Safe atomic power arrangement method, device, system, equipment, medium and product

Abstract

The invention discloses a safe atomic power arrangement method, device, system, equipment, medium and product, and the method comprises the steps: carrying out the feature extraction of safe atomic power, obtaining a multi-dimensional feature tag of the corresponding safe atomic power, and constructing a feature tag library; performing intention processing on the security demand input by the user to obtain a user intention strategy; according to the user intention strategy, safe atomic power meeting the safety requirement of the user is screened out from a feature tag library; arranging the screened safe atomic power to obtain a safe atomic power arrangement strategy; according to the method, a user does not need to deeply understand the safety capability and the safety atomic power, the safety demand intention of the user can be translated into a user intention strategy only by clearly expressing the safety demand by the user, and the arrangement of the safety atomic power is completed in combination with the multi-dimensional feature tag of the safety atomic power; and therefore, complex and changeable safety risks can be effectively dealt with.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security atomic capability orchestration method, device, system, equipment, medium and product. Background Art

[0002] With the advent of the cloud network era, virtualization technology has transformed the network architecture from solid closed to dynamic open, and the boundaries of cyberspace have gradually blurred. At the same time, with the continuous improvement of domestic network security compliance requirements, the acceleration of digital transformation, the wider application of information systems, the increased complexity of systems and the interconnection between systems, the network security environment faced by enterprises has become more complex. At present, various security vendors still provide services to the outside world in the form of security capabilities, such as using security products with simple superposition of multiple security capabilities for security protection to deal with complex network attacks.

[0003] However, in recent years, the network security situation has become increasingly severe. Network attacks have evolved from primitive virus and worm attacks to attack threats with a wider impact range, such as specific target malware, advanced persistent threats (APT), and coordinated attacks, and the means of attack have become multi-layered and intelligent. However, networks are highly interconnected and interdependent, the sources of threats are constantly changing, and high-level network attacks are frequent. It is difficult for a single security product to quickly respond to the increasingly severe domestic and foreign network security threats, and simply stacked multi-domain security products cannot effectively protect against targeted and more intelligent network threats. In order to cope with the above complex and changing security threats, the coordination, linkage and orchestration of security capabilities are particularly important. However, the existing security capability orchestration methods require users to have a deep understanding of various types of security capabilities and have high requirements on the user's technical background, which greatly hinders the process of coordinated protection of security capabilities and makes it difficult to cope with the above complex and changing security risks. Summary of the invention

[0004] In response to the problems existing in the prior art, the embodiments of the present invention provide a method, device, system, equipment, medium and product for orchestrating security atomic capabilities, which do not require users to have an in-depth understanding of security capabilities and security atomic capabilities, and can effectively deal with complex and changing security risks.

[0005] In a first aspect, an embodiment of the present invention provides a method for orchestrating secure atomic capabilities, including:

[0006] Extract features of security atomic capabilities, obtain multi-dimensional feature labels of corresponding security atomic capabilities, and build a feature label library;

[0007] Perform intent processing on the security requirements input by the user to obtain the user intent strategy;

[0008] According to the user intention strategy, screening out security atomic capabilities that meet the user's security needs in the feature tag library;

[0009] The screened security atomic capabilities are orchestrated to obtain a security atomic capability orchestration strategy.

[0010] As an improvement of the above-mentioned scheme, the multi-dimensional feature tag includes: a first dimension feature tag related to the core function instructions of the security atomic capability, a second dimension feature tag related to the policy template of the security atomic capability, a third dimension feature tag related to the IPDRR security framework category to which the security atomic capability belongs, a fourth dimension feature tag related to the deployment location of the security atomic capability, a fifth dimension feature tag related to the deployment method of the security atomic capability, and a sixth dimension feature tag related to the traffic type of the security atomic capability.

[0011] As an improvement of the above solution, the feature extraction of the security atomic capability to obtain the multi-dimensional feature label of the corresponding security atomic capability includes:

[0012] Extracting core function instructions according to the core function description of the security atomic capability as the first dimension feature label of the corresponding security atomic capability;

[0013] Extracting the policy template of the security atomic capability from the security atomic capability policy management module as a second dimension feature label of the corresponding security atomic capability;

[0014] According to the pre-defined security atomic capability description and classification, determine the IPDRR security framework category to which the security atomic capability belongs, and use the IPDRR security framework category to which the security atomic capability belongs as a third dimension feature label;

[0015] Extracting all available deployment locations of the security atomic capability as the fourth dimension feature labels of the corresponding security atomic capability;

[0016] Extract all available deployment modes of the security atomic capability as the fifth dimension feature labels of the corresponding security atomic capability;

[0017] The traffic type to which the security atomic capability belongs is extracted as a sixth dimension feature label of the corresponding security atomic capability; wherein the traffic type includes a traffic type and a non-traffic type.

[0018] As an improvement of the above solution, the method of screening out security atomic capabilities that meet the security requirements of the user in the feature tag library according to the user intention strategy includes:

[0019] According to the pre-set feature tag priority, the user intention strategy is compared with the multi-dimensional feature tags in the feature tag library to perform hierarchical screening of the security atomic capabilities to obtain the security atomic capabilities that meet the user intention strategy;

[0020] Wherein, the feature label library includes multi-dimensional feature labels of each of the security atomic capabilities.

[0021] As an improvement of the above scheme, the feature label priorities include: the first dimension feature label is a high priority, the third dimension feature label and the sixth dimension feature label are medium priority, and the second dimension feature label, the fourth dimension feature label and the fifth dimension feature label are low priority.

[0022] As an improvement of the above scheme, the user intention strategy is compared with the multi-dimensional feature tags in the feature tag library according to the pre-set feature tag priority to perform hierarchical screening of the security atomic capabilities to obtain the security atomic capabilities that meet the user intention strategy, including:

[0023] Taking the information related to the high-priority feature tag in the user intention strategy as the first keyword, determining whether there is a security atomic capability corresponding to the first dimension feature tag that is the same as or similar to the first keyword, and generating a first security atomic capability list based on the security atomic capabilities corresponding to the first dimension feature tags that are similar to the first keyword;

[0024] Using the information related to the feature tag with medium priority in the user intention strategy as the second keyword, screening the security atomic capabilities in the first security atomic capability list to obtain the security atomic capabilities that meet the user intention strategy;

[0025] According to the information related to the low-priority feature tags in the user intent strategy, the security atomic capabilities corresponding to the first dimension feature tags that are the same as the first keyword are screened to obtain the security atomic capabilities that meet the user intent strategy.

[0026] As an improvement of the above solution, the information related to the high-priority feature tag in the user intention strategy is used as the first keyword, and it is determined whether there is a security atomic capability corresponding to the first dimension feature tag that is the same or similar to the first keyword, and a first security atomic capability list is generated according to the security atomic capabilities corresponding to the first dimension feature tags that are similar to the first keyword. The generating of the first security atomic capability list includes:

[0027] Using the information related to the high-priority feature tag in the user intention strategy as the first keyword, searching the first dimension feature tags in the feature tag library;

[0028] In the case where there is a first dimension feature label identical to the first keyword, extracting a security atomic capability corresponding to the first dimension feature label identical to the first keyword;

[0029] When there is no first dimension feature label identical to the first keyword, but there is a first dimension feature label similar to the first keyword, the security atomic capabilities corresponding to multiple first dimension feature labels with the highest similarity to the first keyword are extracted to generate the first security atomic capabilities list.

[0030] As an improvement of the above solution, the method of screening the security atomic capabilities corresponding to the first dimension feature tag that is the same as the first keyword according to the information related to the low-priority feature tag in the user intent strategy to obtain the security atomic capabilities that meet the user intent strategy includes:

[0031] Determine whether the security atomic capability corresponding to the first dimension feature tag identical to the first keyword conforms to the policy template, deployment location, and deployment method indicated by the user intention policy;

[0032] If yes, extracting the security atomic capability corresponding to the first dimension feature label identical to the first keyword as the security atomic capability that complies with the user intention strategy;

[0033] If not, the security atomic capability corresponding to the first dimension feature label with the highest similarity to the first keyword is extracted as the security atomic capability that meets the user intention strategy.

[0034] As an improvement of the above solution, the information related to the feature tag with medium priority in the user intention strategy is used as the second keyword to filter the security atomic capabilities in the first security atomic capability list to obtain the security atomic capabilities that meet the user intention strategy, including:

[0035] Constructing a first feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the first security atomic capability list;

[0036] Using the information related to the feature tag with medium priority in the user intention strategy as the second keyword, searching the feature tags of the third dimension and the feature tags of the sixth dimension in the first feature tag sub-library;

[0037] In the case where there are feature tags of the third dimension and feature tags of the sixth dimension identical to the second keyword, extracting security atomic capabilities corresponding to the feature tags of the third dimension and feature tags of the sixth dimension identical to the second keyword as security atomic capabilities that conform to the user intention strategy;

[0038] In the case that there is no third dimension feature label and sixth dimension feature label identical to the second keyword, but there is a third dimension feature label and sixth dimension feature label similar to the second keyword, extracting the security atomic capability with the highest similarity to the second keyword, and generating the second security atomic capability list;

[0039] In the absence of a third dimension feature tag and a sixth dimension feature tag that are identical or similar to the second keyword, using the first security atomic capability list as the second security atomic capability list;

[0040] The security atomic capabilities in the second security atomic capability list are screened according to the information related to the low-priority feature tag in the user intent policy to obtain the security atomic capabilities that meet the user intent policy.

[0041] As an improvement of the above solution, the method of screening the security atomic capabilities in the second security atomic capability list according to the information related to the low-priority feature tag in the user intention policy to obtain the security atomic capabilities that meet the user intention policy includes:

[0042] Constructing a second feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the second security atomic capability list;

[0043] Using the security policy indicated by the user intention policy as a third keyword, searching the second dimension feature tags in the second feature tag sub-library;

[0044] In the case where there is a second dimension feature tag that is the same as the third keyword, determining whether the corresponding security atomic capability complies with the deployment location and deployment method indicated by the user intention strategy;

[0045] If so, extracting the security atomic capability corresponding to the second dimension feature label that is the same as the third keyword as the security atomic capability that meets the user intention strategy;

[0046] If not, re-search the second dimension feature tags in the second feature tag sub-library;

[0047] In the case where there is no second dimension feature tag identical to the third keyword, but there is a second dimension feature tag similar to the third keyword, extracting security atomic capabilities corresponding to the second dimension feature tags similar to the third keyword, and sorting the extracted security atomic capabilities in descending order of similarity to generate a third security atomic capability list;

[0048] According to the third security atomic capability list, the security atomic capabilities that meet the user's intended policy are screened out.

[0049] As an improvement of the above solution, the method of screening out the security atomic capabilities that meet the user's intention policy according to the third security atomic capability list includes:

[0050] Constructing a third feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the third security atomic capability list;

[0051] According to the order of the security atomic capabilities in the third security atomic capability list, traverse the fourth dimension feature tags and the fifth dimension feature tags in the third feature tag sub-library to determine whether the corresponding security atomic capabilities comply with the deployment location and deployment method indicated by the user intention policy;

[0052] When a secure atomic capability with a deployment location and a deployment method that conforms to the user intention policy is found, extract the corresponding secure atomic capability as the secure atomic capability that conforms to the user intention policy;

[0053] If no secure atomic capability is found that meets the deployment location and deployment method indicated by the user's intention policy, a prompt message is triggered to instruct the user to adjust the security requirement intention.

[0054] As an improvement of the above solution, the security requirement input by the user is processed with intent to obtain the user intent strategy, including:

[0055] Perform word segmentation on the security requirements to obtain intent keywords;

[0056] Matching and expanding the intent keywords with the annotated keywords in the intent corpus to generate user intent;

[0057] The user intention is formatted to obtain the user intention strategy.

[0058] As an improvement of the above solution, the method further includes:

[0059] According to the security atomic capability orchestration strategy, the corresponding security atomic capability is called from the security atomic capability resource pool to perform security protection.

[0060] In a second aspect, an embodiment of the present invention provides a secure atomic capability orchestration device, including:

[0061] The feature extraction module is used to extract features of the security atomic capability, obtain multi-dimensional feature labels of the corresponding security atomic capability, and build a feature label library;

[0062] The intention handling module is used to handle the security requirements input by the user and obtain the user intention strategy;

[0063] A capability screening module, used to screen out security atomic capabilities that meet the user's security requirements in the feature tag library according to the user's intention strategy;

[0064] The capability orchestration module is used to orchestrate the screened security atomic capabilities to obtain the security atomic capability orchestration strategy.

[0065] In a third aspect, an embodiment of the present invention provides a secure atomic capability orchestration system, including: an intention handling layer, an atomic capability orchestration layer, and a capability execution layer;

[0066] The intention handling layer is used to perform intention handling on the security requirements input by the user, obtain the user intention strategy, and input the user intention strategy into the atomic capability orchestration layer;

[0067] The atomic capability orchestration layer is used to extract features of the security atomic capabilities, obtain multi-dimensional feature labels of the corresponding security atomic capabilities, and construct a feature label library; according to the user intention strategy input by the intention handling layer, the security atomic capabilities that meet the user's security needs are screened out in the feature label library; the screened security atomic capabilities are orchestrated to obtain a security atomic capability orchestration strategy, and the security atomic capability orchestration strategy is input into the capability execution layer;

[0068] The capability execution layer is used to call the corresponding secure atomic capability from the secure atomic capability resource pool to perform security protection according to the secure atomic capability orchestration strategy input by the atomic capability orchestration layer.

[0069] In a fourth aspect, an embodiment of the present invention provides a secure atomic capability orchestration device, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the secure atomic capability orchestration method as described in any one of the first aspects is implemented.

[0070] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the security atomic capability orchestration method as described in any one of the first aspects.

[0071] In a sixth aspect, an embodiment of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the secure atomic capability orchestration method as described in any one of the first aspects.

[0072] Compared with the prior art, a method, apparatus, system, device, medium and product for orchestrating security atomic capabilities according to an embodiment of the present invention extracts features of security atomic capabilities to obtain multidimensional feature labels of corresponding security atomic capabilities and constructs a feature label library; then, the security requirements input by the user are processed with intent to obtain a user intent strategy; thereafter, based on the user intent strategy, security atomic capabilities that meet the user's security requirements are screened out from the feature label library, and the screened security atomic capabilities are orchestrated to obtain a security atomic capability orchestration strategy, thereby eliminating the need for users to have an in-depth understanding of security capabilities and security atomic capabilities. Users only need to clearly express their security requirements, and the user's security requirement intentions can be translated into user intent strategies, and the orchestration of security atomic capabilities can be completed in combination with the multidimensional feature labels of security atomic capabilities, thereby effectively responding to complex and changeable security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] In order to more clearly illustrate the technical solution of the present invention, the drawings used in the implementation mode will be briefly introduced below. Obviously, the drawings described below are only some implementation modes of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0074] Figure 1 is a flow chart of a secure atomic capability orchestration method provided by an embodiment of the present invention;

[0075] Figure 2 is another flowchart of the secure atomic capability orchestration method provided by an embodiment of the present invention;

[0076] Figure 3 It is a schematic diagram of the multi-dimensional feature tag content format of the security atomic capability provided by an embodiment of the present invention;

[0077] Figure 4 It is a schematic diagram of the multi-dimensional feature label content of the security atomic capability provided by an embodiment of the present invention;

[0078] Figure 5 is a schematic diagram of multi-dimensional feature labels corresponding to the system vulnerability identification sample provided by an embodiment of the present invention;

[0079] Figure 6 It is a structural block diagram of a secure atomic capability orchestration device provided by an embodiment of the present invention;

[0080] Figure 7 It is a structural block diagram of a secure atomic capability orchestration system provided by an embodiment of the present invention;

[0081] Figure 8It is a structural block diagram of a secure atomic capability orchestration device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0082] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0083] It is understood that the various numbers involved in the embodiments of the present invention are only for the convenience of description and are not intended to limit the scope of the present application. The size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic.

[0084] In embodiments of the present invention, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "include", "comprises", or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article, or device. In the absence of further restrictions, the elements defined by the statement "includes..." do not exclude the presence of other identical elements in the process, method, article, or device including the elements. The term "plurality or several" refers to two or more.

[0085] See also Figure 1 , Figure 1 1 is a flow chart of a secure atomic capability orchestration method provided by an embodiment of the present invention. The secure atomic capability orchestration method specifically includes:

[0086] S11: Extract features of the security atomic capability, obtain multi-dimensional feature labels of the corresponding security atomic capability, and build a feature label library;

[0087] S12: Perform intent processing on the security requirements input by the user to obtain the user intent strategy;

[0088] S13: According to the user intention strategy, screening out security atomic capabilities that meet the user's security requirements in the feature tag library;

[0089] S14: Orchestrate the screened security atomic capabilities to obtain a security atomic capability orchestration strategy.

[0090] It should be noted that the security atomic capability orchestration method described in the embodiment of the present invention can be implemented by a server, a computer, etc., and the detailed process of the above steps S11 to S12 can be referred to Figure 2 , Figure 2 It is another flow chart of the secure atomic capability orchestration method provided by an embodiment of the present invention. In the embodiment of the present invention, the execution process of the secure atomic capability orchestration method can be divided into multiple layers of processing, such as an intent handling layer and an atomic capability orchestration layer. In the intent handling layer, the security requirements input by the user are handled by natural language processing and other means to obtain the user's intent strategy, and the user's intent strategy is sent to the atomic capability orchestration layer; in the atomic capability orchestration layer, it is mainly divided into three parts: first, the secure atomic capability is abstractly extracted to obtain the multidimensional feature label of the secure atomic capability, and a feature label library is constructed based on the multidimensional feature label; second, the capability is screened according to the user's intent strategy, and the secure atomic capability corresponding to the multidimensional feature label that meets the user's security intention is selected from the feature label library; third, based on the atomic capability orchestration template, an orchestration scheme corresponding to the selected secure atomic capability is given, that is, the secure atomic capability orchestration strategy.

[0091] The secure atomic capability orchestration strategy is then sent to the capability execution layer, where the following process is further performed:

[0092] According to the security atomic capability orchestration strategy, the corresponding security atomic capability is called from the security atomic capability resource pool to perform security protection and return the capability execution result.

[0093] Among them, the secure atomic capability orchestration strategy includes the scheduling order of secure atomic capabilities, data flow plan, etc.

[0094] Specifically, the intention processing of the security requirements input by the user to obtain the user intention strategy includes:

[0095] Perform word segmentation on the security requirements to obtain intent keywords;

[0096] Matching and expanding the intent keywords with the annotated keywords in the intent corpus to generate user intent;

[0097] The user intention is formatted to obtain the user intention strategy.

[0098] For example, the user inputs the security requirements for the specified application scenario into the intent handling layer through a graphical interface or natural language or formatted language, such as the description of the security requirements that the user expects to achieve, which usually includes the target asset address, security protection measures, security protection cycle and other security requirements. Among them, the intent handling layer includes an intent decomposition module, an intent matching module, an intent formatting module and an intent corpus, which stores standard keywords related to security business operations, security capabilities, security policies, etc. The specific intent handling process is as follows:

[0099] The intent decomposition module performs word segmentation on the security requirements input by the user and extracts the intent keywords. For example, the security requirement input by the user in natural language is: "Perform a full system vulnerability scan on xxx.xxx.xxx at 2 a.m. every Monday". After word segmentation, the intent keywords of the security requirement are obtained: "Every week, 2:00, xxx.xxx.xxx, system, vulnerability, full scan".

[0100] The intent matching module matches the extracted intent keywords with the standard keywords in the intent corpus, normalizes the intent keywords input by the user through the matched standard keywords, and automatically expands the key information that is not included in the user's security requirements but must be indicated. For example, by constructing an intent knowledge graph of standard keywords, and then mapping and matching the intent keywords corresponding to the security requirements with the intent knowledge graph, the intent keywords of the security requirements given by the user are converted into standardized standard keywords, and referring to the intent knowledge graph, the key information that the user has not fully expressed in the intent keywords is supplemented, such as the capability feature information that the user may need, the strategy that the capability should adopt, etc. For example, the intent keywords obtained by the above word segmentation are matched with the standard keywords in the intent corpus, and are identified as "system, vulnerability, xxx.xxx.xxx, once a week, 2:00, all scans", and the key information is supplemented as "identification, I" to obtain the complete user intent.

[0101] The intent formatting module translates the matched standard keywords and expanded key information into a formatted language, such as XML, to generate a formatted user intent policy, which is then sent to the atomic capability orchestration layer.

[0102] Among them, the multidimensional feature tag can be a six-dimensional feature tag, including but not limited to: a first dimension feature tag related to the core function instructions of the security atomic capability, a second dimension feature tag related to the policy template of the security atomic capability, a third dimension feature tag related to the IPDRR security framework category to which the security atomic capability belongs, a fourth dimension feature tag related to the deployment location of the security atomic capability, a fifth dimension feature tag related to the deployment method of the security atomic capability, a sixth dimension feature tag related to the traffic type of the security atomic capability, etc.

[0103] Specifically, the feature extraction of the security atomic capability to obtain the multi-dimensional feature label of the corresponding security atomic capability includes:

[0104] Extracting core function instructions according to the core function description of the security atomic capability as the first dimension feature label of the corresponding security atomic capability;

[0105] Extracting the policy template of the security atomic capability from the security atomic capability policy management module as a second dimension feature label of the corresponding security atomic capability;

[0106] According to the pre-defined security atomic capability description and classification, determine the IPDRR security framework category to which the security atomic capability belongs, and use the IPDRR security framework category to which the security atomic capability belongs as a third dimension feature label;

[0107] Extracting all available deployment locations of the security atomic capability as the fourth dimension feature labels of the corresponding security atomic capability;

[0108] Extract all available deployment modes of the security atomic capability as the fifth dimension feature labels of the corresponding security atomic capability;

[0109] The traffic type to which the security atomic capability belongs is extracted as a sixth dimension feature label of the corresponding security atomic capability; wherein the traffic type includes a traffic type and a non-traffic type.

[0110] Exemplarily, the atomic capability orchestration layer includes a feature label extraction module, a capability screening module, an atomic capability orchestration module, a security atomic capability set, a feature label library and a security atomic capability orchestration template: wherein the feature label extraction module is used to analyze the characteristics of the security atomic capability, abstract the feature labels of multiple dimensions of the security atomic capability from the functional description of the security atomic capability, and extract the multidimensional feature labels of each security atomic capability to form a feature label library of the security atomic capability; the feature label library is used to store the multidimensional feature labels of each security atomic capability.

[0111] The embodiment of the present invention considers that each security atomic capability has its own characteristics in terms of core function instructions, deployment location, deployment mode, traffic type, policy template, and IPDRR security framework category to which the security atomic capability belongs, and extracts multidimensional feature labels of the security atomic capability through the above multiple dimensions. The following describes the multidimensional feature label extraction method of each dimension respectively.

[0112] (1) Extraction of the first dimension feature labels related to the core functional instructions of the security atomic capability: Extract the core functional instructions, inputs, and outputs of the security atomic capability with reference to the core functional description of the security atomic capability. Take the active identification and passive identification of the security atomic capability as an example:

[0113] The core function of active identification is described as detecting and identifying hardware, software, and data assets in the network through automated scanning methods.

[0114] The core functional instructions are extracted as follows: assets, scanning, identification;

[0115] The input is: scan range;

[0116] The output is: asset information.

[0117] The core function of passive identification is described as analyzing traffic at the link, network, transmission, and application layers through technologies such as DPI to identify asset information.

[0118] The core functional instructions are extracted as follows: traffic, analysis, and identification;

[0119] The inputs are: identification strategy;

[0120] The output is: asset information.

[0121] The core functional instructions of active identification and passive identification can clearly distinguish the core functions of the two security atomic capabilities and can serve as the first dimension feature labels of security atomic capabilities.

[0122] (2) Extraction of the second dimension feature labels related to the policy template of the security atomic capability: The policy template of the security atomic capability can be extracted from the security atomic capability policy management module, which lists the security services that the security atomic capability can provide. Take the security atomic capability, system vulnerability identification, as an example:

[0123] The policy templates for system vulnerability identification can be divided into high-risk system vulnerabilities, medium- and high-risk system vulnerabilities, full system vulnerability scanning, regular system vulnerability scanning, etc.

[0124] (3) Extraction of third-dimensional feature labels related to the IPDRR security framework category to which the security atomic capability belongs: The IPDRR security framework is Identify, Protect, Detect, Detect, and Recover. The extraction of the IPDRR security framework category to which the security atomic capability belongs can refer to the existing CCSA industry standards, such as the description and classification of the security atomic capability in the network security product interoperability.

[0125] (4) Extraction of feature labels of the fourth dimension related to the deployment location of the security atomic capability: The deployment location of the security atomic capability can be divided into near-device deployment, branch deployment, edge deployment, and center deployment. In this dimension, all reasonable deployment locations of the security atomic capability will be listed separately.

[0126] (5) Extraction of the fifth dimension feature labels related to the deployment methods of security atomic capabilities: The deployment methods of security atomic capabilities can be divided into hardware device deployment, virtual deployment, microservice deployment, etc. In this dimension, the reasonable deployment methods of security atomic capabilities will be listed respectively.

[0127] (6) Extraction of the sixth dimension feature label related to the traffic type (e.g., whether it is traffic type) to which the security atomic capability belongs: For traffic type security atomic capabilities, the capability processing object is traffic. For non-traffic type security atomic capabilities, the capability processing object is assets, that is, security processing such as discovery scanning, monitoring, or auditing is completed for the target assets.

[0128] It should be noted that multi-dimensional feature label extraction can be performed on the security atomic capabilities in the pre-built security atomic capability set; the security atomic capability set lists the security atomic capabilities that can provide security services. Through the above multi-dimensional feature label extraction, the feature label content format of multiple dimensions of the security atomic capabilities can be obtained as follows: Figure 3 As shown, Figure 3 The feature labels 1, 2, ..., 6 correspond to the first dimension feature label, the second dimension feature label, ..., the sixth dimension feature label respectively; the label content is the specific description information of the corresponding dimension feature label. The label content can contain multiple label information, such as Figure 4 shown.

[0129] Taking the security atomic capability and system vulnerability identification sample as an example, the multi-dimensional feature label drawing sample of the security atomic capability is as follows: Figure 5As shown. The meaning of the multi-dimensional feature labels of the security atomic capability and system vulnerability identification is: the core functional instruction of system vulnerability identification is "system + vulnerability + identification", and the policy templates are high-risk system vulnerabilities, medium-high-risk system vulnerabilities, full system vulnerability scanning, and regular system vulnerability scanning. The deployment location can support near-device deployment, branch deployment, edge deployment, and center deployment. The deployment method supports hardware device deployment, virtual deployment, and microservice deployment. The IPDRR security framework category is identification-type security atomic capability, and the traffic type is non-traffic-type security atomic capability.

[0130] Specifically, the screening of the security atomic capabilities that meet the security requirements of the user in the feature tag library according to the user intention strategy includes:

[0131] According to the preset feature tag priority, the user intention strategy is compared with the multi-dimensional feature tags in the feature tag library to screen out the security atomic capabilities that meet the user intention strategy;

[0132] Wherein, the feature label library includes multi-dimensional feature labels of each of the security atomic capabilities.

[0133] Among them, the feature label priorities include: the first dimension feature label is a high priority, the third dimension feature label and the sixth dimension feature label are medium priority, and the second dimension feature label, the fourth dimension feature label and the fifth dimension feature label are low priority.

[0134] Furthermore, the user intention strategy is compared with the multi-dimensional feature tags in the feature tag library according to the preset feature tag priority to perform hierarchical screening on the security atomic capabilities to obtain the security atomic capabilities that meet the user intention strategy, including:

[0135] Taking the information related to the high-priority feature tag in the user intention strategy as the first keyword, determining whether there is a security atomic capability corresponding to the first dimension feature tag that is the same as or similar to the first keyword, and generating a first security atomic capability list based on the security atomic capabilities corresponding to the first dimension feature tags that are similar to the first keyword;

[0136] Using the information related to the feature tag with medium priority in the user intention strategy as the second keyword, screening the security atomic capabilities in the first security atomic capability list to obtain the security atomic capabilities that meet the user intention strategy;

[0137] According to the information related to the low-priority feature tags in the user intent strategy, the security atomic capabilities corresponding to the first dimension feature tags that are the same as the first keyword are screened to obtain the security atomic capabilities that meet the user intent strategy.

[0138] Further, the information related to the high-priority feature tag in the user intention strategy is used as the first keyword, and it is determined whether there is a security atomic capability corresponding to the first dimension feature tag that is the same or similar to the first keyword, and the security atomic capability corresponding to the first dimension feature tag that is the same as the first keyword, and generates a first security atomic capability list, including:

[0139] Using the information related to the high-priority feature tag in the user intention strategy as the first keyword, searching the first dimension feature tags in the feature tag library;

[0140] In the case where there is a first dimension feature label identical to the first keyword, extracting a security atomic capability corresponding to the first dimension feature label identical to the first keyword;

[0141] When there is no first dimension feature label identical to the first keyword, but there is a first dimension feature label similar to the first keyword, the security atomic capabilities corresponding to multiple first dimension feature labels with the highest similarity to the first keyword are extracted to generate the first security atomic capabilities list.

[0142] Specifically, the screening of the security atomic capabilities corresponding to the first dimension feature tag identical to the first keyword according to the information related to the low-priority feature tag in the user intent strategy to obtain the security atomic capabilities that meet the user intent strategy includes:

[0143] Determine whether the security atomic capability corresponding to the first dimension feature tag identical to the first keyword conforms to the policy template, deployment location, and deployment method indicated by the user intention policy;

[0144] If yes, extracting the security atomic capability corresponding to the first dimension feature label identical to the first keyword as the security atomic capability that complies with the user intention strategy;

[0145] If not, the security atomic capability corresponding to the first dimension feature label with the highest similarity to the first keyword is extracted as the security atomic capability that meets the user intention strategy.

[0146] Further, the method uses the information related to the feature tag of medium priority in the user intention strategy as the second keyword to filter the security atomic capabilities in the first security atomic capability list to obtain the security atomic capabilities that meet the user intention strategy, including:

[0147] Constructing a first feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the first security atomic capability list;

[0148] Using the information related to the feature tag with medium priority in the user intention strategy as the second keyword, searching the feature tags of the third dimension and the feature tags of the sixth dimension in the first feature tag sub-library;

[0149] In the case where there are feature tags of the third dimension and feature tags of the sixth dimension identical to the second keyword, extracting security atomic capabilities corresponding to the feature tags of the third dimension and feature tags of the sixth dimension identical to the second keyword as security atomic capabilities that conform to the user intention strategy;

[0150] In the case that there is no third dimension feature label and sixth dimension feature label identical to the second keyword, but there is a third dimension feature label and sixth dimension feature label similar to the second keyword, extracting the security atomic capability with the highest similarity to the second keyword, and generating the second security atomic capability list;

[0151] In the absence of a third dimension feature tag and a sixth dimension feature tag that are identical or similar to the second keyword, using the first security atomic capability list as the second security atomic capability list;

[0152] The security atomic capabilities in the second security atomic capability list are screened according to the information related to the low-priority feature tag in the user intent policy to obtain the security atomic capabilities that meet the user intent policy.

[0153] Further, the screening of the security atomic capabilities in the second security atomic capability list according to the information related to the low-priority feature tag in the user intent policy to obtain the security atomic capabilities that meet the user intent policy includes:

[0154] Constructing a second feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the second security atomic capability list;

[0155] Using the security policy indicated by the user intention policy as a third keyword, searching the second dimension feature tags in the second feature tag sub-library;

[0156] In the case where there is a second dimension feature tag that is the same as the third keyword, determining whether the corresponding security atomic capability complies with the deployment location and deployment method indicated by the user intention strategy;

[0157] If so, extracting the security atomic capability corresponding to the second dimension feature label that is the same as the third keyword as the security atomic capability that meets the user intention strategy;

[0158] If not, re-search the second dimension feature tags in the second feature tag sub-library;

[0159] In the case where there is no second dimension feature tag identical to the third keyword, but there is a second dimension feature tag similar to the third keyword, extracting security atomic capabilities corresponding to the second dimension feature tags similar to the third keyword, and sorting the extracted security atomic capabilities in descending order of similarity to generate a third security atomic capability list;

[0160] According to the third security atomic capability list, the security atomic capabilities that meet the user's intended policy are screened out.

[0161] Further, the screening out of the security atomic capabilities that meet the user's intended policy according to the third security atomic capability list includes:

[0162] Constructing a third feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the third security atomic capability list;

[0163] According to the order of the security atomic capabilities in the third security atomic capability list, traverse the fourth dimension feature tags and the fifth dimension feature tags in the third feature tag sub-library to determine whether the corresponding security atomic capabilities comply with the deployment location and deployment method indicated by the user intention policy;

[0164] When a secure atomic capability with a deployment location and a deployment method that conforms to the user intention policy is found, extract the corresponding secure atomic capability as the secure atomic capability that conforms to the user intention policy;

[0165] If no secure atomic capability is found that meets the deployment location and deployment method indicated by the user's intention policy, a prompt message is triggered to instruct the user to adjust the security requirement intention.

[0166] For example, the detailed process of secure atomic capability orchestration performed at the atomic capability orchestration layer is as follows:

[0167] The intent handling layer issues the user intent policy through the capability screening module, performs feature matching / comparison based on the feature tag library, and selects appropriate security atomic capabilities that meet the user's security requirements. First, set the feature tag priorities of multiple dimensions of security atomic capabilities, and complete the hierarchical (for example, three-layer) screening of security atomic capabilities based on the feature tag priorities. In an embodiment of the present invention, the first dimension feature tag related to the core function is set as a high-priority feature tag, the third dimension feature tag and the sixth dimension feature tag related to the IPDRR security framework category and whether it is a traffic type are set as medium-priority feature tags, and the second dimension feature tag, the fourth dimension feature tag, and the fifth dimension feature tag related to the policy template, deployment location, and deployment method are set as low-priority tags.

[0168] The process of comparing multi-dimensional feature labels of security atomic capabilities is as follows:

[0169] Step 1: In the feature tag library, use the core function instructions corresponding to the high-priority feature tags given by the user intention strategy as the first keyword to complete the first-level security atomic capability screening, and execute step 2.

[0170] Step 2: If there is a security atomic capability that is completely consistent with the core function instruction of the security atomic capability given by the user's intention policy, execute step 3. If no completely consistent security atomic capability is screened out, return the security atomic capabilities with high similarity to the core function instruction given by the user's intention policy (for example, the top N with high similarity) to form the first security atomic capability list, and execute step 4.

[0171] Step 3: Directly compare the low-priority feature tags corresponding to the security atomic capability to see if they meet the requirements indicated by the user's intent strategy. If the user's intent strategy is met (for example, other dimensional feature tags are met), the security atomic capability can be directly determined to be used, and the screening process ends. If not, the security atomic capability with the highest similarity to the user's intent strategy is returned, and the first-level screening process ends.

[0172] Step 4: Extract the obtained first security atomic capability list to construct the first feature label sub-library A, and execute step 5.

[0173] Step 5: Based on the first feature tag sub-library A, the feature tag related information of medium priority given by the user intention strategy is used as the second keyword to complete the second-level security atomic capability screening, obtain the second security atomic capability list that meets the conditions, and execute step 6. If the feature tag related information of medium priority is not given in the user intention strategy, the current first security atomic capability list is maintained, that is, the first security atomic capability list is used as the second security atomic capability list, and step 6 is executed.

[0174] Step 6: Extract the second security atomic capability list, build the second feature label sub-library B, and execute step 7.

[0175] Step 7: Based on the second feature tag sub-library B, in the low-priority tags, taking the policy template of the security atomic capability as an example, if there is a security atomic capability that is completely consistent with the policy template given by the user's intended policy, then execute step 8. If not satisfied, return the security atomic capability with a high similarity to the user's intended policy (for example, the top M with a high similarity), and execute step 9.

[0176] Step 8: Compare the deployment location and deployment method of the security atomic capability to see if they can meet the requirements indicated by the user's intent policy. If they meet the user's intent policy, the security atomic capability can be directly determined to be used, and the screening process ends. If not, return to step 7 to continue searching in the second feature tag library B.

[0177] Step 9: Sort by similarity with the user's intention strategy from high to low, construct a third security atomic capability list, and at the same time construct a third feature label sub-library C, and execute step 10.

[0178] Step 10: Compare the deployment location and deployment method of the security atomic capabilities in order to see if they can meet the requirements of the user's intended strategy. If they do, select the security atomic capability and end the screening process. If they do not, continue the comparison. If there is still no security atomic capability that meets the conditions, a prompt message is returned to the user to prompt the user to adjust the input content of the security requirement intention.

[0179] The embodiment of the present invention can realize multi-layer automatic screening of security atomic capabilities through multi-dimensional feature labels of security atomic capabilities and corresponding feature label priorities, and screen out the security atomic capabilities that best meet the user's intentions.

[0180] For the above-screened secure atomic capabilities, the screened secure atomic capabilities are combined with the orchestration template of the secure atomic capabilities through the atomic capability orchestration module, and the secure atomic capability orchestration strategy that adapts to the user's application scenario is output for the secure atomic capability with reference to the orchestration template, and is sent to the capability execution layer.

[0181] Among them, the orchestration template of the security atomic capability lists the commonly used orchestration schemes between various types of security atomic capabilities. The orchestration template can be used as a reference to output the security atomic capability output by the capability screening module to output the security atomic capability orchestration strategy that adapts to the user's application scenario.

[0182] The atomic capability orchestration module then combines the screened secure atomic capabilities with the secure atomic capability orchestration template, and outputs a secure atomic capability orchestration solution that adapts to the user's application scenario for the secure atomic capability with reference to the orchestration template, and sends it to the capability execution layer.

[0183] In the capability execution layer, the security atomic capability resource pool refers to the security atomic capability orchestration strategy to call the corresponding security atomic capability, issue the corresponding security policy, and perform security protection to provide corresponding security guarantees. The capability execution result module retains the security atomic capability execution results and feeds back to the user after all executions are completed.

[0184] Compared with the prior art, the embodiments of the present invention abstract the characteristics of security atomic capabilities into multidimensional feature labels, parse the security intentions input by the user, select the security atomic capabilities that best meet the user's needs based on the multidimensional feature labels of the security atomic capabilities, and orchestrate the security atomic capabilities to generate a security atomic capability orchestration strategy. This does not require users to have an in-depth understanding of security capabilities and security atomic capabilities. Users only need to clearly express their security requirements, and the user's security requirement intentions can be translated into the user's intention strategy, and the orchestration of the security atomic capabilities can be completed in combination with the multidimensional feature labels of the security atomic capabilities, thereby effectively responding to complex and changing security risks.

[0185] See also Figure 6 , Figure 6 The present invention provides a structural block diagram of a secure atomic capability orchestration device, the secure atomic capability orchestration device comprising:

[0186] A feature extraction module 11 is used to extract features of the security atomic capability, obtain multi-dimensional feature labels of the corresponding security atomic capability, and construct a feature label library;

[0187] The intention handling module 12 is used to handle the security requirements input by the user and obtain the user intention strategy;

[0188] A capability screening module 13 is used to screen out security atomic capabilities that meet the user's security requirements in the feature tag library according to the user's intention strategy;

[0189] The capability orchestration module 14 is used to orchestrate the screened security atomic capabilities to obtain a security atomic capability orchestration strategy.

[0190] In an optional embodiment, the multidimensional feature tag includes: a first dimension feature tag related to the core function instructions of the security atomic capability, a second dimension feature tag related to the policy template of the security atomic capability, a third dimension feature tag related to the IPDRR security framework category to which the security atomic capability belongs, a fourth dimension feature tag related to the deployment location of the security atomic capability, a fifth dimension feature tag related to the deployment method of the security atomic capability, and a sixth dimension feature tag related to the traffic type of the security atomic capability.

[0191] In an optional embodiment, the feature extraction module 11 includes:

[0192] A first dimension feature label extraction unit, configured to extract core function instructions according to the core function description of the security atomic capability as a first dimension feature label of the corresponding security atomic capability;

[0193] A second dimension feature label extraction unit, used to extract the policy template of the security atomic capability from the security atomic capability policy management module as the second dimension feature label of the corresponding security atomic capability;

[0194] A third dimension feature label extraction unit, used to determine the IPDRR security framework category to which the security atomic capability belongs according to the pre-defined security atomic capability description and classification, and use the IPDRR security framework category to which the security atomic capability belongs as the third dimension feature label;

[0195] A fourth dimension feature label extraction unit, used to extract all available deployment locations of the security atomic capability as fourth dimension feature labels of the corresponding security atomic capability;

[0196] A fifth dimension feature label extraction unit, used to extract all available deployment modes of the security atomic capability as the fifth dimension feature labels of the corresponding security atomic capability;

[0197] The sixth dimension feature label extraction unit is used to extract the traffic type to which the security atomic capability belongs as the sixth dimension feature label of the corresponding security atomic capability; wherein the traffic type includes traffic type and non-traffic type.

[0198] In an optional embodiment, the capability screening module 13 includes:

[0199] A capability screening unit, configured to compare the user intention strategy with the multi-dimensional feature tags in the feature tag library according to a preset feature tag priority, so as to perform hierarchical screening on the security atomic capabilities and obtain the security atomic capabilities that meet the user intention strategy;

[0200] Wherein, the feature label library includes multi-dimensional feature labels of each of the security atomic capabilities.

[0201] In an optional embodiment, the feature label priorities include: the first dimension feature label is a high priority, the third dimension feature label and the sixth dimension feature label are medium priority, and the second dimension feature label, the fourth dimension feature label and the fifth dimension feature label are low priority.

[0202] In an optional embodiment, the capability screening unit includes:

[0203] a first screening subunit, configured to use the information related to the high-priority feature tag in the user intention strategy as a first keyword, determine whether there is a security atomic capability corresponding to a first dimension feature tag that is identical or similar to the first keyword, and generate a first security atomic capability list based on the security atomic capabilities corresponding to the first dimension feature tags that are similar to the first keyword;

[0204] A second screening subunit is used to screen the security atomic capabilities in the first security atomic capability list by using the information related to the feature tag with medium priority in the user intention strategy as a second keyword to obtain the security atomic capabilities that meet the user intention strategy;

[0205] The third screening sub-unit is used to screen the security atomic capabilities corresponding to the first dimension feature tag that is the same as the first keyword according to the information related to the low-priority feature tag in the user intention strategy, so as to obtain the security atomic capabilities that meet the user intention strategy.

[0206] In an optional embodiment, the first screening subunit includes:

[0207] A first retrieval subunit is configured to retrieve a first dimension feature tag in the feature tag library by using the information related to the high-priority feature tag in the user intention strategy as a first keyword;

[0208] A first capability extraction subunit is configured to extract a security atomic capability corresponding to the first dimension feature tag identical to the first keyword when there is a first dimension feature tag identical to the first keyword;

[0209] The second capability extraction unit is used to extract the security atomic capabilities corresponding to multiple first dimensional feature labels with top similarity to the first keyword when there is no first dimensional feature label identical to the first keyword but there is a first dimensional feature label similar to the first keyword, so as to generate the first security atomic capability list.

[0210] In an optional embodiment, the third screening subunit includes:

[0211] A first judgment subunit is used to judge whether the security atomic capability corresponding to the first dimension feature tag that is the same as the first keyword conforms to the policy template, deployment location, and deployment method indicated by the user intention policy;

[0212] A third capability extraction unit is configured to extract, if yes, a security atomic capability corresponding to a first dimension feature label identical to the first keyword as a security atomic capability that complies with the user intention strategy;

[0213] The fourth capability extraction unit is used to extract the security atomic capability corresponding to the first dimension feature label with the highest similarity to the first keyword as the security atomic capability that meets the user intention strategy.

[0214] In an optional embodiment, the second screening subunit includes:

[0215] A first label sub-library construction sub-unit, configured to construct a first feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the first security atomic capability list;

[0216] A second retrieval subunit is configured to use the information related to the feature tag of medium priority in the user intention strategy as a second keyword to retrieve the feature tags of the third dimension and the feature tags of the sixth dimension in the first feature tag sub-library;

[0217] a fifth capability extraction unit, configured to extract, when there are third dimension feature tags and sixth dimension feature tags identical to the second keyword, security atomic capabilities corresponding to the third dimension feature tags and sixth dimension feature tags identical to the second keyword as security atomic capabilities that comply with the user intention strategy;

[0218] a sixth capability extraction unit, configured to extract, when there is no third dimension feature label and sixth dimension feature label identical to the second keyword, but there is a third dimension feature label and sixth dimension feature label similar to the second keyword, a security atomic capability with a top similarity to the second keyword, and generate a second security atomic capability list;

[0219] A seventh capability extraction unit, configured to use the first security atomic capability list as the second security atomic capability list when there are no third dimension feature labels and sixth dimension feature labels that are identical or similar to the second keyword;

[0220] The fourth screening unit is used to screen the security atomic capabilities in the second security atomic capability list according to the information related to the low-priority feature tags in the user intention policy, so as to obtain the security atomic capabilities that meet the user intention policy.

[0221] In an optional embodiment, the fourth screening unit includes:

[0222] A second label sub-library construction sub-unit, configured to construct a second feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the second security atomic capability list;

[0223] A third retrieval subunit, configured to retrieve the second dimension feature tags in the second feature tag sub-library by using the security policy indicated by the user intention policy as a third keyword;

[0224] A second judgment subunit is used to judge whether the corresponding security atomic capability conforms to the deployment location and deployment mode indicated by the user intention strategy when there is a second dimension feature tag that is the same as the third keyword;

[0225] An eighth capability extraction unit, configured to extract, if yes, a security atomic capability corresponding to a second dimension feature label identical to the third keyword as a security atomic capability that complies with the user intention strategy;

[0226] a ninth capability extraction unit, configured to, if no, re-search the second dimension feature tag in the second feature tag sub-library;

[0227] a tenth capability extraction unit, configured to extract, when there is no second dimensional feature tag identical to the third keyword but there is a second dimensional feature tag similar to the third keyword, security atomic capabilities corresponding to the second dimensional feature tag similar to the third keyword, and sort the extracted security atomic capabilities in descending order of similarity to generate a third security atomic capability list;

[0228] The security atomic capability screening subunit is used to screen out the security atomic capabilities that meet the user's intention policy according to the third security atomic capability list.

[0229] In an optional embodiment, the security atomic capability screening subunit includes:

[0230] A third label sub-library construction sub-unit, configured to construct a third feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the third security atomic capability list;

[0231] A third judgment subunit is used to traverse the fourth dimension feature tags and the fifth dimension feature tags in the third feature tag sub-library according to the order of the security atomic capabilities in the third security atomic capability list, and judge whether the corresponding security atomic capability conforms to the deployment position and deployment mode indicated by the user intention policy;

[0232] an eleventh capability extraction unit, configured to extract, when a security atomic capability having a deployment location and a deployment mode that conforms to the user intention policy is found, a corresponding security atomic capability as a security atomic capability that conforms to the user intention policy;

[0233] The prompt subunit is used to trigger prompt information instructing the user to adjust the security requirement intention when no security atomic capability with a deployment location and deployment method that meets the user's intention policy indication is found.

[0234] In an optional embodiment, the intended treatment module 12 includes:

[0235] An intention decomposition unit, used to perform word segmentation processing on the security requirements to obtain intention keywords;

[0236] An intention matching unit, used to match and expand the intention keyword with the annotated keywords in the intention corpus to generate the user intention;

[0237] The intention formatting unit is used to format the user intention to obtain the user intention strategy.

[0238] In an optional embodiment, the device further includes:

[0239] The capability execution module is used to call the corresponding security atomic capability from the security atomic capability resource pool to perform security protection according to the security atomic capability orchestration strategy.

[0240] It should be noted that the working process of each module in the secure atomic capability orchestration device described in the embodiment of the present invention can refer to the working process of the secure atomic capability orchestration method described in the above embodiment, and the technical effect achieved is also the same as the secure atomic capability orchestration method described in the above embodiment, which will not be repeated here.

[0241] See also Figure 7 , Figure 7 It is a structural block diagram of a secure atomic capability orchestration device provided by an embodiment of the present invention. The secure atomic capability orchestration system comprises: an intention handling layer 21, an atomic capability orchestration layer 22 and a capability execution layer 23;

[0242] The intention handling layer 21 is used to handle the security requirements input by the user, obtain the user intention strategy, and input the user intention strategy into the atomic capability orchestration layer 22;

[0243] The atomic capability orchestration layer 22 is used to extract features of the security atomic capabilities, obtain multi-dimensional feature labels of the corresponding security atomic capabilities, and construct a feature label library; according to the user intention strategy input by the intention handling layer, the security atomic capabilities that meet the user's security needs are screened out in the feature label library; the screened security atomic capabilities are orchestrated to obtain a security atomic capability orchestration strategy, and the security atomic capability orchestration strategy is input into the capability execution layer 23;

[0244] The capability execution layer 23 is used to call the corresponding secure atomic capability from the secure atomic capability resource pool to perform security protection according to the secure atomic capability orchestration policy input by the atomic capability orchestration layer.

[0245] It should be noted that the working process of each layer in the secure atomic capability orchestration system described in the embodiment of the present invention can refer to the working process of the secure atomic capability orchestration method described in the above embodiment, and the technical effect achieved is the same as that of the secure atomic capability orchestration method described in the above embodiment, which will not be repeated here.

[0246] See also Figure 8 , Figure 8 : is a structural block diagram of a secure atomic capability orchestration device provided in an embodiment of the present invention. The secure atomic capability orchestration device includes a processor 31, a memory 32, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the computer program, the steps in the above-mentioned secure atomic capability orchestration method embodiments are implemented, such as steps S11 to S13.

[0247] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 32 and executed by the processor 31 to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the secure atomic capability orchestration device.

[0248] The secure atomic capability orchestration device may include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art may understand that the schematic diagram is only an example of a secure atomic capability orchestration device and does not constitute a limitation on the secure atomic capability orchestration device. The secure atomic capability orchestration device may include more or fewer components than shown in the diagram, or may combine certain components, or different components. For example, the secure atomic capability orchestration device may also include input and output devices, network access devices, buses, etc.

[0249] The processor 31 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 31 is the control center of the secure atomic capability orchestration device, and uses various interfaces and lines to connect various parts of the entire secure atomic capability orchestration device.

[0250] The memory 32 can be used to store the computer program and / or module, and the processor 31 realizes various functions of the secure atomic capability orchestration device by running or executing the computer program and / or module stored in the memory 32, and calling the data stored in the memory 32. The memory 32 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 32 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0251] Wherein, if the module / unit integrated in the secure atomic capability orchestration device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor 31. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0252] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0253] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, many improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A secure atomic capability orchestration method, characterized in that: include: Extract features of security atomic capabilities, obtain multi-dimensional feature labels of corresponding security atomic capabilities, and build a feature label library; Perform intent processing on the security requirements input by the user to obtain the user intent strategy; According to the user intention strategy, screening out security atomic capabilities that meet the user's security needs in the feature tag library; The screened security atomic capabilities are orchestrated to obtain a security atomic capability orchestration strategy.

2. The secure atomic capability arrangement method according to claim 1, characterized in that: The multidimensional feature tag includes: a first dimension feature tag related to the core function instructions of the security atomic capability, a second dimension feature tag related to the policy template of the security atomic capability, a third dimension feature tag related to the IPDRR security framework category to which the security atomic capability belongs, a fourth dimension feature tag related to the deployment location of the security atomic capability, a fifth dimension feature tag related to the deployment method of the security atomic capability, and a sixth dimension feature tag related to the traffic type of the security atomic capability.

3. The secure atomic capability arrangement method according to claim 2, characterized in that: The feature extraction of the security atomic capability to obtain the multi-dimensional feature label of the corresponding security atomic capability includes: Extracting core function instructions according to the core function description of the security atomic capability as the first dimension feature label of the corresponding security atomic capability; Extracting the policy template of the security atomic capability from the security atomic capability policy management module as a second dimension feature label of the corresponding security atomic capability; According to the pre-defined security atomic capability description and classification, determine the IPDRR security framework category to which the security atomic capability belongs, and use the IPDRR security framework category to which the security atomic capability belongs as a third dimension feature label; Extracting all available deployment locations of the security atomic capability as the fourth dimension feature labels of the corresponding security atomic capability; Extract all available deployment modes of the security atomic capability as the fifth dimension feature labels of the corresponding security atomic capability; The traffic type to which the security atomic capability belongs is extracted as a sixth dimension feature label of the corresponding security atomic capability; wherein the traffic type includes a traffic type and a non-traffic type.

4. The secure atomic capability arrangement method according to claim 2, characterized in that: The step of screening out security atomic capabilities that meet the security requirements of the user from the feature tag library according to the user intention strategy includes: According to the pre-set feature tag priority, the user intention strategy is compared with the multi-dimensional feature tags in the feature tag library to perform hierarchical screening of the security atomic capabilities to obtain the security atomic capabilities that meet the user intention strategy; Wherein, the feature label library includes multi-dimensional feature labels of each of the security atomic capabilities.

5. The secure atomic capability arrangement method according to claim 4, characterized in that: The feature tag priorities include: the first dimension feature tag is a high priority, the third dimension feature tag and the sixth dimension feature tag are medium priority, and the second dimension feature tag, the fourth dimension feature tag and the fifth dimension feature tag are low priority.

6. The secure atomic capability arrangement method according to claim 5, characterized in that: The user intention strategy is compared with the multi-dimensional feature tags in the feature tag library according to the preset feature tag priority to perform hierarchical screening on the security atomic capabilities to obtain the security atomic capabilities that meet the user intention strategy, including: Taking the information related to the high-priority feature tag in the user intention strategy as the first keyword, determining whether there is a security atomic capability corresponding to the first dimension feature tag that is the same as or similar to the first keyword, and generating a first security atomic capability list based on the security atomic capabilities corresponding to the first dimension feature tags that are similar to the first keyword; Using the information related to the feature tag with medium priority in the user intention strategy as the second keyword, screening the security atomic capabilities in the first security atomic capability list to obtain the security atomic capabilities that meet the user intention strategy; According to the information related to the low-priority feature tags in the user intent strategy, the security atomic capabilities corresponding to the first dimension feature tags that are the same as the first keyword are screened to obtain the security atomic capabilities that meet the user intent strategy.

7. The secure atomic capability arrangement method according to claim 6, characterized in that: The method of using the information related to the high-priority feature tag in the user intention strategy as the first keyword, determining whether there is a security atomic capability corresponding to the first dimension feature tag that is the same or similar to the first keyword, and generating a first security atomic capability list according to the security atomic capabilities corresponding to the first dimension feature tags that are similar to the first keyword, includes: Using the information related to the high-priority feature tag in the user intention strategy as the first keyword, searching the first dimension feature tags in the feature tag library; In the case where there is a first dimension feature label identical to the first keyword, extracting a security atomic capability corresponding to the first dimension feature label identical to the first keyword; When there is no first dimension feature label identical to the first keyword, but there is a first dimension feature label similar to the first keyword, the security atomic capabilities corresponding to multiple first dimension feature labels with the highest similarity to the first keyword are extracted to generate the first security atomic capabilities list.

8. The secure atomic capability arrangement method according to claim 6, characterized in that: The step of screening the security atomic capabilities corresponding to the first dimension feature tag identical to the first keyword according to the information related to the low-priority feature tag in the user intent strategy to obtain the security atomic capabilities that meet the user intent strategy includes: Determine whether the security atomic capability corresponding to the first dimension feature tag identical to the first keyword conforms to the policy template, deployment location, and deployment method indicated by the user intention policy; If yes, extracting the security atomic capability corresponding to the first dimension feature label identical to the first keyword as the security atomic capability that complies with the user intention strategy; If not, the security atomic capability corresponding to the first dimension feature label with the highest similarity to the first keyword is extracted as the security atomic capability that meets the user intention strategy.

9. The secure atomic capability arrangement method according to claim 6, characterized in that: The method of using the information related to the feature tag of medium priority in the user intention strategy as the second keyword to filter the security atomic capabilities in the first security atomic capability list to obtain the security atomic capabilities that meet the user intention strategy includes: Constructing a first feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the first security atomic capability list; Using the information related to the feature tag with medium priority in the user intention strategy as the second keyword, searching the feature tags of the third dimension and the feature tags of the sixth dimension in the first feature tag sub-library; In the case where there are feature tags of the third dimension and feature tags of the sixth dimension identical to the second keyword, extracting security atomic capabilities corresponding to the feature tags of the third dimension and feature tags of the sixth dimension identical to the second keyword as security atomic capabilities that conform to the user intention strategy; In the case that there is no third dimension feature label and sixth dimension feature label identical to the second keyword, but there is a third dimension feature label and sixth dimension feature label similar to the second keyword, extracting the security atomic capability with the highest similarity to the second keyword, and generating the second security atomic capability list; In the absence of a third dimension feature tag and a sixth dimension feature tag that are identical or similar to the second keyword, using the first security atomic capability list as the second security atomic capability list; The security atomic capabilities in the second security atomic capability list are screened according to the information related to the low-priority feature tag in the user intent policy to obtain the security atomic capabilities that meet the user intent policy.

10. The secure atomic capability arrangement method according to claim 9, characterized in that: The step of screening the security atomic capabilities in the second security atomic capability list according to the information related to the low-priority feature tag in the user intent policy to obtain the security atomic capabilities that meet the user intent policy includes: Constructing a second feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the second security atomic capability list; Using the security policy indicated by the user intention policy as a third keyword, searching the second dimension feature tags in the second feature tag sub-library; In the case where there is a second dimension feature tag that is the same as the third keyword, determining whether the corresponding security atomic capability complies with the deployment location and deployment method indicated by the user intention strategy; If so, extracting the security atomic capability corresponding to the second dimension feature label that is the same as the third keyword as the security atomic capability that meets the user intention strategy; If not, re-search the second dimension feature tags in the second feature tag sub-library; In the case where there is no second dimension feature tag identical to the third keyword, but there is a second dimension feature tag similar to the third keyword, extracting security atomic capabilities corresponding to the second dimension feature tags similar to the third keyword, and sorting the extracted security atomic capabilities in descending order of similarity to generate a third security atomic capability list; According to the third security atomic capability list, the security atomic capabilities that meet the user's intended policy are screened out.

11. The secure atomic capability arrangement method according to claim 10, characterized in that: The step of screening out the security atomic capability that meets the user's intended policy according to the third security atomic capability list includes: Constructing a third feature label sub-library according to the multi-dimensional feature labels of the security atomic capabilities in the third security atomic capability list; According to the order of the security atomic capabilities in the third security atomic capability list, traverse the fourth dimension feature tags and the fifth dimension feature tags in the third feature tag sub-library to determine whether the corresponding security atomic capabilities comply with the deployment location and deployment method indicated by the user intention policy; When a secure atomic capability with a deployment location and a deployment method that conforms to the user intention policy is found, extract the corresponding secure atomic capability as the secure atomic capability that conforms to the user intention policy; If no secure atomic capability is found that meets the deployment location and deployment method indicated by the user's intention policy, a prompt message is triggered to instruct the user to adjust the security requirement intention.

12. The secure atomic capability arrangement method according to claim 1, characterized in that: The intention processing of the security requirements input by the user to obtain the user intention strategy includes: Perform word segmentation on the security requirements to obtain intent keywords; Matching and expanding the intent keywords with the annotated keywords in the intent corpus to generate user intent; The user intention is formatted to obtain the user intention strategy.

13. The secure atomic capability arrangement method according to claim 1, characterized in that: The method further comprises: According to the security atomic capability orchestration strategy, the corresponding security atomic capability is called from the security atomic capability resource pool to perform security protection.

14. A secure atomic capability orchestration device, characterized in that: include: The feature extraction module is used to extract features of the security atomic capability, obtain multi-dimensional feature labels of the corresponding security atomic capability, and build a feature label library; The intention handling module is used to handle the security requirements input by the user and obtain the user intention strategy; A capability screening module, used to screen out security atomic capabilities that meet the user's security requirements in the feature tag library according to the user's intention strategy; The capability orchestration module is used to orchestrate the screened security atomic capabilities to obtain the security atomic capability orchestration strategy.

15. A secure atomic capability orchestration system, characterized in that: include: Intent handling layer, atomic capability orchestration layer, and capability execution layer; The intention handling layer is used to perform intention handling on the security requirements input by the user, obtain the user intention strategy, and input the user intention strategy into the atomic capability orchestration layer; The atomic capability orchestration layer is used to extract features of the security atomic capabilities, obtain multi-dimensional feature labels of the corresponding security atomic capabilities, and construct a feature label library; According to the user intention strategy input by the intention handling layer, screening out security atomic capabilities that meet the user's security needs in the feature tag library; Orchestrate the screened secure atomic capabilities to obtain a secure atomic capability orchestration strategy, and input the secure atomic capability orchestration strategy into the capability execution layer; The capability execution layer is used to call the corresponding secure atomic capability from the secure atomic capability resource pool to perform security protection according to the secure atomic capability orchestration strategy input by the atomic capability orchestration layer.

16. A secure atomic capability orchestration device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the secure atomic capability orchestration method as described in any one of claims 1 to 13 when executing the computer program.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the secure atomic capability orchestration method as described in any one of claims 1 to 13.

18. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the secure atomic capability orchestration method described in any one of claims 1 to 13 is implemented.

Images