A network security incident processing method and device

Abstract

The present invention discloses a network security incident processing method and device, the method comprising: obtaining network security incident information to be processed; the network security incident information to be processed includes M network security warning information; the network security warning information includes event type, event time, and event number; based on the event type and event mapping relationship information, the network security incident information to be processed is classified and processed to obtain first security incident information; the first security incident information includes N network security warning information categories; N is a positive integer not greater than M; based on the sequential relationship of event time, the first security incident information is split and sorted to obtain target security incident information. It can be seen that the present application is conducive to improving the accuracy and efficiency of classification analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security event processing method and device. Background Art

[0002] Network security event analysis mainly processes network security alarms generated by various threat detection devices, honeypot devices, firewall devices, etc., and realizes the mapping from the bottom network security alarm to the upper network security event. Network security event analysis is to analyze the threat type, alarm time, attack source information, attacked information and other dimensions of network security alarms, and aggregate network security alarms to form relatively independent network security events. At present, the methods for analyzing network security events are mainly analyzed by network security alarm clustering / classification, knowledge graph association analysis, etc., and the multi-dimensional characteristics of network security alarms are analyzed by prior knowledge to achieve threat concentration and form network security events. This method requires manual definition of clustering models, classification models or knowledge graphs. When new network security alarm threat types and threat characteristics appear, it is often necessary to reconstruct and train related models. In the era of dynamic and changeable attack and defense games in cyberspace, it is difficult to achieve the expected effect. Therefore, a network security event processing method and device are provided to improve the accuracy and efficiency of classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a network security incident processing method and device that are conducive to improving the accuracy and efficiency of classification analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

[0004] In order to solve the above technical problems, the first aspect of the embodiment of the present invention discloses a network security incident processing method, the method comprising:

[0005] Obtaining pending network security event information; the pending network security event information includes M network security warning information; the network security warning information includes event type, event time, and event number;

[0006] Classify and process the network security event information to be processed based on the event type and event mapping relationship information to obtain first security event information; the first security event information includes N network security warning information categories; N is a positive integer not greater than M;

[0007] Based on the sequential relationship of the event time, the first security event information is split and sorted to obtain target security event information.

[0008] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the classifying and processing the to-be-processed network security event information based on the event type and the event mapping relationship information to obtain the first security event information includes:

[0009] Based on the event type, the to-be-processed network security event information is classified to obtain first standby event information; the first standby event information includes L standby event information; L is a positive integer not less than N; each of the standby event information corresponds to a class number; the standby event information includes a plurality of the network security warning information;

[0010] Based on the event mapping relationship information, first security event information is determined.

[0011] As an optional implementation manner, in the first aspect of the embodiment of the present invention, determining the first security event information based on the event mapping relationship information includes:

[0012] For any of the standby event information, based on the event-technology correspondence between the event type and the technology type in the event mapping relationship information, determine the target technology information corresponding to the standby event information;

[0013] Based on the consistency of the target technical information corresponding to the standby event information, the standby event information and the target technical information corresponding to the standby event information are classified and associated and integrated to obtain the network security warning information class corresponding to the standby event information.

[0014] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the classifying the to-be-processed network security event information based on the event type to obtain the first to-be-used event information includes:

[0015] Based on the event number, sequentially determine the network security warning information in the pending network security event information as the pending network security warning information;

[0016] Determine the class number corresponding to the network security warning information to be classified;

[0017] Selecting the network security warning information that is consistent with the event type corresponding to the network security warning information to be classified from the network security event information to be processed as the target classified network security warning information; the event number corresponding to the target classified network security warning information is inconsistent with the event number corresponding to the network security warning information to be classified;

[0018] Based on the sequential relationship of the event time, the network security warning information corresponding to the network security warning information to be classified and the network security warning information corresponding to the target classified network security warning information are sorted to obtain the standby event information;

[0019] Deleting all the network security warning information corresponding to the standby event information from the network security event information to be processed, to obtain new network security event information to be processed;

[0020] Determine whether the network security event information to be processed contains the network security warning information, and obtain a first existence determination result;

[0021] When the first existence judgment result is yes, triggering the execution of determining, based on the event number, the network security warning information in the pending network security event information as the pending network security warning information in sequence;

[0022] When the first existence judgment result is no, the event mapping relationship information is triggered to execute to determine the first security event information.

[0023] As an optional implementation manner, in the first aspect of the embodiment of the present invention, before classifying and processing the to-be-processed network security event information based on the event type and the event mapping relationship information to obtain the first security event information, the method further includes:

[0024] Acquire initial mapping relationship information; the initial mapping relationship information includes a plurality of event technology correspondences;

[0025] For any of the event-technology correspondences, determine whether the usage status corresponding to the event-technology correspondence is a valid status, and obtain a status determination result;

[0026] When the state judgment result is no, deleting the event-technology correspondence from the initial mapping relationship information;

[0027] When the state judgment result is yes, the judgment process corresponding to the event-technology correspondence relationship is terminated;

[0028] Determine whether the initial mapping relationship information contains all of the event types in the network security event information to be processed, and obtain a first inclusion determination result;

[0029] When the first inclusion judgment result is no, for any of the network security warning information, judging whether the event type corresponding to the network security warning information is included in the initial mapping relationship information, and obtaining a second inclusion judgment result;

[0030] When the second inclusion judgment result is no, in response to the user selecting the technology type corresponding to the network security warning information, obtaining the target technology type;

[0031] Filling the event type corresponding to the network security warning information and the event technology corresponding to the target technology type into the initial mapping relationship information to obtain new initial mapping relationship information;

[0032] When the second determination result is yes, the determination process corresponding to the network security warning information is terminated;

[0033] When the first inclusion judgment result is yes, it is determined that the initial mapping relationship information is the event mapping relationship information.

[0034] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the splitting and sorting of the first security event information based on the sequential relationship of the event time to obtain the target security event information includes:

[0035] Based on the sequential relationship of the event time, the network security warning information class in the first security event information is subjected to time conflict resolution to obtain second security event information; the second security event information includes K time event information classes; K is a positive integer not less than N;

[0036] The second security event information is integrated and sorted to obtain target security event information.

[0037] As an optional implementation manner, in the first aspect of the embodiment of the present invention, based on the sequential relationship of the event time, the network security warning information class in the first security event information is subjected to time conflict resolution to obtain the second security event information, including:

[0038] For any of the standby event information in any of the network security warning information categories, determine the network security warning information to be resolved according to the order of the network security warning information in the standby event information;

[0039] Determine the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved;

[0040] Determine whether the event time corresponding to the network security warning information in other standby event information other than the standby event information intersects with the time interval, and obtain a time determination result;

[0041] When the time judgment result is no, determining that the network security warning information to be resolved is a historical network security warning information to be resolved;

[0042] Determine the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved as a new network security warning information to be resolved, and trigger the execution of determining the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved;

[0043] When the time judgment result is yes, the target technical information corresponding to the standby event information, all the historical network security warning information to be resolved and the network security warning information to be resolved are integrated into one time event information class;

[0044] Deleting all the historical network security warning information to be resolved;

[0045] Deleting the network security warning information corresponding to the time information class from the standby event information;

[0046] Determine whether the standby event information contains the network security warning information, and obtain a second existence determination result;

[0047] When the second existence judgment result is yes, triggering the execution of determining the network security warning information to be resolved according to the order of the network security warning information in the standby event information;

[0048] When the second existence judgment result is no, the time conflict resolution process corresponding to the standby event information is terminated.

[0049] A second aspect of an embodiment of the present invention discloses a network security event processing device, the device comprising:

[0050] An acquisition module, used to acquire information of pending network security events; the pending network security event information includes M network security warning information; the network security warning information includes event type, event time, and event number;

[0051] A first processing module, configured to classify and process the network security event information to be processed based on the event type and the event mapping relationship information to obtain first security event information; the first security event information includes N network security warning information categories; N is a positive integer not greater than M;

[0052] The second processing module is used to split and sort the first security event information based on the sequential relationship of the event time to obtain target security event information.

[0053] A third aspect of the present invention discloses another network security incident processing device, the device comprising:

[0054] A memory storing executable program code;

[0055] a processor coupled to the memory;

[0056] The processor calls the executable program code stored in the memory to execute part or all of the steps in the network security incident processing method disclosed in the first aspect of the embodiment of the present invention.

[0057] The fourth aspect of the present invention discloses a computer-readable storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute some or all of the steps in the network security incident handling method disclosed in the first aspect of an embodiment of the present invention.

[0058] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0059] In the embodiment of the present invention, the network security event information to be processed is obtained; the network security event information to be processed includes M network security warning information; the network security warning information includes event type, event time, and event number; the network security event information to be processed is classified and processed based on the event type and event mapping relationship information to obtain the first security event information; the first security event information includes N network security warning information categories; N is a positive integer not greater than M; based on the sequential relationship of the event time, the first security event information is split and sorted to obtain the target security event information. It can be seen that the present application is conducive to improving the accuracy and efficiency of the classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0061] Figure 1 It is a flowchart of a network security incident processing method disclosed in an embodiment of the present invention;

[0062] Figure 2 It is a structural schematic diagram of a network security incident processing device disclosed in an embodiment of the present invention;

[0063] Figure 3It is a structural schematic diagram of another network security incident processing device disclosed in an embodiment of the present invention;

[0064] Figure 4 It is a structural diagram of a class of standby event information and network security warning information disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or equipment that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or equipment.

[0067] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0068] The present invention discloses a network security incident processing method and device, which are beneficial to improving the accuracy and efficiency of classification analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities. Detailed descriptions are given below.

[0069] Embodiment 1

[0070] See also Figure 1 , Figure 1 It is a flowchart of a network security incident processing method disclosed in an embodiment of the present invention. Figure 1 The described network security incident processing method is applied to a network security system, such as a local server or cloud server for network security incident processing management, and the embodiments of the present invention are not limited thereto. Figure 1As shown, the network security incident processing method may include the following operations:

[0071] 101. Obtain information on pending network security incidents.

[0072] In an embodiment of the present invention, the network security event information to be processed includes M network security warning information.

[0073] In the embodiment of the present invention, the network security warning information includes event type, event time, and event number.

[0074] 102. Classify and process the network security event information to be processed based on the event type and the event mapping relationship information to obtain first security event information.

[0075] In the embodiment of the present invention, the first security event information includes N network security warning information categories.

[0076] In the embodiment of the present invention, N is a positive integer not greater than M.

[0077] 103. Based on the sequential relationship of event time, the first security event information is split and sorted to obtain target security event information.

[0078] It should be noted that the network security incident processing method of the present application can avoid the problem of poor adaptability of the analysis model, ensure the practicality and usability of the technology, and realize the construction from network security alerts to network security incidents.

[0079] It can be seen that implementing the network security incident processing method described in the embodiment of the present invention is conducive to improving the accuracy and efficiency of classification and analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

[0080] In an optional embodiment, the above-mentioned classification processing of the network security event information to be processed based on the event type and the event mapping relationship information to obtain the first security event information includes:

[0081] Based on the event type, the network security event information to be processed is classified to obtain first standby event information; the first standby event information includes L standby event information; L is a positive integer not less than N; each standby event information corresponds to a class number; the standby event information includes a number of network security warning information;

[0082] Based on the event mapping relationship information, first security event information is determined.

[0083] like Figure 4 As shown, the class numbers correspond to warning set A, warning set B, warning set C, warning set D, warning set E, warning set F, and warning set G, which is not limited in this embodiment of the present invention.

[0084] Furthermore, the same standby event information includes several network security warning messages. For example, the standby event information with class number of warning set A includes network security warning messages corresponding to event numbers of alarm 1, alarm 2, alarm 3, alarm 4 and alarm 5.

[0085] It can be seen that implementing the network security incident processing method described in the embodiment of the present invention is conducive to improving the accuracy and efficiency of classification and analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

[0086] In another optional embodiment, determining the first security event information based on the event mapping relationship information includes:

[0087] For any unused event information, based on the event-technology correspondence between the event type and the technology type in the event mapping relationship information, determine the target technology information corresponding to the unused event information;

[0088] Based on the consistency of the target technical information corresponding to the standby event information, the event information to be used and the target technical information corresponding to the standby event information are classified and associated and integrated to obtain the network security warning information class corresponding to the standby event information.

[0089] like Figure 4 As shown, for the two standby event information with class numbers of warning set A and warning set C, their corresponding target technical information is Reconnaissance. Then, the two standby event information with class numbers of warning set A and warning set C can be associated with Reconnaissance and integrated into a network security warning information class.

[0090] It can be seen that implementing the network security incident processing method described in the embodiment of the present invention is conducive to improving the accuracy and efficiency of classification and analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

[0091] In yet another optional embodiment, based on the event type, the network security event information to be processed is classified to obtain the first event information to be used, including:

[0092] Based on the event number, sequentially determine the network security warning information in the network security event information to be processed as the network security warning information to be classified;

[0093] Determine the class number corresponding to the network security warning information to be classified;

[0094] Selecting network security warning information of the same event type as the network security warning information to be classified from the network security event information to be processed as target classified network security warning information; the event number corresponding to the target classified network security warning information is inconsistent with the event number corresponding to the network security warning information to be classified;

[0095] Based on the sequential relationship of event time, the network security warning information corresponding to the to-be-classified network security warning information and the network security warning information corresponding to the target classified network security warning information are sorted and processed to obtain a standby event information;

[0096] Deleting all network security warning information corresponding to the standby event information from the network security event information to be processed, and obtaining new network security event information to be processed;

[0097] Determine whether there is network security warning information in the network security event information to be processed, and obtain a first existence determination result;

[0098] When the first existence judgment result is yes, triggering execution based on the event number, sequentially determining the network security warning information in the network security event information to be processed as the network security warning information to be classified;

[0099] When the first existence judgment result is no, triggering execution based on the event mapping relationship information to determine the first security event information.

[0100] It should be noted that the above-mentioned determination of the network security warning information in the network security event information to be processed as the network security warning information to be classified in sequence based on the event number is performed in order from small to large according to the event number corresponding to each network security warning information in the network security event information to be processed.

[0101] It should be noted that the above-mentioned sorting processing of the network security warning information corresponding to the to-be-classified network security warning information and the network security warning information corresponding to the target classified network security warning information based on the sequential relationship of event time is to arrange the network security warning information one by one from the front to the back according to the event time of the network security warning information corresponding to the to-be-classified network security warning information, such as Figure 4 The middle category number is 5 network security warning information corresponding to the warning set A, which are arranged in sequence according to the order of event time (alarm timestamp).

[0102] In this optional embodiment, as an optional implementation manner, the above-mentioned determining the class number corresponding to the network security warning information to be classified includes:

[0103] Determine whether there is a class number corresponding to the network security warning information to be classified, and obtain a number determination result;

[0104] When the number determination result is no, determining the initial number as the class number corresponding to the network security warning information to be classified;

[0105] When the numbering judgment result is yes, the maximum value among all class numbers is determined to be the target class number;

[0106] The target class number is incremented by 1 numbering unit as the class number corresponding to the network security warning information to be classified.

[0107] For example, when there is currently no class number corresponding to the network security warning information to be classified, the initial numbered warning set A is determined as the class number corresponding to the network security warning information to be classified; when there are currently two class numbers corresponding to the network security warning information to be classified, which are numbered warning set A and numbered warning set B, then numbered warning set B is determined as the target class number, and the target class number is increased by 1 unit to obtain numbered warning set C, and numbered warning set C is used as the class number corresponding to the network security warning information to be classified.

[0108] Furthermore, the above numbering units may be natural numbers, such as 1, 2, etc., or characters, such as A, B, etc., which are not limited in the embodiments of the present invention.

[0109] It can be seen that implementing the network security incident processing method described in the embodiment of the present invention is conducive to improving the accuracy and efficiency of classification and analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

[0110] In yet another optional embodiment, before classifying the network security event information to be processed based on the event type and the event mapping relationship information to obtain the first security event information, the method further includes:

[0111] Obtaining initial mapping relationship information; the initial mapping relationship information includes a number of event technology correspondences;

[0112] For any event-technology correspondence, determine whether the usage status corresponding to the event-technology correspondence is a valid status, and obtain a status determination result;

[0113] When the status judgment result is no, the event technology correspondence relationship is deleted from the initial mapping relationship information;

[0114] When the status judgment result is yes, the judgment process corresponding to the event technology correspondence relationship ends;

[0115] Determine whether the initial mapping relationship information contains all event types in the network security event information to be processed, and obtain a first inclusion determination result;

[0116] When the first inclusion judgment result is no, for any network security warning information, it is judged whether the event type corresponding to the network security warning information is included in the initial mapping relationship information, and a second inclusion judgment result is obtained;

[0117] When the second inclusion judgment result is no, in response to the user selecting the technology type corresponding to the network security warning information, obtaining the target technology type;

[0118] Filling the event type corresponding to the network security warning information and the event technology corresponding to the target technology type into the initial mapping relationship information to obtain new initial mapping relationship information;

[0119] When the second inclusion judgment result is yes, the judgment process corresponding to the network security warning information is terminated;

[0120] When the first inclusion judgment result is yes, it is determined that the initial mapping relationship information is event mapping relationship information.

[0121] It should be noted that the above initial mapping relationship information can be to collect event types (such as alarm types) generated by threat detection devices, honeypot devices, firewall devices, etc., and map all alarm types to 14 technical types based on prior knowledge to form a mapping relationship table. Furthermore, the above technical types include Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. For example, the mapping relationship table can be shown in the following table:

[0122] Event Type Technology Type Alarm type a Reconnaissance Alarm type b Reconnaissance Alarm type c Initial Access Alarm Typed Initial Access Alarm Type e Initial Access Alarm Typef Execution Alarm Type g Persistence

[0123] It should be noted that the above event-technology correspondence may be the alarm type a-Reconnaissance, alarm type b-Reconnaissance, alarm type c-Initial Access, etc. in the above table, which is not limited in the embodiment of the present invention.

[0124] It should be noted that the above-mentioned usage status represents whether the event type is still being used. Furthermore, the usage status includes a valid state and an abandoned state.

[0125] It should be noted that the filling of the initial mapping relationship information with the event type corresponding to the network security warning information and the event technology corresponding to the target technology type may be to add a row of the relationship between the event type and the technology type in the mapping relationship table.

[0126] It can be seen that implementing the network security incident processing method described in the embodiment of the present invention is conducive to improving the accuracy and efficiency of classification and analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

[0127] In an optional embodiment, the first security event information is split and sorted based on the sequential relationship of the event time to obtain the target security event information, including:

[0128] Based on the sequential relationship of event time, the network security warning information class in the first security event information is subjected to time conflict resolution to obtain second security event information; the second security event information includes K time event information classes; K is a positive integer not less than N;

[0129] The second security event information is integrated and sorted to obtain target security event information.

[0130] In this optional embodiment, as an optional implementation mode, the above-mentioned integration and sorting processing of the second security event information to obtain the target security event information includes:

[0131] Sort all time event information classes based on the start and end time of the time event information class to obtain a time event information class sequence;

[0132] For any two adjacent time event information classes in the time event information class sequence, determine whether the target technology types corresponding to the two adjacent time event information classes are consistent, and obtain a consistent determination result;

[0133] When the consistency judgment result is yes, the two adjacent time event information classes are merged into the same target technology type to obtain a new time event information class, and the new time event information class replaces and updates the two adjacent time event information classes;

[0134] When the consistency judgment result is no, the judgment process for the two adjacent time event information classes is terminated;

[0135] The time event information classes are numbered according to the order of each time event information class in the time event information class sequence to obtain target security event information.

[0136] It should be noted that the start and end time of the above-mentioned time event information class represents the start time of the event time corresponding to the first corresponding network security warning information in the time event information class to the end time of the event time corresponding to the last network security warning information.

[0137] It should be noted that numbering the time event information classes according to the order of each time event information class in the time event information class sequence is to update the sequence number to the class number corresponding to the time event information class.

[0138] It can be seen that implementing the network security incident processing method described in the embodiment of the present invention is conducive to improving the accuracy and efficiency of classification and analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

[0139] In another optional embodiment, based on the sequential relationship of event time, time conflicts are resolved for the network security warning information class in the first security event information to obtain second security event information, including:

[0140] For any pending event information in any network security warning information class, determine the network security warning information to be resolved according to the order of the network security warning information in the pending event information;

[0141] Determine the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved;

[0142] Determine whether the event time corresponding to the network security warning information in other standby event information other than the standby event information intersects with the time interval, and obtain a time determination result;

[0143] When the time judgment result is no, determining that the network security warning information to be resolved is a historical network security warning information to be resolved;

[0144] Determine the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved as a new network security warning information to be resolved, and trigger execution to determine the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved;

[0145] When the time judgment result is yes, the target technical information corresponding to the standby event information, all historical network security warning information to be resolved and network security warning information to be resolved are integrated into a time event information class;

[0146] Delete all historical network security warning messages that need to be resolved;

[0147] Deleting the network security warning information corresponding to the time information class from the standby event information;

[0148] Determine whether the standby event information contains network security warning information, and obtain a second existence determination result;

[0149] When the second existence judgment result is yes, triggering execution to determine the network security warning information to be resolved according to the order of the network security warning information in the standby event information;

[0150] When the second existence judgment result is no, the time conflict resolution process corresponding to the standby event information is terminated.

[0151] It should be noted that the network security warning information in the standby event information is arranged in chronological order. For example, the standby event information corresponding to the class number warning set A includes 5 network security warning messages (alarm 1 to alarm 5) arranged in sequence according to the event time (alarm timestamp).

[0152] It should be noted that, according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved, the time interval is determined by determining the end time of the event time corresponding to the network security warning information to be resolved and the start time of the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved as a time interval. For example, the event time corresponding to the network security warning information to be resolved is from 10:10:10 on May 1, 2023 to 10:10:12 on May 1, 2023; the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved is from 10:11:21 on May 1, 2023 to 10:11:24 on May 1, 2023, then the time interval is [10:10:12 on May 1, 2023, 10:11:21 on May 1, 2023].

[0153] It should be noted that the above judgment of whether the event time corresponding to the network security warning information in other standby event information other than the standby event information has an intersection with the time interval indicates that the event time corresponding to the network security warning information in other standby event information is within the time interval. For example, when the event time corresponding to the network security warning information in a standby event information is from 10:10:21 on May 1, 2023 to 10:11:20 on May 1, 2023, this time is within the time interval [10:10:12 on May 1, 2023, 10:11:21 on May 1, 2023], it indicates that the two have an intersection.

[0154] It should be noted that the target technical information corresponding to the standby event information, all historical network security warning information to be resolved, and network security warning information to be resolved are integrated into a time event information class by performing three-level association according to the target technical information (first level), the new class number (such as warning set A.1, warning set A.2) (second level), and the network security warning information arranged in chronological order (third level) to form one time event information class.

[0155] It can be seen that implementing the network security incident processing method described in the embodiment of the present invention is conducive to improving the accuracy and efficiency of classification and analysis of network security incidents, thereby improving the adaptability of network security incident analysis capabilities.

[0156] Embodiment 2

[0157] See also Figure 2 , Figure 2 Schematic diagram of a network security incident processing device disclosed in an embodiment of the present invention. Figure 2 The described device can be applied to a network security system, such as a local server or a cloud server for network security incident processing management, etc., which is not limited in the embodiments of the present invention. Figure 2 As shown, the device may include:

[0158] An acquisition module is used to acquire information about pending network security events; the pending network security event information includes M network security warning information; the network security warning information includes event type, event time, and event number;

[0159] A first processing module is used to classify and process the network security event information to be processed based on the event type and the event mapping relationship information to obtain first security event information; the first security event information includes N network security warning information categories; N is a positive integer not greater than M;

[0160] The second processing module is used to split and sort the first security event information based on the sequential relationship of event time to obtain target security event information.

[0161] It can be seen that implementation Figure 2 The described network security event processing device is conducive to improving the accuracy and efficiency of classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities.

[0162] In another optional embodiment, Figure 2 As shown, the first processing module classifies and processes the network security event information to be processed based on the event type and the event mapping relationship information to obtain the first security event information, including:

[0163] Based on the event type, the network security event information to be processed is classified to obtain first standby event information; the first standby event information includes L standby event information; L is a positive integer not less than N; each standby event information corresponds to a class number; the standby event information includes a number of network security warning information;

[0164] Based on the event mapping relationship information, first security event information is determined.

[0165] It can be seen that implementation Figure 2 The described network security event processing device is conducive to improving the accuracy and efficiency of classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities.

[0166] In yet another optional embodiment, Figure 2 As shown, the first processing module determines the first security event information based on the event mapping relationship information, including:

[0167] For any unused event information, based on the event-technology correspondence between the event type and the technology type in the event mapping relationship information, determine the target technology information corresponding to the unused event information;

[0168] Based on the consistency of the target technical information corresponding to the standby event information, the event information to be used and the target technical information corresponding to the standby event information are classified and associated and integrated to obtain the network security warning information class corresponding to the standby event information.

[0169] It can be seen that implementation Figure 2 The described network security event processing device is conducive to improving the accuracy and efficiency of classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities.

[0170] In yet another optional embodiment, Figure 2 As shown, the first processing module classifies the network security event information to be processed based on the event type, and obtains the first standby event information, including:

[0171] Based on the event number, sequentially determine the network security warning information in the network security event information to be processed as the network security warning information to be classified;

[0172] Determine the class number corresponding to the network security warning information to be classified;

[0173] Selecting network security warning information of the same event type as the network security warning information to be classified from the network security event information to be processed as target classified network security warning information; the event number corresponding to the target classified network security warning information is inconsistent with the event number corresponding to the network security warning information to be classified;

[0174] Based on the sequential relationship of event time, the network security warning information corresponding to the to-be-classified network security warning information and the network security warning information corresponding to the target classified network security warning information are sorted and processed to obtain a standby event information;

[0175] Deleting all network security warning information corresponding to the standby event information from the network security event information to be processed, and obtaining new network security event information to be processed;

[0176] Determine whether there is network security warning information in the network security event information to be processed, and obtain a first existence determination result;

[0177] When the first existence judgment result is yes, triggering execution based on the event number, sequentially determining the network security warning information in the network security event information to be processed as the network security warning information to be classified;

[0178] When the first existence judgment result is no, triggering execution based on the event mapping relationship information to determine the first security event information.

[0179] It can be seen that implementation Figure 2 The described network security event processing device is conducive to improving the accuracy and efficiency of classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities.

[0180] In yet another optional embodiment, Figure 2 As shown, before the first processing module classifies the network security event information to be processed based on the event type and the event mapping relationship information and obtains the first security event information, the first processing module is also used to:

[0181] Obtaining initial mapping relationship information; the initial mapping relationship information includes a number of event technology correspondences;

[0182] For any event-technology correspondence, determine whether the usage status corresponding to the event-technology correspondence is a valid status, and obtain a status determination result;

[0183] When the status judgment result is no, the event technology correspondence relationship is deleted from the initial mapping relationship information;

[0184] When the status judgment result is yes, the judgment process corresponding to the event technology correspondence relationship ends;

[0185] Determine whether the initial mapping relationship information contains all event types in the network security event information to be processed, and obtain a first inclusion determination result;

[0186] When the first inclusion judgment result is no, for any network security warning information, it is judged whether the event type corresponding to the network security warning information is included in the initial mapping relationship information, and a second inclusion judgment result is obtained;

[0187] When the second inclusion judgment result is no, in response to the user selecting the technology type corresponding to the network security warning information, obtaining the target technology type;

[0188] Filling the event type corresponding to the network security warning information and the event technology corresponding to the target technology type into the initial mapping relationship information to obtain new initial mapping relationship information;

[0189] When the second inclusion judgment result is yes, the judgment process corresponding to the network security warning information is terminated;

[0190] When the first inclusion judgment result is yes, it is determined that the initial mapping relationship information is event mapping relationship information.

[0191] It can be seen that implementation Figure 2 The described network security event processing device is conducive to improving the accuracy and efficiency of classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities.

[0192] In yet another optional embodiment, Figure 2 As shown, the second processing module splits and sorts the first security event information based on the sequential relationship of the event time to obtain target security event information, including:

[0193] Based on the sequential relationship of event time, the network security warning information class in the first security event information is subjected to time conflict resolution to obtain second security event information; the second security event information includes K time event information classes; K is a positive integer not less than N;

[0194] The second security event information is integrated and sorted to obtain target security event information.

[0195] It can be seen that implementation Figure 2 The described network security event processing device is conducive to improving the accuracy and efficiency of classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities.

[0196] In yet another optional embodiment, Figure 2 As shown, the second processing module performs time conflict resolution on the network security warning information class in the first security event information based on the sequential relationship of the event time to obtain the second security event information, including:

[0197] For any pending event information in any network security warning information class, determine the network security warning information to be resolved according to the order of the network security warning information in the pending event information;

[0198] Determine the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved;

[0199] Determine whether the event time corresponding to the network security warning information in other standby event information other than the standby event information intersects with the time interval, and obtain a time determination result;

[0200] When the time judgment result is no, determining that the network security warning information to be resolved is a historical network security warning information to be resolved;

[0201] Determine the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved as a new network security warning information to be resolved, and trigger execution to determine the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved;

[0202] When the time judgment result is yes, the target technical information corresponding to the standby event information, all historical network security warning information to be resolved and network security warning information to be resolved are integrated into a time event information class;

[0203] Delete all historical network security warning messages that need to be resolved;

[0204] Deleting the network security warning information corresponding to the time information class from the standby event information;

[0205] Determine whether the standby event information contains network security warning information, and obtain a second existence determination result;

[0206] When the second existence judgment result is yes, triggering execution to determine the network security warning information to be resolved according to the order of the network security warning information in the standby event information;

[0207] When the second existence judgment result is no, the time conflict resolution process corresponding to the standby event information is terminated.

[0208] It can be seen that implementation Figure 2 The described network security event processing device is conducive to improving the accuracy and efficiency of classification analysis of network security events, thereby improving the adaptability of network security event analysis capabilities.

[0209] Embodiment 3

[0210] See also Figure 3 , Figure 3 : is a schematic diagram of the structure of another network security incident processing device disclosed in an embodiment of the present invention. Figure 3 The described device can be applied to a network security system, such as a local server or a cloud server for network security incident processing management, etc., which is not limited in the embodiments of the present invention. Figure 3 As shown, the device may include:

[0211] A memory 301 storing executable program codes;

[0212] a processor 302 coupled to the memory 301;

[0213] The processor 302 calls the executable program code stored in the memory 301 to execute the steps in the network security incident processing method described in the first embodiment.

[0214] Embodiment 4

[0215] An embodiment of the present invention discloses a computer-readable storage medium storing a computer program for electronic data exchange, wherein the computer program enables a computer to execute the steps of the network security incident processing method described in the first embodiment.

[0216] Embodiment 5

[0217] An embodiment of the present invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute the steps in the network security incident processing method described in the first embodiment.

[0218] The device embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0219] Through the specific description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution can be essentially or partly contributed to the prior art in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0220] Finally, it should be noted that the network security incident processing method and device disclosed in the embodiments of the present invention disclose only the preferred embodiments of the present invention, which are only used to illustrate the technical solution of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security incident processing method, characterized in that: The method comprises: Obtaining pending network security event information; the pending network security event information includes M network security warning information; the network security warning information includes event type, event time, and event number; Classify and process the network security event information to be processed based on the event type and event mapping relationship information to obtain first security event information; the first security event information includes N network security warning information categories; N is a positive integer not greater than M; The classifying and processing the to-be-processed network security event information based on the event type and the event mapping relationship information to obtain the first security event information includes: Based on the event type, the to-be-processed network security event information is classified to obtain first standby event information; the first standby event information includes L standby event information; L is a positive integer not less than N; each of the standby event information corresponds to a class number; the standby event information includes a plurality of the network security warning information; Determine first security event information based on the event mapping relationship information; Wherein, determining the first security event information based on the event mapping relationship information includes: For any of the standby event information, based on the event-technology correspondence between the event type and the technology type in the event mapping relationship information, determine the target technology information corresponding to the standby event information; Based on the consistency of the target technical information corresponding to the standby event information, the standby event information and the target technical information corresponding to the standby event information are classified and associated and integrated to obtain a network security warning information class corresponding to the standby event information; The step of classifying the network security event information to be processed based on the event type to obtain the first event information to be used includes: Based on the event number, sequentially determine the network security warning information in the pending network security event information as the pending network security warning information; Determine the class number corresponding to the network security warning information to be classified; Selecting the network security warning information that is consistent with the event type corresponding to the network security warning information to be classified from the network security event information to be processed as the target classified network security warning information; the event number corresponding to the target classified network security warning information is inconsistent with the event number corresponding to the network security warning information to be classified; Based on the sequential relationship of the event time, the network security warning information corresponding to the network security warning information to be classified and the network security warning information corresponding to the target classified network security warning information are sorted to obtain the standby event information; Deleting all the network security warning information corresponding to the standby event information from the network security event information to be processed, to obtain new network security event information to be processed; Determine whether the network security event information to be processed contains the network security warning information, and obtain a first existence determination result; When the first existence judgment result is yes, triggering the execution of determining, based on the event number, the network security warning information in the pending network security event information as the pending network security warning information in sequence; When the first existence judgment result is no, triggering execution of the event-based mapping relationship information to determine the first security event information; Before classifying and processing the to-be-processed network security event information based on the event type and the event mapping relationship information to obtain the first security event information, the method further includes: Acquire initial mapping relationship information; the initial mapping relationship information includes a plurality of event technology correspondences; For any of the event-technology correspondences, determine whether the usage status corresponding to the event-technology correspondence is a valid status, and obtain a status determination result; When the state judgment result is no, deleting the event-technology correspondence from the initial mapping relationship information; When the state judgment result is yes, the judgment process corresponding to the event-technology correspondence relationship is terminated; Determine whether the initial mapping relationship information contains all the event types in the network security event information to be processed, and obtain a first inclusion determination result; When the first inclusion judgment result is no, for any of the network security warning information, determining whether the event type corresponding to the network security warning information is included in the initial mapping relationship information, to obtain a second inclusion judgment result; When the second inclusion judgment result is no, in response to the user selecting the technology type corresponding to the network security warning information, obtaining the target technology type; Filling the event type corresponding to the network security warning information and the event technology corresponding to the target technology type into the initial mapping relationship information to obtain new initial mapping relationship information; When the second determination result is yes, the determination process corresponding to the network security warning information is terminated; When the first inclusion judgment result is yes, determining that the initial mapping relationship information is the event mapping relationship information; Based on the sequential relationship of the event time, the first security event information is split and sorted to obtain target security event information; The splitting and sorting of the first security event information based on the sequential relationship of the event time to obtain target security event information includes: Based on the sequential relationship of the event time, the network security warning information class in the first security event information is subjected to time conflict resolution to obtain second security event information; the second security event information includes K time event information classes; K is a positive integer not less than N; Integrate and sort the second security event information to obtain target security event information; The step of performing time conflict resolution on the network security warning information class in the first security event information based on the sequential relationship of the event time to obtain the second security event information includes: For any of the standby event information in any of the network security warning information categories, determine the network security warning information to be resolved according to the order of the network security warning information in the standby event information; Determine the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved; Determine whether the event time corresponding to the network security warning information in other standby event information other than the standby event information intersects with the time interval, and obtain a time determination result; When the time judgment result is no, determining that the network security warning information to be resolved is a historical network security warning information to be resolved; Determine the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved as a new network security warning information to be resolved, and trigger the execution of determining the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved; When the time judgment result is yes, the target technical information corresponding to the standby event information, all the historical network security warning information to be resolved and the network security warning information to be resolved are integrated into one time event information class; Deleting all the historical network security warning information to be resolved; Deleting the network security warning information corresponding to the time event information class from the standby event information; Determine whether the standby event information contains the network security warning information, and obtain a second existence determination result; When the second existence judgment result is yes, triggering the execution of determining the network security warning information to be resolved according to the order of the network security warning information in the standby event information; When the second existence judgment result is no, the time conflict resolution process corresponding to the standby event information is terminated.

2. A network security incident processing device, characterized in that: The device comprises: An acquisition module is used to acquire information of pending network security events; the pending network security event information includes M network security warning information; the network security warning information includes event type, event time, and event number; A first processing module, configured to classify and process the network security event information to be processed based on the event type and the event mapping relationship information to obtain first security event information; the first security event information includes N network security warning information categories; N is a positive integer not greater than M; The classifying and processing the to-be-processed network security event information based on the event type and the event mapping relationship information to obtain the first security event information includes: Based on the event type, the to-be-processed network security event information is classified to obtain first standby event information; the first standby event information includes L standby event information; L is a positive integer not less than N; each of the standby event information corresponds to a class number; the standby event information includes a plurality of the network security warning information; Determine first security event information based on the event mapping relationship information; Wherein, determining the first security event information based on the event mapping relationship information includes: For any of the standby event information, based on the event-technology correspondence between the event type and the technology type in the event mapping relationship information, determine the target technology information corresponding to the standby event information; Based on the consistency of the target technical information corresponding to the standby event information, the standby event information and the target technical information corresponding to the standby event information are classified and associated and integrated to obtain a network security warning information class corresponding to the standby event information; The step of classifying the network security event information to be processed based on the event type to obtain the first event information to be used includes: Based on the event number, sequentially determine the network security warning information in the pending network security event information as the pending network security warning information; Determine the class number corresponding to the network security warning information to be classified; Selecting the network security warning information that is consistent with the event type corresponding to the network security warning information to be classified from the network security event information to be processed as the target classified network security warning information; the event number corresponding to the target classified network security warning information is inconsistent with the event number corresponding to the network security warning information to be classified; Based on the sequential relationship of the event time, the network security warning information corresponding to the network security warning information to be classified and the network security warning information corresponding to the target classified network security warning information are sorted to obtain the standby event information; Deleting all the network security warning information corresponding to the standby event information from the network security event information to be processed, to obtain new network security event information to be processed; Determine whether the network security event information to be processed contains the network security warning information, and obtain a first existence determination result; When the first existence judgment result is yes, triggering the execution of determining, based on the event number, the network security warning information in the pending network security event information as the pending network security warning information in sequence; When the first existence judgment result is no, triggering execution of the event-based mapping relationship information to determine the first security event information; Before classifying and processing the to-be-processed network security event information based on the event type and the event mapping relationship information to obtain the first security event information, the method further includes: Acquire initial mapping relationship information; the initial mapping relationship information includes a plurality of event technology correspondences; For any of the event-technology correspondences, determine whether the usage status corresponding to the event-technology correspondence is a valid status, and obtain a status determination result; When the state judgment result is no, deleting the event-technology correspondence from the initial mapping relationship information; When the state judgment result is yes, the judgment process corresponding to the event-technology correspondence relationship is terminated; Determine whether the initial mapping relationship information contains all the event types in the network security event information to be processed, and obtain a first inclusion determination result; When the first inclusion judgment result is no, for any of the network security warning information, determining whether the event type corresponding to the network security warning information is included in the initial mapping relationship information, to obtain a second inclusion judgment result; When the second inclusion judgment result is no, in response to the user selecting the technology type corresponding to the network security warning information, obtaining the target technology type; Filling the event type corresponding to the network security warning information and the event technology corresponding to the target technology type into the initial mapping relationship information to obtain new initial mapping relationship information; When the second determination result is yes, the determination process corresponding to the network security warning information is terminated; When the first inclusion judgment result is yes, determining that the initial mapping relationship information is the event mapping relationship information; A second processing module is used to split and sort the first security event information based on the sequential relationship of the event time to obtain target security event information; The splitting and sorting of the first security event information based on the sequential relationship of the event time to obtain target security event information includes: Based on the sequential relationship of the event time, the network security warning information class in the first security event information is subjected to time conflict resolution to obtain second security event information; the second security event information includes K time event information classes; K is a positive integer not less than N; Integrate and sort the second security event information to obtain target security event information; The step of performing time conflict resolution on the network security warning information class in the first security event information based on the sequential relationship of the event time to obtain the second security event information includes: For any of the standby event information in any of the network security warning information categories, determine the network security warning information to be resolved according to the order of the network security warning information in the standby event information; Determine the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved; Determine whether the event time corresponding to the network security warning information in other standby event information other than the standby event information intersects with the time interval, and obtain a time determination result; When the time judgment result is no, determining that the network security warning information to be resolved is a historical network security warning information to be resolved; Determine the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved as a new network security warning information to be resolved, and trigger the execution of determining the time interval according to the event time corresponding to the network security warning information to be resolved and the event time corresponding to the next network security warning information corresponding to the network security warning information to be resolved; When the time judgment result is yes, the target technical information corresponding to the standby event information, all the historical network security warning information to be resolved and the network security warning information to be resolved are integrated into one time event information class; Deleting all the historical network security warning information to be resolved; Deleting the network security warning information corresponding to the time event information class from the standby event information; Determine whether the standby event information contains the network security warning information, and obtain a second existence determination result; When the second existence judgment result is yes, triggering the execution of determining the network security warning information to be resolved according to the order of the network security warning information in the standby event information; When the second existence judgment result is no, the time conflict resolution process corresponding to the standby event information is terminated.

3. A network security incident processing device, characterized in that: The device comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the network security incident processing method as described in claim 1.

4. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are called, they are used to execute the network security incident processing method as claimed in claim 1.

Images