Network security operation supervision system

Abstract

The invention relates to a network security operation supervision system, and the system comprises an information obtaining and analysis module which is used for obtaining network security event log information sent by a security monitoring system; the matching evaluation module is used for preliminarily matching the core event attribute with a feature library corresponding to the type and pre-stored in a platform; the work order generation module is used for generating a primary disposal work order matched with the network security event according to the risk level tag corresponding to the network security event, the recommended disposal means and the recommended disposal main body, and forming a primary disposal sequence; the work order optimization module is used for receiving the primary processing sequence and forming a comprehensive sequence table by taking the recommended processing main body as a sorting factor; according to the invention, the switching frequency among different recommended disposal subjects is reduced, extra time and resource consumption caused by switching of the recommended disposal subjects and disposal means is reduced, and the effect of effectively improving the comprehensive disposal efficiency of the network security events is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security operation supervision system. Background Art

[0002] In the current network security operation plan, when the existing security monitoring system detects a network security incident, it usually reports it to the server, and the security monitoring personnel will query the information such as the region, unit, and person in charge of the network security incident, and notify the unit or person in charge of the network security incident to deal with it. However, this manual method is slow and prone to query errors. It is impossible to effectively supervise and guide the progress of the discovery, judgment and disposal of network security incidents. There are problems such as lack of understanding, supervision and command of the progress of solving network security incidents.

[0003] The Chinese invention patent with application number 202310712710.6 discloses a network security operation analysis method based on a security cloud. The method determines the type of network security incident and extracts the first key feature information and the second key feature information of the network security incident based on the log information of the network security incident; determines the recommended disposal means and the recommended disposal subject corresponding to the network security incident based on the first key feature information; obtains the risk level label corresponding to the network security incident based on the second key feature information; generates and handles the work order based on the risk level label and the recommended disposal means corresponding to the network security incident, and sends the disposal work order to the recommended disposal subject.

[0004] In the prior art, a handling order work order is generated according to the characteristics and risk level of the network security incident, which achieves the role of effective supervision and guidance. However, in the actual handling process, the extra time caused by switching subjects between different incidents and the fixed sorting waiting time are added, which affects the efficiency and effect of handling network security incidents. Summary of the invention

[0005] The present invention aims at the technical problems existing in the prior art and provides a network security operation supervision system.

[0006] The technical solution of the present invention to solve the above technical problems is as follows: a network security operation supervision system, characterized in that the system comprises:

[0007] An information acquisition and analysis module is used to acquire network security event log information sent by the security monitoring system, determine the type of the network security event according to the network security event log information, and extract the core event attributes and evaluation quantitative information of the network security event;

[0008] A matching and evaluation module is used to preliminarily match the core event attributes with the feature library corresponding to the type pre-stored in the platform, determine the disposal means and disposal subject corresponding to the network security event as the recommended disposal means and recommended disposal subject; input the evaluation quantitative information into the network security situation quantitative evaluation model corresponding to the type in the platform, and obtain the risk level label corresponding to the network security event;

[0009] A work order generation module is used to generate a preliminary handling work order matching the network security incident according to the risk level label, recommended handling means and recommended handling subject corresponding to the network security incident, so as to form a primary handling sequence;

[0010] The work order optimization module is used to receive the primary disposal sequence and form a comprehensive sequence list based on the recommended disposal subject as a sorting factor; divide the events of the same risk level and the same recommended disposal subject into the same event group and sort them according to time, and the comprehensive sequence list includes several event groups; send the event group to the recommended disposal subject for disposal, and generate an event disposal report;

[0011] The real-time monitoring module is used to receive event handling reports, monitor the handling status of handling work orders in real time, and issue timely warnings for abnormal status situations.

[0012] Furthermore, the incident handling report includes the actual handling subject, actual handling means, handling time, handling results, handling subject status and the type of network security incident; the actual handling subject and actual handling means are actual operations taken during the actual handling process; the handling results include successful handling and abnormalities; the handling time is the actual handling time of the successfully handled network security incident; the handling subject status is a mark of whether the current usage status of the handling subject is normal; the type of network security incident is the type of security incident.

[0013] Furthermore, the system also includes: an efficiency evaluation module, which is used to obtain the handling time of the network security incident and the comprehensive efficiency index of the corresponding handling subject, and establish a handling optimization table according to the handling subject and the corresponding handling means.

[0014] Furthermore, the comprehensive performance indicators include the handling success rate, average response time and event types that the handling subject is good at handling for the network security incidents. The handling success rate is based on the handling success rate of all events handled by the current handling subject; the average response time is the average handling time of all successfully handled events, and the event types that the handling subject is good at handling are obtained by comprehensive analysis of the comprehensive success rates and average handling times of different types of events.

[0015] Furthermore, the handling optimization table is generated based on the matching degree between the comprehensive effectiveness index and the corresponding handling means; the matching degree is obtained by respectively calculating the comprehensive success rate and the average handling time of multiple handling means for the same event type, and the one with the highest comprehensive success rate and the shortest average handling time has the highest matching degree. The handling means with the highest matching degree in event handling is selected as the preferred means to form a handling optimization table.

[0016] Furthermore, the matching evaluation module also includes: a feature library expansion unit, which is used to receive the comprehensive performance index and the disposal optimization table and generate a performance optimization mechanism, and the performance optimization mechanism is used to select a recommended disposal subject and a recommended disposal means according to the network security incident.

[0017] Furthermore, the performance optimization mechanism takes the best handling subject in the comprehensive performance index as the recommended handling subject, and selects the best handling means as the recommended handling means according to the handling optimization table; if there are multiple suitable handling subjects for the network security incident, the suboptimal handling subject and the corresponding optimal handling means are used as a backup handling group.

[0018] Furthermore, the number of the standby handling groups is determined according to the total number of handling entities that meet the requirements for handling the network security incident.

[0019] Furthermore, the matching evaluation module also includes: a time optimization unit, which is used to estimate the comprehensive processing time of the network security incident in different disposal paths, and select the disposal path with the shortest time according to the comprehensive processing time.

[0020] Furthermore, the handling path refers to the different handling subjects through which the network security incident passes. If there is a single handling subject in the handling path, the corresponding comprehensive processing time is the handling time of the handling subject; if the handling path includes multiple handling subjects, the corresponding comprehensive processing time refers to the sum of the handling time of different handling subjects and the switching time between handling subjects.

[0021] The beneficial effects of the present invention are: through a comprehensive sorting mechanism, events handled by the same recommended disposal subject are centrally allocated, the number of switching between different recommended disposal subjects is reduced, and the extra time and resource consumption caused by switching recommended disposal subjects and disposal methods is reduced, thereby achieving the effect of effectively improving the comprehensive disposal efficiency of network security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is an overall architecture diagram of a network security operation supervision system of the present invention;

[0023] Figure 2 This is an architecture diagram of a matching evaluation module of a network security operation supervision system of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0025] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0026] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid unnecessary details to obscure the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0027] Embodiment 1, as Figure 1 As shown, an embodiment of the present invention provides a network security operation supervision system, the system comprising:

[0028] The information acquisition and analysis module is used to obtain the network security event log information sent by the security monitoring system, determine the type of the network security event according to the network security event log information, and extract the core event attributes and evaluation quantitative information of the network security event.

[0029] Specifically, the core event attributes include information on the attack source, attack target, and attack means; the evaluation quantitative information is the attack and vulnerability information required to participate in the quantitative evaluation of the network security situation.

[0030] In some embodiments, the types of network security events include network attack events and vulnerability events. When the type of network security event is a network attack event, the core event attributes include attack source information, attack object information, and attack means information; the evaluation and quantitative information includes network attack information required for the network security situation quantitative assessment model to participate; the network attack information includes attack source information, attack object information, attack means information, protocol, attack object access rights, network attack type, or system vulnerability of the attack object; when the type of network security event includes a vulnerability event, the core event attributes include URL (uniform-resource-locator, uniform resource location system) and vulnerability type; the evaluation and quantitative information includes vulnerability information required for the network security situation quantitative assessment model to participate, and the vulnerability information includes vulnerability name, vulnerability discovery time, vulnerability host, vulnerability type, vulnerability severity, and vulnerability corresponding port;

[0031] A matching and evaluation module is used to preliminarily match the core event attributes with the feature library corresponding to the type pre-stored in the platform, determine the disposal means and disposal subject corresponding to the network security event as the recommended disposal means and recommended disposal subject; input the evaluation quantitative information into the network security situation quantitative evaluation model corresponding to the type in the platform, and obtain the risk level label corresponding to the network security event;

[0032] Specifically, the network security situation quantitative assessment model is obtained by collecting different types of historical network security event data and preset risk levels to train a constructed neural network model.

[0033] In some embodiments, the platform is a security cloud platform or other network platform; the feature library includes two different sub-feature libraries corresponding to network events and vulnerability events. For different types of network security events, the feature library is pre-set to store feature information of network security events, as well as disposal means information and recommended disposal subject information corresponding to the feature information of each network security event. According to the disposal means information, corresponding means can be executed to dispose of the network security events, and according to the recommended disposal subject information, the corresponding subject can perform the disposal of the network security events.

[0034] Specifically, for each network security event, the similarity between the network security event and the network security events pre-stored in the platform is calculated based on the pattern matching algorithm. If the maximum similarity meets the preset threshold requirement, the handling means and recommended handling subject of the security event corresponding to the maximum similarity value in the pre-stored network security events are associated with the current network security event as the recommended handling means and recommended handling subject, so as to perform subsequent handling of the current network security event.

[0035] The network security situation quantitative assessment model can adopt a neural network model familiar to those skilled in the art (e.g., BP neural network model, APDE-RBF neural network model, etc.), the purpose of which is to be able to evaluate and predict the dynamic development trend of network security events, so as to obtain a risk level that can reflect the importance / urgency / threat degree (priority) of handling network security events. The higher the risk level, the more priority is needed. For example, the state of network security events can be divided into three levels from low to high according to the risk level, and then the four-level network security status level can be quantitatively described using the threshold range of the value, wherein the security index value of level 1 is 0.0-0.3, the security index value of level 2 is 0.3-0.7, and the security index value of level 3 is 0.7-1; then, by inputting the evaluation quantitative information of the network security event into the network security situation quantitative assessment model output, a security index value between 0-1 is obtained, and different index values ​​correspond to different network security levels, thereby obtaining a risk level that reflects the importance / urgency / threat degree (priority) of handling network security events.

[0036] The work order generation module is used to generate a preliminary handling work order matching the network security incident according to the risk level label, recommended handling means and recommended handling subject corresponding to the network security incident, so as to form a primary handling sequence.

[0037] The work order optimization module is used to receive the primary disposal sequence and form a comprehensive sequence list based on the recommended disposal subject as the sorting factor; divide the events of the same risk level and the same recommended disposal subject into the same event group and sort them according to time, and the comprehensive sequence list includes several event groups; send the event group to the recommended disposal subject for disposal, and generate an event disposal report.

[0038] Specifically, the primary handling sequence is composed of a number of preliminary handling work orders, and the recommended handling subject sets the handling status of the network security incident to "pending handling"; after the recommended handling subject completes the handling of the network security incident, the handling status is set to "handled".

[0039] In some embodiments, the sorted event list is traversed according to the primary disposal sequence, and the recommended disposal subject is introduced as a sorting factor to comprehensively sort the primary disposal sequence. Preferably, events with high risk levels are directly handled according to the highest priority; for events with medium and low risk levels, their recommended disposal subjects are checked, and they are re-divided according to whether the recommended disposal subjects are the same. Events with the same risk level and the same recommended disposal subject are divided into the same event group. The comprehensive sequence table includes several event groups. If the time with the same risk level and the same recommended disposal subject is traversed subsequently, the event is inserted into the end of the corresponding event group. Preferably, in order to ensure the compliance of the same recommended disposal subject, the number of events in an event group cannot exceed 7; if a completely matching event group is not found, it is used as a new event group based on the matching degree of risk level and recommended disposal subject.

[0040] The real-time monitoring module is used to receive event handling reports, monitor the handling status of handling work orders in real time, and issue timely warnings for abnormal status situations.

[0041] In some embodiments, the real-time monitoring module is used to monitor the disposal status of each disposal work order in real time, marking the time when the disposal subject receives the corresponding event and the time when the final disposal is completed, that is, the time interval between "to be disposed" and "disposed". The abnormal status includes but is not limited to the time when the disposal status of the network security event is "to be disposed" is greater than or equal to the preset disposal time threshold of the risk level label corresponding to the network security event. The disposal status of the network security event will be set to "abnormal status" in the disposal work order sent to the recommended disposal subject, and the control personnel will be warned in time to reallocate tasks.

[0042] The incident handling report includes the actual handling subject, actual handling means, handling time, handling results, handling subject status and the type of network security incident; the actual handling subject and actual handling means are the actual operations taken during the actual handling process; the handling results include successful handling and abnormalities; the handling time is the actual handling time of the successfully handled network security incident; the handling subject status is a mark of whether the current usage status of the handling subject is normal; the type of network security incident is the type of security incident.

[0043] Specifically, the incident handling report includes but is not limited to the actual handling subject, actual handling means, handling time, handling results, handling subject status and type of network security incident; the actual handling subject and actual handling means are the actual operations taken by the handling personnel when facing the network security incident during the actual handling process, that is, the handling personnel did not adopt the recommended handling subject and recommended handling means, the handling results include successful handling and abnormal, the handling time is the actual handling time of the successfully handled network security incident, the handling subject status is a mark of whether the current handling subject's usage status is normal, the usage status refers to the current subject's load working status, marked with normal and abnormal status, a handling subject that can normally handle the security incident and the handling time is within the preset time is considered to be in a normal state, otherwise, it is an abnormal state, and the preset time needs to be set in advance according to the actual situation; the type of network security incident is the type of security incident handled this time.

[0044] For example, there are three disposal entities A, B, and C, which are good at handling different types of network security incidents. Through the comprehensive sorting mechanism, all the incidents to be handled are first sorted according to the risk level. Then check the recommended disposal entity for each incident, and try to sort the incidents that need to be handled by the same disposal entity in a continuous manner; if the first and third medium-risk incidents in the primary disposal sequence both need to be handled by disposal entity A, then these two incidents will appear in the same event group in the comprehensive sequence table, that is, both in the event group of disposal entity A. When disposal entity A starts to handle the first incident, the next incident will also be handled by disposal entity A, thereby reducing the number of switches between different disposal entities.

[0045] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0046] This application uses a comprehensive sorting mechanism to centrally allocate incidents to be handled by the same recommended disposal entity, reduce the number of switches between different recommended disposal entities, and reduce the extra time and resource consumption caused by switching recommended disposal entities and disposal methods, thereby effectively improving the comprehensive disposal efficiency of network security incidents.

[0047] Embodiment 2, in the above embodiment 1, comprehensive sorting is performed to reduce the extra time and resource consumption caused by switching the recommended disposal subject and disposal means, but multiple performance indicators of the disposal subject cannot be effectively evaluated, which affects the comprehensive disposal efficiency. This embodiment makes further improvements on the basis of the above embodiment.

[0048] The system also includes: an efficiency evaluation module, which is used to obtain the processing time of the network security incident and the comprehensive efficiency index of the corresponding processing subject, and establish a processing optimization table according to the processing subject and the corresponding processing means.

[0049] The comprehensive performance indicators include the handling success rate, average response time and event types that the handling subject is good at handling for the network security incidents. The handling success rate is based on the handling success rate of all events handled by the current handling subject; the average response time is the average handling time of all successfully handled events, and the event types that the handling subject is good at handling are obtained by comprehensive analysis of the comprehensive success rates and average handling times of different types of events.

[0050] The handling optimization table is generated based on the matching degree between the comprehensive effectiveness index and the corresponding handling means; the matching degree is obtained by respectively calculating the comprehensive success rate and the average handling time of multiple handling means for the same event type, and the one with the highest comprehensive success rate and the shortest average handling time has the highest matching degree. The handling means with the highest matching degree in event handling is selected as the preferred means to form a handling optimization table.

[0051] In some embodiments, the handling time and corresponding handling subject information of each event are collected from the real-time monitoring module and the event handling report, and the handling success rate and average response time of each handling subject are calculated based on the collected data. The handling success rate is the handling success rate of all events handled by the current handling subject. Corresponding to the handling success rate is the handling exception rate. For events that generate abnormalities in network security events, the handling exception rate is calculated; the average response time is the average handling time of all successfully handled events. The event type that is good at handling is obtained by comprehensive analysis of the comprehensive success rate and average handling time of different types of events. The success rate obtained for different events is not the same. The comprehensive success rate here is a single type success rate formed for each type of event. The event type with the highest success rate and the shortest average handling time is the event type that is good at handling.

[0052] In some embodiments, the processing optimization table is generated based on the matching degree between the comprehensive effectiveness index and the corresponding processing means; the matching degree is obtained by respectively calculating the comprehensive success rate and the average processing time for multiple processing means of the same event type. The processing means actually adopted in the same event type are not the same. Corresponding comprehensive success rates and average processing times are generated for multiple different processing means. The one with the highest comprehensive success rate and the shortest average processing time has the highest matching degree. The processing means with the highest matching degree in event processing is selected as the preferred means to form a processing optimization table. The processing optimization table is established for the event type and the corresponding optimal processing means, and is used to select the optimal processing means to improve the processing efficiency and the processing success rate.

[0053] In this embodiment, the performance evaluation module is used to effectively evaluate multiple performance indicators of the disposal subject, which can more accurately understand the capabilities and strengths of each disposal subject and reduce the inefficiency caused by mismatched task allocation; based on the matching degree between the event type and the disposal means, the optimal disposal means is recommended, which improves the disposal success rate and shortens the response time; through comprehensive sorting and performance evaluation, the number of switching between different disposal subjects and disposal means is reduced, avoiding unnecessary waste of resources and ensuring efficient use of resources.

[0054] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0055] This application uses the performance evaluation module to effectively evaluate multiple performance indicators of the disposal entity, accurately understand the capabilities and strengths of each disposal entity, and recommend the optimal disposal method based on the matching degree between the event type and the disposal method, thereby achieving the effect of improving the disposal success rate and shortening the response time.

[0056] Embodiment 3, in the above embodiment, an efficiency evaluation module is added to effectively evaluate multiple performance indicators of the disposal subject. This embodiment makes further improvements on the basis of the above embodiment.

[0057] like Figure 2 As shown, the matching evaluation module also includes: a feature library expansion unit, which is used to receive the comprehensive performance index and the disposal optimization table and generate a performance optimization mechanism, and the performance optimization mechanism is used to select a recommended disposal subject and a recommended disposal means according to the network security incident.

[0058] In some embodiments, the feature library expansion unit is responsible for receiving the comprehensive performance index and the treatment optimization table, generating and applying the performance optimization mechanism, and selecting the recommended treatment subject and the recommended treatment means according to the performance optimization mechanism.

[0059] The performance optimization mechanism takes the best handling subject in the comprehensive performance index as the recommended handling subject, and selects the best handling means as the recommended handling means according to the handling optimization table; if there are multiple suitable handling subjects for the network security incident, the suboptimal handling subject and the corresponding optimal handling means are used as a backup handling group.

[0060] Specifically, the performance optimization mechanism automatically selects the optimal disposal subject as the recommended disposal subject according to the comprehensive performance index, and recommends the optimal disposal means for the recommended disposal subject in combination with the disposal optimization table. If there are multiple suitable disposal subjects, they are sorted according to the comprehensive performance index, and the suboptimal disposal subjects and the corresponding optimal disposal means are combined into a backup disposal group. The optimal disposal means corresponding to each different disposal subject in the disposal optimization table are not the same.

[0061] The number of the backup disposal groups is determined by the total number of disposal entities that meet the requirements of the network security incident. Preferably, the number of the backup disposal groups should not exceed two; when the recommended disposal entity cannot handle the incident in time or the disposal effect is poor, a trigger condition is set. For example, when the recommended disposal entity does not start the disposal task within half of the preset time, or the progress of the disposal task is lower than the average disposal time, it is considered "unable to handle in time" or the disposal effect is poor, and the suboptimal disposal entity in the backup disposal group is automatically activated to take over; if the backup disposal group is also unable to handle the incident effectively, the disposal status of the network security incident is set to "abnormal status" and the control personnel are warned in time to reallocate the task.

[0062] In some embodiments, a performance evaluation cycle is set to ensure the timeliness and accuracy of the evaluation results. The performance evaluation cycle is dynamically adjusted according to factors such as system load and event frequency. The number of backup disposal groups is limited to avoid excessive dispersion of resources and to ensure that there are enough alternatives for high-risk events. The specific number can be flexibly adjusted according to actual operating conditions and resource conditions.

[0063] In this embodiment, through the performance evaluation and optimization mechanism, the most suitable handling subject and handling means can be recommended more accurately, thereby improving the efficiency and success rate of event handling; by optimizing the matching and backup handling group settings, the number of switches between inappropriate handling subjects is reduced, avoiding waste of resources.

[0064] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0065] Through performance evaluation and optimization mechanisms, this application can more accurately recommend the most suitable disposal subject and disposal means, effectively increasing the accuracy of recommendations and achieving the effect of improving event handling efficiency and success rate.

[0066] Example 4. In the above example, a feature library expansion unit and a performance optimization mechanism are set up to select the optimal recommended disposal subject and recommended disposal means according to the comprehensive performance index of the disposal subject and the disposal optimization table. However, if multiple network security incidents correspond to an optimal recommended disposal subject at the same time and there is no relevant backup disposal group, the disposal time will be delayed. This example makes further improvements on the basis of the above example.

[0067] like Figure 2 As shown, the matching evaluation module also includes: a time optimization unit, which is used to estimate the comprehensive processing time of the network security incident in different disposal paths, and select the disposal path with the shortest time according to the comprehensive processing time.

[0068] The handling path refers to the different handling subjects that the network security incident passes through. If there is a single handling subject in the handling path, the corresponding comprehensive processing time is the handling time of the handling subject; if the handling path includes multiple handling subjects, the corresponding comprehensive processing time refers to the sum of the handling time of different handling subjects and the switching time between handling subjects.

[0069] In some embodiments, if multiple network security incidents correspond to an optimal recommended handling subject at the same time and there is no relevant backup handling group, the handling time will be delayed. Hierarchical handling is performed according to the handling subjects corresponding to the network security incidents. The network security incidents are divided into multiple interconnected handling processes, and different handling processes are assigned to different handling subjects for hierarchical handling. In order to ensure the efficiency and success rate of the handling, the selection method in the above embodiment is still followed when selecting other handling paths. At the same time, the comprehensive processing time of all handling paths is budgeted, and the handling path with the shortest comprehensive processing time is selected, thereby improving the efficiency and success rate of the handling.

[0070] In some embodiments, the time optimization unit budgets different handling paths for each event, including a single subject handling path and a hierarchical handling path. For the latter, the event is split into multiple parts and assigned to handling subjects at different levels, and the comprehensive processing time (including switching time and handling time of each part) is calculated; the comprehensive processing time of all paths is compared, and the shortest path is selected to generate a handling work order. If multiple events compete for the same optimal handling subject, the hierarchical handling path is given priority to reduce waiting time. For example, there are three network security events A, B, and C occurring at the same time, and they are all recommended to be handled by the optimal handling subject X. However, X is currently busy handling the remaining events and is expected to take a long time to complete. In the traditional handling method, events A, B, and C wait for X to handle in sequence, resulting in a significant extension of the handling time; using hierarchical handling, the time optimization unit splits event A into three parts and handles them sequentially by three different subjects (subject W, subject Y, and subject Z); the comprehensive processing time of traditional handling and hierarchical handling is calculated, including the switching time and the handling time of each part, and the path with the shortest comprehensive processing time is selected to generate a handling work order and start execution. Preferably, the hierarchical splitting of the network security incident is performed according to different stages of the network security incident or different attack points and impact levels, and the key elements and attack paths of the network security incident are identified. According to the key elements and attack paths, the incident is split into several sub-events or handling units, and a specific handling subject is assigned to each sub-event or handling unit, and different handling subjects are used for hierarchical resolution.

[0071] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0072] This application can respond to network security incidents more quickly and reduce handling time by budgeting the comprehensive processing time and selecting the shortest path; adjust resource allocation to avoid excessive concentration of resources leading to delays in incident handling; and through hierarchical handling, rationally utilize the resources of multiple handling entities to achieve optimized configuration, thereby ensuring the success rate of handling each network security incident.

[0073] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0074] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0075] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0076] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0078] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0079] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network security operation supervision system, characterized in that: The system comprises: An information acquisition and analysis module is used to acquire network security event log information sent by a security monitoring system, determine the type of the network security event according to the network security event log information, and extract the core event attributes and evaluation quantitative information of the network security event; A matching and evaluation module is used to preliminarily match the core event attributes with the feature library corresponding to the type pre-stored in the platform, determine the disposal means and disposal subject corresponding to the network security event as the recommended disposal means and recommended disposal subject; input the evaluation quantitative information into the network security situation quantitative evaluation model corresponding to the type in the platform, and obtain the risk level label corresponding to the network security event; A work order generation module is used to generate a preliminary handling work order matching the network security incident according to the risk level label, recommended handling means and recommended handling subject corresponding to the network security incident, so as to form a primary handling sequence; The work order optimization module is used to receive the primary disposal sequence and form a comprehensive sequence list based on the recommended disposal subject as a sorting factor; divide the events of the same risk level and the same recommended disposal subject into the same event group and sort them according to time, and the comprehensive sequence list includes several event groups; send the event group to the recommended disposal subject for disposal, and generate an event disposal report; The real-time monitoring module is used to receive event handling reports, monitor the handling status of handling work orders in real time, and issue timely warnings for abnormal status situations.

2. A network security operation supervision system according to claim 1, characterized in that: The incident handling report includes the actual handling subject, actual handling means, handling time, handling results, handling subject status and the type of network security incident; the actual handling subject and actual handling means are the actual operations taken during the actual handling process; the handling results include successful handling and abnormalities; the handling time is the actual handling time of the successfully handled network security incident; The handling subject status is used to mark whether the current handling subject is in a normal state; the type of network security event is the type of security event.

3. A network security operation supervision system according to claim 1, characterized in that: The system also includes: an efficiency evaluation module, which is used to obtain the processing time of the network security incident and the comprehensive efficiency index of the corresponding processing subject, and establish a processing optimization table according to the processing subject and the corresponding processing means.

4. A network security operation supervision system according to claim 3, characterized in that: The comprehensive performance indicators include the handling success rate of the network security incidents handled by the handling subject, the average response time, and the types of incidents that the handling subject is good at handling. The handling success rate is the handling success rate of all incidents handled by the current handling subject; The average response time is the average handling time of all successfully handled events, and the event types that are good at handling are obtained by comprehensive analysis based on the comprehensive success rate and average handling time of different types of events.

5. A network security operation supervision system according to claim 3, characterized in that: The treatment optimization table is generated according to the matching degree between the comprehensive performance index and the corresponding treatment means; The matching degree is obtained by calculating the comprehensive success rate and average handling time of multiple handling means for the same event type. The matching degree is highest for the means with the highest comprehensive success rate and the shortest average handling time. The handling means with the highest matching degree in event handling is selected as the preferred means to form a handling optimization table.

6. A network security operation supervision system according to claim 1, characterized in that: The matching evaluation module also includes: a feature library expansion unit, which is used to receive the comprehensive performance index and the disposal optimization table and generate a performance optimization mechanism, and the performance optimization mechanism is used to select a recommended disposal subject and a recommended disposal means according to the network security event.

7. A network security operation supervision system according to claim 6, characterized in that: The performance optimization mechanism uses the best treatment subject in the comprehensive performance index as the recommended treatment subject, and selects the best treatment means as the recommended treatment means according to the treatment optimization table; If there are multiple suitable handling entities for the network security incident, the suboptimal handling entity and the corresponding optimal handling method will be used as a backup handling group.

8. A network security operation supervision system according to claim 7, characterized in that: The number of the standby handling groups is determined according to the total number of handling entities that meet the requirements of the network security incident.

9. A network security operation supervision system according to claim 1, characterized in that: The matching evaluation module also includes: a time optimization unit, which is used to estimate the comprehensive processing time of the network security incident in different processing paths, and select the processing path with the shortest time according to the comprehensive processing time.

10. A network security operation supervision system according to claim 9, characterized in that: The handling path refers to the different handling subjects that the network security incident passes through. If there is a single handling subject in the handling path, the corresponding comprehensive processing time is the handling time of the handling subject; if the handling path includes multiple handling subjects, the corresponding comprehensive processing time refers to the sum of the handling time of different handling subjects and the switching time between handling subjects.

Images