A security threat collaborative processing method, device and medium

Abstract

The present invention relates to a method, device and medium for collaborative processing of security threats. The present application receives a security threat alarm event, deduplicates and merges the security threat alarm event, analyzes the information related to the IP in the security threat alarm event, and pulls the relevant personnel of the asset according to the IP or manually assigns the relevant personnel to enter the independent transaction group for different events based on the human-machine collaborative operations room; the transaction group obtains the script for processing security threats through AI intelligent recommendation or collaborates to visually construct a script for security threat alarm events through a script graphical editor, and automatically or semi-automatically calls the basic capabilities in the network through the script to process the security threat alarm event. The integration of human-machine collaboration and script-based security threat corresponding processing automation can effectively improve the efficiency of security threat response processing. And the equipment and medium that implement the method for collaborative processing of security threats can also achieve the corresponding effect of the method.

Description

Technical Field

[0001] The present invention relates to the technical field of security threat response processing, and in particular to a security threat collaborative processing method, device and medium. Background Art

[0002] Over the past decade, with the continuous innovation of security vendors and the improvement of enterprise security construction, the ability of enterprises to detect security threats has been continuously improved. However, after the security incident is triggered, the problem of insufficient response capabilities in the event operation process has gradually become prominent. In the daily security incident operation process, after the security emergency process is initiated, in addition to the communication between the security supervisor and the engineer, the security engineer is often required to interact with the operation and maintenance, IT and other personnel. And, in the end, someone always needs to log in to the system or device through human-computer interaction to complete a series of operations in order to obtain the desired results.

[0003] Security orchestration automated emergency response is a representative of many solutions. Its idea is to combine various actions in the security emergency response process and automatically carry out emergency response work in a scripted manner. With the help of the well-organized security emergency response script, when a security incident occurs, the system will respond through automated means to reduce manual dependence. In this way, the speed and efficiency of security incident response can be guaranteed, the quality of security emergency response can also be guaranteed, and it can also buy time for the defender in the real attack and defense confrontation and accelerate threat response and disposal. On the one hand, security orchestration automated emergency response cannot cover all scenarios, and security personnel are required to work together to deal with security threats that security orchestration automated emergency response cannot cover. On the other hand, in large-scale application scenarios, the amount of analysis data and events of security orchestration automated emergency response are large, and the unified planning of each sub-scenario without restrictions is likely to lead to slow security threat response processing. Summary of the invention

[0004] In order to solve the above technical problem or at least partially solve the above technical problem, the present invention provides a security threat collaborative processing method, device and medium.

[0005] In a first aspect, the present invention provides a method for collaboratively processing security threats, comprising:

[0006] Receive security threat warning events issued by upstream situational awareness, SIEM or SOC, deduplicate and merge the security threat warning events, analyze the information related to the IP in the security threat warning events, pull asset-related personnel according to the IP or manually assign relevant personnel to enter the independent transaction group for different events based on the human-machine collaborative operations room; the transaction group obtains AI-recommended scripts for handling security threats or collaborates to visually construct scripts for security threat warning events through a script graphical editor, and automatically or semi-automatically calls the basic capabilities in the network through the script to handle the security threat warning events. The basic capabilities include security equipment and network security equipment available in the intranet.

[0007] Furthermore, the incident response center receives, formats, queues, and triggers security threat warning events, and provides security threat warning event transmission capabilities based on open APIs.

[0008] Furthermore, based on the Kafka message mechanism and WebSocket real-time streaming technology, a human-machine collaborative operations room is provided to support multi-person online collaborative processing of security threats, and independent transaction groups are created for different events based on the human-machine collaborative operations room;

[0009] The work areas configured in the human-machine collaborative operations room include: event scheduling, capability drive, combat communication, and personnel management work areas.

[0010] Furthermore, the human-machine collaborative operations room implements semantic analysis and context processing through natural language processing (NLP), and combines regular matching and association analysis to process commands issued to the transaction group to speed up the issuance of commands.

[0011] Furthermore, the script arrangement is visualized by using the script graphical editor based on the script library and the action library, wherein:

[0012] Define script rules through event pre-engine, script scheduling engine, and action execution engine, and configure script rules in the script library; use modular programming to define actions, configure actions in the action library, and divide the script library and application library according to usage;

[0013] Design typical scripts based on application scenarios in the security field, and provide a custom script design interface; integrate GUI visual programming capabilities to implement script rule combination and action scheduling by dragging and dropping graphics representing script rules and actions, thereby building scripts.

[0014] Furthermore, basic capability access based on open SDK is adopted to support access to mainstream domestic and foreign network security products.

[0015] Furthermore, Faster R-CNN, NLP natural language processing, and adversarial learning are used to provide AI capabilities in multiple scenarios, including: rapid OCR image recognition in the human-machine collaborative operations room, recommended processing scripts after security threat alarm events occur, and the use of a graphical script editor to visually build scripts for security threat alarm events. Intelligent action recommendations and intelligent deduplication scenarios are provided during the collection of security threat alarm events.

[0016] Furthermore, a report generation API is configured. Users configure the security events for which reports need to be generated through the configuration items of the report generation API. The configuration items support matching security threat alarm events by time period and by keywords. Event summary reports are generated by button triggering. When the event summary reports are generated, they are automatically archived to the system knowledge base.

[0017] In a second aspect, the present invention provides a security threat collaborative processing device, comprising at least one processing unit, a storage unit and a bus unit, wherein the bus unit connects the storage unit and the processing unit, wherein a computer program is stored in the storage unit, and the processing unit executes the computer program to implement the security threat collaborative processing method.

[0018] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method for collaboratively processing security threats.

[0019] The above technical solution provided by the embodiment of the present invention has the following advantages compared with the prior art:

[0020] This application receives security threat warning events, deduplicates and merges the security threat warning events, analyzes the information related to the IP in the security threat warning events, and pulls asset-related personnel according to the IP or manually assigns related personnel to independent transaction groups for different events based on the human-machine collaborative operations room; the transaction group obtains AI intelligently recommended scripts for handling security threats or collaborates to visually construct scripts for security threat warning events through a script graphical editor, and automatically or semi-automatically calls the basic capabilities in the network through the script to handle the security threat warning events. The integration of human-machine collaboration and script-based security threat response automation can effectively improve the efficiency of security threat response processing.

[0021] This application supports the creation of transaction groups based on the IPs involved in security threat alerts, effectively organizing personnel who handle security threat alerts and improving processing efficiency.

[0022] This application uses a graphical editor to visually construct a script for handling security threat alert events. When the script needs to be edited, the script can be efficiently edited by dragging and dropping.

[0023] This application will realize efficient human-machine collaboration by providing command recognition based on AI, recommending processing scripts after security threat alarm events occur, text recognition, and intelligent action recommendations during script construction. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0026] Figure 1 A framework diagram of a method for collaboratively processing security threats provided by an embodiment of the present invention;

[0027] Figure 2 A flowchart of a method for collaboratively processing security threats provided by an embodiment of the present invention;

[0028] Figure 3 A flowchart of an embodiment of processing a security threat alarm of an upstream device based on a security threat collaborative processing method of the present invention;

[0029] Figure 4 A flowchart of an embodiment of processing a security threat alarm of a third-party security device based on a security threat collaborative processing method of the present invention;

[0030] Figure 5 A flowchart of an embodiment of processing security threat alarms of linked honeypot devices based on a security threat collaborative processing method of the present invention;

[0031] Figure 6 A schematic diagram of a security threat collaborative processing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0034] Example 1

[0035] The embodiment of the present invention provides a method for collaborative processing of security threats, aiming to provide two core functions of human-machine collaboration and script-based automated emergency response, to help conduct rapid emergency response to security threat alerts, improve the collaborative process, and increase the speed of security threat alert processing.

[0036] See also Figure 1 As shown, this application follows the "three centers, one engine, and one platform" architecture design. The three centers at the bottom include the system center, the data center, and the event response center.

[0037] Among them, the data center is responsible for event storage, operation records, scheduling logs and audit records; the system center is responsible for identity authentication, authority management, system monitoring and repair, asset management and distributed scheduling; the data center is responsible for the data connection between the present invention and the back-end data products such as Mysql, Elasticsearch, Oracle, etc., and is responsible for the creation and maintenance of knowledge graphs and knowledge bases; the event response center is responsible for monitoring the connectivity of MQ and Rest API, and the creation, monitoring and response of events such as timers and database monitoring. Specifically, the event response center receives, queues, formats, triggers and other operations on security threat warning events, and provides security threat warning event transmission capabilities based on open APIs.

[0038] An intelligent orchestration engine that provides services based on the bottom layer, the intelligent orchestration engine includes: an intelligent decision engine, an execution engine and a human-machine collaborative operations room engine. The intelligent orchestration engine is mainly responsible for the access and pre-formatting of security threat warning events, responsible for the script launch, execution, tracking and scheduling of security threat warning events, responsible for message broadcasting, message notification, progress update in the human-machine collaborative operations room, and responsible for AI capabilities including OCR recognition, intelligent recommendation, and intelligent deduplication.

[0039] The human-machine collaborative operations room engine is based on the Kafka message mechanism and WebSocket real-time streaming technology, providing a human-machine collaborative operations room that supports multiple people to collaboratively handle security threats online. The work areas configured in the human-machine collaborative operations room include: event scheduling, capability drive, combat communication, and personnel management work areas.

[0040] Based on the human-machine collaborative operations room, independent affairs groups are created for different events. Security personnel in the affairs group are configured, authenticated, and permission managed through the personnel management workspace; security personnel in the affairs group are allowed to jointly participate in the handling of security threat warning events. The human-machine collaborative operations room conducts online communication and collaboration based on text, pictures, and attachments through the combat communication workspace. The human-machine collaborative operations room implements scripts through capability-driven

[0041] In order to improve the efficiency of personnel communication, the human-machine collaborative operations room implements semantic analysis and context processing through natural language processing NLP, and combines regular matching and association analysis to process the commands issued to the transaction group to speed up the issuance of commands. Specifically, Faster R-CNN, NLP natural language processing, and adversarial learning are used to provide multi-scenario AI capabilities, including: rapid OCR image recognition in the human-machine collaborative operations room, recommended processing scripts after security threat alarm events occur, and the use of a graphical script editor to visually build scripts for security threat alarm events. Provide intelligent action recommendations and intelligent deduplication scenarios during the collection of security threat alarm events.

[0042] The intelligent decision engine and execution engine support the script graphical editor based on the script library and action library to visualize the script arrangement, wherein the script rules are defined through the event front engine, script scheduling engine, and action execution engine, and the script rules are configured in the script library; modular programming is used to define actions, and the actions are configured in the action library, and the script library and application library are divided according to the purpose of use. In the specific implementation process, a typical script is designed in combination with the application scenarios in the security field, and a custom script design interface is provided; GUI visual programming capabilities are integrated, and the script rule combination and action scheduling are realized by dragging and dropping graphics representing script rules and actions, thereby constructing a script.

[0043] The open platform that provides services based on the above three centers and one engine integrates security application functions, third-party collaboration tools and developer maintenance interfaces. For example, in terms of security application functions, basic capability access based on open SDK is adopted to support the access of mainstream network security products at home and abroad.

[0044] See also Figure 2 As shown, the intelligent orchestration engine is used as the main body to execute a security threat collaborative processing method, and the steps implemented include:

[0045] Receive security threat alerts from upstream situational awareness, SIEM or SOC. Upstream situational awareness, SIEM or SOC can send security threat alerts to the incident response center via Kafka, Syslog, API, or SFTP. The human-machine collaborative operations room engine in the intelligent orchestration engine uses AI to deduplicate and merge security threat alerts, realizing intelligent deduplication scenarios during the collection of security threat alerts.

[0046] Analyze the IP information involved in security threat alarm events, and pull asset-related personnel according to the IP or manually assign relevant personnel to independent transaction groups for different events based on the human-machine collaborative operations room.

[0047] The transaction group obtains AI intelligent recommendations for scripts for handling security threats or collaborates to visually construct scripts for security threat warning events through a script graphical editor.

[0048] The script is used to automatically or semi-automatically call basic capabilities in the network to handle the security threat warning event, and the basic capabilities include security equipment and network security equipment in the intranet.

[0049] The user configures the security events for which reports need to be generated through the configuration items of the report generation API. The configuration items support matching security threat alarm events by time period and keyword, and the event summary report is generated by button triggering. When the event summary report is generated, it will be automatically archived to the system knowledge base.

[0050] In a specific embodiment, see Figure 3 As shown, receive security threat alarms from upstream devices, deduplicate and merge security threat alarms, analyze abnormal IPs in security threat alarms, and collect intelligence information according to the attack direction. Pull relevant personnel into the human-machine collaborative operations room to form a affairs group to carry out disposal work. If it is from inside to outside, the attack IP involved in the security threat alarm is judged on the whitelist. If it is not on the whitelist, the domestic attack IP is handled and recorded and archived with one click, and the attack IP is blocked through the provincial company firewall. If the attack direction is from outside to inside, analyze the ownership of the attack IP or whether it meets the high risk of Tianyan. If it is an overseas IP or meets the high risk of Tianyan, the attack IP is handled and archived with one click. If it is a domestic IP and does not meet the high risk of Tianyan, choose whether to handle it. If you choose to handle it, the domestic attack IP is handled and archived with one click, and the attack IP is blocked through the provincial company firewall. The city and prefecture linkage handles it with one click. If you choose not to handle it, enter the whitelist. It automatically takes corresponding measures according to the attributes of the attacking IP, and has the ability to quickly block the threat source on multiple firewalls at the same time. The time it takes to block a group of IP addresses is shortened from dozens of minutes or more than ten minutes to within 20 seconds.

[0051] In a specific embodiment, see Figure 4 As shown, the mining, virus and Trojan security threat alarms of third-party security equipment are received, the internal and external IP-related intelligence information in the security threat alarms is analyzed, and the asset-related personnel are pulled into the war room. Combined with the attack direction, external IP location, and script application scenario, the security incident is handled. Specifically, if the attack direction is from inside to outside, the location of the asset is judged. When the location of the asset is a prefecture-level city, the prefecture-level city blocks, updates the asset blocking record and archives it. If the location of the asset is not a prefecture-level city, the overseas IP is judged. If it is judged to be an overseas IP, it is automatically blocked. If it is judged to be a domestic IP, the administrator approves the ban, and the scenario where the administrator approves the ban is not an HVV scenario, it will be handled by the prefecture-level city. If the attack direction is from outside to inside, the overseas IP is judged. If it is judged to be an overseas IP, it is automatically blocked. If it is judged to be a domestic IP, the administrator approves the ban, and the scenario where the administrator approves the ban is not an HVV scenario, it will be handled by the prefecture-level city. Through the automated process, after a high-risk event occurs, the relevant information of the event is automatically extracted to the security personnel for information verification. After confirming that the information is correct and needs to be handled, the relevant person in charge is automatically notified. After approval by the administrator, the ban is handled. The time required to handle each incident was reduced from approximately 10 minutes to approximately 15 seconds.

[0052] In a specific embodiment, see Figure 5 As shown, the present invention automatically queries the abnormal IP in the honeypot alarm according to the honeypot alarm captured in the linked honeypot device, pulls the security personnel into the human-machine collaborative operations room to form a business group, and determines whether the abnormal IP is an internal IP. If it is, the abnormal IP is banned after manual review by the business group, and the administrator is informed of the disposal result after banning. Otherwise, the threat intelligence related to the abnormal IP is obtained, and the mobile phone number, email address, and social ID are self-queried to collect, summarize and save data, so as to help security personnel quickly obtain relevant hacker portrait information.

[0053] Example 2

[0054] See also Figure 6 As shown, an embodiment of the present invention provides a security threat collaborative processing device, including: at least one processing unit, a storage unit and a bus unit, the bus unit connecting the storage unit and the processing unit, the storage unit storing a computer program, and the processing unit executing the computer program to implement the security threat collaborative processing method.

[0055] The storage unit may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store security threat warning event information, etc. In addition, the storage unit may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the storage unit may further include a memory remotely arranged relative to the processing unit, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0056] Example 3

[0057] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for collaboratively processing security threats is implemented. Of course, the computer program stored in the storage medium for implementing the method for collaboratively processing security threats provided by an embodiment of the present invention is not limited to the method operations described above, and can also execute related operations in the method for collaboratively processing security threats provided by any embodiment of the present invention.

[0058] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for an electronic device (which can be a mobile phone, a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0059] In the embodiments provided by the present invention, it should be understood that the disclosed structures and methods can be implemented in other ways. For example, the structural embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, structures or units, which can be electrical, mechanical or other forms.

[0060] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0061] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0062] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for collaboratively processing security threats, characterized in that: include: Receive security threat warning events issued by upstream situational awareness, SIEM or SOC, de-duplicate and merge the security threat warning events, analyze the information related to the IP in the security threat warning events, pull asset-related personnel according to the IP or manually assign relevant personnel to enter the independent transaction group for different events based on the human-machine collaborative operations room; the transaction group obtains the script for handling security threats recommended by AI intelligently or collaborates to visually construct a script for security threat warning events through a script graphical editor, and automatically or semi-automatically calls the basic capabilities in the network through the script to handle the security threat warning events. The basic capabilities include security equipment and network security equipment in the intranet; The security threat handling implemented includes: Receive security threat alarms from upstream devices, deduplicate and merge security threat alarms, parse abnormal IPs in security threat alarms, and first collect intelligence information based on the attack direction, pull relevant personnel into the human-machine collaborative operations room to form a affairs group to carry out disposal work. If the attack is from inside to outside, the attack IP involved in the security threat alarm is judged on the whitelist. If it is not on the whitelist, the domestic attack IP is disposed of with one click and recorded and archived, and the attack IP is blocked through the provincial company firewall. If the attack direction is from outside to inside, analyze the ownership of the attack IP or whether it meets the high risk of Tianyan. If it is an overseas IP or meets the high risk of Tianyan, the attack IP is disposed of with one click and recorded and archived. If it is a domestic IP and does not meet the high risk of Tianyan, choose whether to dispose. If you choose to dispose, the domestic attack IP is disposed of with one click and recorded and archived, and the attack IP is blocked through the provincial company firewall. The city and prefecture linkage is handled with one click. If you choose not to dispose, enter the whitelist; Receive security threat alerts from third-party security devices, analyze internal and external IP-related intelligence information in security threat alerts, pull asset-related personnel into the operations room, and handle security incidents based on the attack direction, external IP location, and script application scenarios; if the attack direction is from inside to outside, determine the location of the asset. When the asset location is a prefecture-level city, the prefecture-level city will block, update the asset blocking record, and archive it. If the asset location is not a prefecture-level city, determine the overseas IP. If it is determined to be an overseas IP, it will be automatically blocked. If it is determined to be a domestic IP and the administrator approves the ban, and the scenario where the administrator approves the ban is not an HVV scenario, it will be handled by the prefecture-level city; if the attack direction is from outside to inside, determine the overseas IP. If it is determined to be an overseas IP, it will be automatically blocked. If it is determined to be a domestic IP and the administrator approves the ban, and the scenario where the administrator approves the ban is not an HVV scenario, it will be handled by the prefecture-level city; According to the honeypot alarm captured in the linked honeypot device, the abnormal IP in the honeypot alarm is automatically queried, and the security personnel are pulled into the human-machine collaborative operations room to form a business group to determine whether the abnormal IP is an internal IP. If it is, the abnormal IP is blocked after manual review by the business group, and the administrator is informed of the disposal results after blocking. Otherwise, the threat intelligence related to the abnormal IP is obtained, and the mobile phone number, email address, and social ID are self-queried to collect, summarize and save data to help security personnel quickly obtain relevant hacker portrait information.

2. The method for collaboratively processing security threats according to claim 1, characterized in that: Security threat alert events are received, formatted, queued, and triggered through the incident response center, and the ability to transmit security threat alert events is provided externally based on an open API.

3. The method for collaboratively processing security threats according to claim 1, characterized in that: Based on the Kafka message mechanism and WebSocket real-time streaming technology, a human-machine collaborative operations room is provided to support multiple people to collaboratively handle security threats online, and independent transaction groups are created for different events based on the human-machine collaborative operations room; The work areas configured in the human-machine collaborative operations room include: event scheduling, capability drive, combat communication, and personnel management work areas.

4. The method for collaboratively processing security threats according to claim 3, characterized in that: The human-machine collaborative operations room implements semantic analysis and context processing through natural language processing (NLP), and combines regular matching and association analysis to process commands issued to the transaction group to speed up the issuance of commands.

5. The method for collaboratively processing security threats according to claim 1, characterized in that: The script arrangement is visualized by the script graphical editor based on the script library and the action library, wherein: Define script rules through event pre-engine, script scheduling engine, and action execution engine, and configure script rules in the script library; use modular programming to define actions, configure actions in the action library, and divide the script library and application library according to usage; Design typical scripts based on application scenarios in the security field, and provide a custom script design interface; integrate GUI visual programming capabilities to implement script rule combination and action scheduling by dragging and dropping graphics representing script rules and actions, thereby building scripts.

6. The method for collaboratively processing security threats according to claim 1, characterized in that: Adopt basic capability access based on open SDK to support access to mainstream network security products at home and abroad.

7. The method for collaboratively processing security threats according to claim 1, characterized in that: Faster R-CNN, NLP natural language processing, and adversarial learning are used to provide AI capabilities in multiple scenarios, including: rapid OCR image recognition in the human-machine collaborative operations room, recommended processing scripts after security threat alarm events occur, and intelligent action recommendations in the process of visually building scripts for security threat alarm events through a graphical script editor, as well as intelligent deduplication scenarios during the collection of security threat alarm events.

8. The method for collaboratively processing security threats according to claim 1, characterized in that: Configure the report generation API. Users configure the security events for which reports need to be generated through the configuration items of the report generation API. The configuration items support matching security threat alarm events by time period and keyword. The event summary report is generated by button triggering. When the event summary report is generated, it will be automatically archived to the system knowledge base.

9. A security threat collaborative processing device, characterized in that: include: At least one processing unit, a storage unit and a bus unit, the bus unit connecting the storage unit and the processing unit, the storage unit storing a computer program, and the processing unit executing the computer program to implement the security threat collaborative processing method described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the security threat collaborative processing method described in any one of claims 1 to 8 are implemented.

Images