A network security automation method and system based on SOAR

Abstract

The present invention discloses a network security automation method based on SOAR, which includes: a security analysis model based on the informer algorithm and a security orchestration model based on the ATTN‑D3QN algorithm. By inputting the unknown software running information of the system, the informer model reduces the dimension of the long time series, extracts features and classifies them, outputs the security threat analysis results, and inputs them into the ATTN‑D3QN model. The ATTN‑D3QN model approximates the optimal value function through the attention network, realizes the intelligent orchestration of security systems and security tools, and automatically runs through the API to realize security automation. The present invention also provides a network security automation system based on SOAR, which includes: a data service module, a security analysis module, a SOAR module, and an interaction management module. By integrating the SOAR module, the system focuses on event response operations, improves the efficiency of the security operation and maintenance team, normalizes and standardizes the response process, and shortens the response time.

Description

Technical Field

[0001] The present invention relates to the technical field of network security automation, and in particular to a SOAR-based network security automation method and system. Background Art

[0002] With the advancement of technology and industrialization, more and more enterprises and institutions are using networks to store and access large amounts of important information and confidential documents. Network security and incident response have become crucial components of the security operations and maintenance of various information systems. With the frequent occurrence of security threats, improving the efficiency of security incident response is imperative. Current security automation systems can implement security orchestration and incident response based on a script library, but they still rely heavily on the support of security operations experts and lack sufficient automation. Existing security automation methods and systems cannot meet the needs for system security protection. Summary of the Invention

[0003] In order to solve the technical problem that the existing technology cannot well realize security automation, the present invention provides a network security automation method and system based on SOAR. The method uses the informer algorithm to analyze historical data and real-time data, and generates intelligent orchestration through the ATTN-D3QN algorithm. The analysis results and generated orchestration are visualized and entered into the human-computer interaction module, which can manage scripts, alarms, etc.

[0004] In order to solve the above problems, the present invention provides the following technical solutions:

[0005] In one aspect, the present invention provides a SOAR-based network security automation method, the method comprising:

[0006] A security analysis model based on the informer algorithm and a security orchestration model based on the ATTN-D3QN algorithm. The informer model takes processed system log file information as input. It performs dimensionality reduction, feature extraction, and classification on this long series, outputting security threat analysis results that are then fed into the ATTN-D3QN model. The ATTN-D3QN model uses an attention network to approximate the optimal value function, enabling intelligent orchestration of security systems and tools. It also automatically runs through an API, achieving security automation. The specific steps are:

[0007] Step 1: Dynamically detect security threats in the system, preprocess the system log files, and make them suitable for input into the informer model by combining tags.

[0008] Step 2: Pre-train the informer model using legitimate system data and open-source cyber threat intelligence datasets to perform dimensionality reduction, feature extraction, and classification on the input sequence.

[0009] Step 3: Use the attention network for pre-training to obtain the optimal action-value function. Input the classification results of the informer model, as well as the current system environment status and security toolset. The ATTN-D3QN model simulates the optimal action-value function through attention network pre-training, inputs the policy function, and finally obtains and outputs the security orchestration.

[0010] The informer security analysis model implements intelligent network traffic analysis, threat prediction, and security incident classification based on machine learning. The informer model reduces the dimensionality of long time series, extracts features, and classifies them. The specific steps are:

[0011] Step 1: The informer model input is a triplet Q is the query, K is the key, V is the value, d is the dimension of the input data, and the i-th query is defined in probabilistic form as:

[0012]

[0013] Among them, q i 、k i 、v i Represents the i-th row of Q, K, and V respectively;

[0014] Step 2: In the self-attention learning model, a few dot product pairs will attract most of the attention, while other dot products will attract less attention. In order to distinguish the main attention, the sparsity of the query Q is defined. After removing the constant, the sparsity of the i-th query is defined as:

[0015]

[0016] The first item is the q of all key values i The logarithm of the sum of the exponential functions of LSE, the second term is their arithmetic mean, L K Indicates the length of K;

[0017] Step 3: Make each key value only process the main query of u, and the probabilistic sparse self-attention is defined as:

[0018]

[0019] in, It is a sparse matrix of the same size as q, containing only the Top-u queries under the sparse metric M(q,K), let u = clnL Q , the constant c is the sampling factor;

[0020] Step 4: To solve the numerical stability problem, approximate the sparse measure of the query and define the maximum average measure value as

[0021]

[0022] Step 5: The encoder extracts the long-range correlation of the long time series, extracts the dominant feature value with the dominant feature, and generates a self-attention feature map. The extraction process from the jth layer to the j+1th layer is defined as

[0023]

[0024] in[·] AB Represents an attention block, including multi-head self-attention and one-dimensional convolutional filters;

[0025] Step 6: Use a standard decoder consisting of two identical multi-head self-attention layers with the input vector

[0026]

[0027] The extracted feature values are input into softmax to obtain the security analysis results.

[0028] Based on the informer security analysis model, the system security event classification results are obtained and input into the ATTN-D3QN security orchestration model to achieve intelligent and automated security orchestration and incident response based on deep reinforcement learning, reducing manual participation and improving response efficiency. The specific steps of the ATTN-D3QN model are:

[0029] Step 1: Model the system network to simulate the model environment;

[0030] Step 2: Classify and abstract the security actions in security orchestration and define action set A;

[0031] Step 3: Input the observed state s to the model t Define a state set, which is divided into the state of all nodes in the system network and the state of attacked nodes in the system network. It describes the degree of damage caused by the security incident to the system network. Different security incidents will generate different system states.

[0032] Step 4: The reward value of the model consists of two parts: one is the reward for the executed safety action, and the other is the damage caused by the policy function to the system environment. It can be expressed as

[0033]

[0034] where ω t It is action a t The weight, h t is the security arrangement up to time t, A t is the set of safe actions up to time t;

[0035] Step 5: The action-value function is approximated by the deep network and expressed as

[0036]

[0037] Use the attention network to train the action value function in the D3QN network and obtain

[0038] Q * (s t ,a t )=max π [Q π (s t ,a t )]

[0039] Where γ is the discount rate, Q * (s t ,a t ) is the optimal action value function obtained through training;

[0040] Step 6: According to the output of the informer model, observe the state s t , execute safety action a according to the optimal action value function t , the system environment gives a new state s t+1 and rewards t , and continuously iterate to obtain the final security orchestration.

[0041] On the other hand, the present invention also provides a SOAR-based network security automation system. This system integrates a SOAR module, focuses on incident response operations, and uses machine learning models to achieve intelligent detection, classification, and response to system security incidents. This system implements automated and intelligent incident response, improves the efficiency of the security operation and maintenance team, normalizes and standardizes the response process, and shortens response time. The system includes:

[0042] The data service module is used to provide data generation, data aggregation, data protection, and data storage services. It stores, manages, and protects against leaks of historical data, security logs, and network traffic based on cloud services, cloud data, and database management systems. It monitors network traffic through alarms and sensor systems, and implements system protection and generates real-time data through security tools such as network analysis, vulnerability scanning, honeypots, and probes.

[0043] The security analysis module is used to implement intelligent system analysis, threat prediction, and security incident classification based on machine learning, and is embedded in the above-mentioned informer security analysis model;

[0044] The SOAR module is used to implement intelligent and automated security orchestration and incident response based on deep reinforcement learning, reducing manual intervention and improving response efficiency. It is embedded in the aforementioned ATTN-D3QN security orchestration model.

[0045] The interactive management module is used to visually display the contents of the security analysis module and the SOAR module, allowing security operations personnel to perform script management, alarm management, collaborative processing, workflow management, and automatically generate reports based on system logs.

[0046] The beneficial effects brought about by the technical solution provided by the present invention include at least:

[0047] The present invention integrates mainstream security tools and intelligent security analysis and SOAR modules. Through comprehensive analysis of system logs, it adopts the informer model and implements feature extraction of threat intelligence. According to current security events and security tool libraries, it adopts the ATTN-D3QN model to generate intelligent orchestration. Through a visual interface, it can perform script management, alarm management, workflow management, collaborative processing and automatic report generation, realizing automated and intelligent response to security events, improving the work efficiency of security operation and maintenance personnel and reducing manual dependence. The informer model is adopted to improve the accuracy of threat intelligence extraction and realize intelligent analysis of system logs, with better results than traditional models such as LSTM. The ATTN-D3QN deep learning model is adopted, which not only continues the decision-making ability of the deep reinforcement learning model, but also combines with the attention network, which is better than the standard D3QN model, improves the automation level of the SOAR module, and realizes intelligent orchestration of security tools and systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a network security automation method and system structure diagram based on SOAR.

[0049] Figure 2 This is the structure diagram of the informer security analysis model.

[0050] Figure 3 This is the structure diagram of the ATTN-D3QN security orchestration model. DETAILED DESCRIPTION

[0051] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. However, the following description is merely illustrative and is not intended to limit the scope of the present invention and its application.

[0052] Example 1:

[0053] like Figure 1As shown, this embodiment provides a SOAR-based security automation method and system, which mainly constructs the overall system framework with a data service module, a SOAR module, a security analysis module, and an interaction management module.

[0054] like Figure 2 As shown, the informer model of this embodiment implements the time series classification problem, performs feature extraction optimization through the attention mechanism, and realizes intelligent analysis of security events.

[0055] like Figure 3 As shown, the ATTN-D3QN deep learning model of this embodiment realizes intelligent and automated processing of security orchestration. It uses multi-head attention layers alternating with one-dimensional temporal convolution layers, whose outputs serve as the input of global attention. It also uses fully connected layers alternating with multi-head attention layers, and uses the multi-head attention layers as input to promote gradient backpropagation.

[0056] A SOAR-based network security automation method includes a security analysis model based on the informer algorithm and a security orchestration model based on the ATTN-D3QN algorithm. Processed system log file information is input. The informer model performs dimensionality reduction, feature extraction, and classification on this long series, outputting security threat analysis results that are then fed into the ATTN-D3QN model. The ATTN-D3QN model approximates the optimal value function through an attention network, enabling intelligent orchestration of security systems and tools. The model then automatically runs through an API, achieving security automation. The method includes the following steps:

[0057] Step 1: Dynamically detect security threats in the system, preprocess the system log files, and make them suitable for input into the informer model by combining tags.

[0058] Specifically, in this step, the system log file includes unstructured log data, structured or semi-structured log data. Unstructured log data is mostly stored in the form of text records in the log file, while structured or semi-structured log data is stored in different fields of the database record. Therefore, before performing a unified analysis on the log file, the unstructured log data must first be converted, that is, preprocessed. When this step is specifically implemented, the received system log file is preprocessed, the unstructured log data is converted into structured log events, and unified processing is performed with the fields of the structured or semi-structured log data to make it suitable for input into the informer model.

[0059] Step 2: Pre-train the informer model using legitimate system data and open-source cyber threat intelligence datasets to perform dimensionality reduction, feature extraction, and classification on the input sequence.

[0060] The informer security analysis model performs dimensionality reduction, feature extraction, and classification on long time series, enabling intelligent network traffic analysis, threat prediction, and security incident classification based on machine learning. Specifically, in this step, the informer model receives an input sequence. The pre-trained weights enable rapid analysis and processing of the input data, resulting in log file analysis results and security incident classification within the current system environment.

[0061] Step 3: Use the attention network for pre-training to obtain the optimal action-value function. Input the classification results of the informer model, as well as the current system environment status and security toolset. The ATTN-D3QN model simulates the optimal action-value function through attention network pre-training, inputs the policy function, and finally obtains and outputs the security orchestration.

[0062] The ATTN-D3QN security orchestration model enables intelligent and automated security orchestration and incident response based on deep reinforcement learning, reducing manual intervention and improving response efficiency. Specifically, in this step, the ATTN-D3QN model is pre-trained in a system network modeling environment. It learns the optimal action-value function based on security actions and model states. Based on the input informer model results (i.e., the security analysis results), which serve as the model's current state, the optimal action-value function executes security actions. The system environment then generates new states and rewards, and the process continues iterating to achieve the final security orchestration.

[0063] Example 2:

[0064] The present invention also provides a network security automation system based on SOAR, which includes:

[0065] The data service module is used to provide data generation, data aggregation, data protection, and data storage services. It stores, manages, and protects against leaks of historical data, security logs, and network traffic based on cloud services, cloud data, and database management systems. It monitors network traffic through alarms and sensor systems, and implements system protection and generates real-time data through security tools such as network analysis, vulnerability scanning, honeypots, and probes.

[0066] The security analysis module is used to implement intelligent system analysis, threat prediction, and security incident classification based on machine learning, and is embedded in the above-mentioned informer security analysis model;

[0067] The SOAR module is used to implement intelligent and automated security orchestration and incident response based on deep reinforcement learning, reducing manual intervention and improving response efficiency. It is embedded in the aforementioned ATTN-D3QN security orchestration model.

[0068] The interactive management module is used to visually display the contents of the security analysis module and the SOAR module, allowing security operations personnel to perform script management, alarm management, collaborative processing, workflow management, and automatically generate reports based on system logs.

[0069] The foregoing merely describes preferred embodiments of the present invention, and while the description is relatively specific and detailed, it should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make various modifications, improvements, and substitutions without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A network security automation method based on SOAR, characterized in that: include: A security analysis model based on the informer algorithm and a security orchestration model based on the ATTN-D3QN algorithm; The processed system log file information is input. The informer model performs dimensionality reduction, feature extraction, and classification on the long time series to output security threat analysis results, which are then input into the ATTN-D3QN model. The ATTN-D3QN model approximates the optimal value function through an attention network, enabling intelligent orchestration of security systems and tools, and automatically running them through APIs to achieve security automation. The specific steps are: Step 1: Dynamically detect security threats in the system, preprocess the system log files, and make them suitable for input into the informer model by combining tags; Step 2: Pre-train the informer model using legitimate system data and open-source cyber threat intelligence datasets to perform dimensionality reduction, feature extraction, and classification on the input sequence. Step 3: Use the attention network for pre-training to obtain the optimal action-value function. The informer model's classification results are input, along with the current system environment status and security toolset. The ATTN-D3QN model simulates the optimal action-value function through attention network pre-training. The policy function is then input to ultimately obtain and output a secure orchestration. The specific steps of the ATTN-D3QN model to achieve security orchestration automation and response are: Step 3.1: Model the system network for simulating the model environment; Step 3.2: Classify and abstract the security actions in security orchestration and define action set A; Step 3.3: Observed state s for model input t Define a state set, which is divided into the state of all nodes in the system network and the state of attacked nodes in the system network. It describes the degree of damage caused by the security incident to the system network. Different security incidents will generate different system states. Step 3.4: The reward value of the model consists of two parts: one is the reward obtained by the executed safe action, and the other is the damage caused by the policy function to the system environment; it is expressed as where ω t It is action a t The weight, h t is the security arrangement up to time t, A t is the set of safe actions up to time t; Step 3.5: The action-value function is approximated by the deep network and expressed as Use the attention network to train the action value function in the D3QN network and obtain Q * (s t ,a t )=max π [Q π (s t ,a t )] Where γ is the discount rate, Q * (s t ,a t ) is the optimal action value function obtained through training; Step 3.6: According to the output of the informer model, observe the state s t , execute safety action a according to the optimal action value function t , the system environment gives a new state s t+1 and rewards t , and continuously iterate to obtain the final security orchestration.

2. A network security automation method based on SOAR according to claim 1, characterized in that: The specific steps of the informer model to reduce the dimension of the input sequence, extract features and classify them are as follows: Step 2.1: Informer model input is triples Q is the query, K is the key, V is the value, d is the dimension of the input data, and the i-th query is defined in probabilistic form as: Among them, q i 、k i 、v i Represents the i-th row of Q, K, and V respectively; Step 2.2: In the self-attention learning model, a few dot product pairs will attract most of the attention, while other dot products will attract less attention. In order to distinguish the main attention, define the sparsity of the query Q. Remove the constant. The sparsity of the i-th query is defined as: The first item is the q of all key values i The logarithm of the sum of the exponential functions of LSE, the second term is their arithmetic mean, L K Indicates the length of K; Step 2.3: Make each key value only process the main query of u, and the probabilistic sparse self-attention is defined as: in, It is a sparse matrix of the same size as q, containing only the Top-u queries under the sparse metric M(q,K), let u = clnL Q , the constant c is the sampling factor; Step 2.4: To address the numerical stability issue, approximate the sparse measure of the query and define the maximum average measure as Step 2.5: The encoder extracts the long-range correlation of the long time series, extracts the dominant feature value with the dominant feature, and generates a self-attention feature map. The extraction process from the jth layer to the j+1th layer is defined as in[·] AB Represents an attention block, including multi-head self-attention and one-dimensional convolutional filters; Step 2.6: Use a standard decoder consisting of two identical multi-head self-attention layers with the input vector The extracted feature values are input into softmax to obtain the security analysis results.

3. A network security automation system based on SOAR, characterized in that: include: The data service module is used to provide data generation, data aggregation, data protection, and data storage services. It uses cloud services, cloud data, and database management systems to store, manage, and leak-proof historical data, security logs, and network traffic. It monitors network traffic through alarms and sensor systems, implements system protection through security tools, and generates real-time data. The security analysis module embeds the informer security analysis model to implement intelligent system analysis, threat prediction, and security incident classification based on machine learning; The SOAR module, embedded in the ATTN-D3QN security orchestration model, is used to implement intelligent and automated security orchestration and incident response based on deep reinforcement learning; The interactive management module is used to visually display the contents of the security analysis module and the SOAR module, allowing security operations personnel to perform script management, alarm management, collaborative processing, workflow management, and automatically generate reports based on system logs.

4. A network security automation system based on SOAR according to claim 3, characterized in that: The steps for building the informer security analysis model are as follows: Step 5.1: Informer model input is triples Q is the query, K is the key, V is the value, d is the dimension of the input data, and the i-th query is defined in probabilistic form as: Among them, q i 、k i 、v i Represents the i-th row of Q, K, and V respectively; Step 5.2: In the self-attention learning model, a few dot product pairs will attract most of the attention, while other dot products will attract less attention. In order to distinguish the main attention, define the sparsity of the query Q. Remove the constant. The sparsity of the i-th query is defined as: The first item is the q of all key values i The logarithm of the sum of the exponential functions of LSE, the second term is their arithmetic mean, L K Indicates the length of K; Step 5.3: Make each key value only process the main query of u, and the probabilistic sparse self-attention is defined as: in, It is a sparse matrix of the same size as q, containing only the Top-u queries under the sparse metric M(q,K), let u = clnL Q , the constant c is the sampling factor; Step 5.4: To address the numerical stability issue, approximate the sparse measure of the query and define the maximum average measure as Step 5.5: The encoder extracts the long-range correlation of the long time series, extracts the dominant feature value with the dominant feature, and generates a self-attention feature map. The extraction process from the jth layer to the j+1th layer is defined as in[·] AB Represents an attention block, including multi-head self-attention and one-dimensional convolutional filters; Step 5.6: Use a standard decoder consisting of two identical multi-head self-attention layers with the input vector The extracted feature values are input into softmax to obtain the security analysis results.

5. A network security automation system based on SOAR according to claim 3, characterized in that: The ATTN-D3QN security orchestration model is constructed in the following steps: Step 6.1: Model the system network for simulating the model environment; Step 6.2: Classify and abstract the security actions in security orchestration and define action set A; Step 6.3: Observed state s for model input t Define a state set, which is divided into the state of all nodes in the system network and the state of attacked nodes in the system network. It describes the degree of damage caused by the security incident to the system network. Different security incidents will generate different system states. Step 6.4: The reward value of the model consists of two parts: one is the reward obtained by the executed safe action, and the other is the damage caused by the policy function to the system environment; it is expressed as where ω t It is action a t The weight, h t is the security arrangement up to time t, A t is the set of safe actions up to time t; Step 6.5: The action-value function is approximated by the deep network and expressed as Use the attention network to train the action value function in the D3QN network and obtain Q * (s t ,a t )=max π [Q π (s t ,a t )] Where γ is the discount rate, Q * (s t ,a t ) is the optimal action value function obtained through training; Step 6.6: According to the output of the informer model, observe the state s t , execute safety action a according to the optimal action value function t , the system environment gives a new state s t+1 and rewards t , and continuously iterate to obtain the final security orchestration.

Images