Automatic generation method of orchestration script based on threat intelligence

Abstract

The present invention proposes an automatic generation method of an orchestration script based on threat intelligence, which belongs to the field of network security technology and includes the following steps: acquiring threat intelligence data including threat indicators and attack technology information; analyzing the acquired threat intelligence data and extracting key feature information; selecting a script template that matches the extracted key feature information based on a predefined security orchestration script template library, the script template including a preset operation sequence for automated security response; mapping the extracted key feature information to corresponding fields in the selected script template to generate a customized security response process for a specific threat; automatically generating a security orchestration script based on the generated customized security response process, the security orchestration script being used to coordinate and control multiple security tools and systems. The present invention improves the efficiency and accuracy of security response by integrating threat intelligence data and predefined response templates, thereby enhancing network security protection capabilities.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and relates to a method for automatically generating an orchestration script based on threat intelligence. Background Art

[0002] In the existing technology, network security protection relies on various security tools and systems, which need to be manually configured and managed to cope with the evolving network threats. The acquisition and analysis of threat intelligence data is an important part of security protection. By analyzing threat intelligence data, potential threats can be identified and corresponding protective measures can be taken. However, existing methods usually rely on the experience of security experts for manual processing, which is inefficient and error-prone.

[0003] The main problem with existing technologies is that they are not automated enough, and the security response process is complex and time-consuming. Manually writing and adjusting response scripts not only increases the workload of security experts, but also, due to the lack of standardized processes, easily leads to untimely or inaccurate responses. In addition, in the face of large-scale threat intelligence data, existing methods are difficult to quickly and accurately extract key feature information and generate corresponding security response measures, thus affecting the overall security protection effect.

[0004] Therefore, it is necessary to develop a new method for automatically generating orchestration scripts based on threat intelligence. Summary of the invention

[0005] To solve the above problems, the present application provides a method for automatically generating an orchestration script based on threat intelligence to improve the efficiency and accuracy of network security response.

[0006] The method for automatically generating an orchestration script based on threat intelligence provided in this application includes:

[0007] Obtaining threat intelligence data, including threat indicators and attack technology information;

[0008] Analyze the acquired threat intelligence data and extract key feature information;

[0009] Based on a predefined security orchestration script template library, selecting a script template that matches the extracted key feature information, wherein the script template includes a preset operation sequence for automated security response;

[0010] Map the extracted key feature information to the corresponding fields in the selected script template to generate a customized security response process for specific threats;

[0011] According to the generated customized security response process, a security orchestration script is automatically generated, where the security orchestration script is used to coordinate and control multiple security tools and systems.

[0012] Furthermore, obtaining threat intelligence data includes:

[0013] Collecting threat intelligence data from multiple threat intelligence sources, including open source threat intelligence, commercial threat intelligence services, and internal security logs;

[0014] Standardize the format of collected threat intelligence data.

[0015] Store standardized threat intelligence data in the threat intelligence database.

[0016] Furthermore, the acquired threat intelligence data is analyzed to extract key feature information, including:

[0017] Based on the acquired threat intelligence data, the preliminary feature vector is obtained using the Bayesian network;

[0018] The preliminary feature vector is used as an individual of the initial population, and a genetic algorithm is used to obtain an optimized feature vector; and the optimized feature vector is used as key feature information.

[0019] Furthermore, the method of obtaining a preliminary feature vector based on the acquired threat intelligence data by using a Bayesian network includes:

[0020] Initialize the Bayesian network structure, take each threat indicator and attack technology information in the threat intelligence data as a node of the network, and obtain the initial network structure;

[0021] Based on the initial network structure, the threat intelligence data is converted into a format suitable for Bayesian network analysis through data preprocessing to obtain preprocessed data;

[0022] Using a dynamic probability distribution function, based on the preprocessed data, calculate the initial conditional probability between each node, and use the initial conditional probability to initialize the edge weights of the Bayesian network to obtain an initialized Bayesian network;

[0023] Introducing an adaptive learning rate mechanism into the initialized Bayesian network, adjusting the parameters of the Bayesian network in real time according to the newly input data, and obtaining an adaptively adjusted Bayesian network and updated conditional probabilities;

[0024] Based on the adaptively adjusted Bayesian network and the updated conditional probability, the threat intelligence data is preliminarily classified and feature extracted to generate a preliminary feature vector.

[0025] Furthermore, the adaptive learning rate mechanism is introduced into the initialized Bayesian network, and the parameters of the Bayesian network are adjusted in real time according to the newly input data to obtain the adaptively adjusted Bayesian network and the updated conditional probability, including:

[0026] For each node in the initialized Bayesian network and nodes The edge weights between are dynamically adjusted according to the following formula (1):

[0027] ;

[0028] in, is The node at the iteration and nodes The updated edge weights between them; is The node at the iteration and nodes The edge weights between ; It is at the node and nodes Conditional data The joint conditional probability of Is a node Conditional data The conditional probability of Is a node Conditional data The conditional probability of is the adaptive learning rate, calculated according to the following formula (2):

[0029] ;

[0030] in, is the initial learning rate; is the learning rate decay coefficient; is the current iteration number;

[0031] According to the following formula (3), the conditional probability is updated:

[0032] ;

[0033] in, is The node at the iteration The updated conditional probability of ; is The node at the iteration The conditional probability of is the regularization parameter; is the log-likelihood function For Node The partial derivative of conditional probability is calculated as follows:

[0034] ;

[0035] in, Representation Node The set of neighbor nodes.

[0036] Furthermore, the step of using the preliminary feature vector as an individual of the initial population and using a genetic algorithm to obtain an optimized feature vector includes:

[0037] E101: Initialize a population, which contains multiple individuals, each of which represents a preliminary feature vector;

[0038] E102: For each individual in the population, use the fitness function to evaluate its performance on multiple optimization objectives;

[0039] E103: Perform non-dominated sorting on each individual based on its performance, and select a portion of individuals to enter the next generation population;

[0040] E104: Perform crossover and mutation operations on the next generation population to generate a new population;

[0041] E105: Repeat steps E102 to E104 until a specified stop condition is met, thereby obtaining a set of optimized feature vectors.

[0042] Furthermore, the fitness function adopts the following formula (5):

[0043] ;

[0044] in, is the fitness function; The feature vector representing the individual; is the weight coefficient; Represents the feature vector Features in Conditional data probability; Represents the feature vector Features in The weight of Indicates the number of features; is the feature vector Features in Conditional Target The probability of Indicates the target The variance of is used to measure the volatility of the target; is a constant; represents the log-likelihood function For the feature vector The partial derivative of .

[0045] Furthermore, the selecting a script template matching the extracted key feature information based on a predefined security orchestration script template library includes:

[0046] Establish and maintain a security orchestration script template library, the template library including a plurality of predefined script templates, each script template defining a series of automated security response operations;

[0047] Classify and match the extracted key feature information to determine the corresponding threat type and response requirements;

[0048] According to the classification and matching results of the extracted key feature information, the most suitable script template is selected from the template library;

[0049] If no exact match is found, the closest template is selected and adapted to meet specific needs.

[0050] Furthermore, mapping the extracted key feature information to corresponding fields in the selected script template includes:

[0051] Analyze the selected script template and determine the configurable fields in the template;

[0052] Automatically fill in the configurable fields in the template based on the extracted key feature information;

[0053] If there are fields that cannot be automatically filled, a prompt message is generated to remind the operator to configure manually;

[0054] Generate a customized security response process containing all necessary information and verify its completeness and correctness.

[0055] Furthermore, the security orchestration script is automatically generated according to the generated customized security response process, including:

[0056] Converting the customized security response process into a specific syntax format of the orchestration script, where the syntax format meets the requirements of the target orchestration platform;

[0057] Verify the syntax correctness of the generated orchestration script to ensure there are no syntax errors;

[0058] Conduct simulation tests on the generated orchestration scripts to simulate their execution in the actual environment;

[0059] According to the results of simulation tests, make necessary adjustments and optimizations to ensure that the script can run effectively in the actual environment;

[0060] Deploy tested and optimized orchestration scripts to target systems to automate security responses.

[0061] The beneficial effects of the technical solution provided by this application include:

[0062] By automatically acquiring and analyzing threat intelligence data, key feature information can be quickly extracted, reducing the time for human intervention and manual processing, thereby improving overall response speed and efficiency.

[0063] Based on the predefined security orchestration script template library, script templates that match key feature information are selected to ensure standardization and consistency of response measures and reduce the risk of human errors and inconsistencies.

[0064] The extracted key feature information is automatically mapped to the corresponding fields in the script template to generate a customized security response process, and the security orchestration script is automatically generated and deployed, achieving a high degree of automation of the entire process and reducing the workload of the security team.

[0065] The library of predefined script templates can be continuously updated and expanded based on new threat intelligence and attack techniques, ensuring that the system can flexibly respond to the ever-changing threat environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 It is a flowchart of the method for automatically generating an orchestration script based on threat intelligence provided in the first embodiment of the present application. DETAILED DESCRIPTION

[0067] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0068] The first embodiment of the present application provides a method for automatically generating an orchestration script based on threat intelligence, and the process is as follows: Figure 1 As shown, the following steps are included:

[0069] Step S101: Acquire threat intelligence data, where the threat intelligence data includes threat indicators and attack technology information.

[0070] In step S101, acquiring threat intelligence data is the first step of the method for automatically generating an orchestration script based on threat intelligence. The specific implementation process of this step is as follows:

[0071] Threat intelligence data is collected from multiple threat intelligence sources, which may include but are not limited to open source threat intelligence, commercial threat intelligence services, internal security logs, and other relevant data sources. Open source threat intelligence may come from publicly accessible network security reports, forums, blogs, social media, etc. Commercial threat intelligence services are usually provided by specialized security companies and contain high-quality threat intelligence data that has been analyzed and verified, while internal security logs come from the enterprise's own network security systems, such as firewall logs, intrusion detection system logs, and endpoint security logs.

[0072] Next, the collected threat intelligence data is standardized. This is because the data formats of different intelligence sources may vary. In order to facilitate subsequent processing, they need to be converted into a consistent format. Format standardization includes converting data into a structured format (such as JSON, XML, etc.), cleaning the data to remove redundant information, and unifying the format of timestamps and other key fields.

[0073] After the format is standardized, the standardized threat intelligence data is stored in the threat intelligence database. The threat intelligence database can be a relational database (such as MySQL) or a NoSQL database (such as MongoDB), depending on the specific needs and data size. In the database, threat intelligence data can be stored by source, time, threat type, etc., for quick retrieval and analysis.

[0074] Throughout the process, data security also needs to be considered. Ensure that data is encrypted and protected during transmission and storage to prevent unauthorized access and tampering. In addition, the threat intelligence database needs to be backed up regularly to prevent data loss.

[0075] By implementing the above steps, we can ensure that the acquired threat intelligence data is comprehensive, accurate and easy to process, laying a solid foundation for subsequent threat intelligence analysis and orchestration script generation.

[0076] Step S102: Analyze the acquired threat intelligence data and extract key feature information. This process involves multiple associated steps to ensure that the required information can be fully and accurately extracted.

[0077] First, previously acquired and standardized threat intelligence data is extracted from the threat intelligence database. This data usually contains threat indicators (such as IP addresses, URLs, file hash values) and attack technical information (such as attack methods, tools, attackers' tactics, techniques, and procedures).

[0078] Next, natural language processing (NLP) technology is used to pre-process the textual threat intelligence data. This step includes operations such as word segmentation, part-of-speech tagging, and entity recognition to identify key entities and relationships in the data. For example, specific attack techniques mentioned in the document, the vulnerabilities of the target system, and the characteristics of the attacker can be identified.

[0079] Then, machine learning algorithms are applied to classify and cluster the threat intelligence data. Classification algorithms can be used to categorize threat intelligence data by threat type (such as malware attacks, phishing, denial of service attacks, etc.). Clustering algorithms can be used to discover patterns and associations in the data and identify threat intelligence with similar characteristics. This step helps understand the overall threat landscape and the characteristics of specific threats.

[0080] On this basis, extract key feature information from threat intelligence data. Key feature information usually includes but is not limited to attack targets, attack paths, tools and techniques used, attack motivations, and possible impacts. In order to accurately extract this information, feature selection algorithms can be used to screen and sort features in threat intelligence data based on predefined feature importance scores to retain the most important feature information.

[0081] Throughout the analysis process, the progress and results of data processing are continuously monitored and recorded to ensure the accuracy and completeness of data analysis. The reliability of data can be further improved by verifying and cross-checking data from different sources.

[0082] After completing the above steps, the extracted key feature information will be saved in the specified data structure for use in subsequent steps. These key feature information will be used as input to select the appropriate security orchestration script template and generate a customized security response process.

[0083] Furthermore, the acquired threat intelligence data is analyzed to extract key feature information, including:

[0084] Based on the acquired threat intelligence data, a preliminary feature vector is obtained using a Bayesian network. A Bayesian network is a probabilistic graph model consisting of nodes and edges connecting these nodes, where nodes represent random variables and edges represent conditional dependencies between these variables. In the specific implementation, the threat intelligence data first needs to be converted into a format that can be processed by the Bayesian network. To this end, the data is first preprocessed to map various threat indicators and attack technology information to nodes of the Bayesian network. For example, IP addresses, malicious file hashes, attack tools, etc. can be added to the network as nodes. Then, based on the conditional probability distribution in the data, the conditional probabilities between each node are calculated by training the Bayesian network, and the edge weights of the Bayesian network are initialized with the initial conditional probabilities to obtain preliminary feature vectors. These feature vectors represent the probability distribution of each node under specific conditions and are the basis for subsequent analysis.

[0085] Next, the preliminary feature vector is used as an individual of the initial population, and the optimized feature vector is obtained by using a genetic algorithm; and the optimized feature vector is used as the key feature information. Genetic algorithm is a search algorithm based on natural selection and genetic mechanism, which is often used to solve complex optimization problems. In the process of implementing the genetic algorithm, a population is first initialized, and each individual represents a preliminary feature vector. These individuals generate new individuals through crossover and mutation operations, and the feature vectors are gradually optimized. Specific operations include selection, crossover and mutation. The selection operation evaluates the fitness of each individual and selects individuals with better performance for reproduction; the crossover operation generates new individuals by exchanging some genes of two individuals; the mutation operation introduces new features by randomly changing some genes of individuals to increase the diversity of the population.

[0086] In the specific implementation process, the following steps can be used. First, define the fitness function to evaluate the performance of each individual. The fitness function can be defined based on the performance of the feature vector in actual threat intelligence analysis. For example, the feature vector that can accurately identify threats has a higher fitness. Then, through multiple generations of iterative operations, the feature vector is continuously optimized. Each generation includes selection, crossover and mutation operations. After several generations of iterations, a set of optimized feature vectors is finally obtained.

[0087] These optimized feature vectors are the extracted key feature information. In order to ensure the effectiveness of the optimization process, the fitness of the entire population can be evaluated after each generation of iteration to ensure that the average fitness of the population is constantly improving. Finally, when the fitness of the population reaches a predetermined threshold or the number of iterations reaches a predetermined upper limit, the algorithm stops and outputs the optimized feature vector.

[0088] Through the above detailed steps, key feature information can be extracted from threat intelligence data. Specifically, it uses the Bayesian network to obtain preliminary feature vectors, and optimizes these feature vectors through genetic algorithms, and finally extracts key feature information that can accurately and effectively describe threat intelligence. This process not only ensures the accuracy and effectiveness of feature extraction, but also provides a solid data foundation for subsequent automated security response.

[0089] More specifically, the preliminary feature vector is obtained by using the Bayesian network based on the acquired threat intelligence data, including:

[0090] First, initialize the Bayesian network structure, and take each threat indicator and attack technology information in the threat intelligence data as a node of the network to obtain the initial network structure. First, initialize the Bayesian network structure. This step involves taking each threat indicator and attack technology information in the threat intelligence data as a node of the network to form an initial network structure. Threat indicators and attack technology information include IP addresses, URLs, file hash values, attack methods, etc. These nodes are connected by edges, representing the conditional dependencies between them. For example, there may be an edge between a malicious IP address and the associated malicious file hash value, indicating the correlation between the two. In this way, an initial Bayesian network structure is constructed.

[0091] Next, based on the initial network structure, the threat intelligence data is converted into a format suitable for Bayesian network analysis through data preprocessing to obtain preprocessed data. This step requires cleaning, standardization and format conversion of the original data. Data cleaning includes removing noise data and incomplete data records, and standardization is to convert data in different formats into a structured data format, such as JSON or CSV. The goal of format conversion is to ensure that the data of each node can exist in the form required by the Bayesian network, which can facilitate subsequent analysis and calculation.

[0092] Using a dynamic probability distribution function, based on the preprocessed data, the initial conditional probability between each node is calculated, and the edge weights of the Bayesian network are initialized with the initial conditional probability to obtain an initialized Bayesian network. Based on the preprocessed data, the dependencies between the nodes are determined by statistical analysis, and their conditional probabilities are calculated. The initial conditional probability reflects the probability of a node appearing in another node. For example, given a malicious IP address, the probability of the hash value of the malicious file associated with it is calculated. Use these initial conditional probabilities to initialize the edge weights of the Bayesian network, thereby obtaining a fully initialized Bayesian network.

[0093] Afterwards, an adaptive learning rate mechanism is introduced into the initialized Bayesian network, and the parameters of the Bayesian network are adjusted in real time according to the newly input data to obtain the adaptively adjusted Bayesian network and the updated conditional probability. In order to improve the adaptability of the Bayesian network, an adaptive learning rate mechanism is introduced. The purpose of this step is to adjust the parameters of the Bayesian network in real time according to the newly input data to maintain the dynamics and accuracy of the network model. The adaptive learning rate mechanism enables the Bayesian network to automatically update its parameters according to new data by dynamically adjusting the learning rate. For example, when new threat intelligence data is input, the Bayesian network will recalculate the conditional probabilities between nodes based on this data and adjust the edge weights in the network structure. In this way, the network can always reflect the latest threat intelligence information to ensure the real-time and accuracy of the model. This step specifically includes the following processes:

[0094] First, each node in the initialized Bayesian network needs to be and nodes The edge weight between According to formula (1), the update formula of edge weight is as follows:

[0095] ;

[0096] in, is The node at the iteration and nodes The updated edge weights between them; is The node at the iteration and nodes The edge weights between ; It is at the node and nodes Conditional data The joint conditional probability of Is a node Conditional data The conditional probability of Is a node Conditional data The conditional probability of is the adaptive learning rate, calculated according to formula (2):

[0097] ;

[0098] in, is the initial learning rate; is the learning rate decay coefficient; is the current iteration number;

[0099] After completing the update of edge weights, the conditional probability also needs to be updated. The update formula for conditional probability is as follows:

[0100] ;

[0101] in, is The node at the iteration The updated conditional probability of ; is The node at the iteration The conditional probability of is the regularization parameter; is the log-likelihood function For Node The partial derivative of conditional probability is calculated as follows:

[0102] ;

[0103] in, Representation Node The set of neighbor nodes.

[0104] To implement the above method, first, at each iteration, the edge weights and conditional probabilities of the Bayesian network are updated according to the new input data. In each iteration, the new edge weights are calculated by formula (1), and the conditional probabilities of the nodes are updated by formula (3). Formula (2) is used to dynamically adjust the learning rate to ensure that the learning rate gradually decreases as the number of iterations increases, preventing the parameters from being updated too fast or too slow. Regularization parameter The introduction of helps prevent overfitting and improve the generalization ability of the model.

[0105] Through these steps, the Bayesian network can be adjusted in real time, so that it can be dynamically updated according to the newly input data, so as to always maintain an accurate description of the current threat intelligence. This process ensures the dynamics and accuracy of the model, and provides a reliable foundation for further threat intelligence analysis and response.

[0106] Finally, based on the adaptively adjusted Bayesian network and the updated conditional probability, the threat intelligence data is preliminarily classified and feature extracted to generate a preliminary feature vector. The threat intelligence data is divided into different categories, such as malware attacks, phishing, denial of service attacks, etc., through the classification algorithm. At the same time, preliminary feature vectors are extracted from the classified data through the feature extraction algorithm. These preliminary feature vectors contain the key features of each threat indicator and attack technology information, reflecting their probability distribution and dependency in the Bayesian network.

[0107] Through the above detailed steps, the Bayesian network can be initialized from the threat intelligence data, the data can be preprocessed, the initial condition probability can be calculated, the adaptive learning rate mechanism can be introduced, and finally classification and feature extraction can be performed to generate a preliminary feature vector. This process ensures the accurate analysis of threat intelligence data and the extraction of key features, providing a reliable data foundation for subsequent automated security response.

[0108] Specifically, the step of using the preliminary feature vector as an individual of the initial population and using a genetic algorithm to obtain an optimized feature vector includes:

[0109] E101: Initialize a population that contains multiple individuals, each of which represents a preliminary feature vector. These preliminary feature vectors come from the feature information extracted by the Bayesian network in the previous step. The size of the initial population can be determined based on the complexity of the problem and the availability of computing resources. Each individual in the population serves as the basis of the genetic algorithm and carries specific feature information.

[0110] E102: For each individual in the population, use the fitness function to evaluate its performance on multiple optimization objectives. The fitness function is used to evaluate the performance of individuals on multiple optimization objectives. The optimization objectives may include the performance of feature vectors in identifying threats, reducing false alarm rates, and improving detection accuracy. The fitness function needs to be designed based on these objectives and is usually a comprehensive score that reflects the comprehensive performance of individuals in different aspects. By calculating the fitness value, it is possible to identify which individuals have better performance, providing a basis for the next selection operation.

[0111] The fitness function adopts the following formula (5):

[0112] ;

[0113] in, is the fitness function; The feature vector representing the individual; is the weight coefficient; Represents the feature vector Features in Conditional data The probability of Represents the feature vector Features in The weight of Indicates the number of features; is the feature vector Features in Conditional Target The probability of Indicates the target The variance of is used to measure the volatility of the target; is a constant; represents the log-likelihood function For the feature vector The partial derivative of .

[0114] First, for each eigenvector Features in ,calculate , that is, the feature Conditional data This probability can be calculated through the Bayesian network, which uses the conditional probability distribution to calculate based on the conditional dependencies between nodes.

[0115] Next, calculate the eigenvector Each feature in Weight These weights are usually determined through an early feature selection or weight optimization process, reflecting the importance of each feature in threat intelligence analysis.

[0116] Then, the first part of the fitness function is calculated This part measures the eigenvector All features in the data The ratio of the weighted probability under the condition to the total probability. Through this ratio, the eigenvector can be evaluated in the data Effectiveness in identification.

[0117] For the second part , first calculate the eigenvector Each feature Conditional target Probability Similarly, this probability is calculated by the Bayesian network. Then, the target Variance , which is used to measure the volatility of the target. By taking the weighted average of these probability values ​​and weights and dividing by the square root of the target variance, the feature vector can be evaluated in the target. Performance under conditions.

[0118] Finally, calculate the third part of the fitness function .here, represents the log-likelihood function For the feature vector The partial derivative of . Log-likelihood function It is usually used to measure the degree of fit of model parameters under given data. By calculating its partial derivative with respect to the eigenvector, the contribution of the eigenvector to the model fit can be evaluated. This partial derivative is squared and introduced into the fitness function to penalize excessive partial derivative values ​​to prevent overfitting of the model.

[0119] E103: According to the performance of each individual, non-dominated sorting is performed on it, and a part of individuals are selected to enter the next generation population. Non-dominated sorting is a multi-objective optimization method that divides individuals into different levels, each level contains individuals that are not dominated by other individuals in the level. Dominated individuals are inferior to other individuals in multiple objectives, while non-dominated individuals are superior to other individuals in at least one objective. Through this sorting method, individuals with better performance can be selected to enter the next generation population.

[0120] E104: Perform crossover and mutation operations on the individuals selected to enter the next generation population to generate a new population. The crossover operation generates new individuals by exchanging some genes of two individuals. The mutation operation introduces new features and increases the diversity of the population by randomly changing some genes of individuals. For example, the crossover operation can randomly select the cutting points of two individuals and exchange some of their gene segments; the mutation operation can randomly change certain values ​​in the individual feature vector, allowing the population to explore a larger search space.

[0121] E105: Repeat steps E102 to E104, i.e., repeat the steps of fitness evaluation, non-dominated sorting, crossover and mutation operations until the specified stopping condition is met to obtain a set of optimized feature vectors. The stopping condition may be that a predetermined number of iterations is reached, the fitness value of the population is no longer significantly improved, or other predetermined optimization goals are reached. For example, an upper limit on the number of iterations may be set, and the algorithm stops when the upper limit is reached; or the average fitness value of the population may be monitored, and when it does not change much in several generations, it is considered to have converged and the iteration is stopped.

[0122] Through the above process, a set of optimized feature vectors are finally obtained. The optimized feature vectors represent the feature information that is gradually improved during multiple iterations and optimizations. This information can more accurately describe and respond to threat intelligence data, providing a solid data foundation for subsequent security responses.

[0123] Through this optimization process, not only the quality of the feature vector can be improved, but also the effectiveness of the entire threat intelligence analysis and response system can be enhanced.

[0124] Step S103: Based on a predefined security orchestration script template library, a script template matching the extracted key feature information is selected, wherein the script template includes a preset operation sequence for automated security response.

[0125] In step S103, based on the predefined security orchestration script template library, it is crucial to select a script template that matches the extracted key feature information. This process first requires ensuring that the template library contains enough script templates that cover various possible threat types and corresponding automated security response operation sequences.

[0126] First, a security orchestration script template library needs to be established and maintained. This template library is the basis of the entire method. It contains multiple predefined script templates, each of which defines in detail a series of preset automated security response operation sequences. These sequences are customized according to different threat types and attack technology information. These templates can be defined in advance by security experts based on actual needs and experience, and updated regularly to respond to emerging threats. In order to establish this template library, security experts need to design response operation sequences that can effectively respond to these threats based on different types of threats and attack technologies. These sequences include detection, analysis, isolation, cleanup, recovery and other steps to ensure that the entire process from threat detection to processing is fully covered. The template library should be stored in the form of a database, and each template has clear labels and classifications for fast retrieval and matching.

[0127] First, by analyzing the extracted key feature information, determine the corresponding threat type and response requirements. In this step, first analyze the extracted key feature information to identify the corresponding threat type and specific attack technology information. For example, if the feature information indicates the existence of a specific malware attack, it is necessary to identify the characteristics of this attack and its associated technical indicators. Key feature information usually includes the source of the attack, the type of attack, the attack method, the affected system components, etc. In the classification process, each feature information is classified into a specific threat type and response requirement category using predefined classification standards. The matching algorithm plays a key role in this step. It compares the extracted feature information with the template features in the template library to calculate the matching degree of each template with the current threat intelligence.

[0128] Then, based on the classification and matching results, the script template that best matches the feature information is searched and selected in the template library. This process can be achieved with the help of a matching algorithm. The matching algorithm compares the extracted feature information with the predefined features in the template library, calculates the matching degree of each template with the current threat intelligence, and selects the template with the highest matching degree as the candidate template. If the template with the highest matching degree can fully meet the needs of the current threat intelligence, then the template is directly selected for subsequent automated security response operations.

[0129] If no fully matching template is found, the closest template is selected and adaptive adjustments are made to ensure that the template meets specific requirements to effectively respond to current threats. This adjustment can include modifying certain operation sequences or adding additional response steps to better adapt to specific threat intelligence. When making adaptive adjustments, it is necessary to analyze the specific requirements of the current threat intelligence in detail and compare them with the predefined operations of the selected template to find out the parts that are not fully matched. Then, according to actual needs, add or modify the operation steps. For example, if a template lacks an isolation step for specific malware, the corresponding isolation operation can be added to the template. In addition, in order to ensure that the adjusted template can operate normally, it needs to be tested and verified. This can be done by simulating actual attack scenarios in a simulation environment to verify the effectiveness and accuracy of the template. After the test passes, the adjusted template becomes a customized security response script.

[0130] In order to ensure that the selected and adjusted script template can effectively respond to threats, testing and verification are required. This step can be achieved through a simulation test environment, simulating the execution of the template in the actual environment to detect its effectiveness and accuracy. After verification, the adapted script template is finally determined to provide input for subsequent steps.

[0131] By implementing the above detailed steps, it is ensured that the script template that best suits the current threat intelligence is selected from the predefined security orchestration script template library and adaptively adjusted as needed.

[0132] Step S104: Map the extracted key feature information to the corresponding fields in the selected script template to generate a customized security response process for specific threats. This process requires multiple specific operation steps to ensure that technicians in this field can accurately implement the method. The specific implementation process of this step is as follows:

[0133] First, the selected script template needs to be analyzed in detail to determine all configurable fields in the template. Each script template consists of a preset sequence of automated security response operations, which contain a series of configurable fields that define the specific parameters of the response operation, such as the attack source IP address, target system, trigger conditions, response actions, etc. Analyzing the template and clarifying the meaning of each field and its role in the script is the first step in the mapping process.

[0134] Next, the extracted key feature information is matched with the configurable fields in the template, and the configurable fields in the template are automatically filled. Key feature information usually includes threat indicators and attack technology information, such as IP addresses, URLs, file hash values, attack methods, etc. By mapping these feature information to the corresponding fields of the template, each automated operation sequence can be customized to target the current threat intelligence data. In order to achieve this mapping, a mapping rule set needs to be established, which clearly indicates how to fill the feature information into the template field. For example, if the template field requires the IP address of the attack source to be filled in, the IP address extracted from the corresponding feature information will be filled in the field.

[0135] In actual operation, each template field is processed one by one, the corresponding feature information is found, and filled in according to the mapping rules. If some fields cannot be directly filled in through the automatic mapping rules, the system should generate a prompt message to remind the operator to manually configure. Manually configured fields usually involve more complex or context-related information, which may require the operator to adjust and fill in according to the actual situation.

[0136] After all fields are filled, a preliminary customized security response process is generated. This process should contain all necessary information and operation steps to ensure an effective automated response to the current threat intelligence. In order to verify the completeness and correctness of the generated response process, preliminary inspection and testing are required. This includes checking whether all fields have been filled correctly, whether all operation steps are coherent, and whether the overall process conforms to the expected response logic.

[0137] After verification, the customized security response process is saved to the designated system or database so that the security orchestration script can be automatically generated in the subsequent steps. Throughout the process, the accuracy and consistency of the data must be ensured, and all operations should be logged for easy tracking and auditing.

[0138] By implementing the above detailed steps, step S104 can be implemented to map the extracted key feature information to the corresponding fields in the selected script template to generate a customized security response process for specific threats. This process not only ensures the automation and accuracy of the response process, but also lays a solid foundation for the subsequent security orchestration script generation.

[0139] Step S105: According to the generated customized security response process, a security orchestration script is automatically generated, and the security orchestration script is used to coordinate and control multiple security tools and systems. This process involves multiple specific steps to ensure that the orchestration script can accurately and effectively coordinate and control multiple security tools and systems to respond to specific threats in threat intelligence. The specific implementation process of this step is as follows:

[0140] First, the generated customized security response process needs to be converted into a specific script format, and the syntax format meets the requirements of the target orchestration platform. This step requires understanding the script syntax and format specifications of the target orchestration platform. For example, common orchestration platforms may include Ansible, etc. Each platform has its own specific script language and format requirements. Therefore, the system first analyzes the syntax rules of the target orchestration platform and converts each operation step in the security response process into a corresponding script command. For example, if the response process includes the "isolate infected host" operation, an Ansible playbook task for isolating the host can be generated on the Ansible platform.

[0141] Next, verify the syntax of the generated orchestration script to ensure that there are no syntax errors. This step is very important because syntax errors will cause the script to fail when executed. Verification can be achieved through built-in script syntax checking tools, which can automatically check syntax and format errors in the script and provide detailed error information for correction. For example, the `ansible-lint` tool provided by Ansible can perform syntax checking on the generated playbook. With such a tool, you can ensure that the generated script meets the syntax specifications of the target platform.

[0142] After the syntax verification is passed, simulation testing is performed to simulate the execution of the script in the actual environment. The simulation test environment should be as close to the actual production environment as possible, including the same security tools and system configurations. In the simulation test, the generated orchestration script is executed to observe its control effect on various security tools and systems. For example, whether the script successfully calls the firewall rule update command, whether the malware scan is accurately triggered, etc. Through simulation testing, potential problems can be discovered and adjusted to ensure that the script can run smoothly in actual applications.

[0143] According to the results of the simulation test, make necessary adjustments and optimizations to ensure that the script can run effectively in the actual environment. If problems are found during the execution of the script, the cause of the problem needs to be analyzed and the script needs to be corrected. For example, if the parameter setting of a certain operation step is incorrect, the corresponding parameter value needs to be modified; if the order between certain operation steps needs to be adjusted, re-sequence them. The adjusted script is simulated again until the test passes.

[0144] After all verifications and tests are passed, the tested and optimized orchestration script is deployed to the target system to achieve automated security response. This step includes uploading the script to the target platform and setting the corresponding execution trigger conditions. For example, the script can be deployed to the Ansible control node and configured to execute automatically when specific threat intelligence is detected. After deployment, ensure that the script's execution environment has the necessary permissions and resources so that the script can run correctly.

[0145] Through the above detailed steps, step S105 can be implemented to automatically generate security orchestration scripts based on the generated customized security response process, and ensure that these scripts can accurately and effectively coordinate and control multiple security tools and systems, thereby achieving automated security response. This process not only ensures the accuracy of script generation and execution, but also provides strong support for overall security protection.

[0146] A second embodiment of the present application provides an electronic device, the electronic device comprising:

[0147] processor;

[0148] The memory is used to store a program, and when the program is read and executed by the processor, the program executes the method for automatically generating an orchestration script based on threat intelligence provided in the first embodiment of the present application.

[0149] The third embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method for automatically generating an orchestration script based on threat intelligence provided in the first embodiment of the present application is executed.

[0150] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A method for automatically generating an orchestration script based on threat intelligence, characterized in that: include: Obtaining threat intelligence data, including threat indicators and attack technology information; Analyze the acquired threat intelligence data and extract key feature information; including: Based on the acquired threat intelligence data, the preliminary feature vector is obtained using the Bayesian network, including: Initialize the Bayesian network structure, take each threat indicator and attack technology information in the threat intelligence data as a node of the network, and obtain the initial network structure; Based on the initial network structure, the threat intelligence data is converted into a format suitable for Bayesian network analysis through data preprocessing to obtain preprocessed data; Using a dynamic probability distribution function, based on the preprocessed data, calculate the initial conditional probability between each node, and use the initial conditional probability to initialize the edge weights of the Bayesian network to obtain an initialized Bayesian network; An adaptive learning rate mechanism is introduced into the initialized Bayesian network to adjust the parameters of the Bayesian network in real time according to the newly input data, so as to obtain the adaptively adjusted Bayesian network and the updated conditional probability. Based on the adaptively adjusted Bayesian network and the updated conditional probability, the threat intelligence data is preliminarily classified and feature extracted to generate a preliminary feature vector; The preliminary feature vector is used as an individual of the initial population, and the optimized feature vector is obtained by using a genetic algorithm; and the optimized feature vector is used as key feature information; Based on a predefined security orchestration script template library, selecting a script template that matches the extracted key feature information, wherein the script template includes a preset operation sequence for automated security response; Map the extracted key feature information to the corresponding fields in the selected script template to generate a customized security response process for specific threats; According to the generated customized security response process, a security orchestration script is automatically generated, where the security orchestration script is used to coordinate and control multiple security tools and systems.

2. The method for automatically generating an orchestration script based on threat intelligence according to claim 1, characterized in that: The acquisition of threat intelligence data includes: Collect threat intelligence data from multiple threat intelligence sources, including open source threat intelligence, commercial threat intelligence services, and internal security logs; Standardize the format of collected threat intelligence data; Store standardized threat intelligence data in the threat intelligence database.

3. The method for automatically generating an orchestration script based on threat intelligence according to claim 1, characterized in that: The adaptive learning rate mechanism is introduced into the initialized Bayesian network, and the parameters of the Bayesian network are adjusted in real time according to the newly input data to obtain the adaptively adjusted Bayesian network and the updated conditional probability, including: For each node in the initialized Bayesian network and nodes The edge weights between are dynamically adjusted according to the following formula (1): ； in, is The node at the iteration and nodes The updated edge weights between them; is The node at the iteration and nodes The edge weights between It is at the node and nodes Conditional data The joint conditional probability of Is a node Conditional data The conditional probability of Is a node Conditional data The conditional probability of is the adaptive learning rate, calculated according to the following formula (2): ； in, is the initial learning rate; is the learning rate decay coefficient; is the current iteration number; According to the following formula (3), the conditional probability is updated: ； in, is The node at the iteration The updated conditional probability of ; is The node at the iteration The conditional probability of is the regularization parameter; is the log-likelihood function For Node The partial derivative of conditional probability is calculated as follows: ； in, Representation Node The set of neighbor nodes.

4. The method for automatically generating an orchestration script based on threat intelligence according to claim 1, characterized in that: The method of using the preliminary feature vector as an individual of the initial population and using a genetic algorithm to obtain an optimized feature vector includes: E101: Initialize a population, which contains multiple individuals, each of which represents a preliminary feature vector; E102: For each individual in the population, use the fitness function to evaluate its performance on multiple optimization objectives; E103: Perform non-dominated sorting on each individual based on its performance, and select a portion of individuals to enter the next generation population; E104: Perform crossover and mutation operations on the next generation population to generate a new population; E105: Repeat steps E102 to E104 until a specified stop condition is met, thereby obtaining a set of optimized feature vectors.

5. The method for automatically generating an orchestration script based on threat intelligence according to claim 4, characterized in that: The fitness function in step E102 adopts the following formula (5): ； in, is the fitness function; The feature vector representing the individual; is the weight coefficient; Represents the feature vector Features in Conditional data probability; Represents the feature vector Features in The weight of Indicates the number of features; is the feature vector Features in Conditional Target probability; Indicates the target The variance of is used to measure the volatility of the target; is a constant; represents the log-likelihood function For the feature vector The partial derivative of .

6. The method for automatically generating an orchestration script based on threat intelligence according to claim 1, characterized in that: The step of selecting a script template that matches the extracted key feature information based on a predefined security orchestration script template library includes: Establish and maintain a security orchestration script template library, the template library including a plurality of predefined script templates, each script template defining a series of automated security response operations; Classify and match the extracted key feature information to determine the corresponding threat type and response requirements; According to the classification and matching results of the extracted key feature information, the most suitable script template is selected from the template library; If no exact match is found, the closest template is selected and adapted to meet specific needs.

7. The method for automatically generating an orchestration script based on threat intelligence according to claim 1, characterized in that: The step of mapping the extracted key feature information to corresponding fields in the selected script template includes: Analyze the selected script template and determine the configurable fields in the template; Automatically fill in the configurable fields in the template based on the extracted key feature information; If there are fields that cannot be automatically filled, a prompt message is generated to remind the operator to configure manually; Generate a customized security response process containing all necessary information and verify its completeness and correctness.

8. The method for automatically generating an orchestration script based on threat intelligence according to claim 1, characterized in that: The method of automatically generating a security orchestration script based on the generated customized security response process includes: Converting the customized security response process into a specific syntax format of the orchestration script, where the syntax format meets the requirements of the target orchestration platform; Verify the syntax correctness of the generated orchestration script to ensure there are no syntax errors; Conduct simulation tests on the generated orchestration scripts to simulate their execution in the actual environment; Adjust and optimize according to the results of simulation tests to ensure that the script can run effectively in the actual environment; Deploy tested and optimized orchestration scripts to target systems to automate security responses.

Images