a method for using the above-described security incident defense and response script generation system for SOAR, the steps of which are as follows:

[0013] S11, Obtain information on security events to be processed;

[0014] S12, Based on the mapping relationship in the first mapping module, obtain the defense strategy corresponding to the security event to be processed, display it on the visualization interface, and let the user select the displayed defense strategy;

[0015] S13. Based on the mapping relationship in the second mapping module, obtain the defense action corresponding to the selected defense strategy, display it on the visualization interface, and let the user select the displayed defense action;

[0016] S14 generates defense handling scripts for all selected defense actions and security events to be handled.

[0017] Step S11 further includes:

[0018] Step S111: Collect and parse the security event logs of the security events to be processed, and convert the third-party security events into standard security events;

[0019] Step S112: Based on the mapping table of security events to ATT&CK attack techniques, the TTPid of the ATT&CK attack technique mapped to the security event to be processed is used as the security event ID of the security event to be processed.

[0020] Step S12 further includes:

[0021] Step S121: The first mapping module includes a defense strategy matrix, which includes the mapping relationship between security event IDs and textual descriptions of defense strategies in the security event defense strategy knowledge system. The textual description of the defense strategy corresponding to the security event ID of the security event to be processed is obtained according to the defense strategy matrix.

[0022] In step S12, the defense strategy includes detection method categories and mitigation method categories, and the defense strategies for the same security event are displayed on the visualization interface according to different categories.

[0023] In step S13, each defense strategy corresponds to one or more defense actions.

[0024] The beneficial effects achieved by this application are as follows:

[0025] This solution abstracts the attack methods of security incidents through multi-level knowledge mapping, then transforms them into defense methods using the knowledge association between attack and defense methods. Next, it maps security incidents to defense response script actions through the mapping of defense methods to standardized script actions. A guided interactive process then selects script actions to generate a defense response script. Finally, a script adapter converts the general script to generate a script adapted to the corresponding SOAR platform. This application transforms the process of arranging security incident response scripts from relying entirely on personnel's knowledge to a recommendation and selection based on mapping relationships, thereby greatly reducing the difficulty of arrangement and improving the quality and efficiency of script generation.

[0026] This application effectively addresses the following issues: the lack of a comprehensive knowledge system and theoretical methodology to support the development of security attack and defense strategies when creating incident response scripts; insufficient coverage of similar security incidents and scenarios in pre-written security response scripts, and a lack of adaptability to real-world user scenarios; and the high difficulty and low efficiency of manually creating complex scripts due to the lack of historical experience to refer to. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0028] Figure 1 This is a module structure diagram of the SOAR security incident defense and response script generation system used in this application.

[0029] Figure 2 This application provides a flowchart for the method of generating security incident defense and response scripts for SOAR. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] like Figure 1 The diagram shown is a module structure diagram of the security incident defense and response script generation system for SOAR used in this application. The security incident defense and response script generation system of this application mainly includes a database module, a security incident acquisition module, a policy mapping module, an action mapping module, and a script arrangement module, wherein:

[0032] The database module includes a first mapping module and a second mapping module. The first mapping module includes the mapping relationship between security events and defense strategies in the existing security event defense strategy knowledge system. The second mapping module includes the mapping relationship between defense strategies and defense actions in SOAR.

[0033] The security event acquisition module is used to parse the log information of the security events to be processed and convert it into the standardized security event format defined by SOAR;

[0034] The policy mapping module is used to obtain the defense policy for the security event to be processed according to the mapping relationship in the first mapping module;

[0035] The action mapping module is used to obtain the defense actions of the defense strategy for the security event to be processed according to the mapping relationship in the second mapping module;

[0036] The script arrangement module is used to provide users with choices of defense strategies and defense actions obtained by the strategy mapping module and action mapping module in a visual manner, and to generate a defense response script for the finally selected defense action.

[0037] This application also includes a script service module, which provides an adapter for converting standardized network defense scripts into network defense scripts that support various versions of SOAR products, and provides script download services.

[0038] This invention also provides a knowledge-guided method for generating security incident defense and response scripts. This method maps the textual descriptions of defense methods associated with ATT&CK attack techniques to defense actions described in the OpenC2 standardized defense language, and then converts them using OpenC2 to the defense action specifications corresponding to specific SOAR product models, achieving end-to-end defense script generation from security incidents to executable defense actions. The input to this method is a specific security event. First, the security event is mapped using ATT&CK to convert it into a description of an abstract security technology and obtain the corresponding ATT&CK attack technology ID (TTPid). Then, using the TTPid as a keyword, a search is performed in a defense method matrix consisting of ATT&CK attack mitigation and detection methods, CAPEC attack mitigation and detection indicators, and D3FEND defense technologies to obtain the textual description of the corresponding defense method, realizing the knowledge-level conversion from attack to defense. Next, the textual description of each defense method is mapped to the standard network defense action described by OpenC2. Finally, through the network defense action adapter, the standard network defense action is converted into an executable network defense action that supports various versions and models of SOAR products, realizing the end-to-end conversion between security events and executable network defense actions. Because a defense method for an attack technique includes two phases—detection and mitigation—and because it combines multiple knowledge systems, a single TTPid can retrieve textual descriptions of multiple defense methods and techniques. Furthermore, a textual description of a defense method may include multiple standard defense actions when mapping defense actions. Thus, an input security event, through multiple mappings and transformations, forms a two-stage, wizard-style list of selectable multi-network defense actions. The user first selects one or more textual descriptions of defense methods. The system then displays the corresponding specific network defense actions based on the selected descriptions. The user then selects one or more network defense actions, ultimately generating a response script consisting of a set of network defense actions. Finally, the user-specified SOAR product model converts the standardized network defense action script into an executable script for that specific SOAR model. The process is as follows: Figure 2 As shown, the specific steps include:

[0039] (1) Collect attack mitigations and detection methods from the ATT&CK knowledge system to obtain a textual description of the defense method for each TTPid. Collect attack mitigations and detection indicators from the CAPEC knowledge system to obtain a textual description of the defense method for each TTPid. Collect attack detection, hardening, and isolation methods from the D3FEND knowledge system to obtain a textual description of the defense method for each TTPid.

[0040] (2) Construct a knowledge matrix of defense methods using TTPid as the index, as shown in Table 1:

[0041]

[0042] Table 1

[0043] Each ID here provides a descriptive text about the defense method from the official knowledge base. For example, DS0015 corresponds to "Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute-force attempt to gain access to a system using legitimate credentials." CAPEC-49's detection indicator corresponds to "Many incorrect login attempts are detected by the system." D3FEND's D3-SDA corresponds to "Detecting unauthorized user sessions by comparing the duration of a user logon session with a baseline behavior model."

[0044] (3) A security event was received.

[0045] (4) Query the mapping table of security events to ATT&CK attack techniques, and find the TTPid of an ATT&CK attack technique that the security event is mapped to.

[0046] (5) Using TTPid as the keyword, query the defense method knowledge matrix to find textual descriptions of various defense methods in the detection and mitigation stages.

[0047] (6) Use each queried defense method to query the corresponding standardized network defense action in the mapping table between defense methods and OpenC2 defense actions. Each defense method may return one or more defense actions.

[0048] (7) Display each defense method in each stage according to the two stages of detection and mitigation. After the user selects a defense method, display the network defense action corresponding to that defense method. The user then selects a defense action. After all selections are completed, generate the corresponding standardized response and handling script based on the selected network defense action.

[0049] (8) The system uses an adapter to convert standardized defense actions according to the pre-set SOAR model, and converts them into network defense actions that can be directly executed by the corresponding SOAR product.

[0050] This invention realizes a knowledge-guided security incident defense and handling script generation system and method. It can provide guided action arrangement of security incident response and handling scripts through a mapping chain consisting of security incidents, attack methods, defense methods, and network defense actions. This changes the process of arranging security incident response and handling scripts from relying entirely on the knowledge in people's minds to recommendation and selection based on mapping relationships, thereby greatly reducing the difficulty of arrangement and improving the quality and efficiency of script generation.

[0051] The following example illustrates the method for generating a knowledge-guided security incident defense and response script. The specific implementation process is as follows:

[0052] (1) Receive the security event log, convert it into the system standard security event format, and obtain the security event name as "TCP Denial of Service Attack". Assume that the relevant asset IP is 192.168.0.3 and the relevant external IPs are 11.22.33.44 and 11.22.33.55.

[0053] (2) Use the event name "TCP Denial of Service Attack" to query the security event and ATT&CK attack technique mapping table to obtain the attack technique T1498.001: "Network Denial of Service: Direct Network Flood";

[0054] (3) Use T1498.001 to query the defense method knowledge matrix, and the defense method knowledge matrix is ​​shown in Table 2:

[0055]

[0056] Table 2

[0057] (4) For each defense method, query the mapping table between defense methods and OpenC2 to find its corresponding network defense action (the start_time, duration, and other fields are omitted here). For example:

[0058] DS0029 corresponding action:

[0059] action1:

[0060] {"action":"query",

[0061] "target":{"ipv4_connection":{"src_addr":192.168.0.3}},

[0062] “args”:{“eventname”:“Network connectivity behavior baseline anomaly”}

[0063] "actuator":{"soc":{"hostname":"soc-01"}}}

[0064] D3-PMAD corresponding actions:

[0065] action2:

[0066] {"action":"query",

[0067] "target":{"ipv4_connection":{"src_addr":192.168.0.3}},

[0068] “args”:{“eventname”:“Network traffic behavior anomaly”}

[0069] "actuator":{"ids":{"hostname":"ids-01"}}}

[0070] D3-NTF corresponding actions:

[0071] action3:

[0072] {"action":"deny",

[0073] "target": {"ipv4_connection": {"src_addr": "11.22.33.44, 11.22.33.55"}},

[0074] "actuator": {"firewall": {"hostname": "firewall-01"}}

[0075] and

[0076] action4:

[0077] {"action": "deny",

[0078] "target": {"ipv4_connection": {"dst_port": 8100}},

[0079] "actuator": {"firewall": {"hostname": "firewall-01"}};

[0080] CAPEC-482 corresponding action

[0081] action5:

[0082] {"action": {"set": {"SYN_threshold": 100}},

[0083] "target": {"ipv4_connection": {"dst_addr": "192.168.0.3"}},

[0084] "actuator": {"firewall": {"hostname": "firewall-01"}}

[0085] (5) The system displays all selectable defense methods and network defense actions in stages, allowing users to make interactive selections. After the user selects DS0029, D3-PMAD, D3-NTF and CAPEC-482, the corresponding action1, action2, action3, action4 and action5 are displayed. The user selects action1, action3 and action5 based on this, indicating that the user has selected action1 as "SOC system network connection relationship anomaly detection about 192.168.0.3", action3 as "firewall blocking rules to block traffic from external IPs 11.22.33.44 and 11.22.33.55", and action5 as "set the SYN connection segment threshold to 100 through the firewall".

[0086] (6) Response and handling script.

[0087] (7) The system converts action1, action3 and action5 into corresponding executable scripts based on the selected SOAR product model.

[0088] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application. Clearly, those skilled in the art can make various alterations and variations to this application without departing from its spirit and scope. Thus, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A security incident defense playbook generation system for SOAR, characterized in that, It includes a database module, a security event acquisition module, a policy mapping module, an action mapping module, and a script arrangement module, among which: The database module includes a first mapping module and a second mapping module. The first mapping module includes the mapping relationship between security events and defense strategies in the existing security event defense strategy knowledge system. The second mapping module includes the mapping relationship between defense strategies and defense actions in SOAR. The security event acquisition module is used to parse the log information of the security events to be processed and convert it into the standardized security event format defined by SOAR; The policy mapping module is used to obtain the defense policy for the security event to be processed according to the mapping relationship in the first mapping module; The action mapping module is used to obtain the defense actions of the defense strategy for the security event to be processed according to the mapping relationship in the second mapping module; The script arrangement module is used to provide users with choices of defense strategies and defense actions obtained by the strategy mapping module and action mapping module in a visual manner, and to generate a defense response script for the finally selected defense action.

2. The security incident defense playbook generation system for SOAR of claim 1, wherein, The first mapping module includes a defense strategy matrix, which includes the mapping relationship between security event IDs and textual descriptions of defense strategies in the security event defense strategy knowledge system.

3. The security incident defense playbook generation system for SOAR of claim 1, wherein, The existing knowledge system for security incident defense strategies consists of the ATT&CK knowledge system, the CAPEC knowledge system, and the D3FEND knowledge system.

4. The security incident defense playbook generation system for SOAR of claim 1, wherein, It also includes a script service module, which converts defense response scripts into defense response scripts that support multiple versions of SOAR through a defense action adapter, and provides them for download.

5. A method of using the security incident defense playbook generation system for SOAR as claimed in any one of claims 1-4, characterized in that, The steps of this method are as follows: S11, Obtain information on security events to be processed; S12, Based on the mapping relationship in the first mapping module, obtain the defense strategy corresponding to the security event to be processed, display it on the visualization interface, and let the user select the displayed defense strategy; S13. Based on the mapping relationship in the second mapping module, obtain the defense action corresponding to the selected defense strategy, display it on the visualization interface, and let the user select the displayed defense action; S14 generates defense handling scripts for all selected defense actions and security events to be handled.

6. The method of using the security event defense playbook generation system for SOAR as claimed in any one of claims 1-4, wherein, Step S11 also includes: Step S111: Collect and parse the security event logs of the security events to be processed, and convert the third-party security events into standard security events; Step S112: Based on the mapping table of security events to ATT&CK attack techniques, the TTPid of the ATT&CK attack technique mapped to the security event to be processed is used as the security event ID of the security event to be processed.

7. The method of using the security event defense playbook generation system for SOAR as claimed in any one of claims 1-4, wherein, Step S12 also includes: Step S121: The first mapping module includes a defense strategy matrix, which includes the mapping relationship between security event IDs and textual descriptions of defense strategies in the security event defense strategy knowledge system. The textual description of the defense strategy corresponding to the security event ID of the security event to be processed is obtained according to the defense strategy matrix.

8. The method for using the security incident defense and response script generation system for SOAR as described in any one of claims 1-4, as described in claim 5, is characterized in that... In step S12, the defense strategy includes a detection method category and a mitigation method category, and the defense strategy of the same security event is displayed on the visual interface according to different categories.

9. The method of using the security event defense playbook generation system for SOAR as claimed in any one of claims 1-4, wherein, In step S13, each defense strategy corresponds to one or more defense actions.

Images