Method and apparatus for adapting network security incident scripts

Abstract

The application provides a network security event script adaptation method and device, the method comprising: obtaining all historical network security event scripts; generating a plurality of initial network security event scripts according to the source network topology and the target network topology corresponding to the historical network security event scripts; evaluating the fitness of each initial network security event script; selecting a set number of initial network security event scripts according to the fitness for iteration to obtain an adapted network security event script; repeating the evaluation step and the iteration step at least once until the maximum number of iterations is reached or the fitness reaches the fitness threshold to generate a target network security event script; and adapting the target network security event script to the target network topology to complete a network security drill. The method solves the problem that the network security event script in the prior art is usually designed for a specific network topology, which cannot be directly applied to other network environments.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security event script adaptation method, a network security event script adaptation device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the rapid development and widespread application of information technology, network security threats have become increasingly complex and diverse. Various means of network attacks are emerging in an endless stream, including distributed denial of service (DDOS) attacks, data leaks, and advanced persistent threat (APT) attacks, which seriously threaten the network security of enterprises and institutions. In order to effectively respond to these threats, enterprises and institutions need to conduct network security drills regularly to improve their response capabilities and defense levels. However, existing network security drill systems often face the following problems when simulating actual attack incidents: Strong specificity: Existing network security event scripts are usually designed for specific network topologies and cannot be directly applied to other network environments. Lack of flexibility: These scripts lack dynamic adjustment and adaptability, making it difficult to simulate attack incidents in different network environments. Poor adaptability: It is impossible to effectively improve the trainees' ability to respond to specific attack incidents in different network environments. Summary of the Invention

[0003] The main purpose of the present application is to provide a network security event script adaptation method, a network security event script adaptation device, a computer-readable storage medium and a computer program product, so as to at least solve the problem in the prior art that network security event scripts are usually designed for specific network topologies and cannot be directly applied to other network environments.

[0004] To achieve the above-mentioned objectives, according to one aspect of the present application, a method for adapting a network security event script is provided, comprising: obtaining all historical network security event scripts, wherein the historical network security event scripts are scripts generated based on network security events that have occurred; generating multiple initial network security event scripts based on the source network topology and target network topology corresponding to the historical network security event scripts, wherein the source network topology is the network topology to which the historical network security event scripts belong, and the target network topology is the network topology to be adapted; an evaluation step of evaluating the fitness of each of the initial network security event scripts; an iteration step of selecting a set number of the initial network security event scripts for iteration based on the fitness to obtain an adapted network security event script, wherein the adapted network security event script is a script optimized based on the initial network security event script; repeating the evaluation step and the iteration step in sequence at least once until a maximum number of iterations is reached or the fitness reaches a fitness threshold, thereby generating a target network security event script, wherein the target network security event script is the network security event script with the highest current fitness among all the adapted network security event scripts; and adapting the target network security event script to the target network topology to complete a network security drill.

[0005] Optionally, all historical network security event scripts are obtained, including: obtaining all attack sub-techniques, each of which consists of an attack sub-technique type, a topology node requirement, an attack action, and an attack result; forming corresponding attack behaviors according to each attack sub-technique and the corresponding network topology node, the network topology node being a node adapted to the topology node requirement of the attack sub-technique, and one attack sub-technique and one network topology node forming one attack behavior; combining all the attack behaviors to form multiple attack techniques, the attack technique being a sequence formed by multiple attack behaviors; combining all the attack techniques to form multiple attack tactics, the attack tactics being a collection of multiple attack techniques; forming multiple groups of attack tactic sequences from all the attack tactics to obtain the historical network security event script, and a group of attack tactic sequences being one historical network security event script.

[0006] Optionally, multiple initial network security event scripts are generated based on the source network topology and target network topology corresponding to the historical network security event scripts, including: forming multiple attack sub-technology libraries based on all the attack sub-technology, and all the attack sub-technology in each attack sub-technology library are of the same type; constructing a mapping relationship based on the network topology nodes in the source network topology and the network topology nodes in the target network topology, and the mapping relationship at least includes the type relationship of the network topology nodes and the connection relationship between the network topology nodes; for the source network topology nodes of each source topology behavior in the source network topology, querying according to the mapping relationship to obtain the corresponding target network topology node, the source topology behavior represents the network topology node corresponding to the attack behavior of the source network topology, and the target network topology node The network topology node corresponding to the source network topology node in the mapping relationship; searching in the target attack sub-technology library according to each target network topology node to obtain the corresponding target attack sub-technology, the target attack sub-technology library is the attack sub-technology library corresponding to the type of the target network topology node, and the target attack sub-technology is the attack sub-technology that the target network topology node can meet the topology node requirements; new attack behaviors are generated according to all the target network topology nodes and the corresponding target attack sub-technology; according to all the new attack behaviors, the attack technology and the attack tactics are updated in sequence to generate the current attack tactics; according to each current attack tactic, the corresponding historical network security events are updated to generate all the initial network security event scripts.

[0007] Optionally, evaluating the fitness of each of the initial network security event scripts includes: when a first condition is met, calculating the fitness of the initial network security event script according to a first formula, wherein the first formula is F(E i )=α×Sim W (E i )+β×Sim T (E i )+γ×Sim C (E i )+δ×Sim R (E i ), Sim W (E i ) represents the retention degree of the attack tactics, Sim T (E i ) represents the retention of attack technology, Sim C (E i ) represents the retention degree of the attack sub-technique, Sim R (E i) represents the retention degree of the attack result, E i represents the i-th initial network security event script, α, β, γ, and δ are all weight parameters and satisfy α+β+γ+δ=1, the first condition is that the satisfaction of the topological node requirements of all the attack sub-techniques in the initial network security event script is greater than the satisfaction threshold; if the first condition is not met, the fitness of the initial network security event script is determined according to the second formula, and the second formula is F(E i )=-∞。

[0008] Optionally, a set number of the initial network security event scripts are selected according to the fitness to iterate and obtain an adapted network security event script, including: randomly selecting a said initial network security event scripts from all the said initial network security event scripts; determining two said initial network security event scripts whose crossover rate between each of the a said initial network security event scripts is greater than a crossover rate threshold as the first parent individual and the second parent individual, respectively, and the crossover rate is the probability of the two said initial network security event scripts crossing; dividing the first parent individual into a first front part and a first back part according to the intersection point, and dividing the second parent individual into a second front part and a second back part according to the intersection point, and the intersection point is less than or equal to a minimum length value, and the minimum length value is the first parent individual. The smaller length value between the length of a parent individual and the length of the second parent individual; sequentially splicing the first front part and the second back part to obtain a first offspring individual, and sequentially splicing the second front part and the first back part to obtain a second offspring individual; adding the first offspring individual and the second offspring individual to a network security event script set, where the network security event script set is a set formed by all offspring individuals; randomly selecting at least one variant individual in the network security event script set to perform a mutation operation to obtain the adapted network security event script, where the variant individual is the offspring individual whose mutation rate is greater than the mutation threshold, the mutation rate is the probability of random change of the offspring individual, and the mutation operation is an operation to change the variant individual.

[0009] Optionally, randomly selecting at least one variant individual in the network security event script set to perform a mutation operation to obtain the adapted network security event script, including: randomly selecting at least one variant individual in the network security event script set according to a mutation rate; randomly selecting an attack tactic from the variant individual to obtain a random attack tactic; randomly selecting an attack behavior from the random attack tactic to obtain a random attack behavior; searching for a mapping network topology node according to the network topology node in the random attack behavior, and replacing the network topology node in the random attack behavior with the mapping network topology node, the mapping network topology node being the node searched according to the mapping relationship; Find the corresponding network topology node in the target network topology; when the mapped network topology node cannot be found according to the network topology node in the random attack behavior, randomly search for the adapted attack sub-technology in the attack sub-technology library according to the adaptation condition, and replace the attack sub-technology in the random attack behavior with the adapted attack sub-technology, the adaptation condition is the condition that meets the topology node requirement of the attack sub-technology in the random attack behavior, and the adapted attack sub-technology is the attack sub-technology that meets the adaptation condition; change the mutated individual according to the mapped network topology node or the adapted attack sub-technology to obtain the adapted network security event script.

[0010] Optionally, before randomly selecting at least one variant individual from the network security event script set according to the mutation rate, the method further includes: adaptively adjusting the mutation rate according to a first adaptive formula to accelerate iterative convergence, wherein the first adaptive formula is θ t+1 =θ min +(θ max +θ min )e -μfavg(t) , where θ t+1 is the mutation rate of the t+1th iteration, θ min To set the minimum mutation rate, θ max To set the maximum mutation rate, f avg (t) is the average value of the fitness of the initial network security event script in the tth iteration, and μ is a control parameter.

[0011] According to another aspect of the present application, a network security event script adaptation device is provided, the device comprising: an acquisition unit, configured to acquire all historical network security event scripts, wherein the historical network security event scripts are scripts generated for network security events that have occurred; a first generation unit, configured to generate multiple initial network security event scripts based on a source network topology and a target network topology corresponding to the historical network security event scripts, wherein the source network topology is the network topology to which the historical network security event scripts belong, and the target network topology is the network topology to be adapted; an evaluation unit, configured to perform an evaluation step to evaluate the fitness of each of the initial network security event scripts; an iteration unit, configured to perform an iteration step to select a set number of the initial network security event scripts for iteration based on the fitness to obtain an adapted network security event script, wherein the adapted network security event script is a script optimized based on the initial network security event script; a second generation unit, configured to sequentially repeat the evaluation step and the iteration step at least once until a maximum number of iterations is reached or the fitness reaches a fitness threshold, thereby generating a target network security event script, wherein the target network security event script is the network security event script with the highest current fitness among all the adapted network security event scripts; and an adaptation unit, configured to adapt the target network security event script to the target network topology to complete the network security drill.

[0012] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the methods described.

[0013] According to another aspect of the present application, a computer program product is provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, any one of the methods described above is implemented.

[0014] Applying the technical solution of the present application, in the adaptation method of the network security event script, by obtaining the historical network security event script that has occurred, an initial network security event script is generated based on the actual historical network security event script and its corresponding source network topology and the target network topology that needs to be adapted, a fitness function is defined, the fitness of each initial network security event script is evaluated, and according to the fitness, an excellent initial network security event script is selected for reproduction to generate an adapted network security event script, and then all the adapted network security event scripts are further evaluated, and the adapted network security event script with the highest fitness is adapted to the target network topology as the target network security event script. The present application enables the network security event script generated based on the network security event that has occurred to adapt to different network topologies, thereby conducting effective security drills and impact assessments in different environments. The present application solves the problem in the prior art that network security event scripts are usually designed for specific network topologies, which makes them incapable of being directly applied to other network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A hardware structure block diagram of a mobile terminal for executing an adaptation method for a network security event script provided in an embodiment of the present application is shown;

[0016] Figure 2 A schematic diagram of a process for adapting a network security event script according to an embodiment of the present application is shown;

[0017] Figure 3 A structural block diagram of an adaptation device for a network security event script provided according to an embodiment of the present application is shown.

[0018] The above drawings include the following reference numerals:

[0019] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. DETAILED DESCRIPTION

[0020] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0021] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] As described in the background, existing network security event scripts in the prior art are typically designed for specific network topologies and cannot be directly applied to other network environments. These scripts lack dynamic adjustment and adaptability, making it difficult to simulate attack events in different network environments. This fails to effectively improve trainees' ability to respond to specific attack events in different network environments. To address the problem in the prior art that network security event scripts are typically designed for specific network topologies and cannot be directly applied to other network environments, the embodiments of the present application provide a network security event script adaptation method, a network security event script adaptation device, a computer-readable storage medium, and a computer program product.

[0024] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.

[0025] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure diagram of a mobile terminal of a method for adapting a network security event script according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown) a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU or a programmable logic device FPGA and other processing devices) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0026] The memory 104 can be used to store computer programs, such as software programs and modules of application software, such as the computer program corresponding to the device information display method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned networks include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the above-mentioned network may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, abbreviated as NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0027] In this embodiment, an adaptation method for a network security event script running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Figure 2 FIG. 1 is a flow chart of a method for adapting a network security event script according to an embodiment of the present application. Figure 2 As shown, the method includes the following steps:

[0029] Step S201: Acquire all historical network security event scripts, where the historical network security event scripts are scripts generated based on network security events that have occurred.

[0030] Specifically, in order to adapt the generated network security event script to different network topologies, a specific network security event script that actually occurred is first obtained as a data basis.

[0031] Step S202: Generate multiple initial network security event scripts based on the source network topology and target network topology corresponding to the historical network security event scripts. The source network topology is the network topology to which the historical network security event scripts belong, and the target network topology is the network topology to be adapted.

[0032] Specifically, an initial population of the adaptive evolutionary algorithm is generated based on a specific network security event script that actually occurs and its corresponding source network topology and target network topology that needs to be adapted. The individuals of the initial population are the above-mentioned initial network security event scripts.

[0033] Step S203, an evaluation step, evaluates the fitness of each of the above initial network security event scripts.

[0034] Specifically, a fitness function is defined to evaluate the fitness of each initial network security event script, so as to select the initial network security event script with high fitness.

[0035] Step S204 is an iterative step, in which a set number of the initial network security event scripts are selected according to the fitness to perform iterations to obtain an adapted network security event script, where the adapted network security event script is a script optimized according to the initial network security event script.

[0036] Specifically, in order to generate new population individuals, namely the above-mentioned adapted network security event scripts, through selection, crossover and mutation operations, the above-mentioned excellent initial network security event scripts are selected according to fitness for reproduction to obtain the above-mentioned adapted network security event scripts.

[0037] Step S205, repeat the above evaluation step and the above iteration step in sequence at least once until the maximum number of iterations is reached or the above fitness reaches the fitness threshold, and generate a target network security event script, which is the network security event script with the highest current fitness among all the above adapted network security event scripts.

[0038] Specifically, the above evaluation step and the above iteration step are repeated until the maximum number of iterations is reached or the fitness reaches a threshold, and one or a group of adapted network security event scripts with the highest fitness are selected as the target network security event scripts.

[0039] Step S206: adapt the target network security event script to the target network topology to complete the network security drill.

[0040] Specifically, the network security event script or scripts generated by the above method can be automatically adapted to the user's network topology environment as a variant of the original script, allowing the user to verify the attack effects of the network security event on themselves or a specific network topology environment and conduct impact assessments or network security emergency drills while retaining certain attack technical characteristics of the original network security event script. The target network security event script is a specific drill script that matches the target network topology, and the network security drill is completed by adapting the target network security event script to the target network topology.

[0041] In this embodiment, in the adaptation method of the network security event script, first, all historical network security event scripts are obtained, and the above-mentioned historical network security event scripts are scripts generated based on the network security events that have occurred; then, multiple initial network security event scripts are generated based on the source network topology and target network topology corresponding to the above-mentioned historical network security event scripts, the above-mentioned source network topology is the network topology to which the above-mentioned historical network security event scripts belong, and the above-mentioned target network topology is the network topology to be adapted; then, an evaluation step is performed to evaluate the fitness of each of the above-mentioned initial network security event scripts; then, an iteration step is performed to select a set number of the above-mentioned initial network security event scripts according to the above-mentioned fitness to perform iterations to obtain an adapted network security event script, and the above-mentioned adapted network security event script is a script optimized according to the above-mentioned initial network security event script; then, the above-mentioned evaluation step and the above-mentioned iteration step are repeated in sequence at least once until the maximum number of iterations is reached or the above-mentioned fitness reaches the fitness threshold, and a target network security event script is generated, and the above-mentioned target network security event script is the network security event script with the highest current fitness among all the above-mentioned adapted network security event scripts; finally, the above-mentioned target network security event script is adapted to the above-mentioned target network topology to complete the network security drill. This application obtains historical network security event scripts that have occurred, generates initial network security event scripts based on the actual historical network security event scripts and their corresponding source network topology and the target network topology that needs to be adapted, defines a fitness function, evaluates the fitness of each initial network security event script, selects excellent initial network security event scripts for reproduction based on the fitness, generates adapted network security event scripts, and then continues to evaluate all adapted network security event scripts, and adapts the adapted network security event script with the highest fitness to the target network topology as the target network security event script. This application enables the network security event scripts generated based on the network security events that have occurred to adapt to different network topologies, thereby conducting effective security drills and impact assessments in different environments. This application solves the problem in the prior art that network security event scripts are usually designed for specific network topologies, which makes them incapable of being directly applied to other network environments.

[0042] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the adaptation method of the network security event script of the present application will be described in detail below with reference to specific embodiments.

[0043] In order to obtain a network security event script generated based on a network security event that has occurred to provide a data basis, in an optional implementation, step S201 includes:

[0044] Step S2011: Acquire all attack sub-techniques, each of which consists of an attack sub-technique type, topology node requirements, attack actions, and attack results;

[0045] Step S2012: generating corresponding attack behaviors based on each of the attack sub-techniques and the corresponding network topology nodes. The network topology nodes are nodes that meet the requirements of the topology nodes of the attack sub-techniques. Each attack sub-technique and each network topology node generate one attack behavior.

[0046] Step S2013: combining all the aforementioned attack behaviors to form multiple attack techniques, where the aforementioned attack techniques are sequences formed by multiple aforementioned attack behaviors;

[0047] Step S2014: Combining all the aforementioned attack techniques to form multiple attack tactics, where the aforementioned attack tactics are a collection of multiple aforementioned attack techniques.

[0048] In step S2015, all the above attack tactics are formed into multiple groups of attack tactic sequences to obtain the above historical network security event scripts. A group of the above attack tactic sequences constitutes one above historical network security event script.

[0049] In the above embodiment, the network security event script E is represented as a set of ordered attack tactic sequences E={W1, W2, ..., W m}, for each attack tactic W m Is a set of attack techniques: W m ={T1, T2, ..., T k}, each attack technology T k It is a set of attack behavior sequences containing specific attack sub-techniques: k ={S1, S2, ..., S n}, each attack behavior S n Expressed as: S n=(C,N), where C represents the attack sub-technique and N represents the network topology node that meets the topology requirements of the attack sub-technique C. Each attack sub-technique C is represented as C=(M,O,A,R), where M represents the attack sub-technique type, O represents the topology node requirements, and A represents the specific attack action, representing the attack result on the network topology node. Based on the above rules, all historical network security event scripts are generated, providing the data foundation for generating subsequent target network security event scripts. Attack behavior, attack tactics, attack techniques, and attack sub-techniques are all concepts in the ATT&CK attack chain. An attack behavior is a structure or class that indicates the specific network topology node to which the attack sub-technique is applied. Here, the attack sub-technique is specifically represented as a class with an attribute M indicating its type and an attribute A describing the specific attack action. Function O returns whether the input topology node meets the topology node requirements, and function R modifies the input topology node's state to the post-attack state.

[0050] In order to improve the quality of the initial network security event script as much as possible while ensuring diversity and global search, in an optional implementation, the above step S202 includes:

[0051] Step S2021: forming a plurality of attack sub-technique libraries based on all the aforementioned attack sub-techniques, wherein all the aforementioned attack sub-techniques in each of the aforementioned attack sub-technique libraries are of the same type;

[0052] Step S2022: constructing a mapping relationship based on the network topology nodes in the source network topology and the network topology nodes in the target network topology, wherein the mapping relationship includes at least a type relationship of the network topology nodes and a connection relationship between the network topology nodes;

[0053] Step S2023: For each source topology behavior in the source network topology, query the source network topology node according to the mapping relationship to obtain a corresponding target network topology node, where the source topology behavior represents the network topology node corresponding to the attack behavior of the source network topology, and the target network topology node is the network topology node corresponding to the source network topology node in the mapping relationship.

[0054] Step S2024: Searching a target attack sub-technique library for each target network topology node to obtain a corresponding target attack sub-technique. The target attack sub-technique library is a library of attack sub-techniques corresponding to the type of the target network topology node. The target attack sub-technique is an attack sub-technique for which the target network topology node can meet the requirements of the topology node.

[0055] Step S2025: Generate new attack behaviors according to all the target network topology nodes and the corresponding target attack sub-techniques;

[0056] Step S2026: updating the aforementioned attack techniques and tactics in sequence according to all the new aforementioned attack behaviors to generate corresponding current attack tactics;

[0057] Step S2027: updating the corresponding historical network security events according to each of the current attack tactics, and generating all the initial network security event scripts.

[0058] In the above embodiment, assuming that the source network topology Gs and the target network topology Gt are known, and the nodes and connection modes of the source network topology and the target network topology are known, an attack sub-technique library based on the attack sub-technique type is first formed according to all attack sub-techniques. Each attack sub-technique library contains the same type of attack sub-techniques that can be applied to nodes in different topologies. A mapping relationship M is constructed for the nodes of the source network topology Gs and the target network topology Gt. The mapping relationship can be based on the type, attribute and connection relationship of the node. Example mapping relationship M: {N s1 →N t1 , N s1 -N t2 ,...}. For each attack behavior S in the source network topology Gs i , find the topological nodes that meet the topological node requirements in the target network topology Gt and replace the nodes in the attack behavior, such as the attack behavior in the historical network security event script of the source network topology Find the node N that meets the conditions in the target network topology Gt t1 , and then in the attack sub-technique library of the same attack sub-technique type A new attack sub-technique was found in Make N t1 It can meet its topological node requirements and generate new attack behaviors The newly generated attack behavior Assemble the attack techniques and tactics in the order of the original historical cybersecurity event script to form new attack techniques T1′ and attack tactics W1′. Add the assembled attack tactic sequence {W1′} as individuals to the initial population E0. Each individual is a complete cybersecurity event script, namely the initial cybersecurity event script, containing the remapped attack tactics, attack techniques, and attack behaviors. Repeat this process until no new individuals can be generated.

[0059] In order to evaluate the pros and cons of each initial network security event in the target network topology to implement optimal iteration, in an optional implementation, step S203 includes:

[0060] Step S2031: When the first condition is met, the fitness of the initial network security event script is calculated according to a first formula, where the first formula is F(E i )=α×Sim W (E i )+β×Sim T (E i )+γ×Sim C (E i )+δ×Sim R (E i ), Sim W (E i ) represents the retention degree of the attack tactics, Sim T (E i ) represents the retention of attack technology, Sim C (E i ) represents the retention degree of the attack sub-technique, Sim R (E i ) represents the retention degree of the attack result, E i represents the i-th initial network security event script, α, β, γ, and δ are all weight parameters and satisfy α+θ+γ+δ=1, and the first condition is that the satisfaction degree of the topological node requirements of all the attack sub-techniques in the initial network security event script is greater than the satisfaction degree threshold;

[0061] Step S2032: If the first condition is not met, the fitness of the initial network security event script is determined according to a second formula, where the second formula is F(E i )=-∞。

[0062] In the above embodiment, the fitness function F(E i ) is used to assess the initial cybersecurity incident E i The fitness of the attack sub-technology is based on the following five aspects: p (C ijk ), retention of attack tactics: Sim W (E i ), Attack technology retention: Sim T (E i ), retention of attack sub-techniques: Sim C (E i ), retention of attack results: Sim R (E i ). The fitness function is defined as:

[0063]

[0064] , calculate the fitness of the initial network security incident script according to the fitness function. Calculate the retention degree Simw(E) of the above attack tactics according to the third formula i ), the third formula above is Where n represents the total number of attack tactics in the initial network security incident script, and wi is a weight parameter used to represent the i-th attack tactic. Importance in the initial network security event script above (defaults to 1 if no specific weight is given). is a similarity function used to evaluate the i-th attack tactic in the initial network security incident script The degree of similarity in the above historical cybersecurity incident scripts. Among them, m1 is the total number of attack tactics in the above historical network security event scripts, for Compared with the j-th attack tactic in the above historical network security incident script The type similarity can be calculated and The weighted sum of the similarities between the types of attack techniques in the above historical network security event scripts and the ratio of the number of the above attack tactics. for The position number in the above historical network security event script is the same as the attack tactic in the above historical network security event. The Euclidean distance between the position numbers. The retention degree Sim of the above attack technology is calculated according to the fourth formula T (E i ), the fourth formula above is Where n2 represents the total number of attack techniques in the initial network security incident script, t i is a weight parameter used to indicate the importance of the i-th attack technique in the initial network security incident script (the default value is 1 if there is no special weight information). is a similarity function used to evaluate the i-th attack technique in the above initial network security incident script The similarity degree in the above historical network security event scripts. The above similarity function Among them, m2 is the total number of attack techniques in the above historical network security incident scripts, is a type similarity function used to measure the above historical network security event scripts and initial cybersecurity incident scripts The similarity of attack technology types can be calculated by and The weighted sum of the similarities between the attack sub-techniques of each attack behavior is obtained. is a distance similarity function, which is used to measure the similarity of the application position of attack technology in the historical network security incident script and the initial network security incident script. The number of the attack tactic in the initial network security incident script and The number of the attack tactic in the above historical network security event script The Euclidean distance between them is calculated, for example Among them, γ is a control parameter that determines the degree of influence of position difference on similarity. According to the fifth formula, the retention degree Sim of the above attack sub-technique is calculated. C (E i ), the fifth formula above is Where n3 is the total number of attack behaviors in the initial network security incident script, c i is the weight, which is used to indicate the importance of the i-th attack behavior in the initial network security event script (the default is 1 if there is no special weight information). is a similarity function used to evaluate the attack sub-technique of the i-th attack behavior in the initial network security incident script The degree of similarity in historical cybersecurity event scripts. Similarity function It can be defined based on type consistency and position consistency. The type consistency is to determine whether the types of attack sub-techniques are consistent, and the position consistency is to measure the matching degree of the application locations of the attack sub-techniques. Where m3 is the total number of attack behaviors in historical network security event scripts, It is a type consistency function that measures the similarity of attack sub-technique types in historical cybersecurity incident scripts and initial cybersecurity incident scripts. The position consistency function measures the similarity of the application locations of attack sub-techniques in historical cybersecurity incident scripts and initial cybersecurity incident scripts. The type consistency function can be defined as a binary function or a similarity measure based on type features: The position consistency function evaluates the similarity of the locations where the attack sub-techniques are applied in the event script: Where, and Attack sub-techniques and Position number in the initial cybersecurity event script and the historical cybersecurity event script, Position difference metric (such as Euclidean distance or other metric), γ is a control parameter that determines the degree of influence of position difference on similarity. The retention calculation method for attack results is as follows: (1) The last attack behavior of all attack techniques in the last attack tactic in the initial network security event script is combined into a new set (2) The last attack behavior of all attack techniques in the last attack tactic in the historical network security event script is combined into a new set Then the retention degree of the attack result Sim R (E i ) is R N The attack results of the attack sub-techniques in R O The number of similarities between the attack results of the attack sub-techniques in m and R N The ratio of the number of elements p in , that is Satisfaction is achieved by bringing the topological nodes in the mapped attack behavior into the topological node requirement function of the corresponding attack sub-technology. If it is satisfied, true is returned, and if it is not satisfied, false is returned. All attack behaviors must satisfy the topological satisfaction, that is, the function returns true. If the topological satisfaction of an attack behavior is not satisfied, the value of the fitness function of the individual (i.e., the script) is negative infinity, that is, it is completely unfit.

[0065] In order to improve the diversity of adapted network security event scripts, in an optional implementation, the above step S204 includes:

[0066] Step S2041, randomly selecting a initial network security event script from all the initial network security event scripts;

[0067] Step S2042: Determine two of the a initial network security event scripts whose crossover rate between each other is greater than a crossover rate threshold as the first parent individual and the second parent individual, respectively. The crossover rate is a probability of the two initial network security event scripts crossing each other.

[0068] Step S2043: dividing the first parent individual into a first front portion and a first back portion according to an intersection point, and dividing the second parent individual into a second front portion and a second back portion according to the intersection point, wherein the intersection point is less than or equal to a minimum length value, and the minimum length value is the smaller length value between the length of the first parent individual and the length of the second parent individual;

[0069] Step S2044: sequentially splicing the first front portion and the second back portion to obtain a first offspring individual, and sequentially splicing the second front portion and the first back portion to obtain a second offspring individual;

[0070] Step S2045: Add the first child individual and the second child individual to a network security event script set, where the network security event script set is a set formed by all the child individuals;

[0071] Step S2046: randomly select at least one mutant individual from the above-mentioned network security event script set to perform a mutation operation to obtain the above-mentioned adapted network security event script. The above-mentioned mutant individual is the above-mentioned offspring individual whose mutation rate is greater than the mutation threshold. The above-mentioned mutation rate is the probability of random change of the above-mentioned offspring individual. The above-mentioned mutation operation is the operation of changing the above-mentioned mutant individual.

[0072] In the above embodiment, a individuals are randomly selected from the population, and the individual with the highest fitness is selected from these a individuals according to the selection formula. The above selection formula is: Among them, tour represents a group of randomly selected individuals, E selected It is the individual with the highest fitness. E can also be used when selecting the parent generation. selected As one of the parents. Order-preserving Crossover (OPC) is used, and the specific steps are as follows: select two parent individuals E1 and E2 according to the crossover rate ε. In other words, select individuals whose crossover rate between the two parent individuals is greater than the crossover rate threshold as the first parent individual E1 and the second parent individual E2; randomly select a crossover point k and divide the parent individuals into the first half and the second half. The first half of the attack tactic sequence of the first child individual E3 comes from the first parent individual E1, and the second half is completed according to the order of the second parent individual E2. The first half of the attack tactic sequence of the second child individual E4 comes from the second parent individual E2, and the second half is completed according to the order of the first parent individual E1. The above formula for the first child individual is E3 = {W 11 ,...,W 1k , W 2(k+1) ,.....,W 2m}, the formula for the second generation individual is E4={W 21 ,...,W 2k , W 1(k+1) ,.....,W 1m}, where W ij represents the jth attack tactic of the i-th parent individual, k is the intersection point, and m is the total number of attack tactics. Example: Assume that the attack tactic sequences of E1 and E2 are: E1 = {W 11 , W 12 , W 13}, E2={W 21 , W 22 , W 23}, select the crossover point k = 1, generate offspring individuals: E3 = {W 11 , W 22 , W 23}, E4={W 21 , W 12 , W 13The above-mentioned offspring individuals are the above-mentioned adapted network security event scripts. A new population is formed based on all the offspring individuals, namely the above-mentioned network security event script set, and the above-mentioned mutation operation is performed. The above-mentioned mutation operation introduces new genotypes by making small random changes to certain parts of the individuals, thereby improving the diversity of the network security event script set.

[0073] In order to maintain the diversity of the network security event script set and avoid falling into a local optimum, in an optional implementation manner, the above step S2046 includes:

[0074] Step S20461: randomly selecting at least one mutant individual from the above-mentioned network security event script set according to the mutation rate;

[0075] Step S20462, randomly selecting one of the above attack tactics from the above mutated individuals to obtain a random attack tactic;

[0076] Step S20463, randomly selecting one of the above-mentioned attack behaviors from the above-mentioned random attack tactics to obtain a random attack behavior;

[0077] Step S20464: searching for a mapping network topology node based on the network topology node in the random attack behavior, and replacing the network topology node in the random attack behavior with the mapping network topology node. The mapping network topology node is a corresponding network topology node in the target network topology found according to the mapping relationship.

[0078] Step S20465: If the mapped network topology node cannot be found according to the network topology node in the random attack behavior, a random search for an adapted attack sub-technique is performed in the attack sub-technique library according to an adaptation condition, and the attack sub-technique in the random attack behavior is replaced with the adapted attack sub-technique. The adaptation condition is a condition that satisfies the topology node requirement of the attack sub-technique in the random attack behavior, and the adapted attack sub-technique is an attack sub-technique that meets the adaptation condition.

[0079] Step S20466: Modify the mutated individual according to the above-mentioned mapping network topology node or the above-mentioned adaptive attack sub-technology to obtain the above-mentioned adapted network security event script.

[0080] In the above embodiment, an order-preserving mutation operation (OPM) is adopted, and the specific steps are as follows: selecting a mutation individual according to the mutation rate θ, in other words, randomly selecting an individual whose mutation rate θ in the network security event script is greater than the mutation rate threshold as the above mutation individual; randomly selecting an attack tactic W from the above mutation individual i, that is, the random attack tactics mentioned above, and then randomly select an attack technique T from the random attack tactics i , that is, the random attack technology T i , and then randomly select an attack behavior S from the random attack technology i Perform the operation. Prioritize replacing network topology nodes: attack sub-technique C based on attack behavior i In the target network topology Gt, the mapping topology network node is searched according to the mapping relationship and replaced with the mapping topology network node; if the mapping topology network node cannot be found, the attack sub-technique is replaced: according to the topology node requirements, the attack sub-technique library L of the attack behavior is randomly searched for an adaptive attack sub-technique to replace it; if a replaceable attack sub-technique cannot be found, the above mutation operation does not need to be performed. E′={W1,....,W i ′,...,W n}, W i ′={T i1 ,...,T′ ij ,...,T i(ni)}, T′ ij ={S ij1 ,...,S′ ijk ,...,S ij(ni)}, where S′ ijk It is the mutated aggressive behavior, T ij ′ is the mutated attack technology, ensuring that the new attack behavior meets the topology node requirements, n i Indicates attack technique W i The total number of attack behaviors in ′.

[0081] In order to speed up the iterative convergence, in an optional implementation manner, before the above step S20461, the method further includes:

[0082] Step S301, adaptively adjust the mutation rate according to a first adaptive formula to accelerate iterative convergence, wherein the first adaptive formula is θ t+1 =θ min+ (θ max +θ min )e -μfavg(t) , where θ t+1 is the mutation rate of the t+1th iteration, θ min To set the minimum mutation rate, θ max To set the maximum mutation rate, f avg (t) is the average value of the fitness of the initial network security event script in the tth iteration, and μ is a control parameter.

[0083] In the above embodiment, the mutation rate and crossover rate are adaptively adjusted according to the evolutionary situation to accelerate convergence. Generally, a higher mutation rate is set in the early stage of evolution to increase the diversity of the population, and the mutation rate is reduced in the later stage of evolution to stabilize the population. μ is a control parameter that determines the speed at which the mutation rate decays. The above mutation rate is adaptively adjusted according to the first adaptive formula to accelerate iterative convergence. Similarly, the crossover rate is adaptively adjusted according to the second adaptive formula. The second adaptive formula is ε t+1 =ε min +(ε max +ε min )e -σfavg(t) , where ε t+l is the crossover rate of the t+1th iteration, ε min To set the minimum crossover rate, ε max To set the maximum crossover rate, f avg (t) is the average value of the fitness of the initial network security event script at the tth iteration, and σ is a control parameter that determines the speed at which the crossover rate increases.

[0084] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0085] The embodiments of the present application also provide an adaptation device for a network security event script. It should be noted that the adaptation device for the network security event script of the embodiments of the present application can be used to execute the adaptation method for the network security event script provided in the embodiments of the present application. The device is used to implement the above-mentioned embodiments and preferred embodiments, and the details that have been described will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0086] The following introduces the adaptation device of the network security event script provided in the embodiment of the present application.

[0087] Figure 3 1 is a structural block diagram of an adaptation device for a network security event script according to an embodiment of the present application. Figure 3 As shown, the device includes:

[0088] The acquisition unit 10 is used to acquire all historical network security event scripts, where the historical network security event scripts are scripts generated based on network security events that have occurred.

[0089] Specifically, in order to adapt the generated network security event script to different network topologies, a specific network security event script that actually occurred is first obtained as a data basis.

[0090] The first generation unit 20 is used to generate multiple initial network security event scripts according to the source network topology and target network topology corresponding to the above-mentioned historical network security event scripts, wherein the above-mentioned source network topology is the network topology to which the above-mentioned historical network security event scripts belong, and the above-mentioned target network topology is the network topology to be adapted.

[0091] Specifically, an initial population of the adaptive evolutionary algorithm is generated based on a specific network security event script that actually occurs and its corresponding source network topology and target network topology that needs to be adapted. The individuals of the initial population are the above-mentioned initial network security event scripts.

[0092] The evaluation unit 30 is configured to execute an evaluation step to evaluate the adaptability of each of the above-mentioned initial network security event scripts.

[0093] Specifically, a fitness function is defined to evaluate the fitness of each initial network security event script, so as to select the initial network security event script with high fitness.

[0094] The iterative unit 40 is used to perform an iterative step, select a set number of the above-mentioned initial network security event scripts according to the above-mentioned fitness, and iterate to obtain an adapted network security event script. The above-mentioned adapted network security event script is a script optimized according to the above-mentioned initial network security event script.

[0095] Specifically, in order to generate new population individuals, namely the above-mentioned adapted network security event scripts, through selection, crossover and mutation operations, the above-mentioned excellent initial network security event scripts are selected according to fitness for reproduction to obtain the above-mentioned adapted network security event scripts.

[0096] The second generation unit 50 is used to repeat the above-mentioned evaluation step and the above-mentioned iteration step in sequence at least once until the maximum number of iterations is reached or the above-mentioned fitness reaches the fitness threshold, and generate a target network security event script. The above-mentioned target network security event script is the network security event script with the highest current fitness among all the above-mentioned adapted network security event scripts.

[0097] Specifically, the above evaluation step and the above iteration step are repeated until the maximum number of iterations is reached or the fitness reaches a threshold, and one or a group of adapted network security event scripts with the highest fitness are selected as the target network security event scripts.

[0098] The adaptation unit 60 is configured to adapt the target network security event script to the target network topology to complete the network security drill.

[0099] Specifically, the network security event script or scripts generated by the above method can be automatically adapted to the user's network topology environment as a variant of the original script, allowing the user to verify the attack effects of the network security event on themselves or a specific network topology environment and conduct impact assessments or network security emergency drills while retaining certain attack technical characteristics of the original network security event script. The target network security event script is a specific drill script that matches the target network topology, and the network security drill is completed by adapting the target network security event script to the target network topology.

[0100] In this embodiment, an acquisition unit is configured to acquire all historical network security event scripts, where the historical network security event scripts are scripts generated for network security events that have occurred. A first generation unit is configured to generate multiple initial network security event scripts based on a source network topology and a target network topology corresponding to the historical network security event scripts, where the source network topology is the network topology to which the historical network security event scripts belong, and the target network topology is the network topology to be adapted. An evaluation unit is configured to perform an evaluation step to evaluate the fitness of each of the initial network security event scripts. An iteration unit is configured to perform an iteration step to select a set number of the initial network security event scripts for iteration based on the fitness to obtain an adapted network security event script, where the adapted network security event script is a script optimized based on the initial network security event script. A second generation unit is configured to sequentially repeat the evaluation step and the iteration step at least once until a maximum number of iterations is reached or the fitness reaches a fitness threshold, thereby generating a target network security event script, where the target network security event script is the network security event script with the highest current fitness among all the adapted network security event scripts. An adaptation unit is configured to adapt the target network security event script to the target network topology to complete the network security drill. This application obtains historical network security event scripts that have occurred, generates initial network security event scripts based on the actual historical network security event scripts and their corresponding source network topology and the target network topology that needs to be adapted, defines a fitness function, evaluates the fitness of each initial network security event script, selects excellent initial network security event scripts for reproduction based on the fitness, generates adapted network security event scripts, and then continues to evaluate all adapted network security event scripts, and adapts the adapted network security event script with the highest fitness to the target network topology as the target network security event script. This application enables the network security event scripts generated based on the network security events that have occurred to adapt to different network topologies, thereby conducting effective security drills and impact assessments in different environments. This application solves the problem in the prior art that network security event scripts are usually designed for specific network topologies, which makes them incapable of being directly applied to other network environments.

[0101] In order to obtain a network security event script generated based on a network security event that has occurred to provide a data basis, in an optional embodiment, the acquisition unit includes:

[0102] The acquisition module acquires all attack sub-techniques. Each of the above attack sub-techniques consists of attack sub-technique type, topology node requirements, attack action and attack result.

[0103] A first forming module forms a corresponding attack behavior according to each of the above-mentioned attack sub-techniques and the corresponding network topology node, wherein the above-mentioned network topology node is a node that adapts to the above-mentioned topology node requirements of the above-mentioned attack sub-technique, and each above-mentioned attack sub-technique and each above-mentioned network topology node form one above-mentioned attack behavior;

[0104] The second forming module combines all the above attack behaviors to form multiple attack techniques, where the above attack techniques are sequences formed by multiple attack behaviors;

[0105] The third forming module combines all the above attack techniques to form multiple attack tactics, where the above attack tactics are a collection of multiple attack techniques;

[0106] The fourth forming module forms multiple groups of attack tactic sequences from all the above attack tactics to obtain the above historical network security event scripts. A group of the above attack tactic sequences constitutes one above historical network security event script.

[0107] In the above embodiment, the network security event script E is represented as a set of ordered attack tactic sequences E={W1, W2, ..., W m}, for each attack tactic W m Is a set of attack techniques: W m ={T1, T2, ..., T k}, each attack technology T k It is a set of attack behavior sequences containing specific attack sub-techniques: k ={S1, S2, ..., S n}, each attack behavior S n Expressed as: S n= (C, N), where C represents the attack sub-technique and N represents the network topology node that meets the topology requirements of the attack sub-technique C. Each attack sub-technique C is represented as C = (M, O, A, R), where M represents the attack sub-technique type, O represents the topology node requirements, and A represents the specific attack action, representing the attack result on the network topology node. Based on the above rules, all historical network security event scripts are generated, providing the data foundation for generating subsequent target network security event scripts. Attack behavior, attack tactics, attack techniques, and attack sub-techniques are all concepts in the ATT&CK attack chain. An attack behavior is a structure or class that indicates the specific network topology node to which the attack sub-technique is applied. Here, the attack sub-technique is specifically represented as a class with an attribute M indicating its type and an attribute A describing the specific attack action. Function O returns whether the input topology node meets the topology node requirements, and function R modifies the input topology node's state to the post-attack state.

[0108] In order to improve the quality of the initial network security event script as much as possible while ensuring diversity and global search, in an optional implementation, the first generating unit includes:

[0109] a fifth forming module, forming a plurality of attack sub-technique libraries based on all the above attack sub-techniques, wherein all the above attack sub-techniques in each of the above attack sub-technique libraries are of the same type;

[0110] A construction module constructs a mapping relationship based on the network topology nodes in the source network topology and the network topology nodes in the target network topology, wherein the mapping relationship includes at least a type relationship of the network topology nodes and a connection relationship between the network topology nodes;

[0111] A query module queries the source network topology node of each source topology behavior in the source network topology according to the mapping relationship to obtain a corresponding target network topology node, wherein the source topology behavior represents the network topology node corresponding to the attack behavior of the source network topology, and the target network topology node is the network topology node corresponding to the source network topology node in the mapping relationship;

[0112] A search module searches for each target network topology node in a target attack sub-technology library to obtain a corresponding target attack sub-technology, wherein the target attack sub-technology library is the attack sub-technology library corresponding to the type of the target network topology node, and the target attack sub-technology is the attack sub-technology for which the target network topology node can meet the requirements of the topology node;

[0113] A first generation module generates new attack behaviors according to all the target network topology nodes and the corresponding target attack sub-techniques;

[0114] The second generation module updates the above attack techniques and tactics in sequence according to all new attack behaviors to generate current attack tactics accordingly;

[0115] The third generation module updates the corresponding historical network security events according to each of the current attack tactics, and generates all the initial network security event scripts.

[0116] In the above embodiment, assuming that the source network topology Gs and the target network topology Gt are known, and the nodes and connection modes of the source network topology and the target network topology are known, an attack sub-technique library based on the attack sub-technique type is first formed according to all attack sub-techniques. Each attack sub-technique library contains the same type of attack sub-techniques that can be applied to nodes in different topologies. A mapping relationship M is constructed for the nodes of the source network topology Gs and the target network topology Gt. The mapping relationship can be based on the type, attribute and connection relationship of the node. Example mapping relationship M: {N s1 →N t1 , N s1 -N t2 ,...}. For each attack behavior S in the source network topology Gs i , find the topological nodes that meet the topological node requirements in the target network topology Gt and replace the nodes in the attack behavior, such as the attack behavior in the historical network security event script of the source network topology Find the node N that meets the conditions in the target network topology Gt t1 , and then in the attack sub-technique library of the same attack sub-technique type A new attack sub-technique was found in Make N t1 It can meet its topological node requirements and generate new attack behaviors The newly generated attack behavior Assemble the attack techniques and tactics in the order of the original historical cybersecurity event script to form new attack techniques T1′ and attack tactics W1′. Add the assembled attack tactic sequence {W1′} as individuals to the initial population E0. Each individual is a complete cybersecurity event script, namely the initial cybersecurity event script, containing the remapped attack tactics, attack techniques, and attack behaviors. Repeat this process until no new individuals can be generated.

[0117] In order to evaluate the pros and cons of each initial network security event in the target network topology to implement optimal iteration, in an optional embodiment, the evaluation unit includes:

[0118] The first calculation module calculates the fitness of the initial network security event script according to a first formula when a first condition is met. The first formula is F(E i )=α×Sim W (E i )+β×Sim T (E i )+γ×Sim C (E i )+δ×Sim R (E i ), Simw(E i ) represents the retention degree of the attack tactics, Sim T (E i ) represents the retention of attack technology, Sim C (E i ) represents the retention degree of the attack sub-technique, Sim R (E i ) represents the retention degree of the attack result, E represents the i-th initial network security event script, α, β, γ, and δ are all weight parameters and satisfy α+β+γ+δ=1, and the first condition is that the satisfaction degree of the topological node requirements of all the attack sub-techniques in the initial network security event script is greater than the satisfaction threshold;

[0119] A first determining module determines the fitness of the initial network security event script according to a second formula when the first condition is not met, wherein the second formula is F(E i )=-∞。

[0120] In the above embodiment, the fitness function F(E i ) is used to assess the initial cybersecurity incident E i The fitness of the attack sub-technology is based on the following five aspects: p (C ijk ), retention of attack tactics: Simw(E i ), Attack technology retention: Sim T (E i ), retention of attack sub-techniques: Sim C (E i ), retention of attack results: Sim R (E i ). The fitness function is defined as:

[0121]

[0122] , calculate the fitness of the initial network security incident script according to the fitness function. Calculate the retention degree Simw(E) of the above attack tactics according to the third formula i ), the third formula above is Where n represents the total number of attack tactics in the initial network security incident script, and wi is a weight parameter used to represent the i-th attack tactic. Importance in the initial network security event script above (defaults to 1 if no specific weight is given). is a similarity function used to evaluate the i-th attack tactic in the initial network security incident script The degree of similarity in the above historical cybersecurity incident scripts. Among them, m1 is the total number of attack tactics in the above historical network security event scripts, for Compared with the j-th attack tactic in the above historical network security incident script The type similarity can be calculated and The weighted sum of the similarities between the types of attack techniques in the above historical network security event scripts and the ratio of the number of the above attack tactics. for The position number in the above historical network security event script is the same as the attack tactic in the above historical network security event. The Euclidean distance between the position numbers. The retention degree Sim of the above attack technology is calculated according to the fourth formula T (E i ), the fourth formula above is Where n2 represents the total number of attack techniques in the initial network security incident script, t i is a weight parameter used to indicate the importance of the i-th attack technique in the initial network security incident script (the default value is 1 if there is no special weight information). is a similarity function used to evaluate the i-th attack technique in the above initial network security incident script The similarity degree in the above historical network security event scripts. The above similarity function Among them, m2 is the total number of attack techniques in the above historical network security incident scripts, is a type similarity function used to measure the above historical network security event scripts and initial cybersecurity incident scripts The similarity of attack technology types can be calculated by and The weighted sum of the similarities between the attack sub-techniques of each attack behavior is obtained. is a distance similarity function, which is used to measure the similarity of the application position of attack technology in the historical network security incident script and the initial network security incident script. The number of the attack tactic in the initial network security incident script and The number of the attack tactic in the above historical network security event script The Euclidean distance between them is calculated, for example Among them, γ is a control parameter that determines the degree of influence of position difference on similarity. According to the fifth formula, the retention degree Sim of the above attack sub-technique is calculated. C (E i ), the fifth formula above is Where n3 is the total number of attack behaviors in the initial network security incident script, c i is the weight, which is used to indicate the importance of the i-th attack behavior in the initial network security event script (the default is 1 if there is no special weight information). is a similarity function used to evaluate the attack sub-technique of the i-th attack behavior in the initial network security incident script The degree of similarity in historical cybersecurity event scripts. Similarity function It can be defined based on type consistency and position consistency. The type consistency is to determine whether the types of attack sub-techniques are consistent, and the position consistency is to measure the matching degree of the application locations of the attack sub-techniques. Where m3 is the total number of attack behaviors in historical network security event scripts, It is a type consistency function that measures the similarity of attack sub-technique types in historical cybersecurity incident scripts and initial cybersecurity incident scripts. The position consistency function measures the similarity of the application locations of attack sub-techniques in historical cybersecurity incident scripts and initial cybersecurity incident scripts. The type consistency function can be defined as a binary function or a similarity measure based on type features: The position consistency function evaluates the similarity of the locations where the attack sub-techniques are applied in the event script: Where, and Attack sub-techniques and Position number in the initial cybersecurity event script and the historical cybersecurity event script, Position difference metric (such as Euclidean distance or other metric), γ is a control parameter that determines the degree of influence of position difference on similarity. The retention calculation method for attack results is as follows: (1) The last attack behavior of all attack techniques in the last attack tactic in the initial network security event script is combined into a new set (2) The last attack behavior of all attack techniques in the last attack tactic in the historical network security event script is combined into a new set Then the retention degree of the attack result Sim R (E i ) is R N The attack results of the attack sub-techniques in R O The number of similarities between the attack results of the attack sub-techniques in m and R N The ratio of the number of elements p in , that is Satisfaction is achieved by bringing the topological nodes in the mapped attack behavior into the topological node requirement function of the corresponding attack sub-technology. If it is satisfied, true is returned, and if it is not satisfied, false is returned. All attack behaviors must satisfy the topological satisfaction, that is, the function returns true. If the topological satisfaction of an attack behavior is not satisfied, the value of the fitness function of the individual (i.e., the script) is negative infinity, that is, it is completely unfit.

[0123] In order to improve the diversity of adapted network security event scripts, in an optional implementation manner, the second generating unit includes:

[0124] A selection module randomly selects a of the above initial network security event scripts from all the above initial network security event scripts;

[0125] A second determination module determines two of the a initial network security event scripts whose crossover rate between each pair is greater than a crossover rate threshold as first parent individuals and second parent individuals, respectively, where the crossover rate is a probability of the two initial network security event scripts crossing each other;

[0126] a crossover module, dividing the first parent individual into a first front portion and a first back portion according to a crossover point, and dividing the second parent individual into a second front portion and a second back portion according to the crossover point, wherein the crossover point is less than or equal to a minimum length value, and the minimum length value is a smaller length value between a length of the first parent individual and a length of the second parent individual;

[0127] A first splicing module sequentially splices the first front portion and the second rear portion to obtain a first offspring individual, and sequentially splices the second front portion and the first rear portion to obtain a second offspring individual;

[0128] A second splicing module adds the first offspring individual and the second offspring individual to a network security event script set, where the network security event script set is a set formed by all offspring individuals;

[0129] The mutation module randomly selects at least one mutant individual from the above-mentioned network security event script set to perform a mutation operation to obtain the above-mentioned adapted network security event script, wherein the above-mentioned mutant individual is the above-mentioned offspring individual whose mutation rate is greater than the mutation threshold, the above-mentioned mutation rate is the probability of the above-mentioned offspring individual undergoing random change, and the above-mentioned mutation operation is the operation of changing the above-mentioned mutant individual.

[0130] In the above embodiment, a individuals are randomly selected from the population, and the individual with the highest fitness is selected from these a individuals according to the selection formula. The above selection formula is: Among them, tour represents a group of randomly selected individuals, E selected It is the individual with the highest fitness. E can also be used when selecting the parent generation. selected As one of the parents. Order-preserving Crossover (OPC) is used, and the specific steps are as follows: select two parent individuals E1 and E2 according to the crossover rate ε. In other words, select individuals whose crossover rate between the two parent individuals is greater than the crossover rate threshold as the first parent individual E1 and the second parent individual E2; randomly select a crossover point k and divide the parent individuals into the first half and the second half. The first half of the attack tactic sequence of the first child individual E3 comes from the first parent individual E1, and the second half is completed according to the order of the second parent individual E2. The first half of the attack tactic sequence of the second child individual E4 comes from the second parent individual E2, and the second half is completed according to the order of the first parent individual E1. The above formula for the first child individual is E3 = {W 11 ,...,W 1k , W 2(k+1) ,.....,W 2m}, the formula for the second generation individual is E4={W 21 ,...,W 2k , W 1(k+1) ,.....,W 1m}, where W ij represents the jth attack tactic of the i-th parent individual, k is the intersection point, and m is the total number of attack tactics. Example: Assume that the attack tactic sequences of E1 and E2 are: E1 = {W 11 , W 12 , W 13}, E2={W 21 , W 22 , W 23}, select the crossover point k = 1, generate offspring individuals: E3 = {W 11 , W 22 , W 23}, E4={W 21 , W 12 , W 13The above-mentioned offspring individuals are the above-mentioned adapted network security event scripts. A new population is formed based on all the offspring individuals, namely the above-mentioned network security event script set, and the above-mentioned mutation operation is performed. The above-mentioned mutation operation introduces new genotypes by making small random changes to certain parts of the individuals, thereby improving the diversity of the network security event script set.

[0131] In order to maintain the diversity of the network security event script set and avoid falling into a local optimum, in an optional implementation, the mutation module includes:

[0132] A first selection submodule randomly selects at least one mutant individual from the above-mentioned network security event script set according to the mutation rate;

[0133] The second selection submodule randomly selects one of the above attack tactics from the above mutant individuals to obtain a random attack tactic;

[0134] The third selection submodule randomly selects one of the above attack behaviors from the above random attack tactics to obtain a random attack behavior;

[0135] A first replacement submodule searches for a mapping network topology node according to the network topology node in the random attack behavior, and replaces the network topology node in the random attack behavior with the mapping network topology node, wherein the mapping network topology node is a corresponding network topology node in the target network topology found according to the mapping relationship;

[0136] A second replacement submodule, when the mapped network topology node cannot be found according to the network topology node in the random attack behavior, randomly searches for an adaptive attack sub-technique in the attack sub-technique library according to an adaptation condition, and replaces the attack sub-technique in the random attack behavior with the adaptive attack sub-technique, where the adaptation condition is a condition that satisfies the topology node requirement of the attack sub-technique in the random attack behavior, and the adaptive attack sub-technique is an attack sub-technique that meets the adaptation condition;

[0137] The changing submodule changes the above-mentioned mutant individuals according to the above-mentioned mapping network topology nodes or the above-mentioned adaptation attack sub-technology to obtain the above-mentioned adaptation network security event script.

[0138] In the above embodiment, an order-preserving mutation operation (OPM) is adopted, and the specific steps are as follows: selecting a mutation individual according to the mutation rate θ, in other words, randomly selecting an individual whose mutation rate θ in the network security event script is greater than the mutation rate threshold as the above mutation individual; randomly selecting an attack tactic W from the above mutation individual i , that is, the random attack tactics mentioned above, and then randomly select an attack technique T from the random attack tacticsi , that is, the random attack technology T i , and then randomly select an attack behavior Si from the random attack technology to operate. Prioritize replacing network topology nodes: According to the attack sub-technology C of the attack behavior i In the target network topology Gt, the mapping topology network node is searched according to the mapping relationship and replaced with the mapping topology network node; if the mapping topology network node cannot be found, the attack sub-technique is replaced: according to the topology node requirements, the attack sub-technique library L of the attack behavior is randomly searched for an adaptive attack sub-technique to replace it; if a replaceable attack sub-technique cannot be found, the above mutation operation does not need to be performed. E′={W1,....,W i ′,...,W n}, W i ′={T i1 ,...,T′ ij ,...,T i(ni)}, T′ ij ={S ij1 ,...,S′ ijk ,...,S ij(ni)}, where S′ ijk It is the mutated aggressive behavior, T ij ′ is the mutated attack technology, ensuring that the new attack behavior meets the topology node requirements, n i Indicates attack technique W i The total number of attack behaviors in ′.

[0139] In order to speed up the iterative convergence, in an optional implementation manner, the apparatus further includes:

[0140] The adjustment unit is configured to adaptively adjust the mutation rate according to a first adaptive formula to accelerate iterative convergence before randomly selecting at least one mutant individual from the above-mentioned network security event script set according to the mutation rate, wherein the first adaptive formula is θ t+1 =θ min +(θ max +θ min )e -μfavg(t) , where θ t+1 is the mutation rate of the t+1th iteration, θ min To set the minimum mutation rate, θ max To set the maximum mutation rate, f avg (t) is the average value of the fitness of the initial network security event script in the tth iteration, and μ is a control parameter.

[0141] In the above embodiment, the mutation rate and crossover rate are adaptively adjusted according to the evolutionary situation to accelerate convergence. Generally, a higher mutation rate is set in the early stage of evolution to increase the diversity of the population, and the mutation rate is reduced in the later stage of evolution to stabilize the population. μ is a control parameter that determines the speed at which the mutation rate decays. The above mutation rate is adaptively adjusted according to the first adaptive formula to accelerate iterative convergence. Similarly, the crossover rate is adaptively adjusted according to the second adaptive formula. The second adaptive formula is ε t+1 =ε min +(ε max +ε min )e -σfavg(t) , where ε t+1 is the crossover rate of the t+1th iteration, ε min To set the minimum crossover rate, ε max To set the maximum crossover rate, f avg (t) is the average value of the fitness of the initial network security event script at the tth iteration, and σ is a control parameter that determines the speed at which the crossover rate increases.

[0142] The network security event script adaptation device includes a processor and memory. The acquisition unit, first generation unit, and evaluation unit are all stored as program units in the memory. The processor executes the program units stored in the memory to implement the corresponding functions. The modules are all located in the same processor; alternatively, the modules can be located in different processors in any combination.

[0143] The processor contains a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured, and kernel parameters can be adjusted to address the problem that existing network security event scripts are typically designed for specific network topologies, making them inapplicable to other network environments.

[0144] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0145] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the adaptation method of the network security event script.

[0146] An embodiment of the present invention provides a processor, which is used to run a program, wherein the adaptation method of the network security event script is executed when the program is running.

[0147] An embodiment of the present invention provides a network security event script adaptation system, which includes a processor, a memory, and a program stored in the memory and runnable on the processor. When the processor executes the program, it implements at least the steps corresponding to the network security event script adaptation method.

[0148] The present application also provides a computer program product, which, when executed on a data processing device, is adapted to execute a program corresponding to the steps of the adaptation method for initializing at least a network security event script.

[0149] Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be implemented using a general-purpose computing device, can be centralized on a single computing device, or can be distributed across a network of multiple computing devices. They can be implemented using program code executable by the computing device, and thus, can be stored in a storage device and executed by the computing device. In some cases, the steps shown or described herein can be performed in a different order than that shown, or can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0150] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0151] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0152] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0154] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0155] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0156] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0157] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0158] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0159] 1) The adaptation method of the network security event script of the present application obtains the historical network security event script that has occurred, generates an initial network security event script based on the actual historical network security event script and its corresponding source network topology and the target network topology that needs to be adapted, defines a fitness function, evaluates the fitness of each initial network security event script, selects excellent initial network security event scripts for reproduction according to the fitness, generates an adapted network security event script, and then continues to evaluate all the adapted network security event scripts, and adapts the adapted network security event script with the highest fitness to the target network topology as the target network security event script. The present application can adapt the network security event script generated based on the network security event that has occurred to different network topologies, thereby conducting effective security drills and impact assessments in different environments. The present application solves the problem in the prior art that network security event scripts are usually designed for specific network topologies and cannot be directly applied to other network environments.

[0160] 2) The adaptation device of the network security event script of the present application obtains the historical network security event script that has occurred, generates an initial network security event script based on the actual historical network security event script and its corresponding source network topology and the target network topology that needs to be adapted, defines a fitness function, evaluates the fitness of each initial network security event script, selects excellent initial network security event scripts for reproduction according to the fitness, generates an adapted network security event script, and then continues to evaluate all the adapted network security event scripts, and adapts the adapted network security event script with the highest fitness to the target network topology as the target network security event script. The present application can adapt the network security event script generated based on the network security event that has occurred to different network topologies, thereby conducting effective security drills and impact assessments in different environments. The present application solves the problem in the prior art that network security event scripts are usually designed for specific network topologies and cannot be directly applied to other network environments.

[0161] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A method for adapting a network security event script, characterized in that: include: Obtain all historical network security event scripts, where the historical network security event scripts are scripts generated based on network security events that have occurred; Generate multiple initial network security event scripts according to the source network topology and target network topology corresponding to the historical network security event script, wherein the source network topology is the network topology to which the historical network security event script belongs, and the target network topology is the network topology to be adapted; An evaluation step of evaluating the fitness of each of the initial network security event scripts; an iterative step of selecting a set number of the initial network security event scripts according to the fitness and performing iterations to obtain an adapted network security event script, wherein the adapted network security event script is a script optimized according to the initial network security event script; Repeating the evaluation step and the iteration step in sequence at least once until a maximum number of iterations is reached or the fitness reaches a fitness threshold, and generating a target network security event script, wherein the target network security event script is the network security event script with the highest fitness among all the adapted network security event scripts; Adapting the target network security event script to the target network topology to complete the network security drill, Obtaining all historical network security event scripts includes: obtaining all attack sub-techniques, each of which consists of an attack sub-technique type, a topology node requirement, an attack action, and an attack result; forming corresponding attack behaviors according to each attack sub-technique and the corresponding network topology node, the network topology node being a node adapted to the topology node requirement of the attack sub-technique, and one attack sub-technique and one network topology node forming one attack behavior; combining all the attack behaviors to form multiple attack techniques, wherein the attack technique is a sequence formed by multiple attack behaviors; combining all the attack techniques to form multiple attack tactics, wherein the attack tactics is a collection of multiple attack techniques; forming multiple groups of attack tactic sequences from all the attack tactics to obtain the historical network security event script, wherein a group of attack tactic sequences is one historical network security event script.

2. The method according to claim 1, characterized in that Generate multiple initial network security event scripts according to the source network topology and the target network topology corresponding to the historical network security event scripts, including: forming a plurality of attack sub-technique libraries based on all the attack sub-techniques, wherein all the attack sub-techniques in each attack sub-technique library are of the same type; Building a mapping relationship based on the network topology nodes in the source network topology and the network topology nodes in the target network topology, wherein the mapping relationship includes at least a type relationship between the network topology nodes and a connection relationship between the network topology nodes; For each source topology behavior in the source network topology, query the source network topology node according to the mapping relationship to obtain a corresponding target network topology node, wherein the source topology behavior represents the network topology node corresponding to the attack behavior of the source network topology, and the target network topology node is the network topology node corresponding to the source network topology node in the mapping relationship; Searching the target attack sub-technology library according to each target network topology node to obtain a corresponding target attack sub-technology, wherein the target attack sub-technology library is the attack sub-technology library corresponding to the type of the target network topology node, and the target attack sub-technology is the attack sub-technology that the target network topology node can meet the topology node requirements; Generate new attack behaviors according to all the target network topology nodes and the corresponding target attack sub-techniques; updating the attack techniques and attack tactics in sequence according to all new attack behaviors to generate current attack tactics accordingly; The corresponding historical network security events are updated according to each current attack tactic to generate all the initial network security event scripts.

3. The method according to claim 1, characterized in that Evaluate the fitness of each of the initial cybersecurity incident scripts, including: When the first condition is met, the fitness of the initial network security event script is calculated according to a first formula, where the first formula is: , represents the retention degree of the attack tactics, Indicates the retention of attack techniques, represents the retention degree of the attack sub-technique, Indicates the retention degree of the attack result, represents the i-th initial network security event script, are all weight parameters and satisfy , the first condition is that the satisfaction degree of the topological nodes required by all the attack sub-techniques in the initial network security event script is greater than the satisfaction degree threshold; In the case where the first condition is not met, the fitness of the initial network security event script is determined according to a second formula, where the second formula is: .

4. The method according to claim 1, wherein Selecting a set number of the initial network security event scripts according to the fitness to perform iterations to obtain an adapted network security event script, including: Randomly selecting a said initial network security event scripts from all said initial network security event scripts; Determine two of the a initial network security event scripts whose crossover rate between each of the two is greater than a crossover rate threshold as the first parent individual and the second parent individual, respectively, where the crossover rate is the probability of the two initial network security event scripts crossing each other; dividing the first parent individual into a first front portion and a first back portion according to a crossover point, and dividing the second parent individual into a second front portion and a second back portion according to the crossover point, wherein the crossover point is less than or equal to a minimum length value, wherein the minimum length value is a smaller length value between the length of the first parent individual and the length of the second parent individual; Sequentially splicing the first front part and the second back part to obtain a first offspring individual, and sequentially splicing the second front part and the first back part to obtain a second offspring individual; Adding the first child individual and the second child individual to a network security event script set, where the network security event script set is a set formed by all child individuals; At least one mutant individual in the network security event script set is randomly selected to perform a mutation operation to obtain the adapted network security event script, wherein the mutant individual is the offspring individual whose mutation rate is greater than a mutation threshold, the mutation rate is the probability of the offspring individual undergoing random changes, and the mutation operation is an operation to change the mutant individual.

5. The method according to claim 2, characterized in that Randomly selecting at least one mutation individual from the network security event script set to perform a mutation operation to obtain the adapted network security event script, including: Randomly selecting at least one mutation individual from the network security event script set according to the mutation rate; Randomly selecting one of the attack tactics among the mutant individuals to obtain a random attack tactic; Randomly selecting one of the attack behaviors in the random attack tactics to obtain a random attack behavior; Searching for a mapping network topology node according to the network topology node in the random attack behavior, and replacing the network topology node in the random attack behavior with the mapping network topology node, wherein the mapping network topology node is a corresponding network topology node in the target network topology searched according to the mapping relationship; In the case where the mapped network topology node cannot be found according to the network topology node in the random attack behavior, randomly searching for an adapted attack sub-technique in the attack sub-technique library according to an adaptation condition, and replacing the attack sub-technique in the random attack behavior with the adapted attack sub-technique, wherein the adaptation condition is a condition that satisfies the topology node requirement of the attack sub-technique in the random attack behavior, and the adapted attack sub-technique is an attack sub-technique that meets the adaptation condition; The mutated individual is changed according to the mapped network topology node or the adapted attack sub-technology to obtain the adapted network security event script.

6. The method according to claim 5, characterized in that Before randomly selecting at least one variant individual from the network security event script set according to the mutation rate, the method further includes: The mutation rate is adaptively adjusted according to a first adaptive formula to accelerate iterative convergence. The first adaptive formula is: ,in For the t+ The mutation rate of 1 iteration, To set the minimum mutation rate, To set the maximum mutation rate, is the average value of the fitness of the initial network security event script in the t-th iteration, is the control parameter.

7. An adaptation device for a network security event script, characterized in that: The device comprises: An acquisition unit, configured to acquire all historical network security event scripts, wherein the historical network security event scripts are scripts generated by network security events that have occurred; a first generating unit, configured to generate a plurality of initial network security event scripts according to a source network topology and a target network topology corresponding to the historical network security event scripts, wherein the source network topology is the network topology to which the historical network security event scripts belong, and the target network topology is the network topology to be adapted; An evaluation unit, configured to perform an evaluation step to evaluate the fitness of each of the initial network security event scripts; an iterative unit, configured to perform an iterative step, selecting a set number of the initial network security event scripts for iteration according to the fitness, to obtain an adapted network security event script, wherein the adapted network security event script is a script optimized according to the initial network security event script; a second generating unit, configured to sequentially repeat the evaluating step and the iterating step at least once until a maximum number of iterations is reached or the fitness reaches a fitness threshold, and generate a target network security event script, wherein the target network security event script is the network security event script with the highest fitness among all the adapted network security event scripts; an adapting unit, configured to adapt the target network security event script to the target network topology to complete the network security drill, The acquisition unit includes: an acquisition module, which acquires all attack sub-techniques, each of which is composed of an attack sub-technique type, a topology node requirement, an attack action, and an attack result; a first formation module, which forms a corresponding attack behavior according to each attack sub-technique and a corresponding network topology node, wherein the network topology node is a node adapted to the topology node requirement of the attack sub-technique, and one attack sub-technique and one network topology node form one attack behavior; a second formation module, which combines all the attack behaviors to form multiple attack techniques, wherein the attack technique is a sequence formed by multiple attack behaviors; a third formation module, which combines all the attack techniques to form multiple attack tactics, wherein the attack tactics is a collection of multiple attack techniques; a fourth formation module, which forms multiple groups of attack tactic sequences from all the attack tactics to obtain the historical network security event script, wherein a group of attack tactic sequences is one historical network security event script.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 6.

9. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images