Network security operation method and device, computing device, and storage medium

Abstract

The present application relates to the technical field of network security, and particularly relates to a network security operation method and device, a computing device and a storage medium. The method comprises: when an instruction of executing a target activity is received, at least one target case is determined, and at least one script is configured for each target case; a target node APP corresponding to each script is determined, the target node APPs are connected in series according to a predetermined stage order, and a data processing step in each target node APP is defined, so as to generate a corresponding stage of the script by using the target node APP; for each target case, the following is executed: based on a corresponding relationship, knowledge reasoning data of the current target case is obtained from a database; based on each script configured for the current target case, the knowledge reasoning data is processed in turn according to the stage order by using a plurality of target node APPs of the current script. The present application can improve the automation capability of network security operation, and improve the real-time performance and accuracy of detecting network threats.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application relates to the technical field of network security, in particular to a network security operation method and device, computing equipment and storage medium. BACKGROUND

[0002] The traditional network security operation method is that security experts manually monitor the log, traffic and other data of each host in the enterprise, and when reasoning out security knowledge data, the security experts manually analyze whether there is an exception in the security knowledge data according to a security processing flow, and when analyzing an alarm event, the security experts manually execute a corresponding response flow according to different alarm events.

[0003] It can be seen that, with the continuous development of network space attack technology, the traditional network security operation method has been difficult to meet the real-time, accuracy and automation needs of the enterprise for network threat detection.

[0004] Therefore, a new network security operation method is urgently needed. SUMMARY

[0005] In order to solve the problem that the traditional network security operation method is difficult to meet the real-time, accuracy and automation needs of the enterprise for network threat detection, the embodiment of the present application provides a network security operation method, device, computing equipment and storage medium.

[0006] In a first aspect, the embodiment of the present application provides a network security operation method, comprising:

[0007] A plurality of node APPs are written based on each activity, wherein the node APP is used to execute the data processing step of the node;

[0008] A database for storing knowledge reasoning results of network data of each host is obtained to establish a corresponding relationship between each case and a storage location in the database;

[0009] When receiving an instruction to execute a target activity, at least one target case is determined, and at least one script is configured for each target case;

[0010] The target node APP corresponding to each script is determined, the target node APP is connected in series according to a predetermined stage order, and the data processing step in each target node APP is defined to generate a corresponding stage of the script by using the target node APP; wherein each stage corresponds to at least one target node APP;

[0011] For each target case, the following is performed: based on the corresponding relationship, the knowledge reasoning data of the current target case is obtained from the database;

[0012] Based on each script configured according to the current target case, a plurality of target node APPs of the current script are used to sequentially process the knowledge reasoning data according to the stage order.

[0013] In a second aspect, the embodiments of the present application further provide a network security operation device, comprising:

[0014] The writing unit is configured to write a plurality of node APPs based on each activity; wherein the node APP is configured to execute data processing steps of the node;

[0015] The establishing unit is configured to obtain a database for storing knowledge reasoning results of network data of each host, so as to establish a correspondence between each case and a storage location in the database;

[0016] The determining unit is configured to determine at least one target case when receiving an instruction to execute a target activity, and configure at least one script for each target case;

[0017] The generating unit is configured to determine target node APPs corresponding to each script, connect the target node APPs according to a predetermined stage order, and define data processing steps in each target node APP, so as to generate a corresponding stage of the script by using the target node APP; wherein each stage corresponds to at least one target node APP;

[0018] The obtaining unit is configured to, for each target case, perform the following: based on the correspondence, obtaining knowledge reasoning data of the current target case from the database;

[0019] The processing unit is configured to, based on each script configured according to the current target case, use a plurality of target node APPs of the current script to sequentially process the knowledge reasoning data according to the stage order.

[0020] In a third aspect, the embodiments of the present application further provide a computing device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described in any embodiment of the present application.

[0021] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, and when the computer program is executed in a computer, the computer executes the method described in any embodiment of the present application.

[0022] The embodiment of the present application provides a network security operation method, device, computing equipment and storage medium, first, a plurality of node APPs are written based on each activity; then, a database for storing knowledge reasoning results of network data of each host is acquired, so as to establish a corresponding relationship between each case and a storage location in the database; when an instruction of executing a target activity is received, at least one target case is determined, and at least one script is configured for each target case; then, a target node APP corresponding to each script is determined, the target node APP is connected in series according to a predetermined stage order, and a data processing step in each target node APP is defined, so that the target node APP generates a corresponding stage of the script; then, for each target case, the following is executed: based on the corresponding relationship, knowledge reasoning data of the current target case is acquired from the database; finally, based on each script configured for the current target case, the knowledge reasoning data is processed in sequence according to the stage order by using a plurality of target node APPs of the current script. Therefore, the present scheme can greatly improve the automation capability of network security operation, and can effectively meet the real-time performance and accuracy of network threat detection of enterprises. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0024] Figure 1 It is a network security operation method flow chart provided by an embodiment of the present application;

[0025] Figure 2 It is a network security operation method overall architecture diagram provided by an embodiment of the present application;

[0026] Figure 3 It is a hardware architecture diagram of an electronic device provided by an embodiment of the present application;

[0027] Figure 4 It is a network security operation device structure diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0029] As described above, the traditional network security operation method is that security experts manually monitor the log, traffic and other data of each host in the enterprise. After reasoning the security knowledge data, the security experts manually analyze whether there is an anomaly in the security knowledge data according to the security processing flow. When an alarm event is analyzed, the security experts manually execute the corresponding response flow according to different alarm events. It can be seen that the traditional network security operation method is mostly manual processing, so the real-time performance and accuracy of detecting network threats are naturally low.

[0030] In order to solve the above technical problems, the inventors can consider using self-defined node APP to freely perform function visual arrangement and response to improve the automation capability of network security operation, such as complex intelligence recognition, vulnerability recognition and automated response. Then, at least one script can be configured for each target case when starting to execute the target activity. The target node APP corresponding to each script is connected in series according to the predetermined stage order, and the data processing steps in each target node APP are defined, so as to generate the corresponding stage of the script by using the target node APP. Further, when each target case is executed, the knowledge reasoning data of the current target case can be accessed from the database. Based on each script configured for the current target case, the knowledge reasoning data is processed in sequence by using the target node APP of the current script according to the stage order. Compared with the traditional network security operation method of manual detection and analysis response, the present solution can improve the real-time performance and accuracy of network threat detection.

[0031] The specific implementation of the above concept will be described below.

[0032] Please refer to Figure 1 The embodiments of the present application provide a network security operation method, which comprises:

[0033] Step 100: based on each activity, a plurality of node APPs are written; wherein the node APP is used to execute the data processing steps of the node;

[0034] Step 102: a database for storing the knowledge reasoning results of the network data of each host is obtained, so as to establish the correspondence between each case and the storage location in the database;

[0035] Step 104: When receiving the instruction of executing the target activity, at least one target case is determined, and at least one script is configured for each target case;

[0036] Step 106: The target node APP corresponding to each script is determined, the target node APPs are connected in series according to the predetermined stage order, and the data processing steps in each target node APP are defined, so as to generate the corresponding stage of the script by using the target node APP; wherein each stage corresponds to at least one target node APP;

[0037] Step 108: For each target case, the knowledge reasoning data of the current target case is obtained from the database based on the corresponding relationship;

[0038] Step 110: Based on each script configured for the current target case, the knowledge reasoning data is processed in sequence according to the stage order by using the target node APPs of the current script.

[0039] In the embodiment of the application, first, a plurality of node APPs are written based on each activity; then, a database for storing the knowledge reasoning results of the network data of each host is obtained to establish the corresponding relationship between each case and the storage location in the database; when receiving the instruction of executing the target activity, at least one target case is determined, and at least one script is configured for each target case; then, the target node APP corresponding to each script is determined, the target node APPs are connected in series according to the predetermined stage order, and the data processing steps in each target node APP are defined, so as to generate the corresponding stage of the script by using the target node APP; then, for each target case, the knowledge reasoning data of the current target case is obtained from the database based on the corresponding relationship; finally, based on each script configured for the current target case, the knowledge reasoning data is processed in sequence according to the stage order by using the target node APPs of the current script. Therefore, the scheme can greatly improve the automation ability of network security operation, and can effectively meet the real-time and accuracy of network threat detection required by enterprises.

[0040] The execution mode of each step is described below. Figure 1

[0041] For step 100:

[0042] As Figure 2 ​As shown, the application market contains a plurality of node APPs (not all are marked), each of which can perform the defined data processing steps, for example, the external system APP can determine which alarm information in the input target data needs to be sent to the external processing department, and send the alarm information to the corresponding external personnel or department according to the preset response mode; the triage APP can perform alarm aggregation and credibility calculation on the alarm information in the input target data, and then set the priority, and can also perform alarm investigation to eliminate false alarms.

[0043] It should be noted that in the embodiments of the present application, the activities include routine activities, guard activities and heavy guard activities. A pre-built node APP can be programmed based on each activity. When the built-in APP does not meet certain special scenarios, a node APP can also be programmed according to system rules to customize logic processing.

[0044] For step 102:

[0045] In the embodiments of the present application, the log, traffic and other data of each host in the target enterprise need to be converted into a knowledge graph for storage, and then the network data of each host in the target enterprise is used for knowledge reasoning by using the knowledge graph to infer knowledge data. These knowledge data are data that may have threats, and in steps 104-110, the knowledge data can be processed according to the stages in the script to identify the types of threat data in the knowledge data, such as threat intelligence, vulnerabilities, hacking attacks, etc., and then automatically respond according to the identification results according to the stages in the script.

[0046] The generation method of the knowledge reasoning result in step 102 is described below.

[0047] In some embodiments, the generation method of the knowledge reasoning result can include the following steps S1-S5:

[0048] Step S1: Real-time acquisition of external known data and network data of each host; wherein the network data includes log data and traffic data;

[0049] Step S2: Based on the network data and the pre-acquired professional knowledge base, the data structure of the ontology is modeled to obtain a knowledge model; wherein the data structure includes the name, attributes and association relationship of the ontology;

[0050] Step S3: Based on the professional knowledge base and the knowledge model, the knowledge entities, attributes and association relationships of the network data are extracted to generate a plurality of target knowledge;

[0051] Step S4: Based on the target knowledge, a knowledge graph is generated, and the knowledge graph and the external known data are stored in a database.

[0052] Step S5: determining an analysis rule based on the external known data, so as to perform knowledge reasoning on the target knowledge based on the analysis rule to obtain a knowledge reasoning result.

[0053] In this embodiment, by generating a knowledge graph based on the network data of each host, the correlation between entities in the knowledge graph can be used to effectively expand the context of threat event analysis, and further achieve effective detection, comprehensive tracing and accurate prediction of threat events.

[0054] The execution mode of each step is described below.

[0055] For step S1:

[0056] In this embodiment, the external known data includes consultation data of ChatGPT, knowledge data of the ATT&CK site and expert-labeled feature data.

[0057] This embodiment needs to predict the network security of each host in the enterprise, so it is necessary to obtain the log data and traffic data of each host in the enterprise. In order to subsequently use the ATT&CK engine, NLP reasoning engine and other machine learning engines to perform knowledge reasoning on the network data of each host in the enterprise, it is necessary to obtain the consultation data of ChatGPT, the knowledge data of the ATT&CK site and the expert-labeled feature data as external known data, so as to serve as the basis data for the ATT&CK engine, NLP reasoning engine and other machine learning engines to determine the analysis rule and perform knowledge reasoning.

[0058] For step S2:

[0059] In this embodiment, in order to establish a knowledge graph in which network data of various types are associated with each other and improve the detection, tracing and prediction capabilities of network security, knowledge modeling and knowledge extraction need to be performed on the unstructured data and semi-structured data in the network data.

[0060] Knowledge modeling mainly refers to modeling the names, properties and correlation relationships of the ontologies of various data types, including modeling the field and scope of the ontology, the ontology class and class structure, the ontology property, the ontology property relationship and the relationship between ontologies.

[0061] For step S3:

[0062] In this embodiment, knowledge extraction is performed on the knowledge entities, properties and correlation relationships of the network data, which can be achieved at least in the following three ways:

[0063] Method one, knowledge extraction based on a knowledge extraction template and a professional knowledge base.

[0064] The second mode is to perform knowledge extraction based on a deep learning model of network security.

[0065] The third mode is to perform knowledge extraction based on a knowledge extraction template and a professional knowledge base, and also based on a deep learning model of network security, and then compare the extraction results of the two modes to summarize the final knowledge extraction result.

[0066] The following describes the three modes.

[0067] First, the first mode is described.

[0068] In the first mode, step S3 can include:

[0069] obtaining a knowledge extraction template containing knowledge entities, attributes, and association relationships;

[0070] For each network data, the following is performed:

[0071] based on the knowledge extraction template, knowledge extraction is performed on the knowledge entities, attributes, and association relationships of the current network data;

[0072] when the knowledge entities cannot be identified, based on the professional knowledge base, knowledge extraction is performed on the knowledge entities, attributes, and association relationships of the current network data;

[0073] based on the data structure of the ontology in the knowledge model, the extracted knowledge is converted into target knowledge.

[0074] In this embodiment, first, the expert sets the knowledge extraction template, and for each network data, the knowledge extraction template is used to perform knowledge extraction first, when the knowledge extraction template does not contain the knowledge entities or features in the current network data, the professional knowledge base is used to perform knowledge extraction on the knowledge entities, attributes, and association relationships of the current network data; if the professional knowledge base also does not contain the knowledge entities or features in the current network data, the expert needs to perform knowledge extraction on the current network data, and the knowledge extraction result is supplemented to the knowledge extraction template and the professional knowledge base to update the knowledge extraction template and the professional knowledge base. Then, according to the data structure of the ontology in the knowledge model, the extracted knowledge is converted to the corresponding position in the ontology data structure to generate target knowledge.

[0075] The above describes the first mode, and the following describes the second mode.

[0076] In the second mode, step S3 can include:

[0077] input each network data into a deep learning model pre-trained based on network security data to classify and identify the knowledge entities, attributes, and association relationships in the network data;

[0078] Based on the data structure of the ontology in the knowledge model and the classification recognition result of each network data, the target knowledge is generated.

[0079] In this embodiment, the deep learning model needs to be generated by pre-training based on network security data, and then each network data is input into the deep learning model to classify and recognize the knowledge entities, attributes and association relationships in the network data; then, according to the classification recognition result of each network data, the corresponding knowledge is converted to the corresponding position in the ontology data structure in the knowledge model to generate the target knowledge.

[0080] It can be understood that the deep learning model needs to be continuously iterated and optimized to make the result of knowledge extraction more accurate.

[0081] Next, the third mode is described.

[0082] In this third mode, step S3 can include:

[0083] Obtaining a knowledge extraction template containing knowledge entities, attributes and association relationships;

[0084] For each network data, the following is performed:

[0085] Based on the knowledge extraction template, the knowledge entities, attributes and association relationships of the current network data are extracted;

[0086] When the knowledge entities cannot be recognized, the knowledge entities, attributes and association relationships of the current network data are extracted based on the professional knowledge base;

[0087] Based on the data structure of the ontology in the knowledge model, the extracted knowledge is converted into the first target knowledge;

[0088] Each network data is input into a deep learning model pre-trained based on network security data to classify and recognize the knowledge entities, attributes and association relationships in the network data;

[0089] Based on the data structure of the ontology in the knowledge model and the classification recognition result of each network data, the second target knowledge is generated;

[0090] Based on the first target knowledge and the second target knowledge, the target knowledge is generated.

[0091] In the embodiment, the extraction results of the first and second manners (i.e., the first target knowledge and the second target knowledge) can be compared and summarized to generate the final target knowledge. The network data is extracted by the two manners of the knowledge extraction template, the professional knowledge base and the deep learning model, and then the knowledge extraction of the two manners is compared and analyzed to generate more accurate target knowledge, which can improve the accuracy of knowledge extraction.

[0092] For step S4:

[0093] The structured network data, the target knowledge extracted in step S3 and the external known data are stored in a database.

[0094] For step S5:

[0095] In the embodiment, various inference engines such as the ATT&CK engine and the NLP inference engine are integrated, and therefore, before the step of determining the analysis rule based on the external known data, the target engine is determined from an engine list to determine the analysis rule and perform knowledge inference by using the target engine; the engine list includes the ATT&CK engine and the NLP inference engine.

[0096] In the embodiment, when the target engine is determined as the NLP inference engine, step S5 can include:

[0097] Obtaining a data range and a rule instruction;

[0098] Obtaining the target knowledge in the data range from the database to create a session based on the target knowledge;

[0099] The NLP inference engine obtains a rule feature from the consultation data of ChatGPT and the feature data labeled by experts according to the rule instruction;

[0100] Detecting the target knowledge in the session based on the rule feature to obtain first inference knowledge;

[0101] Obtaining second inference knowledge based on the association relationship of the first inference knowledge;

[0102] Generating a knowledge inference result based on the first inference knowledge and the second inference knowledge.

[0103] In the embodiment, the data range for this analysis needs to be determined first, and the data range includes a computer range and a time range. For example, the computer range can be determined as the finance department, and the time range is determined by determining the running strategy of the session, and the running strategy of the session includes manual and scheduling. The manual mode is to perform an analysis, and the scheduling mode is to perform a periodic analysis according to a time point (such as performing an analysis every 10 minutes or every 1 hour).

[0104] Then, the rule instruction is confirmed manually, and then the NLP inference engine obtains the rule features from the consultation data of ChatGPT and the expert-labeled feature data in the database according to the rule instruction. For example, the rule instruction is "detect whether there is a DDOS attack", then the NLP inference engine will first identify the rule instruction, and then obtain the DDOS feature from the consultation data of ChatGPT and the expert-labeled feature data.

[0105] Then, the target knowledge in the conversation is detected based on the rule features to obtain first inference knowledge, and second inference knowledge can be obtained according to the association relationship of the first inference knowledge, and then the first inference knowledge and the second inference knowledge are taken as the knowledge inference result.

[0106] In the embodiment of the application, when the target engine is determined as the ATT&CK engine, step S5 can include:

[0107] obtaining the data range and the rule instruction;

[0108] obtaining the target knowledge in the data range from the database to create a conversation based on the target knowledge;

[0109] the ATT&CK engine obtains the rule features from the knowledge data of the ATT&CK site according to the rule instruction;

[0110] detecting the target knowledge in the conversation based on the rule features to obtain first inference knowledge;

[0111] obtaining second inference knowledge based on the association relationship of the first inference knowledge;

[0112] generating a knowledge inference result based on the first inference knowledge and the second inference knowledge.

[0113] In this embodiment, the inference process of the NLP inference engine is similar, first determine the data range of this analysis, the data range includes the computer range and the time range. Then, the rule instruction is confirmed manually, and then the NLP inference engine obtains the rule features from the knowledge data of the ATT&CK site in the database according to the rule instruction. Then, the target knowledge in the conversation is detected based on the rule features to obtain first inference knowledge, and second inference knowledge can be obtained according to the association relationship of the first inference knowledge, and then the first inference knowledge and the second inference knowledge are taken as the knowledge inference result.

[0114] In the embodiment of the present application, the case is an event processing source defining the same nature, which can be events of the same organization or region, events of the same device, events of the same event classification, or events of the same event level. For example, when the target activity is “cyber security activity”, the case can be “threat detection of the finance department”, and the knowledge reasoning data corresponding to this case is the knowledge reasoning data of the finance department. It can be understood that different cases require different knowledge reasoning data, and therefore a corresponding relationship between each case and the storage location in the database needs to be established. When the case is executed, the required knowledge reasoning data can be obtained from the corresponding storage location in the database.

[0115] For step 104:

[0116] In some embodiments, after the step of “determining at least one target case”, before the step of “determining the target node APP corresponding to each script”, it further includes configuring team personnel for each target case and dividing the permissions for each team personnel.

[0117] In the embodiment, after determining the target activity that needs to be executed, the target case of the target activity is determined, and the number of target cases is at least one. Then, team personnel is configured for each target case in the target activity, and the permissions are divided for each team personnel. Each target case can be configured with a script by the team personnel, and each target case can be configured with one script or multiple scripts.

[0118] For step 106:

[0119] In the embodiment of the present application, the stage includes a start stage, an automatic stage, a manual stage, and an end stage. The automatic stage includes an intelligence recognition stage, a vulnerability recognition stage, a hacker attack recognition stage, an external response stage, and / or a work order system stage.

[0120] It should be noted that each script has only one start stage and one end stage, and the other stages are divided into automatic and manual stages. According to the actual situation of each case, the team personnel can set only the automatic stage, only the manual stage, or both the automatic stage and the manual stage in a script. The automatic stage in a script can have only one or multiple, and the manual stage is the same. In this way, a unified space combat system for multi-person cooperation is constructed, and the script and the stage are defined by multi-person cooperation. Since the script of the previous case is stored, and each stage is generated by calling the corresponding node APP from the application market, the embodiment can realize the quick calling of each script or each stage, not only realizing the cooperation of everyone, but also realizing the efficient cooperation between man and machine, and realizing the linkage at any time and in any place, thereby improving the operation freedom of network security and expanding the application scope.

[0121] It should be noted that the functions that can be realized by the automatic stage and the manual stage are not limited to those listed in the embodiment, and the automatic stage can also be a data optimization stage, a traceability evidence collection stage, etc., which are not limited herein.

[0122] For step 108:

[0123] After configuring the scripts for each target case of the target activity, the target case is executed. For each target case, the knowledge reasoning data of the current target case is obtained from the database based on the correspondence between each case in step 102 and the storage location in the database, so that the knowledge reasoning data is processed in sequence according to each script configured for the current target case by using the target node APPs of the current script in the stage order.

[0124] For step 110:

[0125] For example, it is assumed that the stage order of the current script is the start stage, the first automatic stage (alarm triage stage), the second automatic stage (intelligence recognition stage), the manual stage, the external response stage, the work order system stage, and the end stage. Then the knowledge reasoning data of the current target case enters the first automatic stage from the start stage, the first automatic stage uses the triage APP to perform alarm triage and alarm investigation on the knowledge reasoning data, obtains a triage result, and determines the target data transmitted to the next stage based on the knowledge reasoning data and the triage result; the second automatic stage uses the intelligence APP to perform intelligence recognition on the target data of the first automatic stage, obtains an intelligence recognition result, and determines the target data transmitted to the next stage based on the target data of the first automatic stage and the intelligence recognition result; the manual stage obtains the target data of the second automatic stage, and manually processes the target data of the second automatic stage, and transmits the processing result to the external system APP as the target data; and so on, the knowledge reasoning data is processed in sequence according to the stage order of the current script.

[0126] In some embodiments, when the current stage is the intelligence recognition stage, the intelligence recognition stage performs data processing in the following manner:

[0127] Obtain the target data transmitted from the previous stage;

[0128] Use at least one target node APP corresponding to the current intelligence recognition stage to identify the address in the target data according to the data processing steps defined by the target node APP, and obtain an intelligence recognition result;

[0129] Determine the target data transmitted to the next stage by the current intelligence recognition stage based on the target data transmitted from the previous stage and the intelligence recognition result.

[0130] Similarly, when the current stage is a vulnerability identification stage, the vulnerability identification stage processes data in the following manner:

[0131] Obtain the target data passed from the previous stage;

[0132] Using at least one target node APP corresponding to the current vulnerability identification stage, and following the data processing steps defined by the target node APP, vulnerability identification is performed on the target data passed from the previous stage to obtain the vulnerability identification result.

[0133] Based on the target data and vulnerability identification results transmitted from the previous stage, determine the target data to be transmitted from the current vulnerability identification stage to the next stage.

[0134] It should be noted that the current stage determines the target data to be passed to the next stage in the following way:

[0135] The target data from the previous stage and the data processing results from the current stage are overlaid and filtered to obtain the target data from the current stage to be transmitted to the next stage.

[0136] In some implementations, when the current stage is an external response stage, the external response stage processes data in the following manner:

[0137] Obtain the target data passed from the previous stage;

[0138] Using the external system APP corresponding to the current external response stage, and following the data processing steps defined by the external system APP, the alarm information that needs to be transmitted to the outside from the target data transmitted from the previous stage is sent to the outside.

[0139] Determine if there are any unprocessed alarm messages in the target data transmitted from the previous stage;

[0140] If not, the end signal will be sent to the end stage;

[0141] If so, the unprocessed alarm information will be used as the target data to be passed to the next level stage, and the next level stage is the work order system stage.

[0142] In some implementations, the work order system stage processes data in the following manner:

[0143] Obtain the target data passed from the previous stage;

[0144] Using the notification app corresponding to the work order system stage, work order data is generated based on each alarm information in the target data, and the work order data is processed according to the defined distribution method.

[0145] Therefore, this solution has at least the following beneficial effects:

[0146] 1) This solution frees up manpower from heavy and inefficient manual safety operations, transforms the technical experience of frontline personnel and the management requirements of actual work into visually arranged operation steps, and can permanently save each workflow as experience accumulation to ensure the correctness and timeliness of safety incident handling.

[0147] 2) This solution standardizes the processing of various alarms, logs, and traffic. Based on a combination of various apps (intelligence, vulnerabilities, hackers, etc.), it provides the ability to analyze behavior and discover abnormal alarms, providing security for scenarios such as alarm convergence and the discovery of advanced threats from abnormal traffic.

[0148] 3) The platform of this invention abstracts and arranges the processes that can be solidified in daily operations into a directed acyclic flowchart (i.e., script), realizing the automated and visual execution of the script, with the goal of 24 / 7 "zero-attendance" network security.

[0149] 3) Digitize safety plans or processes, and use automation technology to complete all the parts that can be automated. The parts that require manual handling should still be handled by people. Through visual orchestration tools, people, technology and processes can be organically combined to form a standardized, repeatable and more efficient safety operation process.

[0150] like Figure 3 , Figure 4 As shown, this embodiment of the invention provides a network security operation device. The device embodiment can be implemented through software, hardware, or a combination of both. From a hardware perspective, such as... Figure 3 The diagram shown is a hardware architecture diagram of a computing device housing a network security operation device according to an embodiment of the present invention. (Except for...) Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, the computing device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 4 As shown, a device in a logical sense is formed by the CPU of the computing device in which it is located reading the corresponding computer program from the non-volatile memory into the memory for execution.

[0151] like Figure 4 As shown in the figure, this embodiment provides a network security operation device, including:

[0152] The writing unit 401 is used to write several node apps based on each activity; wherein, the node app is used to execute the data processing steps of that node;

[0153] The establishing unit 402 is configured to acquire a database for storing knowledge reasoning results of network data of each host, and establish a correspondence between each case and a storage location in the database;

[0154] The determining unit 403 is configured to determine at least one target case when receiving an instruction of performing a target activity, and configure at least one script for each target case;

[0155] The generating unit 404 is configured to determine a target node APP corresponding to each script, concatenate the target node APPs in a predetermined stage order, and define a data processing step in each target node APP, so as to generate a corresponding stage of the script by using the target node APP; each stage corresponds to at least one target node APP.

[0156] The acquiring unit 405 is configured to, for each target case, perform the following: based on the correspondence, acquiring knowledge reasoning data of the current target case from the database;

[0157] The processing unit 406 is configured to, based on each script configured for the current target case, perform data processing on the knowledge reasoning data in a stage order by using a plurality of target node APPs of the current script.

[0158] In an embodiment of the present application, after the determining unit 403 determines at least one target case, before the determining unit 403 determines a target node APP corresponding to each script, the determining unit 403 is further configured to configure a team member for each target case, and divide the authority for each team member.

[0159] In an embodiment of the present application, the stages in the generating unit 404 include a start stage, an automatic stage, a manual stage, and an end stage; the automatic stage includes an intelligence identification stage, a vulnerability identification stage, a hacker attack identification stage, an external response stage, and / or a work order system stage.

[0160] In an embodiment of the present application, when the current stage of the processing unit 406 is the intelligence identification stage, the intelligence identification stage performs data processing in the following manner:

[0161] Acquiring target data transmitted from a previous stage;

[0162] Using at least one target node APP corresponding to the current intelligence identification stage to identify an address in the target data according to a data processing step defined by the target node APP, to obtain an intelligence identification result;

[0163] Based on the target data transmitted from the previous stage and the intelligence identification result, determining target data transmitted from the current intelligence identification stage to a next stage.

[0164] In an embodiment of the present application, the current stage in the processing unit 406 is determined by the following way to transmit the target data to the next stage:

[0165] The target data transmitted from the previous stage and the data processing result of the current stage are subjected to data superposition and data filtering to obtain the target data transmitted from the current stage to the next stage.

[0166] In an embodiment of the present application, when the current stage in the processing unit 406 is the external response stage, the external response stage is subjected to data processing in the following way:

[0167] The target data transmitted from the previous stage is obtained.

[0168] The alarm information in the target data transmitted from the previous stage and needed to be transmitted to the outside is sent to the outside by using the external system APP corresponding to the current external response stage according to the data processing steps defined by the external system APP.

[0169] It is determined whether there is any unprocessed alarm information in the target data transmitted from the previous stage.

[0170] If not, an end signal is transmitted to the end stage.

[0171] If yes, the unprocessed alarm information is taken as the target data transmitted to the next stage, and the next stage is the work order system stage.

[0172] In an embodiment of the present application, the work order system stage in the processing unit 406 is subjected to data processing in the following way:

[0173] The target data transmitted from the previous stage is obtained.

[0174] The work order data is generated based on each alarm information in the target data by using the notification APP corresponding to the work order system stage, and the work order data is disposed according to the defined delivery mode.

[0175] The information interaction and execution process between the modules in the above device are based on the same concept as the method embodiments of the present application, and the specific content can be referred to the description in the method embodiments of the present application, which will not be described here.

[0176] The embodiment of the present application further provides a computing device including a memory and a processor, the memory stores a computer program, and the processor executes the computer program to realize the network security operation method in any embodiment of the present application.

[0177] The embodiment of the present application also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program enables a processor to execute the network security operation method in any of the embodiments of the present application when the computer program is executed by the processor.

[0178] Specifically, a system or an apparatus provided with a storage medium storing software program codes for realizing the functions of any of the above embodiments, and a computer (or CPU or MPU) of the system or the apparatus reads out and executes the program codes stored in the storage medium.

[0179] In this case, the program codes read from the storage medium can realize the functions of any of the above embodiments by themselves, and therefore the program codes and the storage medium storing the program codes constitute a part of the present application.

[0180] The storage medium for providing the program codes includes a floppy disk, a hard disk, a magneto-optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program codes can be downloaded from a server computer via a communication network.

[0181] In addition, it should be understood that not only the program codes read by the computer, but also the operating system or the like operating on the computer can perform part or all of the actual operations based on the instructions of the program codes, thereby realizing the functions of any of the above embodiments.

[0182] In addition, it should be understood that the program codes read from the storage medium can be written into a memory provided in an extension board inserted into the computer or a memory provided in an extension module connected to the computer, and then part or all of the actual operations can be performed based on the instructions of the program codes by a CPU or the like installed on the extension board or the extension module, thereby realizing the functions of any of the above embodiments.

[0183] It should be noted that, in this document, the terms such as first and second are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. In addition, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, a method, an article or an apparatus including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such a process, a method, an article or an apparatus.

[0184] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by related hardware of program instruction, the foregoing program can be stored in a computer readable storage medium, and the program executes the steps of the method embodiments when executed.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for operating network security, characterized in that, include: For each activity, several node apps are developed; wherein, each node app is used to execute the data processing steps of that node; Obtain the database used to store the knowledge reasoning results of each host network data, in order to establish the correspondence between each case and the storage location in the database; When an instruction to execute a target activity is received, at least one target case is identified, and at least one script is configured for each target case; Identify the target node APP corresponding to each script, connect the target node APPs in a predetermined stage order, and define the data processing steps in each target node APP to generate the corresponding stage for the script using the target node APP; wherein, each stage corresponds to at least one target node APP; For each target case, the following steps are performed: Based on the aforementioned correspondence, retrieve the knowledge reasoning data for the current target case from the database; Based on each script configured for the current target case, the knowledge reasoning data is processed sequentially according to the stage order using several target node APPs of the current script. The methods for generating knowledge reasoning results include: Extract knowledge from the knowledge entities, attributes, and relationships of network data to generate several target knowledge items; Based on the target knowledge, a knowledge graph is generated, and the knowledge graph and external known data are stored in the database. Based on external known data, analysis rules are determined, and based on these rules, knowledge reasoning is performed on the target knowledge to obtain the knowledge reasoning results. The process of determining analysis rules based on externally known data, and then performing knowledge reasoning on the target knowledge based on these rules to obtain the knowledge reasoning results includes: Commands to retrieve data range and rules; Retrieve target knowledge within the data scope from the database to create a session based on the target knowledge; The NLP inference engine extracts rule features from ChatGPT's consultation data and expert-annotated feature data based on rule instructions; Based on rule features, target knowledge in the conversation is detected to obtain the first inference knowledge; Based on the relationships established by the first inference knowledge, the second inference knowledge is obtained; Based on the first and second reasoning knowledge, the knowledge reasoning result is generated.

2. The method according to claim 1, characterized in that, After determining at least one target case and before determining the target node APP corresponding to each script, the method further includes: configuring team members for each target case and assigning permissions to each team member.

3. The method according to claim 1, characterized in that, The stage includes a start stage, an automatic stage, a manual stage, and an end stage; the automatic stage includes: an intelligence identification stage, a vulnerability identification stage, a hacker attack identification stage, an external response stage, and / or a work order system stage.

4. The method according to claim 3, characterized in that, When the current stage is an intelligence identification stage, the intelligence identification stage processes data in the following manner: Obtain the target data passed from the previous stage; Using at least one target node APP corresponding to the current intelligence identification stage, the address in the target data is identified according to the data processing steps defined by the target node APP to obtain the intelligence identification result; Based on the target data transmitted from the previous stage and the intelligence identification results, the target data transmitted from the current intelligence identification stage to the next stage is determined.

5. The method according to claim 4, characterized in that, The current stage determines the target data to be passed to the next stage in the following way: The target data from the previous stage and the data processing results from the current stage are overlaid and filtered to obtain the target data from the current stage to be transmitted to the next stage.

6. The method according to claim 3, characterized in that, When the current stage is an external response stage, the external response stage processes data in the following manner: Obtain the target data passed from the previous stage; Using the external system APP corresponding to the current external response stage, and following the data processing steps defined by the external system APP, the alarm information that needs to be transmitted to the outside from the target data transmitted from the previous stage is sent to the outside. Determine if there are any unprocessed alarm messages in the target data transmitted from the previous stage; If not, the end signal will be sent to the end stage; If so, the unprocessed alarm information will be used as the target data to be passed to the next level stage, and the next level stage is the work order system stage.

7. The method according to claim 6, characterized in that, The work order system platform processes data in the following manner: Obtain the target data passed from the previous stage; Using the notification APP corresponding to the work order system stage, work order data is generated based on each alarm information in the target data, and the work order data is processed according to the defined distribution method.

8. A network security operation apparatus for implementing the method as described in any one of claims 1-7, characterized in that, include: A writing unit is used to write several node apps based on each activity; wherein, the node apps are used to execute the data processing steps of that node; Establish a unit to acquire a database for storing knowledge reasoning results of network data from each host, so as to establish a correspondence between each case and its storage location in the database; The determining unit is configured to determine at least one target case and configure at least one script for each target case when it receives an instruction to execute a target activity. The generation unit is used to determine the target node APP corresponding to each script, connect the target node APPs in a predetermined stage order, and define the data processing steps in each target node APP to generate the corresponding stage of the script using the target node APP; wherein, each stage corresponds to at least one target node APP. The acquisition unit is configured to perform the following for each target case: based on the correspondence, acquire the knowledge reasoning data of the current target case from the database; The processing unit is used to process the knowledge reasoning data sequentially according to the stage order for each script configured for the current target case, using several target node APPs of the current script.

9. A computing device comprising a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-7.

Images