A method, apparatus, system, device and medium for processing a safety script

Abstract

The application discloses a kind of processing methods, device, system, equipment and medium of security script, it is related to communication technical field, the method includes: obtaining threat alarm information, and determine the security policy matched with the threat alarm information;According to the security policy, call corresponding security script;The security policy has at least one security script corresponding;The called security script is atomized arrangement, and based on the policy flow of the security policy, the business flow node required for each security script to execute the security policy is generated and the corresponding node thread is allocated for business flow node;Based on the relationship cache, determine the business flow node to be executed and the corresponding node thread;Based on the thread mark attribute, determine the node thread to be executed, execute the corresponding node thread.The application adopts the way of high concurrency in thread to process the concurrency of security script, improve the rate and throughput of security script response.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and specifically to a method, apparatus, system, device, and medium for processing secure scripts. Background Technology

[0002] Platforms based on Security Orchestration Automation and Response (SOAR) technology orchestrate and execute security scripts to complete security tasks that previously required multi-person, multi-system, and multi-interface online collaboration. This significantly reduces response time, decreases reliance on personnel, improves work efficiency, ensures the quality of emergency response, and improves the overall mean time to repair (MTTR) level of the security team.

[0003] Currently, high-concurrency SOAR processing is executed sequentially across nodes. This causes subsequent nodes to wait for extended periods, impacting the execution of other response strategies and resulting in overall low processing efficiency.

[0004] Therefore, how to improve the response and processing capabilities of security scripts under high concurrency is an important issue that the industry urgently needs to address. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method, apparatus, system, device and medium for processing security scripts, in order to solve the problem that when processing SOAR security scripts with high concurrency, a large number of nodes will be in a waiting state for a long time, resulting in low overall processing efficiency.

[0006] According to a first aspect, embodiments of the present invention provide a method for processing security scripts, the method comprising:

[0007] Obtain threat alert information and determine the security policy that matches the threat alert information;

[0008] According to the security policy, the corresponding security script is invoked; the security policy corresponds to at least one security script.

[0009] The invoked security scripts are atomically orchestrated, and based on the policy flow of the security policy, business process nodes required for each security script to execute the security policy are generated, and corresponding node threads are allocated to the business process nodes. Each business process node corresponds to at least one node thread, and a relationship cache is formed among the node threads to indicate the execution order of the node threads and the correlation between the business process nodes. Each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time, and weight base point.

[0010] Based on the relationship cache, the business process node to be executed and the corresponding node thread are determined;

[0011] Based on the thread tagging attribute, the node thread to be executed is determined, and the corresponding node thread is executed in response to the threat alarm information.

[0012] In conjunction with the first aspect, in the first embodiment of the first aspect, the security script and security policy in the method are stored in a preset security threat event database, and the security threat event database stores at least one security script and at least one security policy and establishes a mapping relationship between the security script and the security policy.

[0013] In conjunction with the first aspect, in the second embodiment of the first aspect, the atomic orchestration of the invoked security script, and the generation of business process nodes required for each security script to execute the security policy based on the policy flow of the security policy, as well as the allocation of corresponding node threads to the business process nodes, specifically include:

[0014] Based on the policy flow of the security policy, the invoked security script is atomically orchestrated to obtain at least one business process node; each business process node has a corresponding business queue in its business, and the business process node has corresponding node information.

[0015] Based on the policy flow after the security policy has been loaded, a corresponding number of node threads are allocated to the security script;

[0016] Based on the node information, the node thread corresponding to the business process node is enqueued into its corresponding business queue.

[0017] In conjunction with the second implementation of the first aspect, in the third implementation of the first aspect, the step of determining the node thread to be executed based on the thread tag attribute and executing the corresponding node thread in response to the threat alarm information specifically includes:

[0018] Based on the thread tagging attribute, determine the node thread to be executed;

[0019] Lock the business queue corresponding to the node thread to be executed, and call and execute the corresponding node thread from the business queue;

[0020] Once it is determined that all the node threads enqueued in the business queue have been executed, the lock on the business queue is released to allow the node threads to be enqueued in the business queue.

[0021] In conjunction with the second implementation of the first aspect, in the fourth implementation of the first aspect, the policy flow based on the security policy atomically orchestrates the invoked security script to obtain at least one of the business process nodes, specifically including:

[0022] Based on the policy flow of the security policy, the security script is decomposed into business processes to obtain at least one of the business process nodes.

[0023] The business process node is assigned to an unlocked business queue; when the business queue is in a relational state or has been occupied by an assigned task, the business queue is locked.

[0024] In conjunction with the third embodiment of the first aspect, in the fifth embodiment of the first aspect, the step of determining the node thread to be executed based on the thread tag attribute and executing the corresponding node thread to respond to the threat alarm information specifically includes, further, the following:

[0025] Uncalled node threads are added to the synchronization queue to wait to be awakened; each node thread in the synchronization queue has an indication relationship with the preceding and following nodes as well as an indication relationship with the first and last nodes, and when a node thread enters the synchronization queue, a locking flag is added to the node thread, and when the node thread leaves the synchronization queue, the locking flag added to the node thread is released.

[0026] According to a second aspect, embodiments of the present invention also provide a security script processing apparatus, the apparatus comprising:

[0027] The threat acquisition module is used to acquire threat alert information and determine the security policy that matches the threat alert information;

[0028] The script scheduling module is used to invoke the corresponding security script according to the security policy; the security policy corresponds to at least one security script.

[0029] The script orchestration module is used to atomically orchestrate the invoked security scripts and, based on the policy flow of the security policy, generate the business process nodes required for each security script to execute the security policy and allocate corresponding node threads to the business process nodes; each business process node corresponds to at least one node thread, and the node threads form a relationship cache to indicate the execution order of the node threads and the correlation between the business process nodes; each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time, and weight base point;

[0030] The node determination module determines the business process node to be executed and the corresponding node thread based on the relationship cache.

[0031] The thread execution module is used to determine the node thread to be executed based on the thread tag attribute, and execute the corresponding node thread in response to the threat alarm information.

[0032] According to a third aspect, embodiments of the present invention also provide a security script processing system, the system comprising:

[0033] The system includes a scheduling center, a policy center, a security script response center, a business thread pool, and several partitioned thread processing centers.

[0034] The dispatch center is used to receive external threat alerts, send the threat alerts to the policy center, and obtain the security policies and security scripts fed back by the policy center based on the threat alerts.

[0035] The policy center stores preset security scripts and security policies, determines the security policy and corresponding security script that match the threat alarm information, and feeds it back to the dispatch center.

[0036] The security script response center is used to receive the security policy and security script issued by the scheduling center, and based on the policy process corresponding to the security policy, rearrange the business atomic nodes of the security script, generate the business process nodes required for each security script to execute the security policy, and allocate corresponding node threads to the business process nodes.

[0037] Each partition thread processing center is used to determine the business process node to be executed and its corresponding node thread based on the relation cache, and to determine the node thread to be executed based on the thread tag attribute, and execute the corresponding node thread in response to the threat alarm information; each business process node corresponds to at least one node thread, and the node threads form a relation cache to indicate the execution order of the node threads and the correlation between the business process nodes before and after; each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time and weight base point;

[0038] The business thread pool is used to allocate a corresponding number of node threads to each partition processor.

[0039] According to a fourth aspect, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the processing method of any of the security scripts described above.

[0040] According to a fifth aspect, embodiments of the present invention also provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the processing method of any of the security scripts described above.

[0041] The security script processing method, apparatus, system, device, and medium of the present invention atomize the security script into several business process nodes and assign corresponding node threads to the business process nodes. This makes the security script not a unified whole, but a collection of specific security capability business operations. Each atomized node can be regarded as a whole and execute corresponding operations. Nodes at the same level can execute in parallel without interference. Subsequently, a relationship cache is formed between node threads to indicate the execution order of node threads and the correlation between business process nodes. Node threads also have thread marking attributes. The corresponding node threads are executed, and a high-concurrency processing method within threads is used to deal with the concurrency of the security script, improving the response rate and throughput of the security script. This allows the response capability of the security script to be horizontally expanded and improved. Attached Figure Description

[0042] The features and advantages of the invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the invention in any way. In the drawings:

[0043] Figure 1 A flowchart illustrating the security script processing method provided by the present invention is shown;

[0044] Figure 2 The diagram illustrates the principle of node thread allocation in the security script processing method provided by the present invention.

[0045] Figure 3 A schematic diagram of the node thread allocation process in the security script processing method provided by the present invention is shown;

[0046] Figure 4 A schematic diagram of the synchronization queue in the security script processing method provided by the present invention is shown;

[0047] Figure 5 This diagram illustrates the synchronization queue enqueueing process in the security script processing method provided by the present invention.

[0048] Figure 6 This diagram illustrates the process of dequeuing from the synchronization queue in the security script processing method provided by the present invention.

[0049] Figure 7 A schematic diagram of the structure of the security script processing device provided by the present invention is shown;

[0050] Figure 8One of the structural schematic diagrams of the security script processing system provided by the present invention is shown;

[0051] Figure 9 A second schematic diagram of the structure of the security script processing system provided by the present invention is shown;

[0052] Figure 10 A schematic diagram of the structure of an electronic device is shown, illustrating the security script processing method provided by the present invention. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] Simple cybersecurity prevention and blocking strategies are no longer sufficient to deal with existing cyberattacks. Enterprises and organizations must pay more attention to prevention in cybersecurity detection and response, that is, to build a new security protection system that integrates blocking, detection, response and prevention under the assumption that the network has already been attacked.

[0055] Security scripts provide a security protection system that integrates blocking, detection, response, and prevention. Security scripts orchestrate existing security capabilities, define a workflow and corresponding triggering rules. When external threat alerts (events) meet the triggering rules of the security script, the workflow defined in the security script will be automatically executed, and the security capabilities orchestrated in the security script will also be invoked to respond to the threat alerts.

[0056] To execute security scripts, SOAR technology emerged. With security orchestration and automation at its core, SOAR integrates people, processes, technologies, and tools to assist security operations personnel in their daily work and improve operational efficiency. Platforms based on SOAR technology orchestrate and execute security scripts to complete security tasks that previously required multi-person, multi-system, and multi-interface online collaboration, significantly reducing response time, decreasing reliance on personnel, improving work efficiency, ensuring the quality of emergency response, and ultimately enhancing the overall MTTR (Mean Time To Responsibility) of the security team.

[0057] Current SOAR security scripts are processed at each node using a workflow model. Under high concurrency, they are primarily executed sequentially through the security capability's own scheduling center. However, because some nodes have sequential execution relationships, if a security script takes too long to execute at a particular node, subsequent nodes will be in a long waiting state, which will affect the execution of other response strategies and result in low overall processing efficiency.

[0058] Therefore, how to improve the response and processing capabilities of security scripts under high concurrency is an important issue that the industry urgently needs to address.

[0059] To address the aforementioned issues, this embodiment provides a method for processing security scripts, aiming to prevent most threads from remaining idle for extended periods during concurrent processing of security scripts. This method for processing security scripts can be used in electronic devices, including but not limited to computers and mobile terminals. Figure 1 This is a flowchart illustrating a method for processing security scripts according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0060] S10. Obtain threat alert information and determine the security policy matching the threat alert information. In this embodiment of the invention, different levels of security script response processing will be performed according to different threat alert information to carry out dynamic policy defense against security threats.

[0061] S20. According to the security policy, the corresponding security script is invoked. In this embodiment of the invention, the security policy corresponds to at least one security script.

[0062] This method pre-stores several pre-defined security scripts and their corresponding workflows, as well as pre-defined static security policies. Each security policy outlines the overall handling process for a security threat event, and each policy requires at least one security script to execute; therefore, each security policy corresponds to at least one security script. When external threat alerts (events) are reported, the system matches and automatically assigns the appropriate security policy and security script based on preset rules.

[0063] In this embodiment of the invention, the aforementioned security policies and security scripts are also stored in a preset security threat event database. It should be noted that the security threat event database stores at least one security script and at least one security policy, and a mapping relationship between the security script and the security policy is established.

[0064] Preferably, security strategies can be specifically formulated based on the degree of threat, the method of threat, etc., in order to respond to different security threat events.

[0065] This method matches the corresponding security policy to the threat alert information, and then generates the corresponding business process node and corresponding node thread for each security playbook, loading all nodes of the policy process of a security policy.

[0066] In some optional embodiments of the present invention, if the current number of node threads is insufficient for allocation, this policy process will not be loaded until a sufficient number of threads are available to provide the security policy.

[0067] S30. Perform atomic orchestration on the invoked security scripts, and based on the policy flow of the security policy, generate the business process nodes required for each security script to execute the security policy and allocate corresponding node threads for each business process node. Each business process node has at least one node thread, and a relationship cache is formed between the node threads to indicate the execution order of the node threads and the correlation between the business process nodes. Each node thread has a thread tag attribute, which is used to characterize importance and includes information such as priority, time, and weight base point.

[0068] It should be noted that thread tag attributes are primarily used to determine the execution priority of node threads, mainly including business priority, time priority, and weight base points assigned by the scheduling center or manually. By adding appropriate attributes to the relevant threads to be executed, the response speed can be improved during security script responses.

[0069] Based on the current service model, after obtaining the security policies and security scripts, the security scripts will be rearranged, and corresponding node threads will be generated for each business process node. These node threads will be used to process the security scripts accordingly in order to provide security capabilities to respond to threat alerts.

[0070] Specifically, based on the policy flow corresponding to the security policy, threat alert information business requests are decomposed into atomic business process nodes and assigned to corresponding business queues. Once a series of decomposed business process nodes are obtained, the business queues are continuously queued. It's understood that multiple business queues may be queried simultaneously, but only one business processing thread can occupy a business queue at a time. When a business processing thread occupies a business queue, it performs the corresponding enqueue operation, enqueuing the business process node. After the current business queue operation is completed, the process continues to the next business queue until all decomposed business process nodes are enqueued.

[0071] Therefore, in this embodiment of the invention, the security script is not a unified whole, but consists of specific security capability business operations. These can be atomic, and each atomic node can be regarded as a whole and perform corresponding operations. Nodes at the same level can execute in parallel without interference.

[0072] S40. Based on relational caching, determine the business process nodes to be executed and their corresponding node threads.

[0073] S50. Based on the thread tag attribute, determine the node thread to be executed and execute the corresponding node thread in response to threat alarm information.

[0074] Since the associated cache contains the execution order of node threads and the correlation between business process nodes, and the thread tag attribute can characterize the importance of nodes, the execution order of all node threads can be obtained by comparing the associated cache and a series of thread tag attributes. That is, when scheduling each node thread, this method will determine the execution order of the threads based on the associated cache of thread execution, and also based on the thread tag attribute of the node thread. In this embodiment of the invention, when encountering node threads that do not need to be executed immediately, but need to be executed after the corresponding node is executed, or when the current processor is executing the corresponding node thread, the current node thread will be placed in the synchronization queue. After the current node thread is completed, it can be woken up and scheduled at any time.

[0075] Understandably, after the node thread to be executed has finished executing, the business process node to be executed and the next node thread to be executed will be determined again based on the relationship cache and thread tag attribute.

[0076] In this method, after an assigned node thread completes the loading of its thread tag attributes, it also registers the loaded node threads, performing corresponding thread information registration and verification. Then, the registered node threads are loaded into the business process nodes, ensuring that the thread tag attributes can correctly serve as the criterion for determining the execution order.

[0077] The security script processing method of this invention atomizes the security script into several business process nodes and assigns corresponding node threads to each business process node. This makes the security script not a unified whole, but rather a collection of specific security capability business operations. Each atomized node can be regarded as a whole and execute corresponding operations. Nodes at the same level can execute in parallel without interference. Subsequently, a relationship cache is formed between node threads to indicate the execution order of node threads and the correlation between business process nodes. Node threads also have thread marking attributes. The corresponding node threads are executed, and a high-concurrency processing method within threads is used to deal with the concurrency of the security script, improving the response rate and throughput of the security script. This allows the response capability of the security script to be horizontally expanded and improved.

[0078] Please see Figure 2 Each strategy process is atomically divided into multiple business process nodes, and each business process node contains all the processing information for that node. This node information is mainly used for loading when allocating node threads in the resource pool. After the thread corresponding to the business process node is allocated, it will be enqueued into the corresponding business queue. For example, process A will only enter the queue of business A.

[0079] For details, please refer to Figure 3 Each business process node has a corresponding business queue. When allocating node threads to a business process node, the node thread is enqueued into its corresponding business queue by reading the node information of the business process node. That is, the invoked security script is first atomically orchestrated to obtain at least one business process node. Then, based on the policy process that can load the security policy, a corresponding number of node threads are allocated to the security script. Finally, the node information is read, and the node thread corresponding to the business process node is enqueued into its corresponding business queue.

[0080] More specifically, the process first locks the enqueueing function for all business queues in the current partition, then dequeues the node threads from each business queue in turn, and finally calls the node threads again. This process determines the execution order of the node threads based on the associated cache and also on the thread flag attribute of the node threads. If a node thread is already being executed, the remaining node threads are placed in a synchronization queue to await subsequent wake-up. After reading and executing all node threads in the business queues, the lock is released, allowing each business queue to re-enqueue.

[0081] Please see Figure 4 , Figure 5 and Figure 6 The business queue also has a synchronization queue, where nodes are the nodes to be executed that are placed in the synchronization queue.

[0082] The synchronization queue contains head and tail information. The head points to the first node, which is the head node of the synchronization queue, and the tail points to the last node, which is the tail node of the synchronization queue. Each node in the synchronization queue also has information such as prew, next, node information, and thread tag attributes. Among them, prew points to the address of the previous node, next points to the address of the next node, and the node content mainly contains some parameter data required by the current node thread for execution.

[0083] It should be noted that when there are no nodes in the synchronization queue, the head node points to an empty node, and similarly, when there are no nodes in the synchronization queue, the tail node also points to an empty node.

[0084] Therefore, the thread nodes added to the synchronization queue form a doubly linked list, which can be traversed from front to back or from back to front.

[0085] Enqueueing in the synchronization queue is implemented as follows: When a node thread is ready to execute, it first checks if any other node thread is currently using it. If not, the node thread will execute directly. If it is used, the node thread is marked and prepared to enter the synchronization queue. The marking information of the node thread is read, and a locking flag is added to the node thread. This locking flag indicates that the node thread has already been enqueued by another queue and cannot be enqueued or locked again. Attempting to enqueue or lock while locked will directly display the corresponding locking failure message. After successfully adding the locking flag, the information is refreshed to the associated cache of the node thread execution, and then the node thread with the added locking flag is added to the tail of the synchronization queue. When a new node thread is enqueued, the tail in the current queue points to the new node, and the prev of the new node points to the original tail node in the synchronization queue.

[0086] Synchronization queue dequeueing is implemented as follows: After a node thread finishes execution, it wakes up the next node thread based on `next`, and prepares to perform the synchronization dequeueing operation for the completed node thread. At this time, the node thread's locking flag is first released. After successful release, the information is refreshed into the node thread's execution-related cache. During synchronization dequeueing, after the first node's thread releases its synchronization state, it wakes up the subsequent node's thread, and the subsequent node's thread, upon acquiring the released synchronization state, sets itself as the first node.

[0087] As can be seen, each business queue stores a queue lock, and the locking mechanism runs through the entire business execution process. After the business decomposition service parses and decomposes the business, before storing the corresponding business process nodes into the corresponding business queue, the business processing thread continuously queries the business queue. If the current queue lock is closed or the queue is occupied by other threads, it will continue to query until the queue lock is opened, and the decomposed business nodes are enqueued. After completing the service of all business queues, the queue lock is released so that the next business processing thread can continue processing.

[0088] During service processing, if a queue lock is already occupied, a new business queue will be requested. After acquiring the business queue for processing, the queue lock will be closed, and the service occupancy flag will be set to the service itself. This effectively prevents interference from subsequent enqueued threads during business processing, ensuring that all business nodes that entered the business queue first are processed first, preventing large-scale backlogs of business requests, and allowing the same business requests entering various business queues to be processed almost simultaneously. After processing all nodes in the business queue, the queue lock will be opened and released. This allows subsequent processing services to continue processing the next round of business queue requests.

[0089] The following describes the security script processing apparatus provided in the embodiments of the present invention. The security script processing apparatus described below can be referred to in correspondence with the security script processing method described above.

[0090] To address the aforementioned issues, this embodiment provides a security script processing apparatus designed to prevent most threads from remaining idle for extended periods during concurrent security script processing. This security script processing apparatus can be used in electronic devices, including but not limited to computers and mobile terminals. Figure 7 This is a schematic diagram of the structure of a security script processing device according to an embodiment of the present invention, such as... Figure 7 As shown, the device includes:

[0091] The threat acquisition module 10 is used to acquire threat alert information and determine the security policy that matches the threat alert information. In this embodiment of the invention, different levels of security script response processing are performed according to different threat alert information to conduct dynamic policy defense against security threats.

[0092] The script scheduling module 20 is used to call the corresponding security script according to the security policy. In this embodiment of the invention, the security policy corresponds to at least one security script.

[0093] The device pre-stores several pre-defined security scripts and their corresponding workflows, as well as pre-defined static security policies. Each security policy outlines the overall handling process for a security threat event; a single policy requires the execution of at least one security script, thus each policy corresponds to at least one security script. When external threat alerts (events) are reported, the device automatically matches and assigns appropriate security policies and scripts based on preset rules.

[0094] In this embodiment of the invention, the aforementioned security policies and security scripts are also stored in a preset security threat event database. It should be noted that the security threat event database stores at least one security script and at least one security policy, and a mapping relationship between the security script and the security policy is established.

[0095] Preferably, security strategies can be specifically formulated based on the degree of threat, the method of threat, etc., in order to respond to different security threat events.

[0096] The device will match the corresponding security policy with the threat alarm information, and then generate the corresponding business process node and corresponding node thread for each security script, and load all nodes of the policy process of a security policy.

[0097] In some optional embodiments of the present invention, if the current number of node threads is insufficient for allocation, this policy process will not be loaded until a sufficient number of threads are available to provide the security policy.

[0098] The script orchestration module 30 is used to atomically orchestrate the called security scripts and, based on the policy flow of the security policy, generate the business process nodes required for each security script to execute the security policy and allocate corresponding node threads for each business process node. Each business process node has at least one node thread, and a relationship cache is formed between the node threads to indicate the execution order of the node threads and the correlation between the business process nodes. Each node thread has a thread tag attribute, which is used to characterize importance and includes information such as priority, time, and weight base point.

[0099] It should be noted that the thread tag attribute is mainly used to determine the priority of node thread execution, and mainly includes information such as business priority, time priority, and weight base points assigned by the scheduling center or manually.

[0100] Based on the current service model, after obtaining the security policies and security scripts, the security scripts will be rearranged, and corresponding node threads will be generated for each business process node. These node threads will be used to process the security scripts accordingly in order to provide security capabilities to respond to threat alerts.

[0101] Specifically, based on the policy flow corresponding to the security policy, threat alert information business requests are decomposed into atomic business process nodes and assigned to corresponding business queues. Once a series of decomposed business process nodes are obtained, the business queues are continuously queued. It's understood that multiple business queues may be queried simultaneously, but only one business processing thread can occupy a business queue at a time. When a business processing thread occupies a business queue, it performs the corresponding enqueue operation, enqueuing the business process node. After the current business queue operation is completed, the process continues to the next business queue until all decomposed business process nodes are enqueued.

[0102] Therefore, in this embodiment of the invention, the security script is not a unified whole, but consists of specific security capability business operations. These can be atomic, and each atomic node can be regarded as a whole and perform corresponding operations. Nodes at the same level can execute in parallel without interference.

[0103] The node determination module 40 is used to determine the business process node to be executed and the corresponding node thread based on the relation cache.

[0104] The thread execution module 50 determines the node thread to be executed based on the thread tag attribute and executes the corresponding node thread in response to threat alarm information.

[0105] Because the associated cache contains the execution order of node threads and the correlation between business process nodes, and the thread tag attribute can characterize the importance of nodes, the execution order of all node threads can be obtained by comparing the associated cache and a series of thread tag attributes. That is, when scheduling each node thread, the device will determine the execution order of the threads based on the associated cache of thread execution, and also based on the thread tag attribute of the node thread. In this embodiment of the invention, when encountering node threads that do not need to be executed immediately, but need to be executed after the corresponding node is executed, or when the current processor is executing the corresponding node thread, the current node thread will be placed in the synchronization queue. After the current node thread is completed, it can be woken up and scheduled at any time.

[0106] Understandably, after the node thread to be executed has finished executing, the business process node to be executed and the next node thread to be executed will be determined again based on the relationship cache and thread tag attribute.

[0107] In this device, after an assigned node thread completes the loading of its thread tag attributes, it also registers the loaded node threads, performing corresponding thread information registration and verification. Then, the registered node threads are loaded into the business process nodes, ensuring that the thread tag attributes can correctly serve as the criterion for determining the execution order.

[0108] The security script processing apparatus of this invention atomizes the security script into several business process nodes and assigns corresponding node threads to these nodes. This makes the security script not a unified whole, but rather composed of specific security capability business operations. Each atomized node can be regarded as a whole and execute corresponding operations. Nodes at the same level can execute in parallel without interference. Subsequently, a relationship cache is formed between node threads to indicate the execution order of node threads and the correlation between business process nodes. Node threads also have thread marking attributes. The apparatus executes the corresponding node threads and adopts a high-concurrency processing method to deal with the concurrency of the security script, thereby improving the response rate and throughput of the security script and enabling the horizontal expansion and improvement of the security script's response capability.

[0109] Please see Figure 8 and Figure 9 The present invention also provides a security script processing system, which mainly consists of a scheduling center, a policy center, a security script response center, a business thread pool, and several partitioned thread processing centers.

[0110] The scheduling center is primarily responsible for the overall scheduling of the entire system, essentially acting as the main thread for business processing. Each business function needs to register, receive verification, receive scheduling requests, and add / unlock flags at the scheduling center. The scheduling center is responsible for, but is not limited to, responding to and processing external threat alerts, scheduling the policy center, task distribution, dynamically controlling the number of threads in the business thread pool, and receiving registration and verification functions for threads from various nodes.

[0111] The policy center pre-stores pre-defined security scripts and their corresponding workflows, as well as pre-defined static security policies. Each security policy outlines the overall handling process for a security threat event; a policy requires at least one security script to execute, thus each policy corresponds to at least one security script. When an external threat alert (event) is reported, the dispatch center receives the alert and queries the policy center. The policy center automatically assigns the appropriate security policy and security script based on preset rules and feeds them back to the dispatch center. The dispatch center, based on the current service model, then distributes the security policy and security script obtained from the policy center to the security script response center for re-arrangement and security capability response to the threat alert.

[0112] Preferably, security strategies can be specifically formulated based on the degree of threat, the method of threat, etc., in order to respond to different security threat events.

[0113] The security script response center receives data from the policy center, rearranges the existing security scripts into business atomic nodes, and then calls the partition thread processing center to generate corresponding node threads for each business process node. These node threads are then used to process the security scripts accordingly. Therefore, in this embodiment of the invention, the security script is not a unified whole, but rather consists of specific security capability business operations. These can be atomicated, and each atomic node can be treated as a whole and execute corresponding operations. Furthermore, nodes at the same level can execute in parallel without interference.

[0114] Each partition thread processing center contains a synchronization queue, which is used to process all node threads of the current partition. All node threads of all processes in the partition enter the corresponding synchronization queue, and then the partition thread processing center loads all node threads in the current synchronization queue at the same time and processes them in sequence.

[0115] Specifically, the partitioned thread processing center includes an associated cache that contains the execution order of node threads and the relationships between business process nodes. The scheduling center can also dynamically assign thread marking attributes, such as base point weights, based on the importance of node threads and business process nodes. After comparing a series of thread marking attributes, the partitioned thread processing center processes the corresponding node threads in a certain order. When encountering node threads that do not need to be executed immediately, that await the execution of their corresponding nodes, or that the current processor is currently executing a corresponding node thread, the partitioned thread processing center places the current node thread in a synchronization queue. Once the current node thread has finished executing, it can be awakened and scheduled at any time.

[0116] If the corresponding node thread is not loaded into the current synchronization queue, the partition thread processing center will spin, occupy the current service processor, and will not relinquish it until a new business queue resource is allocated. This puts the processing service in a very efficient processing state, ready to receive business resources from the business queue at any time, so as to receive new node thread processing at any time.

[0117] Therefore, the node thread executes the associated cache and stores the thread tag attributes of the relevant business node thread. The thread tag attributes include at least the business priority, time priority, and weight base points assigned by the scheduling center or manually.

[0118] It should be noted that each partition thread processing center can handle multiple policy processes, that is, multiple security policies.

[0119] Once the security policy, business process nodes, and node threads are determined, the corresponding thread tagging information, such as business priority, weight base point, and time priority, is loaded into the corresponding thread nodes. After loading, the threads are registered with the scheduling center for corresponding thread information registration and verification. After registration, once the partition thread processing service has finished loading, the thread tagging information and other associated information will be uniformly refreshed to the partition thread processing center as a criterion for determining the execution order. When scheduling threads for each business process node, the thread service will determine the execution order of the node threads based on the associated cache of the node threads, and also based on the thread tagging attributes of the node threads. If a node thread is already executing, it will be placed in the synchronization H queue, waiting to be woken up later.

[0120] For details, please refer to Figure 3 Each business process node has its corresponding business queue. When allocating a node thread to a business process node, the node thread corresponding to the business process node is enqueued into its corresponding business queue by reading the node information of the business process node.

[0121] More specifically, when the partitioned thread processing center handles services, it first locks the enqueue function for all business queues in the current partition, then dequeues the node threads from each business queue in turn, and finally calls the node threads. This process determines the execution order of node threads based on associated caches and also on the thread flag attributes of the node threads. If a node thread is already being executed, the remaining threads are placed in a synchronization queue to await subsequent wake-up. After reading all node threads from the business queues, the lock is released, allowing each business queue to re-enqueue.

[0122] The business thread pool dynamically allocates a corresponding number of node threads to each partition processor. The scheduling center controls the total number of concurrent node threads by distributing the data to the business thread pool. The business thread pool monitors each partition processor and distributes the corresponding number of node threads to the corresponding processor, thereby controlling the concurrency of each partition thread processing center to prevent excessive consumption of service resources and slow response.

[0123] If the current number of node threads in the system is insufficient for allocation, this policy process will not be loaded until a sufficient number of threads are available to provide the security policy.

[0124] The security script processing system of this invention atomizes the security script into several business process nodes and assigns corresponding node threads to these nodes. This makes the security script not a unified whole, but rather a collection of specific security capability business operations. Each atomized node can be treated as a whole and execute corresponding operations. Nodes at the same level can execute in parallel without interference. Subsequently, a relationship cache is formed between node threads to indicate the execution order of node threads and the correlation between business process nodes. Node threads also have thread marking attributes. By employing a high-concurrency processing method within threads to handle the concurrency of the security script, the response rate and throughput of the security script are improved, allowing for horizontal expansion and enhancement of the security script's responsiveness.

[0125] Figure 10 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 10 As shown, the electronic device may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a processing method of a security script, the method including:

[0126] Obtain threat alert information and determine the security policy that matches the threat alert information;

[0127] According to the security policy, the corresponding security script is invoked; the security policy corresponds to at least one security script.

[0128] The invoked security scripts are atomically orchestrated, and based on the policy flow of the security policy, business process nodes required for each security script to execute the security policy are generated, and corresponding node threads are allocated to the business process nodes. Each business process node corresponds to at least one node thread, and a relationship cache is formed among the node threads to indicate the execution order of the node threads and the correlation between the business process nodes. Each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time, and weight base point.

[0129] Based on the relationship cache, the business process node to be executed and the corresponding node thread are determined;

[0130] Based on the thread tagging attribute, the node thread to be executed is determined, and the corresponding node thread is executed in response to the threat alarm information.

[0131] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is capable of executing the processing method of the security script provided by the above methods, the method comprising:

[0133] Obtain threat alert information and determine the security policy that matches the threat alert information;

[0134] According to the security policy, the corresponding security script is invoked; the security policy corresponds to at least one security script.

[0135] The invoked security scripts are atomically orchestrated, and based on the policy flow of the security policy, business process nodes required for each security script to execute the security policy are generated, and corresponding node threads are allocated to the business process nodes. Each business process node corresponds to at least one node thread, and a relationship cache is formed among the node threads to indicate the execution order of the node threads and the correlation between the business process nodes. Each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time, and weight base point.

[0136] Based on the relationship cache, the business process node to be executed and the corresponding node thread are determined;

[0137] Based on the thread tagging attribute, the node thread to be executed is determined, and the corresponding node thread is executed in response to the threat alarm information.

[0138] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a processing method for performing the security scripts provided by the methods described above, the method comprising:

[0139] Obtain threat alert information and determine the security policy that matches the threat alert information;

[0140] According to the security policy, the corresponding security script is invoked; the security policy corresponds to at least one security script.

[0141] The invoked security scripts are atomically orchestrated, and based on the policy flow of the security policy, business process nodes required for each security script to execute the security policy are generated, and corresponding node threads are allocated to the business process nodes. Each business process node corresponds to at least one node thread, and a relationship cache is formed among the node threads to indicate the execution order of the node threads and the correlation between the business process nodes. Each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time, and weight base point.

[0142] Based on the relationship cache, the business process node to be executed and the corresponding node thread are determined;

[0143] Based on the thread tagging attribute, the node thread to be executed is determined, and the corresponding node thread is executed in response to the threat alarm information.

[0144] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing a security script, characterized in that, The method includes: Obtain threat alert information and determine the security policy that matches the threat alert information; According to the security policy, the corresponding security script is invoked; the security policy corresponds to at least one security script. The invoked security scripts are atomically orchestrated, and based on the policy flow of the security policy, business process nodes required for each security script to execute the security policy are generated, and corresponding node threads are allocated to the business process nodes. Each business process node corresponds to at least one node thread, and a relationship cache is formed among the node threads to indicate the execution order of the node threads and the correlation between the business process nodes. Each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time, and weight base point. Based on the relationship cache, the business process node to be executed and the corresponding node thread are determined; Based on the thread tagging attribute, the node thread to be executed is determined, and the corresponding node thread is executed in response to the threat alarm information.

2. The method for processing security scripts according to claim 1, characterized in that, In the method, the security script and security policy are stored in a preset security threat event database, and the security threat event database stores at least one security script and at least one security policy and establishes a mapping relationship between the security script and the security policy.

3. The method for processing security scripts according to claim 1, characterized in that, The atomic orchestration of the invoked security scripts, and the generation of business process nodes required for each security script to execute the security policy based on the policy flow of the security policy, as well as the allocation of corresponding node threads to the business process nodes, specifically include: Based on the policy flow of the security policy, the invoked security script is atomically orchestrated to obtain at least one business process node; each business process node has a corresponding business queue in its business, and the business process node has corresponding node information. Based on the policy flow after the security policy has been loaded, a corresponding number of node threads are allocated to the security script; Based on the node information, the node thread corresponding to the business process node is enqueued into its corresponding business queue.

4. The method for processing security scripts according to claim 3, characterized in that, The step of determining the node thread to be executed based on the thread tag attribute and executing the corresponding node thread in response to the threat alarm information specifically includes: Based on the thread tagging attribute, determine the node thread to be executed; Lock the business queue corresponding to the node thread to be executed, and call and execute the corresponding node thread from the business queue; Once it is determined that all the node threads enqueued in the business queue have been executed, the lock on the business queue is released to allow the node threads to be enqueued in the business queue.

5. The method for processing security scripts according to claim 3, characterized in that, The policy flow based on the security policy atomically orchestrates the invoked security script to obtain at least one of the business process nodes, specifically including: Based on the policy flow of the security policy, the security script is decomposed into business processes to obtain at least one of the business process nodes. The business process node is assigned to an unlocked business queue; when the business queue is closed or already occupied by an assigned task, the business queue is locked.

6. The method for processing security scripts according to claim 4, characterized in that, The process of determining the node thread to be executed based on the thread tag attribute and executing the corresponding node thread in response to the threat alarm information specifically includes: Uncalled node threads are added to the synchronization queue to wait to be awakened; each node thread in the synchronization queue has an indication relationship with the preceding and following nodes as well as an indication relationship with the first and last nodes, and when a node thread enters the synchronization queue, a locking flag is added to the node thread, and when the node thread leaves the synchronization queue, the locking flag added to the node thread is released.

7. A device for processing a security script, characterized in that, The device includes: The threat acquisition module is used to acquire threat alert information and determine the security policy that matches the threat alert information; The script scheduling module is used to invoke the corresponding security script according to the security policy; the security policy corresponds to at least one security script. The script orchestration module is used to atomically orchestrate the invoked security scripts and, based on the policy flow of the security policy, generate the business process nodes required for each security script to execute the security policy and allocate corresponding node threads to the business process nodes; each business process node corresponds to at least one node thread, and the node threads form a relationship cache to indicate the execution order of the node threads and the correlation between the business process nodes; each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time, and weight base point; The node determination module determines the business process node to be executed and the corresponding node thread based on the relationship cache. The thread execution module is used to determine the node thread to be executed based on the thread tag attribute, and execute the corresponding node thread in response to the threat alarm information.

8. A system for processing secure scripts, characterized in that, The system includes: The system includes a scheduling center, a policy center, a security script response center, a business thread pool, and several partitioned thread processing centers. The dispatch center is used to receive external threat alerts, send the threat alerts to the policy center, and obtain the security policies and security scripts fed back by the policy center based on the threat alerts. The policy center stores preset security scripts and security policies, determines the security policy and corresponding security script that match the threat alarm information, and feeds it back to the dispatch center. The security script response center is used to receive the security policy and security script issued by the scheduling center, and based on the policy process corresponding to the security policy, rearrange the business atomic nodes of the security script, generate the business process nodes required for each security script to execute the security policy, and allocate corresponding node threads to the business process nodes. Each partition thread processing center is used to determine the business process node to be executed and its corresponding node thread based on the relation cache, and to determine the node thread to be executed based on the thread tag attribute, and execute the corresponding node thread in response to the threat alarm information; each business process node corresponds to at least one node thread, and the node threads form a relation cache to indicate the execution order of the node threads and the correlation between the business process nodes before and after; each node thread has a thread tag attribute, which is used to characterize importance and includes at least priority, time and weight base point; The business thread pool is used to allocate a corresponding number of node threads to each partition processor.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the processing method of the security script as described in any one of claims 1 to 6.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the processing method of the security script as described in any one of claims 1 to 6.

Images