A method, system, device and storage medium for implementing security linkage orchestration

Abstract

The present invention discloses a method, system, device and storage medium for realizing security linkage orchestration, the method includes: a security event definition step; a disposal action configuration step; an execution action definition step; a trigger rule definition step; a model evaluation step; the trigger rule definition step includes: extracting events from a security event definition module to combine event logical relationships, extracting actions from an execution action definition module to configure disposal methods, extracting required action request parameters from a disposal action configuration module to perform legality verification, and finally forming a predefined linkage process model. The present invention can effectively simplify the operation of security operation and maintenance personnel, reduce maintenance costs and learning costs, improve security operation efficiency, have high reliability, and can ensure the success rate of linkage action adaptation, and flexibly and quickly form a process for automatically handling security events by predefining a set of linkage process models and disposal action interface configuration models.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system, device and storage medium for implementing security linkage orchestration. Background Art

[0002] As the cybersecurity offensive and defensive confrontation becomes increasingly fierce, simple cybersecurity prevention and blocking strategies are no longer sufficient to deal with existing cyber attacks. Enterprises and organizations must pay more attention to prevention work in cybersecurity detection and response, that is, to build a new security protection system that integrates blocking, detection, response and prevention under the assumption that the network has been attacked. Security orchestration automation came into being. It is a new concept proposed in the field of information security in recent years. It is a collection of a series of technologies. With security orchestration and automation as the core, it integrates people, processes, technologies and tools to assist security operators in their daily work and improve security operation efficiency.

[0003] For the linkage orchestration of security events, the current solutions include: linkage process workflow model based on BPMN and linkage interface calling method based on WebService. Among them, the disadvantages of linkage process workflow model solution based on BPMN are: complex concept definition, no unified specification of logical relationship between graphic elements, and BPMN description language is too professional. The disadvantages of linkage interface calling solution based on WebService are: WebService calling method needs to obtain service description file provided by the server in advance and generate corresponding calling client agent, which is not flexible enough for different device types. Summary of the invention

[0004] In view of this, the present invention provides a method and system for implementing security linkage orchestration, which can effectively reduce the maintenance cost and learning cost of security operation and maintenance personnel, improve security operation efficiency, have high reliability, and ensure the success rate of linkage action adaptation, and flexibly and quickly form a process for automated processing of security incidents.

[0005] In a first aspect, an embodiment of the present invention provides a method for implementing security linkage orchestration, including:

[0006] Security event definition step: The security event definition module defines security events and configures the filtering query conditions for whether the event is matched;

[0007] Disposal action configuration step: the disposal action configuration module configures the disposal action interface provided by the security device for remotely calling the security device to execute the disposal action;

[0008] Execution action definition step: the execution action definition module defines the execution action and extracts the parameters without default values ​​from the disposal action configuration module as disposal objects;

[0009] Trigger rule definition steps: The trigger rule definition module defines the trigger rules for the linkage process, including: extracting events from the security event definition module to combine event logical relationships; extracting actions from the execution action definition module to configure the disposal method; extracting required action request parameters from the disposal action configuration module to verify the legality; and finally forming a predefined linkage process model.

[0010] According to a specific implementation of an embodiment of the present invention, the processing action configuration module configures the processing action interface provided by the security device including:

[0011] Request method definition step: classify the request method types into three types: HTTP, SNMP, and WebServi ce, and each processing action is one of them;

[0012] Request parameter definition step: the request parameter is one or more; a single request parameter is divided into three parts: parameter information, parameter mapping, and data type, and defined respectively; the parameter mapping is used to automatically associate and map the parameter with the field in the event or action in the linkage process model; the data type is used for data type conversion during interface call to make it meet the interface call requirements;

[0013] Steps to form a disposal action configuration model:

[0014] For the same security device, the handling actions are classified into one type of configuration to form a handling action configuration model for this type of security device. The configuration sequence is to determine the device to which the action belongs, determine the action interface request method, and determine the interface request parameters.

[0015] According to a specific implementation of an embodiment of the present invention, in the security event definition, the content that needs to be defined for the security event includes the event type, event output field, and event hit condition; the event output field is a field that can be associated with a disposal action parameter;

[0016] In the execution action definition, the content that needs to be defined for the execution action includes the action name, action provider, action handling interface and action handling object, and the action handling object is an optional item.

[0017] According to a specific implementation method of an embodiment of the present invention, in the trigger rule definition step, the required action request parameters are extracted from the handling action configuration module for legality verification, including: when the trigger rule definition is performed, the matching degree will be automatically checked for legality when the event is associated with the action. The rule is legal only when all parameters required by any handling action interface are adapted. The inspection order is the existence of default values ​​for the parameters, the existence of handling objects with the same parameter names in the execution action, and the existence of a mapping relationship between the output fields and parameters of a single event combination unit.

[0018] According to a specific implementation of the embodiment of the present invention, the step further includes a model evaluation step: evaluating the linkage process model, which is divided into three parts: pre-checking, in-process monitoring and post-evaluation;

[0019] The pre-check verifies the legality of the model definition when the linkage process model is formed; the in-process monitoring collects the linkage execution status during the execution of the linkage process model, and outputs the number of event hits, action execution success rate, and action execution processing time; the post-evaluation obtains the reliability score of the linkage process model through the evaluation formula.

[0020] According to a specific implementation of the embodiment of the present invention, the evaluation formula is:

[0021] Reliability score = (number of hits of each sub-event * sum of event proportion weights / total number of event hits) * 30 + average success rate of each action execution * 50 + (timeout threshold / average execution processing time of each action) * 20.

[0022] In a second aspect, an embodiment of the present invention further provides a security linkage orchestration implementation system, including:

[0023] A security event definition module is configured to define security events and configure filtering query conditions for whether the events are matched;

[0024] A processing action configuration module is configured to configure a processing action interface provided by a security device, so as to remotely call the security device to execute a processing action;

[0025] An execution action definition module is configured to define an execution action and extract a parameter without a default value from a disposal action configuration module as a disposal object;

[0026] The trigger rule definition module is configured to define the trigger rules of the linkage process, including: extracting events from the security event definition module to combine event logical relationships; extracting actions from the execution action definition module to configure the disposal method; extracting required action request parameters from the disposal action configuration module to verify the legality; and finally forming a predefined linkage process model.

[0027] According to a specific implementation of an embodiment of the present invention, configuring the handling action interface provided by the security device includes:

[0028] Request method definition step: classify the request method types into three types: HTTP, SNMP, and WebServi ce, and each processing action is one of them;

[0029] Request parameter definition step: the request parameter is one or more; a single request parameter is divided into three parts: parameter information, parameter mapping, and data type, and defined respectively; the parameter mapping is used to automatically associate and map the parameter with the field in the event or action in the linkage process model; the data type is used for data type conversion during interface call to make it meet the interface call requirements;

[0030] Steps to form a disposal action configuration model:

[0031] For the same security device, the handling actions are classified into one type of configuration to form a handling action configuration model for the type of security device. The configuration sequence is to determine the device to which the action belongs, determine the action interface request method, and determine the interface request parameters.

[0032] The system also includes a model evaluation module: configured to evaluate the linkage process model, which is divided into three parts: pre-inspection, in-process monitoring and post-evaluation; the pre-inspection verifies the legality of the model definition when the linkage process model is formed; the in-process monitoring collects the linkage execution status during the execution of the linkage process model, and outputs the number of event hits, the action execution success rate, and the action execution processing time; the post-evaluation obtains the reliability score of the linkage process model through the evaluation formula.

[0033] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0034] at least one processor; and,

[0035] a memory communicatively connected to the at least one processor; wherein,

[0036] The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor executes the above-mentioned security linkage orchestration implementation method.

[0037] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, which stores computer instructions, and when the computer instructions are executed by at least one processor, the at least one processor executes the security linkage orchestration implementation method as described above.

[0038] In the fifth aspect, an embodiment of the present invention further provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer executes the security linkage orchestration implementation method in the aforementioned first aspect or any implementation method of the first aspect.

[0039] The present invention arranges various security events and handling actions by pre-defining a set of linkage process models, so that after a security event occurs, the corresponding handling actions are executed according to the linkage process model. The reliability of security linkage arrangement is improved through pre-inspection, in-process monitoring, and post-evaluation systems. A set of configuration models is proposed for handling actions to standardize the definition of handling actions, so that the system can quickly connect to the handling action interface provided by third-party security equipment.

[0040] The present invention can effectively reduce the maintenance cost and learning cost of security operation and maintenance personnel, improve security operation efficiency, has high reliability, can ensure the success rate of linkage action adaptation, and flexibly and quickly form a process for automatically handling security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0042] Figure 1 A block diagram of a method for implementing security linkage orchestration provided by an embodiment of the present invention;

[0043] Figure 2 A flowchart of a safety device linkage processing action configuration provided by an embodiment of the present invention;

[0044] Figure 3 A flow chart of a linkage processing action configuration model provided by an embodiment of the present invention;

[0045] Figure 4 A flow chart of a predefined linkage process model provided by an embodiment of the present invention;

[0046] Figure 5 A flowchart of the legal verification of a linkage process model provided by an embodiment of the present invention;

[0047] Figure 6 A linkage process model evaluation flow chart provided by an embodiment of the present invention;

[0048] Figure 7 A schematic diagram of a security linkage orchestration implementation system provided by an embodiment of the present invention; and

[0049] Figure 8 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0051] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0052] For ease of understanding, the terms are explained as follows:

[0053] Security incidents: network security incidents generated by third-party security devices, such as malicious program alarm events, network attack events, information security incidents, etc.

[0054] Linkage orchestration: orchestrate the process of linking with third-party security devices to handle security incidents.

[0055] Disposal action: Security devices support a series of operations on disposal objects, such as blocking IP, blocking ports, ending processes, etc. The corresponding disposal objects are IP addresses, port numbers, process identifiers, etc.

[0056] Disposal action interface: The remote calling method provided by the security device for the disposal action.

[0057] As the cybersecurity situation becomes increasingly complex, simple cybersecurity prevention methods are no longer sufficient to deal with existing cyber attacks. For a security management system, automated response and handling of security incidents is very important. More and more organizations are in urgent need of quickly building automated response processes for security incidents.

[0058] However, due to the increasing types of security equipment and the inconsistent interface definitions among equipment manufacturers, the existing solutions cannot solve the emerging types of security equipment, resulting in the inability to quickly connect to new disposal action interfaces. In addition, the existing solutions are too complicated in defining the linkage process, which increases the difficulty of operation and understanding for security operation and maintenance personnel.

[0059] By predefining a set of linkage process models and handling action interface configuration models, the present invention can effectively simplify the operations of security operation and maintenance personnel, reduce maintenance costs and learning costs, improve security operation efficiency, have high reliability, and ensure the success rate of linkage action adaptation, and flexibly and quickly form a process for automated processing of security incidents.

[0060] The following is a detailed description with reference to the accompanying drawings and embodiments.

[0061] Figure 1 A block diagram of a method for implementing security linkage orchestration provided by an embodiment of the present invention.

[0062] Cooperate Figure 1 As shown, a method for implementing security linkage orchestration provided by an embodiment of the present invention includes: a security event definition step; a disposal action configuration step; an execution action definition step; a trigger rule definition step; and a model evaluation step.

[0063] 1. Security event definition step: The security event definition module defines security events and configures the filtering query conditions for whether the events are matched.

[0064] In the security event definition, the contents that need to be defined include: event type, event output field, and event hit condition.

[0065] Among them, the event output field is the field in the event data that can be used as the processing action interface parameter for events of this type, that is, the field that can be associated with the processing action parameters; the event hit condition is the basis for determining whether the event occurs, that is, the query method for filtering the event from security events.

[0066] 2. Disposal action configuration step: The disposal action configuration module configures the disposal action interface provided by the security device for remotely calling the security device to execute the disposal action.

[0067] Cooperate Figure 2 As shown, the processing action configuration module configures the processing action interface provided by the security device including:

[0068] (1) Request method definition steps:

[0069] The request method types are divided into three types: HTTP, SNMP, and WebService, and each processing action is one of them;

[0070] Among them, HTTP needs to define: request port, interface address, protocol type (whether encrypted), request method (Http verb); SNMP needs to define: request port, protocol version, operation action; WebService needs to define: request port, interface address, protocol type (whether encrypted), service description (WSDL), target method.

[0071] (2) Request parameter definition steps:

[0072] There are one or more request parameters. A single request parameter is divided into three parts: parameter information, parameter mapping, and data type.

[0073] The parameter information includes parameter encoding, whether it is required, parameter name, parameter location (request header, request body, request address), and default value; parameter mapping is used to automatically associate and map parameters with fields in events or actions in the linkage process model; data types are used for data type conversion during interface calls to make them meet the interface call requirements, and are divided into integer, floating point, Boolean, character, and timestamp types.

[0074] (3) Steps to form a disposal action configuration model:

[0075] Cooperate Figure 3 As shown, for the same security device, the handling actions are classified into one type of configuration to form a handling action configuration model for this type of security device. The configuration sequence is to determine the device to which the action belongs, determine the action interface request method, and determine the interface request parameters.

[0076] 3. Execution action definition step: The execution action definition module defines the execution action and extracts parameters without default values ​​from the disposal action configuration module as disposal objects.

[0077] The content that needs to be defined when executing an action: action name, action provider, action handling interface, and action handling object (optional).

[0078] The action provider is a third-party security device that supports linkage disposal actions; the disposal action interface is a remote calling method for disposal actions provided by the security device; and the action disposal object is an interface parameter field in the disposal action interface that has no default value.

[0079] 4. Trigger rule definition steps:

[0080] Cooperate Figure 4 As shown, the trigger rule definition module defines the trigger rules of the linkage process, including: extracting events from the security event definition module to combine event logical relationships; extracting actions from the execution action definition module to configure the disposal method; extracting required action request parameters from the disposal action configuration module to verify the legality; and finally forming a predefined linkage process model.

[0081] The triggering rules are divided into two parts: the rule triggering conditions and the execution action association.

[0082] The rule triggering condition is the logical combination relationship between events. The basic logical relationship is AND, OR. Logical combination can be performed between one or more events. For example:

[0083] 1) The rule is triggered when event A and event B occur at the same time or event C occurs;

[0084] 2) The rule is triggered when event A occurs;

[0085] 3) The rule is triggered when event A and event B occur at the same time.

[0086] The execution action association is the disposal action executed when the rule is triggered. There can be multiple disposal actions, and multiple actions will be executed in the defined order. In addition, the action execution methods include immediate execution and periodic execution. Immediate execution is executed once after being triggered, and periodic execution is executed a certain number of times at defined time intervals after being triggered.

[0087] Cooperate Figure 5 As shown, in the trigger rule definition step, extracting the required action request parameters from the disposal action configuration module for legality verification includes:

[0088] When the trigger rule is defined, the match will be automatically checked for legality when the event is associated with the action. The rule is legal only when all parameters required by any disposal action interface are adapted. The checking order is that the parameter has a default value, there is a disposal object with the same parameter name in the execution action, and there is a mapping relationship between the output field and parameter of a single event combination unit.

[0089] 5. Model evaluation steps:

[0090] Cooperate Figure 6 As shown in Figure 1, the linkage process model is evaluated, which is divided into three parts: pre-inspection, in-process monitoring, and post-evaluation. The linkage process model can verify and improve the reliability of security linkage orchestration through model evaluation.

[0091] The pre-check verifies the legality of the model definition when the linkage process model is formed; the in-process monitoring collects the linkage execution status during the linkage process model execution, and outputs the number of event hits, action execution success rate, and action execution processing time; the post-evaluation obtains the reliability score of the linkage process model through the evaluation formula, which is:

[0092] Reliability score = (number of hits of each sub-event * sum of event proportion weights / total number of event hits) * 30 + average success rate of each action execution * 50 + (timeout threshold / average execution processing time of each action) * 20.

[0093] The first part of the formula shows the hit probability of each sub-event in the model, which is used to measure the event hit reliability in the model, where the event proportion weight is the proportion weight of each sub-event in the event logic combination. The second part shows the execution success rate of each action in the model, which is used to measure the action execution reliability. The third part shows the execution efficiency of each action in the model, which is used to measure the action delay reliability, where the timeout threshold is an adjustable parameter.

[0094] The reliability scoring formula can reflect the reliability of the linkage process model and help security operation and maintenance personnel optimize the linkage process model definition.

[0095] From the above, it can be seen that the present invention predefines the linkage process model. Security operation and maintenance personnel only need to define the corresponding events, actions, and linkage trigger rules respectively to realize the automated processing flow of security incident handling response. In addition, the reliability of security incident linkage orchestration is improved through pre-inspection, in-process monitoring, and post-evaluation. The present invention also proposes a set of linkage handling action configuration models, which flexibly defines the action interface, standardizes the interface as a combination of request method and request parameters, and expands the interface call type.

[0096] Figure 7 A security linkage orchestration implementation system 400 provided in an embodiment of the present invention includes:

[0097] The security event definition module 410 is used to define security events and configure filtering query conditions for whether the events are hit;

[0098] The processing action configuration module 420 is used to configure the processing action interface provided by the security device, so as to remotely call the security device to execute the processing action;

[0099] An execution action definition module 430 is used to define an execution action and extract parameters without default values ​​from a disposal action configuration module as disposal objects;

[0100] The trigger rule definition module 440 is used to define the trigger rules of the linkage process, including: extracting events from the security event definition module to combine event logical relationships; extracting actions from the execution action definition module to configure the disposal method; extracting required action request parameters from the disposal action configuration module to verify the legality; and finally forming a predefined linkage process model.

[0101] Model evaluation module 450: used to evaluate the linkage process model, which is divided into three parts: pre-check, in-process monitoring and post-evaluation. Pre-check verifies the legality of the model definition when the linkage process model is formed; in-process monitoring collects linkage execution status during the execution of the linkage process model, and outputs the number of event hits, action execution success rate, and action execution processing time; post-evaluation obtains the reliability score of the linkage process model through the evaluation formula.

[0102] Since there is a one-to-one correspondence between the system and the method, they will not be described one by one here.

[0103] See also Figure 8 The embodiment of the present invention further provides an electronic device 50, the electronic device comprising:

[0104] at least one processor; and,

[0105] a memory communicatively connected to the at least one processor; wherein,

[0106] The memory stores instructions that can be executed by the at least one processor, such as the above-mentioned method for implementing security linkage orchestration.

[0107] An embodiment of the present invention further provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute a security linkage orchestration implementation method as described above.

[0108] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes a security linkage orchestration implementation method as described above.

[0109] Reference below Figure 8 , which shows a schematic diagram of the structure of an electronic device 50 suitable for implementing an embodiment of the present invention. The electronic device in the embodiment of the present invention may include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a vehicle terminal (such as a vehicle navigation terminal), and the like. Figure 8 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0110] like Figure 8 As shown, the electronic device 50 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 50 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0111] Typically, the following devices may be connected to the I / O interface 505: input devices 506 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 508 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 509. The communication device 509 may allow the electronic device 50 to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device 50 with various devices is shown in the figure, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively.

[0112] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present invention are executed.

[0113] It should be noted that the computer-readable medium of the present invention can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0114] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0115] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for implementing security linkage orchestration, characterized in that: include: Security event definition step: The security event definition module defines security events and configures the filtering query conditions for whether the event is matched; The content that needs to be defined for the security event includes event type, event output field, and event hit condition; the event output field is a field that can be associated with a disposal action parameter; Disposal action configuration step: the disposal action configuration module configures the disposal action interface provided by the security device for remotely calling the security device to execute the disposal action; The disposal action configuration module configures the disposal action interface provided by the security device, including: a request method definition step: the request method type is divided into three types: HTTP, SNMP, and WebService, and each disposal action is one of them; a request parameter definition step: the request parameter is one or more; a single request parameter is divided into three parts: parameter information, parameter mapping, and data type, and defined separately; the parameter mapping is used to automatically associate and map the parameters with the fields in the events or actions in the linkage process model; the data type is used for data type conversion during interface call to make it meet the interface call requirements; a disposal action configuration model formation step: for the same security device, the disposal actions are classified into one type of configuration to form a disposal action configuration model for this type of security device, and the configuration order is to determine the device to which the action belongs, determine the action interface request method, and determine the interface request parameters; Execution action definition step: the execution action definition module defines the execution action and extracts parameters without default values ​​from the disposal action configuration module as disposal objects; the contents that need to be defined in the execution action include the action name, action provider, disposal action interface and action disposal object, and the action disposal object is an optional item; Trigger rule definition step: The trigger rule definition module defines the trigger rules of the linkage process, including: extracting events from the security event definition module to combine event logical relationships; extracting actions from the execution action definition module to configure the disposal method; extracting the required action request parameters from the disposal action configuration module for legality verification; and finally forming a predefined linkage process model; the extraction of the required action request parameters from the disposal action configuration module for legality verification includes: when the trigger rule definition is performed, a legality check will be automatically performed on the matching degree when the event and action are associated. The rule is legal only when all parameters required by any disposal action interface are adapted. The inspection order is that the parameters have default values, the disposal objects with the same parameter names exist in the execution action, and the output fields of the single event combination unit and the parameters have a mapping relationship.

2. The method for implementing security linkage orchestration according to claim 1, characterized in that: It also includes the model evaluation step: evaluating the linkage process model, which is divided into three parts: pre-checking, in-process monitoring and post-evaluation; The pre-check verifies the legality of the model definition when the linkage process model is formed; the in-process monitoring collects the linkage execution status during the linkage process model execution, and outputs the number of event hits, action execution success rate, and action execution processing time; The post-evaluation obtains the reliability score of the linkage process model through the evaluation formula.

3. The method for implementing security linkage orchestration according to claim 2, characterized in that: The evaluation formula is: Reliability score = (number of hits of each sub-event * sum of event proportion weights / total number of event hits) * 30 + average success rate of each action execution * 50 + (timeout threshold / average execution processing time of each action) * 20.

4. A security linkage orchestration implementation system, characterized in that: include: A security event definition module is configured to define security events and configure filtering query conditions for whether the events are matched; The content that needs to be defined for the security event includes event type, event output field, and event hit condition; the event output field is a field that can be associated with a disposal action parameter; A processing action configuration module is configured to configure a processing action interface provided by a security device, so as to remotely call the security device to execute a processing action; The configuration of the handling action interface provided by the security device includes: a request method definition step: the request method type is divided into three types: HTTP, SNMP, and WebService, and each handling action is one of them; a request parameter definition step: the request parameter is one or more; a single request parameter is divided into three parts: parameter information, parameter mapping, and data type, and defined separately; the parameter mapping is used to automatically associate and map the parameters with the fields in the events or actions in the linkage process model; the data type is used for data type conversion during interface call to make it meet the interface call requirements; a handling action configuration model forming step: for the same security device, the handling actions are classified into one type of configuration to form a handling action configuration model for this type of security device, and the configuration order is to determine the device to which the action belongs, determine the action interface request method, and determine the interface request parameters; An execution action definition module is configured to define an execution action and extract parameters without default values ​​from a disposal action configuration module as disposal objects; the contents to be defined for the execution action include an action name, an action provider, a disposal action interface, and an action disposal object, and the action disposal object is an optional item; The trigger rule definition module is configured to define the trigger rules for the linkage process, including: extracting events from the security event definition module to combine event logical relationships; extracting actions from the execution action definition module to configure the disposal method; extracting the required action request parameters from the disposal action configuration module for legality verification; and finally forming a predefined linkage process model; the extraction of the required action request parameters from the disposal action configuration module for legality verification includes: when the trigger rule definition is defined, a legality check will be automatically performed on the matching degree when the event and the action are associated. The rule is legal only when all the parameters required by any disposal action interface are adapted. The inspection order is that the parameters have default values, the disposal objects with the same parameter names exist in the execution action, and the output fields of the single event combination unit and the parameters have a mapping relationship.

5. The security linkage orchestration implementation system according to claim 4, characterized in that: The system also includes a model evaluation module: configured to evaluate the linkage process model, which is divided into three parts: pre-check, in-process monitoring and post-evaluation; the pre-check verifies the legality of the model definition when the linkage process model is formed; the in-process monitoring collects the linkage execution status during the linkage process model execution, and outputs the event hit count, action execution success rate, and action execution processing time; The post-evaluation obtains the reliability score of the linkage process model through the evaluation formula.

6. An electronic device, characterized in that: The electronic device includes: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and when the instructions are executed by the at least one processor, the at least one processor executes the security linkage orchestration implementation method according to any one of claims 1 to 3.

7. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by at least one processor, cause the at least one processor to execute the security linkage orchestration implementation method as described in any one of claims 1-3.

Images