Enterprise information security automatic response method and device and medium

Abstract

The invention provides an enterprise information security automatic response method and device, and belongs to the technical field of network information security, the method comprises the following steps: firstly, outputting an alarm IP and an alarm level of an alarm log through a large language model, and then carrying out analysis through a multi-layer rechecking mechanism: if the IP geographic position of the alarm log is the Internet, further analyzing the IP threat degree; if the IP threat degree is malicious, further confirming whether the alarm IP is matched with a local white list; if the matching is unsuccessful, the IP risk level is marked as malicious, and the IP risk level is marked as suspicious under other conditions. And finally, by calculating a risk value comparison threshold value of the alarm IP, determining whether the alarm IP is malicious or not and taking a blocking measure. According to the method, the construction link of an enterprise information security operation and automatic response platform can be simplified, the discovery possibility and the automatic response capability of security personnel on unknown attack behaviors in massive logs can be increased, and the probability of information security events of enterprises is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network information security, and in particular relates to a method, a device and a medium for automatic response to enterprise information security based on alarm logs. Background Art

[0002] Security devices, system logs, sensors, and monitoring tools will accumulate a large amount of alarm log data during long-term operation. These alarm log data include real security incidents, such as hacker scanning logs and equipment compromise logs, as well as a large amount of false alarm information. At this time, the amount of alarm log data is far greater than the handling capacity of security managers, and security incidents will also be submerged in a large number of invalid alarms, resulting in security managers being unable to promptly discover and handle security threats in massive alarm logs.

[0003] There are two main types of current mainstream information security operations and automation solutions. The first type is the enterprise security information and event management system (SIEM), which collects event data from various data sources and uses complex algorithms to analyze to detect threats. The analysis results can be used to generate reminders, alarms, and guide response work. The disadvantage of this solution is that it requires customized development of programs for various steps such as log filtering, parsing, and classification. The development cycle and cost cannot be controlled. Once the enterprise introduces new security equipment, it is uncertain whether it can be successfully connected.

[0004] The second category is the Security Automation and Response Platform (SOAR). The SOAR platform automates the execution of security tasks by orchestrating different security tools and technologies, helping to integrate and coordinate different security tools and processes to improve security response efficiency. The disadvantage of this solution is that it can only execute orchestrated tasks. When encountering unknown tasks, it cannot execute tasks. However, as network attacks become increasingly complex, experts cannot predefine all alarm behaviors, and cannot associate multiple security device alarm analyses. Summary of the invention

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides a method, device and medium for automated response to enterprise information security, so as to solve the technical problems in the prior art that enterprises have a long investment cycle in building related platforms / systems, the cost and equipment adaptability are uncontrollable, it is difficult to detect or the response capability is poor to unknown attack behaviors, and it is impossible to associate alarm analysis of multiple security devices.

[0006] In order to achieve the above object, the main technical solutions adopted by the present invention include:

[0007] In a first aspect, an embodiment of the present invention provides a method for automated response to enterprise information security, including:

[0008] S1. Input the real-time alarm logs collected from multiple security devices into the constructed large language model, and output the alarm IP and alarm level; if the alarm level is normal, mark the IP risk level as normal and jump to step S3; if the alarm level is abnormal, jump to step S2;

[0009] S2. Analyze through a multi-layer review mechanism: if the IP location of the alarm log is the Internet, further analyze the IP threat level; if the IP threat level is malicious, further confirm whether the alarm IP matches the local whitelist; if the match is unsuccessful, mark the IP risk level as malicious, and in other cases, mark the IP risk level as suspicious;

[0010] S3. If the IP risk level is malicious, it will be automatically blocked; if the IP risk level is normal or suspicious, the analysis results will be input into the preset calculation rules to output the risk value of each alarm IP, and the same alarm IP will be associated to comprehensively determine whether the risk value exceeds the preset threshold; if it is judged as yes, disposal measures will be taken; if it is judged as no, an alarm record will be generated.

[0011] Furthermore, the remaining situations are all marked as suspicious IP risk levels, including:

[0012] Match the alarm IP with the GEOIP database, and output whether the alarm IP belongs to the Internet or the local area network. If the IP belongs to the local area network, mark the IP risk level as suspicious;

[0013] Match the alarm IP whose IP geographic location is the Internet with the threat intelligence library, and output the IP threat level as malicious, suspicious, or normal. If the threat level is suspicious or normal, mark the IP risk level as suspicious;

[0014] Match the alarm IPs with malicious IP threat level with the local whitelist. If the match is successful, mark the IP risk level as suspicious.

[0015] Furthermore, the handling means in step S3 includes: blocking the alarm IP and simultaneously changing its IP risk level to malicious.

[0016] Furthermore, the preset calculation rules include a calculation formula R=D*G*W*α, where R is the risk value, D is the alarm level, G is the IP affiliation, W is the threat level, and α is the whitelist matching status; each independent variable takes different parameter values ​​according to the analysis results; if a certain independent variable has no output result, the minimum value of the independent variable parameter value is taken.

[0017] Furthermore, the step S3 described in associating the same alarm IP to comprehensively determine whether the risk value exceeds the preset threshold, including: associating and analyzing whether the alarm IP is repetitive, and if so, accumulating the risk value to determine whether it exceeds the preset threshold; if not, directly outputting the alarm record.

[0018] Furthermore, the method also includes: formatting and outputting the results of the analysis of each alarm log and storing them in a database, the results including at least the alarm IP, IP risk level, alarm level, whitelist matching status, IP ownership, log recording time and risk value.

[0019] Furthermore, in step S1, the data sources of the alarm log mainly include firewalls, WAF, situational awareness, intrusion detection and other security devices. Log delivery and collection tools such as syslog and filebeat are used to send the security alarm logs generated by the devices to the message queue to achieve real-time log delivery, and the aggregation of alarm logs of multiple devices is achieved through the message queue.

[0020] In a second aspect, an embodiment of the present invention further provides a device for automated response to enterprise information security, including:

[0021] The data analysis module is used to obtain the real-time alarm logs of multiple security devices and input them into the constructed large language model to output the alarm IP and alarm level;

[0022] The result review module uses a multi-layer progressive review mechanism of "IP geographic location-IP threat level-local whitelist matching" to conduct a step-by-step analysis of the alarm IPs with abnormal alarm levels; marking the IP risk levels corresponding to different situations;

[0023] The calculation module is used to input each analysis result into the preset calculation rules and output the risk value;

[0024] The correlation analysis module is used to correlate the alarm IPs whose IP risk levels are marked as normal or suspicious, confirm whether there are the same alarm IPs, and comprehensively determine whether the risk value exceeds the preset threshold;

[0025] The disposal module is used to block the alarm IP whose IP risk value exceeds the preset threshold or the alarm IP whose IP risk level is marked as malicious; the remaining alarm IPs generate alarm records.

[0026] Furthermore, the result review module includes:

[0027] An IP attribution analysis unit is used to match the alarm IP with the GEOIP library and output the IP attribution of the alarm IP as the Internet or the local area network;

[0028] The threat level analysis unit matches the alarm IPs belonging to the Internet with the threat intelligence database and outputs the IP threat level as malicious, suspicious, or normal.

[0029] Whitelist matching analysis unit, matching the alarm IPs with malicious IP threat level with the local whitelist;

[0030] Output unit, if the IP belongs to the local area network, the IP risk level is marked as suspicious; if the IP threat level is suspicious or normal, the IP risk level is marked as suspicious; if the alarm IP matches the local whitelist, the IP risk level is marked as suspicious; if the alarm IP does not match the local whitelist, the IP risk level is marked as malicious.

[0031] In a third aspect, an embodiment of the present invention further provides a computer-readable medium, wherein a computer program is stored in the storage medium, and the computer program is configured to execute any of the aforementioned enterprise information security automated response methods and devices when running.

[0032] The beneficial effects of this technical solution are as follows: (1) It simplifies the construction of enterprise information security operations and automated response platforms, and the enterprise security investment cycle and cost are controllable; (2) Through the operating principle of the multi-layer review mechanism, it not only effectively reduces the possible errors in large language model analysis, but also increases the possibility of security personnel discovering unknown attack behaviors in massive logs and the ability to automatically respond; (3) It can realize the correlation analysis of multiple security device alarm logs and provide sortable security risk scores, thereby reducing the probability of information security incidents in the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 The present invention is a flowchart of a method for automated response to enterprise information security.

[0034] Figure 2 A schematic diagram of the input and output flow of the large language model of the present invention.

[0035] Figure 3 It is a schematic diagram of the process of the multi-layer review mechanism of the present invention.

[0036] Figure 4 It is a flow chart of the association analysis module of the present invention. DETAILED DESCRIPTION

[0037] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be interpreted as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0038] Explanation of relevant terms in this application:

[0039] Large Language Model: A large language model is an artificial intelligence model based on deep learning that can be used to generate large-scale natural language texts, such as articles and conversations. The large model learns complex patterns and features by training massive data, has stronger generalization capabilities, and can make accurate predictions on unseen data.

[0040] Threat Intelligence Database: Threat Intelligence Database is a database that collects, analyzes and organizes threat intelligence. The Threat Intelligence Database includes not only known threats, but also unknown threats, abnormal activities or other suspicious behaviors. It can provide real-time and near real-time threat intelligence data to security practitioners, helping them to timely discover and take targeted security measures based on these threat intelligence, thereby improving the company's network security defense capabilities.

[0041] KAFKA cluster: KAFKA cluster is a distributed, high-performance messaging system that can provide reliable, high-throughput messaging services.

[0042] LAN: A LAN is a network formed by connecting several computers within a smaller area, usually used for internal communication and resource sharing.

[0043] Reference Figure 1 and Figure 2 , this implementation provides a method for automated response of enterprise information security, including the following steps:

[0044] S1. Input the real-time alarm logs collected from multiple security devices into the constructed large language model, and output the alarm IP and alarm level; if the alarm level is normal, mark the IP risk level as normal and jump to step S3; if the alarm level is abnormal, jump to step S2;

[0045] S2. Further analysis is carried out through a multi-layer review mechanism: if the IP geographical location of the alarm log is the Internet, the IP threat level is further analyzed; if the IP threat level is malicious, it is further confirmed whether the alarm IP matches the local whitelist; if the match is unsuccessful, the IP risk level is marked as malicious, and in other cases, the IP risk level is marked as suspicious;

[0046] S3. If the IP risk level is malicious, it will be automatically blocked; if the IP risk level is normal or suspicious, the analysis results will be input into the preset calculation rules to output the risk value of each alarm IP, and the same alarm IP will be associated to comprehensively determine whether the risk value exceeds the preset threshold; if it is judged as yes, disposal measures will be taken; if it is judged as no, an alarm record will be generated.

[0047] Specifically, the "preset calculation rules" in step S3 include the calculation formula R=D*G*W*α, where R is the risk value, D is the alarm level, G is the IP attribution, W is the threat level, and α is the whitelist matching status; each independent variable takes different parameter values ​​according to the analysis results; if a certain independent variable has no output result, the minimum value of the independent variable parameter value is taken. For specific application, please see the following text.

[0048] The "preset calculation rules" also include: if there are multiple identical alarm IPs, the risk values ​​of the identical alarm IPs are summed up. The summation step is completed by the association analysis module.

[0049] Specifically, the data source of the alarm log in step S1 mainly includes firewalls, WAF, situational awareness, intrusion detection and other security devices. The security alarm log generated by the device is sent to the message queue using log delivery and collection tools such as syslog and filebeat to achieve real-time log delivery, and the aggregation of multiple device alarm logs is achieved through the message queue. In the embodiment of the present invention, the KAFKA cluster is used as the message queue. When there are new alarm devices that need to be monitored later, it is only necessary to synchronize the alarm log to the KAFKA cluster.

[0050] The alarm log in the message queue is transmitted to the constructed large language model. Through continuous intervention in the analysis results of the large language model, it is required to format the alarm IP and alarm level in the output alarm log, where the alarm level is recorded as D. In this embodiment, the alarm levels are divided into high risk, medium risk, low risk, and normal, and are correspondingly recorded as D1, D2, D3, and D4, and the risk parameter values ​​are 1, 0.5, 0.1, and 0, respectively. For specific details, please refer to the following Table 1. Of course, how to divide the alarm levels and the reference values ​​corresponding to each level can be adjusted according to the actual situation of the enterprise.

[0051] Alarm level mark Risk reference value High risk D1 1 Moderate D2 0.5 Low risk D3 0.1 normal D4 0

[0052] Table 1 Classification and value of alarm level D

[0053] Specifically, the large language model classifies the alarm logs into alarm levels based on the correlation analysis of the access behavior, access frequency, access characteristics, access success, and other dimensions in the alarm logs. For example, normal access logs are identified as normal; abnormal requests, suspicious crawlers, directory scanning, and other scanning behaviors are identified as low risk; XSS injection, CSRF injection, SQL injection, and other attack behaviors but access failure are identified as medium risk; command injection, SQL injection, and other attack behaviors and access success are identified as high risk.

[0054] Reference Figure 3 In order to reduce the serious impact on the production environment caused by large language model analysis errors, this technical solution designs a multi-layer review mechanism in step S2. The analysis principle of "alarm, etc. - IP geographic location - IP threat level - local whitelist matching" is as follows:

[0055] If the large language model identifies that the alarm level of the alarm log is normal, the IP risk level of the alarm log is recorded as normal, and according to the above calculation formula, D takes the minimum value of 0, that is, the risk value R is 0. Further, the log is thrown into the correlation analysis module for analysis.

[0056] If the large language model analysis result is identified as high risk, medium risk or low risk, the extracted alarm IP is matched with the GEOIP library and the geographical location of the IP is output. The geographical location is classified by LAN and Internet (actual address) and recorded as G (divided into G1 and G2 according to location). In this embodiment, G1 takes a value of 0.95 and G2 takes a value of 0.05. Similarly, the score can be adjusted according to the actual situation of the enterprise. The scoring of the embodiment of the present invention is shown in Table 2 below:

[0057] IP ownership mark Risk reference value internet G1 0.95 local area network G2 0.05

[0058] Table 2 Classification and value of IP attribute G

[0059] If the IP belongs to the local area network, the IP risk level is marked as suspicious. After calculating the formula and recording the risk value of the log, the alarm log is thrown into the correlation analysis module to complete the analysis of the log. For example: the alarm level of an alarm log is medium-risk and further analyzed as a local area network through IP attribution, then the value of D is 0.5, and the value of G is 0.05. Since the threat level W and the whitelist matching status α are not involved in the analysis, W takes the minimum value of 0.01 (see Table 3 below for details), and α takes the minimum value of 0.01 (see Table 4 below for details), and the risk value R = 0.5*0.05*0.01*0.01; at the same time, the IP risk level of the alarm log is marked as suspicious.

[0060] If the IP belongs to the Internet, the extracted alarm IP is matched with the threat intelligence library and the IP matching result is output. In this embodiment, the threat intelligence matching result is divided into malicious, suspicious, and normal. The output result is recorded as W (divided into W1, W2, and W3 according to the threat level). Similarly, the scores corresponding to each threat level can be adjusted according to the actual situation of the enterprise. The reference values ​​in the embodiment of the present invention are shown in Table 3 below.

[0061] IP Threat Level mark Risk reference value Malicious W1 0.9 suspicious W2 0.09 normal W3 0.01

[0062] Table 3 Classification and value of IP threat level W

[0063] If the threat level is suspicious or normal, the IP risk level of the alarm log is marked as suspicious, and the log risk value R is recorded and thrown into the correlation analysis module to complete the log analysis. For example: the alarm level of an alarm log is medium-risk and further analyzed as the Internet through IP attribution. According to the multi-layer review mechanism, the IP threat level is further analyzed as suspicious, then D takes the value of 0.5, G takes the value of 0.95, W takes the value of 0.09, and because the whitelist matching status α is not involved in the analysis, the value is 0.01, and the risk value R = 0.5*0.95*0.09*0.01; at the same time, the IP risk level of the alarm log is marked as suspicious.

[0064] If the threat level is malicious, the extracted IP is matched with the local whitelist. If it matches the whitelist, the IP risk level is marked as suspicious, and the log risk value is recorded as D*G*W*α, where the α setting value is 0.01 for matching and 1 for non-matching. Similarly, 0.01 here can be adjusted according to the actual situation. Throw the log into the association analysis module to complete the log analysis. For example: The alarm level of an alarm log is medium-risk and the IP attribution analysis is the Internet. After further analysis, the IP threat level is malicious. According to the multi-layer review mechanism, it is further associated with the local whitelist and the IP can be matched. Then the calculation rule is: D takes the value of 0.5, G takes the value of 0.95, W takes the value of 0.9, the whitelist matching status α is 0.01, and the risk value R = 0.5*0.95*0.9*0.01; at the same time, the IP risk level of the alarm log is marked as suspicious.

[0065] If the IP of the alarm log does not match the whitelist, the automatic blocking of this alarm is completed through the API of the firewall, network gate or other gateway device, and the IP risk level is marked as malicious. After recording the risk value R of the log, the analysis of the log is completed. For example: the alarm level of an alarm log is medium-risk and the IP attribution analysis is the Internet. After further analysis of its IP threat level as malicious, according to the multi-layer review mechanism, it is further associated with the local whitelist and the IP is not matched. Then the calculation rule is: D takes the value of 0.5, G takes the value of 0.05, W takes the value of 0.9, the whitelist matching status α takes the value of unmatched 1, and the risk value R = 0.5*0.95*0.9*1; at the same time, the IP risk level of the alarm log is marked as malicious.

[0066] Whitelist matching status mark Risk reference value match <![CDATA[α1]]> 0.01 No match <![CDATA[α2]]> 1

[0067] Table 4 Classification and value of whitelist matching status α

[0068] After the multi-layer review mechanism logic judgment, the risk value of each alarm log is analyzed according to the alarm IP and stored in the MYSQL database. The main table of the database of the embodiment of the present invention is introduced in Table 5 below.

[0069]

[0070] Table 5 Database diagram

[0071] refer to Figure 4 , this implementation further describes the correlation analysis mechanism in detail. When the multi-layer review mechanism is completed and the risk value of each alarm log is calculated, it is also necessary to associate the alarm log IP marked with the IP risk level as normal or suspicious to confirm whether the alarm IP is repetitive. If it is repeated, the risk value of the alarm IP is accumulated and calculated to confirm whether it exceeds the preset threshold; if it does not appear repeatedly, the alarm record is output directly. If the accumulated risk value exceeds the preset threshold, it will directly enter the disposal module for banning, and simultaneously change its IP risk level to malicious. By utilizing the method of multi-device risk value correlation analysis calculation, the ability to discover unknown attack methods is increased. If the accumulated risk value does not exceed the preset threshold, the alarm log is directly output.

[0072] For example, if the risk value of an alarm IP is R = 0.5*0.95*0.9*0.01 = 0.004275 and it occurs three times, the final risk value = 0.004275*3 = 0.012825. The accumulated risk value 0.012825 is used to determine whether it exceeds the preset threshold.

[0073] In summary, the technical solution of the present application can realize real-time security incident discovery and automated handling, and provide security personnel with sortable security risk scores, ensuring that security personnel can quickly discover security threats in massive logs, thereby reducing the probability of information security incidents occurring in the enterprise.

[0074] Another embodiment of the present invention provides a device for automated response to enterprise information security, including:

[0075] The data analysis module is used to obtain the real-time alarm logs of multiple security devices and input them into the constructed large language model to output the alarm IP and alarm level;

[0076] The result review module uses a multi-layer review mechanism of "IP geographic location-IP threat level-local whitelist matching" to conduct a step-by-step analysis of the alarm IPs with abnormal alarm levels; marking the IP risk levels corresponding to different situations;

[0077] The calculation module is used to input each analysis result into the preset calculation rules and output the risk value;

[0078] The correlation analysis module is used to correlate the alarm IPs whose IP risk levels are marked as normal or suspicious, confirm whether there are the same alarm IPs, and comprehensively determine whether the risk value exceeds the preset threshold;

[0079] The disposal module is used to ban the alarm IP whose risk value exceeds the preset threshold, automatically block the alarm IP whose IP risk value is marked as malicious, and generate an alarm record for the alarm IP whose risk value does not exceed the preset threshold.

[0080] Specifically, the result review module includes:

[0081] An IP attribution analysis unit is used to match the alarm IP with the GEOIP library and output the IP attribution of the alarm IP as the Internet or the local area network;

[0082] The threat level analysis unit matches the alarm IPs belonging to the Internet with the threat intelligence database and outputs the IP threat level as malicious, suspicious, or normal.

[0083] Whitelist matching analysis unit, matching the alarm IPs with malicious IP threat level with the local whitelist;

[0084] Output unit, if the IP belongs to the local area network, the IP risk level is marked as suspicious; if the IP threat level is suspicious or normal, the IP risk level is marked as suspicious; if the alarm IP matches the local whitelist, the IP risk level is marked as suspicious; if the alarm IP does not match the local whitelist, the IP risk level is marked as malicious.

[0085] Another embodiment of the present invention provides a computer-readable storage medium, including a computer-readable storage medium storing a computer program and a processor. When the computer program is read and executed by the processor, the method for automated response to enterprise information security as described above is implemented.

[0086] Since the system / device described in the above embodiments of the present invention is a system / device used to implement the method of the above embodiments of the present invention, a person skilled in the art can understand the specific structure and deformation of the system / device based on the method described in the above embodiments of the present invention, and thus will not be described in detail here. All systems / devices used in the method of the above embodiments of the present invention belong to the scope of protection of the present invention.

[0087] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the protection scope of the present invention.

[0088] Since the system / device described in the above embodiments of the present invention is a system / device used to implement the method of the above embodiments of the present invention, a person skilled in the art can understand the specific structure and deformation of the system / device based on the method described in the above embodiments of the present invention, and thus will not be described in detail here. All systems / devices used in the method of the above embodiments of the present invention belong to the scope of protection of the present invention.

[0089] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the protection scope of the present invention.

Claims

1. A method for automated response to enterprise information security, characterized in that The steps include: S1. Input the real-time alarm logs collected from multiple security devices into the constructed large language model, and output the alarm IP and alarm level; if the alarm level is normal, mark the IP risk level as normal and jump to step S3; if the alarm level is abnormal, jump to step S2; S2. Analyze through a multi-layer review mechanism: if the IP location of the alarm log is the Internet, further analyze the IP threat level; if the IP threat level is malicious, further confirm whether the alarm IP matches the local whitelist; if the match is unsuccessful, mark the IP risk level as malicious, and in other cases, mark the IP risk level as suspicious; S3. If the IP risk level is malicious, it will be automatically blocked; If the IP risk level is normal or suspicious, each analysis result is input into the preset calculation rules to output the risk value of each alarm IP, and the same alarm IP is associated to comprehensively determine whether the risk value exceeds the preset threshold; If it is determined to be so, then disposal measures will be taken; If the judgment is no, an alarm record is generated.

2. A method for automated enterprise information security response as described in claim 1, characterized in that The remaining cases are marked as suspicious IP risk level, including: Match the alarm IP with the GEOIP database, and output whether the alarm IP belongs to the Internet or the local area network. If the IP belongs to the local area network, mark the IP risk level as suspicious; Match the alarm IP whose IP geographic location is the Internet with the threat intelligence library, and output the IP threat level as malicious, suspicious, or normal. If the threat level is suspicious or normal, mark the IP risk level as suspicious; Match the alarm IPs with malicious IP threat level with the local whitelist. If the match is successful, mark the IP risk level as suspicious.

3. The method for automated enterprise information security response as claimed in claim 1, characterized in that The treatment means in step S3 include: The warning IP is blocked and its IP risk level is changed to malicious at the same time.

4. A method for automated enterprise information security response as described in claim 1 or 2, characterized in that The preset calculation rules include the calculation formula R=D*G*W*α, Where R is the risk value, D is the warning level, G is the IP attribution, W is the threat level, and α is the whitelist matching status; each independent variable takes different parameter values ​​according to the analysis results; If there is no output result for a certain independent variable, the minimum value among the parameter values ​​of the independent variable is taken.

5. The method for automated enterprise information security response as claimed in claim 1, characterized in that The step S3 of associating the same alarm IP to comprehensively determine whether the risk value exceeds the preset threshold includes: associating and analyzing whether the alarm IP is repetitive, and if so, accumulating the risk value to determine whether it exceeds the preset threshold; if not, directly outputting the alarm record.

6. The method for automated enterprise information security response as claimed in claim 1, characterized in that The method also includes: formatting and outputting the results of the analysis of each alarm log and storing them in a database, the results including at least the alarm IP, IP risk level, alarm level, whitelist matching status, IP ownership, log recording time and risk value.

7. The method for automated enterprise information security response as claimed in claim 1, characterized in that In step S1, the data sources of the alarm log mainly include firewalls, WAF, situational awareness, intrusion detection and other security devices. Log transmission and collection tools such as syslog and filebeat are used to send the security alarm logs generated by the devices to the message queue to achieve real-time log transmission, and the aggregation of alarm logs of multiple devices is achieved through the message queue.

8. An enterprise information security automated response device, characterized in that include: The data analysis module is used to obtain the real-time alarm logs of multiple security devices and input them into the constructed large language model to output the alarm IP and alarm level; The result review module uses the multi-layer progressive review mechanism of "IP geographic location-IP threat level-local whitelist matching" to conduct a step-by-step analysis of the alarm IPs with abnormal alarm levels; marking the IP risk levels corresponding to different situations; The calculation module is used to input each analysis result into the preset calculation rules and output the risk value; The correlation analysis module is used to correlate the alarm IPs whose IP risk levels are marked as normal or suspicious, confirm whether there are the same alarm IPs, and comprehensively determine whether the risk value exceeds the preset threshold; The disposal module is used to block the alarm IP whose IP risk value exceeds the preset threshold or the alarm IP whose IP risk level is marked as malicious; the remaining alarm IPs generate alarm records.

9. The device for automated enterprise information security response as claimed in claim 8, characterized in that The result review module comprises: An IP attribution analysis unit is used to match the alarm IP with the GEOIP library and output the IP attribution of the alarm IP as the Internet or the local area network; The threat level analysis unit matches the alarm IPs belonging to the Internet with the threat intelligence database and outputs the IP threat level as malicious, suspicious, or normal. Whitelist matching analysis unit, which matches the alarm IPs with malicious IP threat level with the local whitelist; Output unit, if the IP belongs to the local area network, the IP risk level is marked as suspicious; if the IP threat level is suspicious or normal, the IP risk level is marked as suspicious; if the alarm IP matches the local whitelist, the IP risk level is marked as suspicious; if the alarm IP does not match the local whitelist, the IP risk level is marked as malicious.

10. A computer-readable medium, characterized in that The storage medium stores a computer program, wherein the computer program is configured to execute the enterprise information security automated response method and device described in any one of claims 1 to 9 when running.

Images