Automatic processing method and related equipment for network security alarm based on threat intelligence

Abstract

The automatic handling method and related equipment of network security alarms based on threat intelligence provided by the present invention can perform correlation analysis by combining the alarm logs sent by the intelligent analysis engine and the threat intelligence logs queried on the multi-source converged threat intelligence platform, and use the preset threat intelligence evaluation table to obtain the reputation value corresponding to the threat intelligence log, so as to accurately evaluate the reliability of the threat intelligence log, and then achieve efficient network security protection through the preset alarm response strategy.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to an automatic handling method for network security alarms based on threat intelligence and related equipment. Background Art

[0002] With the rapid development of Internet technology, various network attacks emerge in complex network environments, and the means of attack become more diverse and complex, which continuously challenges traditional network security solutions.

[0003] In order to deal with network security threats, threat intelligence obtained based on big data correlation analysis plays a vital role in helping enterprises and organizations quickly understand internal threat information. However, as a kind of data-based knowledge, threat intelligence is difficult to provide direct network security protection alone, and the reliability of threat intelligence is difficult to verify. There is a problem of too high false alarm rate, which can easily reduce the effect of network security protection.

[0004] Therefore, how to perform efficient network security protection based on threat intelligence has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] In view of the above problems, the present disclosure provides an automatic handling method and related equipment for network security alarms based on threat intelligence that overcome the above problems or at least partially solve the above problems. The technical solution is as follows:

[0006] An automatic handling method for network security alarms based on threat intelligence, comprising:

[0007] Obtaining security event information sent by the intelligent analysis engine, the security event information including multiple alarm logs related to the attack, wherein the alarm logs include alarm source information and alarm time period;

[0008] Querying the threat intelligence log corresponding to the alarm source information in the multi-source converged threat intelligence platform;

[0009] Determine an intelligence time period associated with the threat intelligence log using the alarm time period;

[0010] The intelligent analysis engine is used to collect statistics of alarm data under each preset alarm dimension within the intelligence time period to obtain alarm statistical information;

[0011] Based on the threat intelligence log and the alarm statistics, a reputation value corresponding to the threat intelligence log is obtained using a preset threat intelligence evaluation table;

[0012] Based on a preset alarm response strategy, a disposal operation matching the reputation value is performed on the target object pointed to by the alarm source information.

[0013] Optionally, the performing a disposal operation matching the reputation value on the target object pointed to by the alarm source information based on a preset alarm response strategy includes:

[0014] When the reputation value is greater than a first preset threshold, banning the target object pointed to by the alarm source information;

[0015] When the reputation value is greater than a second preset threshold value and not greater than the first preset threshold value, generating an alarm notification corresponding to the target object pointed to by the alarm source information;

[0016] When the reputation value is not greater than the second preset threshold, an event record sheet corresponding to the target object pointed to by the alarm source information is generated.

[0017] Optionally, the alarm log includes a first alarm log screened out by the intelligent analysis engine using a real-time association rule analysis strategy in the original log corresponding to the alarm source information, and a second alarm log in the original log that has an attack timing relationship with the first alarm log.

[0018] Optionally, the alarm log also includes: severity level, attack classification, alarm name, destination address, start event, original log, attack result and alarm number.

[0019] Optionally, the preset alarm dimensions include alarm quantity, impact scope, timeliness, threat level, confidence level, threat type, alarm source, geographic location, alarm device deployment location, and blocking impact level.

[0020] Optionally, applied to security orchestration automation and response systems.

[0021] An automatic handling device for network security alarms based on threat intelligence comprises: a security event information obtaining unit, a threat intelligence log query unit, an intelligence time period determination unit, an alarm statistical information obtaining unit, a reputation value obtaining unit and a handling operation execution unit.

[0022] The security event information obtaining unit is used to obtain the security event information sent by the intelligent analysis engine, the security event information includes a plurality of alarm logs related to the attack, wherein the alarm log includes alarm source information and alarm time period;

[0023] The threat intelligence log query unit is used to query the threat intelligence log corresponding to the alarm source information in the multi-source converged threat intelligence platform;

[0024] The intelligence time period determination unit is used to determine the intelligence time period associated with the threat intelligence log using the alarm time period;

[0025] The alarm statistical information obtaining unit is used to use the intelligent analysis engine to count the alarm data under each preset alarm dimension within the intelligence time period to obtain alarm statistical information;

[0026] The reputation value obtaining unit is used to obtain the reputation value corresponding to the threat intelligence log based on the threat intelligence log and the alarm statistical information using a preset threat intelligence evaluation table;

[0027] The handling operation execution unit is used to execute a handling operation matching the reputation value on the target object pointed to by the alarm source information based on a preset alarm response strategy.

[0028] Optionally, the handling operation execution unit includes: a blocking subunit, an alarm notification generating subunit and an event record generating subunit.

[0029] The blocking subunit is configured to block the target object pointed to by the alarm source information when the reputation value is greater than a first preset threshold;

[0030] The alarm notification generating subunit is used to generate an alarm notification corresponding to the target object pointed to by the alarm source information when the reputation value is greater than the second preset threshold and not greater than the first preset threshold;

[0031] The event record sheet generating subunit is used to generate an event record sheet corresponding to the target object pointed to by the alarm source information when the reputation value is not greater than the second preset threshold.

[0032] A computer-readable storage medium having a program stored thereon, characterized in that when the program is executed by a processor, the program implements any of the above-mentioned methods for automatically handling network security alarms based on threat intelligence.

[0033] An electronic device, comprising at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute any of the above-mentioned methods for automatically handling network security alarms based on threat intelligence.

[0034] By means of the above technical scheme, the present disclosure provides an automatic disposal method and related equipment for network security alarm based on threat intelligence, obtains security event information sent by an intelligent analysis engine, and the security event information includes multiple alarm logs related to the attack, wherein the alarm log includes alarm source information and alarm time period; queries the threat intelligence log corresponding to the alarm source information in the multi-source convergence threat intelligence platform; determines the intelligence time period associated with the threat intelligence log by using the alarm time period; obtains alarm statistical information by using the intelligent analysis engine to count the alarm data under each preset alarm dimension in the intelligence time period; obtains the reputation value corresponding to the threat intelligence log based on the threat intelligence log and the alarm statistical information, and performs a disposal operation matching the reputation value on the target object pointed to by the alarm source information based on the preset alarm response strategy. The present disclosure combines the alarm log sent by the intelligent analysis engine with the threat intelligence log queried on the multi-source convergence threat intelligence platform for correlation analysis, and obtains the reputation value corresponding to the threat intelligence log by using the preset threat intelligence evaluation table, thereby accurately evaluating the reliability of the threat intelligence log, and then realizing efficient network security protection through the preset alarm response strategy.

[0035] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the specific implementation methods of the present disclosure are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present disclosure. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0037] Figure 1 A flowchart of an implementation method of an automatic handling method of a network security alarm based on threat intelligence provided by an embodiment of the present disclosure is shown;

[0038] Figure 2 A flow chart showing another implementation of a method for automatically handling network security alerts based on threat intelligence provided by an embodiment of the present disclosure;

[0039] Figure 3 A schematic diagram of the system architecture of an automatic handling system for network security alarms based on threat intelligence provided by an embodiment of the present disclosure is shown;

[0040] Figure 4 A schematic diagram of the structure of an automatic handling device for network security alarms based on threat intelligence provided by an embodiment of the present disclosure is shown;

[0041] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0042] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0043] like Figure 1 As shown, a flowchart of an implementation method of an automatic handling method of a network security alarm based on threat intelligence provided by an embodiment of the present disclosure is provided. The automatic handling method of a network security alarm based on threat intelligence may include:

[0044] S100. Obtain security event information sent by the intelligent analysis engine, where the security event information includes multiple alarm logs related to the attack, wherein the alarm log includes alarm source information and alarm time period.

[0045] Among them, the intelligent analysis engine is an analysis network that collects and integrates commercial bank asset data and various security product logs through artificial intelligence technology. The intelligent analysis engine can obtain log data collected by network security probes deployed by security products, encrypt and store the log data uniformly, and sort and filter the obtained log data based on real-time association rule analysis strategies, which can identify attack threats, thereby improving the detection accuracy of security incidents involving attack behaviors, reducing the false alarm rate of attack behaviors, and helping to achieve efficient network security protection.

[0046] Among them, the alarm log in the security event information is the log data formed by the intelligent analysis engine associating and integrating the contextual security data information related to the attack. Optionally, the alarm log includes the first alarm log selected by the intelligent analysis engine using the real-time association rule analysis strategy in the original log corresponding to the alarm source information and the second alarm log in the original log that has an attack time sequence relationship with the first alarm log.

[0047] The intelligent analysis engine can collect and integrate the original logs of security products for security monitoring of multiple data sources, and use real-time association rule analysis strategies to filter out the first alarm log that needs attention from each original log. Among them, the alarm log is an event record of the alarm prompt issued by the security product, which can record the description of related operations such as date, time, user and action. Optionally, security products can include WAF firewalls, AISA systems, APT protection systems, anti-DDOS defense systems, email security systems, and host security systems. The intelligent analysis engine can send alarm logs and provide external interfaces for alarm queries.

[0048] Among them, the real-time association rule analysis strategy is a big data real-time threat identification rule designed according to actual security needs based on feature analysis technology, statistical analysis technology and heterogeneous data association analysis technology. For example: using the computer statement "data source = 'QIANXIN_APT'and application protocol = 'DNS'and device location code rlike '.*Core network.*'", the alarm log with the application protocol DNS in the APT protection system deployed in the core network can be filtered out. In addition, the real-time association rule analysis strategy can also involve the threat identification of successful login with weak passwords, successful upload of suspected webshells, and suspected upload of high-risk files. Through the real-time association rule analysis strategy, the disclosed embodiment can identify attack threats in massive data, improve the detection accuracy of security incidents involving attack behaviors, reduce the false alarm rate of attack behaviors, improve security operation efficiency, and protect the safety and stability of the enterprise production environment.

[0049] The disclosed embodiment filters the original logs through real-time correlation rules, which can reduce the number of logs that need to be queried for threat intelligence logs later and reduce the query pressure. At the same time, it performs correlation analysis on single alarm logs to restore the full picture of security incidents, which can help enterprises to effectively detect, defend and deal with network attacks in a timely manner.

[0050] After filtering out the first alarm log of the target object corresponding to the alarm source information, the intelligent analysis engine can perform attack-related analysis based on the first alarm log, determine the second alarm log generated by the security product for the target object corresponding to the alarm source information before and after the alarm prompt time in the first alarm log, and arrange the first alarm log and the second alarm log in chronological order to obtain security event information.

[0051] Optionally, the alarm source information may be an alarm source address (IP address) or an alarm domain name.

[0052] Optionally, the alarm log also includes: severity level, attack category, alarm name, destination address, start event, original log, attack result and alarm number.

[0053] S200. Query the threat intelligence log corresponding to the alarm source information in the multi-source converged threat intelligence platform.

[0054] Among them, the multi-source convergence threat intelligence platform is a platform for collecting threat intelligence. The multi-source convergence threat intelligence platform can connect to multiple security vendors, obtain threat intelligence from multiple intelligence sources, and standardize and deduplicate the acquired threat intelligence, integrate the processed threat intelligence into the threat intelligence library, and generate corresponding threat intelligence logs. The multi-source convergence threat intelligence platform can establish an evaluation mechanism based on multiple intelligence sources, understand the quality of intelligence data, optimize the weight of intelligence sources, enhance the reliability of threat analysis results, and provide comprehensive analysis capabilities based on permission configuration through interface and page management methods. The disclosed embodiment collects the latest threat intelligence logs from multiple intelligence sources through the multi-source convergence threat intelligence platform, which can achieve complementary threat intelligence from multiple intelligence sources, form a comprehensive, accurate and highly real-time threat intelligence library, avoid the problem of single information from a single intelligence source, and improve the comprehensiveness, accuracy and timeliness of network security protection.

[0055] S300: Determine an intelligence time period associated with a threat intelligence log by using an alarm time period.

[0056] The intelligence time period may be a period of time before the alarm time period. Optionally, the intelligence time period may be 2 hours before the alarm time period.

[0057] S400. Utilize the intelligent analysis engine to collect statistics on alarm data under each preset alarm dimension within the intelligence time period to obtain alarm statistical information.

[0058] The disclosed embodiment can obtain alarm statistical information by calling an interface provided by the intelligent analysis engine to collect alarm data under each preset alarm dimension within a statistical intelligence time period in the intelligent analysis engine.

[0059] Optionally, preset alarm dimensions include alarm quantity, impact scope, timeliness, threat degree, confidence level, threat type, alarm source, geographic location, alarm device deployment location, and blocking impact degree.

[0060] S500: Based on the threat intelligence log and the alarm statistics, a reputation value corresponding to the threat intelligence log is obtained using a preset threat intelligence evaluation table.

[0061] Among them, the preset threat intelligence evaluation table is an evaluation standard pre-established based on the threat intelligence logs of multiple intelligence sources and each preset alarm dimension. The preset threat evaluation table records the threat intelligence logs of each intelligence source and the weights corresponding to each preset alarm dimension and the reputation value calculation method. The disclosed embodiment can calculate the alarm data under each preset alarm dimension in the threat intelligence log and the alarm statistical information using the reputation value calculation method based on the threat intelligence logs of each intelligence source and the weights corresponding to each preset alarm dimension recorded in the preset threat evaluation table, and obtain the reputation value corresponding to the threat intelligence log.

[0062] The disclosed embodiment combines threat intelligence logs and multiple preset alarm dimensions to calculate the credibility value of threat intelligence logs, which helps to provide protection and supplement the alarm source information corresponding to threat intelligence logs with high credibility values, thereby improving the application value of threat intelligence logs.

[0063] The disclosed embodiment is based on the security products deployed by commercial banks under the current security architecture. The threat intelligence logs are compared with the alarm logs of various security products including series, bypass, and depth, which can verify the reliability of threat intelligence information and reduce the false alarm rate of attack behaviors.

[0064] S600: Based on a preset alarm response strategy, a disposal operation matching the reputation value is executed on the target object pointed to by the alarm source information.

[0065] Among them, the preset alarm response strategy is a response strategy that is pre-set for reputation values ​​under different specific values. The disclosed embodiment can set matching disposal operations for reputation values ​​of different values ​​or belonging to different value intervals in the preset alarm response strategy. After obtaining the reputation value corresponding to the threat intelligence log, determine the disposal operation that matches the reputation value in the preset alarm response strategy, so as to automatically execute the disposal operation and complete the corresponding network security alarm.

[0066] Optional, based on Figure 1 The method shown, such as Figure 2 As shown, a flowchart of another implementation of the method for automatically handling network security alarms based on threat intelligence provided by an embodiment of the present disclosure is provided, and step S600 may include:

[0067] S610: When the reputation value is greater than a first preset threshold, block the target object pointed to by the alarm source information.

[0068] S620: When the reputation value is greater than the second preset threshold and not greater than the first preset threshold, generate an alarm notification corresponding to the target object pointed to by the alarm source information.

[0069] S630: When the reputation value is not greater than the second preset threshold, generate an event record corresponding to the target object pointed to by the alarm source information.

[0070] The first preset threshold and the second preset threshold can be set according to actual needs.

[0071] Optionally, the automatic handling method of network security alarms based on threat intelligence provided by the embodiments of the present disclosure can be applied to a security orchestration automation and response system.

[0072] Among them, the Security Orchestration Automation and Response (SOAR) system has the ability to respond to security and handle threats. By receiving security event information sent by the intelligent analysis engine and obtaining threat intelligence logs from the multi-source threat intelligence platform, it can reversely check the target objects pointed to by the alarm source information of the threat, quickly understand the current security incident situation, and locate the root cause of the threat, so as to make correct and timely response and disposal according to the degree of threat.

[0073] like Figure 3 As shown, a system architecture diagram of an automatic handling system for network security alarms based on threat intelligence provided by an embodiment of the present disclosure is provided. The automatic handling system for network security alarms based on threat intelligence is composed of a security orchestration automation and response system, an intelligent analysis engine, a multi-source converged threat intelligence platform, and a third-party handling platform. The intelligent analysis engine uploads security event information to the security orchestration automation and response system, and then the security orchestration automation and response system queries the threat intelligence log in the multi-source converged threat intelligence platform, and queries the alarm statistics in the intelligent analysis engine. Finally, the security orchestration automation and response system calls the interface of the corresponding third-party handling platform based on the obtained reputation value, thereby performing corresponding handling operations. By utilizing the security orchestration automation and response system, the disclosed embodiment can effectively handle network security alarms in complex network security protection scenarios and improve network security protection efficiency.

[0074] The present disclosure provides an automatic handling method for network security alarms based on threat intelligence, which obtains security event information sent by an intelligent analysis engine, wherein the security event information includes multiple alarm logs related to the attack, wherein the alarm log includes alarm source information and alarm time period; querying the threat intelligence log corresponding to the alarm source information in the multi-source convergence threat intelligence platform; using the alarm time period, determining the intelligence time period associated with the threat intelligence log; using the intelligent analysis engine to count the alarm data under each preset alarm dimension in the intelligence time period, and obtaining alarm statistical information; based on the threat intelligence log and the alarm statistical information, using the preset threat intelligence evaluation table, obtaining the reputation value corresponding to the threat intelligence log; based on the preset alarm response strategy, executing a handling operation matching the reputation value on the target object pointed to by the alarm source information. The present disclosure combines the alarm log sent by the intelligent analysis engine with the threat intelligence log queried on the multi-source convergence threat intelligence platform for correlation analysis, and uses the preset threat intelligence evaluation table to obtain the reputation value corresponding to the threat intelligence log, thereby accurately evaluating the reliability of the threat intelligence log, and then realizing efficient network security protection through the preset alarm response strategy.

[0075] Although operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order.Multitasking and parallel processing may be advantageous under certain circumstances.

[0076] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0077] Corresponding to the above method embodiment, the present disclosure embodiment also provides an automatic handling device for network security alarms based on threat intelligence, the structure of which is as follows: Figure 4 As shown, it may include: a security event information obtaining unit 100, a threat intelligence log query unit 200, an intelligence time period determination unit 300, an alarm statistics information obtaining unit 400, a reputation value obtaining unit 500 and a disposal operation execution unit 600.

[0078] The security event information obtaining unit 100 is used to obtain the security event information sent by the intelligent analysis engine, where the security event information includes multiple alarm logs related to the attack, wherein the alarm log includes alarm source information and alarm time period.

[0079] The threat intelligence log query unit 200 is used to query the threat intelligence log corresponding to the alarm source information in the multi-source converged threat intelligence platform.

[0080] The intelligence time period determination unit 300 is used to determine the intelligence time period associated with the threat intelligence log by using the alarm time period.

[0081] The alarm statistical information obtaining unit 400 is used to obtain alarm statistical information by using the intelligent analysis engine to collect alarm data under each preset alarm dimension within a statistical intelligence time period.

[0082] The reputation value obtaining unit 500 is used to obtain the reputation value corresponding to the threat intelligence log based on the threat intelligence log and the alarm statistical information using a preset threat intelligence evaluation table.

[0083] The handling operation execution unit 600 is used to execute a handling operation matching the reputation value on the target object pointed to by the alarm source information based on a preset alarm response strategy.

[0084] Optionally, the handling operation execution unit 600 includes: a blocking subunit, an alarm notification generating subunit and an event record generating subunit.

[0085] The blocking subunit is used to block the target object pointed to by the alarm source information when the reputation value is greater than a first preset threshold.

[0086] The alarm notification generating subunit is used to generate an alarm notification corresponding to the target object pointed to by the alarm source information when the reputation value is greater than the second preset threshold and not greater than the first preset threshold.

[0087] The event log generation subunit is used to generate an event log corresponding to the target object pointed to by the alarm source information when the reputation value is not greater than the second preset threshold. Optionally, the alarm log includes a first alarm log selected by the intelligent analysis engine using a real-time association rule analysis strategy in the original log corresponding to the alarm source information and a second alarm log in the original log that has an attack time sequence relationship with the first alarm log.

[0088] Optionally, the alarm log also includes: severity level, attack category, alarm name, destination address, start event, original log, attack result and alarm number.

[0089] Optionally, preset alarm dimensions include alarm quantity, impact scope, timeliness, threat degree, confidence level, threat type, alarm source, geographic location, alarm device deployment location, and blocking impact degree.

[0090] Optionally, the automatic handling device for network security alarms based on threat intelligence can be applied to a security orchestration automation and response system.

[0091] The present disclosure provides an automatic disposal device for network security alarm based on threat intelligence, which obtains security event information sent by an intelligent analysis engine, wherein the security event information includes multiple alarm logs related to the attack, wherein the alarm log includes alarm source information and alarm time period; the threat intelligence log corresponding to the alarm source information is queried in a multi-source converged threat intelligence platform; the alarm time period is used to determine the intelligence time period associated with the threat intelligence log; the intelligent analysis engine is used to count the alarm data under each preset alarm dimension in the intelligence time period to obtain alarm statistical information; based on the threat intelligence log and the alarm statistical information, a preset threat intelligence evaluation table is used to obtain the reputation value corresponding to the threat intelligence log; based on the preset alarm response strategy, a disposal operation matching the reputation value is performed on the target object pointed to by the alarm source information. The present disclosure combines the alarm log sent by the intelligent analysis engine with the threat intelligence log queried in the multi-source converged threat intelligence platform for correlation analysis, and uses the preset threat intelligence evaluation table to obtain the reputation value corresponding to the threat intelligence log, thereby accurately evaluating the reliability of the threat intelligence log, and then realizing efficient network security protection through the preset alarm response strategy.

[0092] Regarding the device in the above embodiment, the specific manner in which each unit performs the operation has been described in detail in the embodiment of the method, and will not be elaborated here.

[0093] The automatic handling device for network security alarms based on threat intelligence includes a processor and a memory. The above-mentioned security event information obtaining unit 100, threat intelligence log query unit 200, intelligence time period determination unit 300, alarm statistical information obtaining unit 400, reputation value obtaining unit 500 and handling operation execution unit 600 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0094] The processor contains a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters can be adjusted to combine the alarm logs sent by the intelligent analysis engine and the threat intelligence logs queried on the multi-source converged threat intelligence platform for correlation analysis, and the reputation value corresponding to the threat intelligence log is obtained using the preset threat intelligence evaluation table, so as to accurately evaluate the reliability of the threat intelligence log, and then achieve efficient network security protection through the preset alarm response strategy.

[0095] An embodiment of the present disclosure provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the automatic handling method of network security alarms based on threat intelligence.

[0096] An embodiment of the present disclosure provides a processor, which is used to run a program, wherein the program executes the automatic handling method of network security alarms based on threat intelligence when running.

[0097] like Figure 5 As shown, the embodiment of the present disclosure provides an electronic device 1000, which includes at least one processor 1001, at least one memory 1002 connected to the processor 1001, and a bus 1003; wherein the processor 1001 and the memory 1002 communicate with each other through the bus 1003; the processor 1001 is used to call the program instructions in the memory 1002 to execute the above-mentioned automatic handling method of network security alarm based on threat intelligence. The electronic device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0098] The present disclosure also provides a computer program product, which, when executed on an electronic device, is suitable for executing a program of initializing the steps of an automatic handling method for network security alerts based on threat intelligence.

[0099] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, apparatuses, electronic devices (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the instructions executed by the processor of the computer or other programmable device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0100] In a typical configuration, an electronic device includes one or more processors (CPU), a memory, and a bus. The electronic device may also include an input / output interface, a network interface, and the like.

[0101] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0102] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0103] In the description of the present disclosure, it should be understood that the terms "up", "down", "front", "back", "left" and "right" etc. indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description. They do not indicate or imply that the positions or elements referred to must have specific directions, be constructed and operate in specific directions. Therefore, they should not be understood as limitations of the present disclosure.

[0104] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should also be noted that the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] It will be appreciated by those skilled in the art that the embodiments of the present disclosure may be provided as methods, systems or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] The above are only embodiments of the present disclosure and are not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the scope of the claims of the present disclosure.

Claims

1. A method for automatically handling network security alerts based on threat intelligence, characterized in that: include: Obtaining security event information sent by the intelligent analysis engine, the security event information including multiple alarm logs related to the attack, wherein the alarm logs include alarm source information and alarm time period; Querying the threat intelligence log corresponding to the alarm source information in the multi-source converged threat intelligence platform; Determine an intelligence time period associated with the threat intelligence log using the alarm time period; The intelligent analysis engine is used to collect statistics of alarm data under each preset alarm dimension within the intelligence time period to obtain alarm statistical information; Based on the threat intelligence log and the alarm statistics, a reputation value corresponding to the threat intelligence log is obtained by using a preset threat intelligence evaluation table; the preset threat intelligence evaluation table is an evaluation standard pre-established based on the threat intelligence logs of multiple intelligence sources and each preset alarm dimension, and the preset threat intelligence evaluation table records the weights corresponding to the threat intelligence logs of each intelligence source and each preset alarm dimension and the reputation value calculation method; When the credibility value is greater than a first preset threshold, the target object pointed to by the alarm source information is banned; when the credibility value is greater than a second preset threshold and not greater than the first preset threshold, an alarm notification corresponding to the target object pointed to by the alarm source information is generated; when the credibility value is not greater than the second preset threshold, an event record sheet corresponding to the target object pointed to by the alarm source information is generated.

2. The method according to claim 1, characterized in that The alarm log includes a first alarm log screened out by the intelligent analysis engine using a real-time association rule analysis strategy in the original log corresponding to the alarm source information, and a second alarm log in the original log that has an attack timing relationship with the first alarm log.

3. The method according to claim 1, characterized in that The alarm log also includes: severity level, attack classification, alarm name, destination address, start event, original log, attack result and alarm number.

4. The method according to claim 1, characterized in that The preset alarm dimensions include alarm quantity, impact scope, timeliness, threat level, confidence level, threat type, alarm source, geographic location, alarm device deployment location, and blocking impact level.

5. The method according to claim 1, characterized in that: Applied to security orchestration automation and response systems.

6. An automatic handling device for network security alarms based on threat intelligence, characterized in that: include: Security event information acquisition unit, threat intelligence log query unit, intelligence time period determination unit, alarm statistics information acquisition unit, reputation value acquisition unit and disposal operation execution unit, The security event information obtaining unit is used to obtain the security event information sent by the intelligent analysis engine, the security event information includes a plurality of alarm logs related to the attack, wherein the alarm log includes alarm source information and alarm time period; The threat intelligence log query unit is used to query the threat intelligence log corresponding to the alarm source information in the multi-source converged threat intelligence platform; The intelligence time period determination unit is used to determine the intelligence time period associated with the threat intelligence log using the alarm time period; The alarm statistical information obtaining unit is used to use the intelligent analysis engine to count the alarm data under each preset alarm dimension within the intelligence time period to obtain alarm statistical information; The reputation value obtaining unit is used to obtain the reputation value corresponding to the threat intelligence log based on the threat intelligence log and the alarm statistical information using a preset threat intelligence evaluation table; the preset threat intelligence evaluation table is an evaluation standard pre-established based on the threat intelligence logs of multiple intelligence sources and each preset alarm dimension, and the preset threat intelligence evaluation table records the weights corresponding to the threat intelligence logs of each intelligence source and each preset alarm dimension and the reputation value calculation method; The handling operation execution unit includes: a blocking subunit, an alarm notification generation subunit and an event record sheet generation subunit; The blocking subunit is configured to block the target object pointed to by the alarm source information when the reputation value is greater than a first preset threshold; The alarm notification generating subunit is used to generate an alarm notification corresponding to the target object pointed to by the alarm source information when the reputation value is greater than the second preset threshold and not greater than the first preset threshold; The event record sheet generating subunit is used to generate an event record sheet corresponding to the target object pointed to by the alarm source information when the reputation value is not greater than the second preset threshold.

7. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by the processor, the method for automatically handling network security alarms based on threat intelligence as described in any one of claims 1 to 5 is implemented.

8. An electronic device, comprising at least one processor, and at least one memory and bus connected to the processor; wherein: The processor and the memory communicate with each other via the bus; The processor is used to call the program instructions in the memory to execute the automatic handling method of network security alarms based on threat intelligence as described in any one of claims 1 to 5.

Images