Network security event processing method and device
Through the collection, format conversion, screening and priority assessment of network security events, quickly identify and handle high priority events, solve the problem of low efficiency of network security incidents in existing technology, and achieve efficient event response.
Patent Information
- Application Number
- CN202411678994.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-22
- Publication Date
- 2025-01-28
AI Technical Summary
The prior art has detection delays in handling network security events, especially when attack methods are concealed or complex, resulting in inefficient processing.
By collecting incidents of network security equipment, formatting and screening are performed, an abnormal event is recognized and the priority is evaluated. High -priority incidents generate alarm information, and low priority events are sent to network security systems with the lowest resource usage.
The rapid discovery and network security incidents have been achieved, and the processing efficiency is improved. Even if the attack method is hidden or complex, it can respond in a timely manner.
Smart Images
Figure CN119383007A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data processing technology, and in particular to a method and device for processing network security incidents. Background Art
[0002] With the development of network technology, network security issues are also increasing. After a security incident related to network security occurs, it is necessary to deal with the security incident in a timely and effective manner to ensure the normal operation of the network.
[0003] At present, many network security incidents can only rely on manual intervention. The first step of manual intervention is to detect the occurrence of network security incidents through network monitoring tools and other means. After confirming the occurrence of network security incidents, network security incidents are resolved manually. Although network monitoring tools can monitor network traffic and system activities in real time, they still have a certain detection delay, especially when the occurrence of network security incidents is very covert or the attack method is more complex. Some attacks may not be easy to capture in the early stages, so manual detection may be delayed, resulting in inefficient handling of network security incidents.
[0004] Therefore, how to improve the efficiency of handling network security incidents has become an urgent problem to be solved in this field. Summary of the invention
[0005] The present application provides a method and device for processing network security incidents, aiming to improve the processing efficiency of network security incidents.
[0006] In order to achieve the above objectives, this application provides the following technical solutions:
[0007] A method for handling network security incidents, comprising:
[0008] Collect multiple network security events of network security devices;
[0009] For each of the network security events, convert the format of the network security event to obtain a standard network security event;
[0010] Filter out abnormal cybersecurity events from all standard cybersecurity events and identify them as target cybersecurity events;
[0011] For each of the target network security events, evaluating the target network security event to obtain a priority of the target network security event;
[0012] When the priority of the target network security event is high, generating and feeding back alarm information based on the target network security event;
[0013] When the priority of the target network security event is not the high priority, the target network security event is sent to a target network security system so that the target network security system processes the target network security event; the target network security system is the network security system with the lowest resource utilization among all network security systems.
[0014] Optionally, screening out abnormal network security events from all standard network security events and marking them as target network security events includes:
[0015] For each of the standard network security events, the standard network security event is input into the large model to obtain relevant information; the relevant information includes the type and characteristics of the standard network security event;
[0016] Filtering prompt words corresponding to the relevant information from a prompt word library;
[0017] Inputting the prompt word into the large model to obtain a parsing result; the parsing result includes a potential threat level of a standard network security event;
[0018] Standard network security events with a potential threat level greater than a preset level are screened out from all standard network security events and identified as target network security events.
[0019] Optionally, for each of the target network security events, evaluating the target network security event to obtain a priority of the target network security event includes:
[0020] Classify all target network security events to obtain multiple sets; wherein one set contains target network security events of the same type;
[0021] For each set of the collections, filter out historical network security events corresponding to the collection from the historical event library;
[0022] For each target network security event in the set, compare the target network security event with the historical network security events to obtain the impact scope of the target network security event;
[0023] Get the current network load status and current network security device status;
[0024] Using the current network load status and the current network security device status to evaluate the target network security event, and obtain the impact range of the network environment;
[0025] Based on the impact scope of the network security event and the impact scope of the network environment, a priority of the target network security event is determined.
[0026] Optionally, determining the priority of the target network security event based on the impact scope of the network security event and the impact scope of the network environment includes:
[0027] Determine whether the impact scope of the network security incident is greater than the preset incident impact scope;
[0028] If the impact scope of the network security event is greater than the preset event impact scope, determining whether the impact scope of the network environment is greater than the preset environment impact scope;
[0029] If the impact range of the network environment is greater than the preset environmental impact range, determining the priority of the target network security event as a high priority;
[0030] If the impact scope of the network security event is not greater than the preset event impact scope, or the impact scope of the network environment is not greater than the preset environment impact scope, then the priority of the target network security event is determined to be medium priority;
[0031] If the impact scope of the network security event is not greater than the preset event impact scope, and the impact scope of the network environment is not greater than the preset environment impact scope, the priority of the target network security event is determined to be a low priority.
[0032] Optionally, when the priority of the target network security event is not the high priority, sending the target network security event to a target network security system so that the target network security system processes the target network security event, includes:
[0033] When the priority of the target network security event is not the high priority, obtaining resource usage rates of all network security systems;
[0034] From the resource utilization rates of all network security systems, select the network security system with the lowest resource utilization rate and mark it as the target network security system;
[0035] The target network security event is sent to a target network security system so that the target network security system processes the target network security event.
[0036] A network security event processing device, comprising:
[0037] A collection unit, used to collect multiple network security events of network security devices;
[0038] A conversion unit, configured to convert the format of each network security event to obtain a standard network security event;
[0039] A screening unit, used to screen out abnormal network security events from all standard network security events and mark them as target network security events;
[0040] An evaluation unit, configured to evaluate each target network security event to obtain a priority of the target network security event;
[0041] A generating unit, configured to generate and feed back warning information based on the target network security event when the priority of the target network security event is high priority;
[0042] A sending unit is used to send the target network security event to a target network security system when the priority of the target network security event is not the high priority, so that the target network security system processes the target network security event; the target network security system is the network security system with the lowest resource utilization rate among all network security systems.
[0043] Optionally, the screening unit is specifically used for:
[0044] For each of the standard network security events, the standard network security event is input into the large model to obtain relevant information; the relevant information includes the type and characteristics of the standard network security event;
[0045] Filtering prompt words corresponding to the relevant information from a prompt word library;
[0046] Inputting the prompt word into the large model to obtain a parsing result; the parsing result includes a potential threat level of a standard network security event;
[0047] Standard network security events with a potential threat level greater than a preset level are screened out from all standard network security events and identified as target network security events.
[0048] Optionally, the evaluation unit is specifically used for:
[0049] Classify all target network security events to obtain multiple sets; wherein one set contains target network security events of the same type;
[0050] For each set of the collections, filter out historical network security events corresponding to the collection from the historical event library;
[0051] For each target network security event in the set, compare the target network security event with the historical network security events to obtain the impact scope of the target network security event;
[0052] Get the current network load status and current network security device status;
[0053] Using the current network load status and the current network security device status to evaluate the target network security event, and obtain the impact range of the network environment;
[0054] Based on the impact scope of the network security event and the impact scope of the network environment, a priority of the target network security event is determined.
[0055] Optionally, the evaluation unit is specifically used for:
[0056] Determine whether the impact scope of the network security incident is greater than the preset incident impact scope;
[0057] If the impact scope of the network security event is greater than the preset event impact scope, determining whether the impact scope of the network environment is greater than the preset environment impact scope;
[0058] If the impact range of the network environment is greater than the preset environmental impact range, determining the priority of the target network security event as a high priority;
[0059] If the impact scope of the network security event is not greater than the preset event impact scope, or the impact scope of the network environment is not greater than the preset environment impact scope, then the priority of the target network security event is determined to be medium priority;
[0060] If the impact scope of the network security event is not greater than the preset event impact scope, and the impact scope of the network environment is not greater than the preset environment impact scope, the priority of the target network security event is determined to be a low priority.
[0061] Optionally, the sending unit is specifically used for:
[0062] When the priority of the target network security event is not the high priority, obtaining resource usage rates of all network security systems;
[0063] From the resource utilization rates of all network security systems, select the network security system with the lowest resource utilization rate and mark it as the target network security system;
[0064] The target network security event is sent to a target network security system so that the target network security system processes the target network security event.
[0065] The technical solution provided by this application collects and converts each network security event into a standard network security event; selects the target network security event from all standard network security events; for each target network security event, evaluates the target network security event to obtain the priority of the target network security event; when the priority of the target network security event is high priority, generates and feedbacks alarm information based on the target network security event; when the priority of the target network security event is not high priority, sends the target network security event to the target network security system. Even if the attack method is very covert or complex, the attacker's behavior often still deviates from the normal behavior pattern, so abnormal network security events can be selected from the standard network security events, and network security events can be quickly discovered and handled, thereby improving the processing efficiency of network security events. BRIEF DESCRIPTION OF THE DRAWINGS
[0066] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0067] Figure 1 A flowchart of a method for handling network security incidents provided in an embodiment of the present application;
[0068] Figure 2 A flowchart of a method for screening network security events provided in an embodiment of the present application;
[0069] Figure 3 A flowchart of a priority determination method provided in an embodiment of the present application;
[0070] Figure 4 A flowchart of a method for sending a network security event provided in an embodiment of the present application;
[0071] Figure 5 A schematic diagram of the architecture of a device for processing network security events provided in an embodiment of the present application. DETAILED DESCRIPTION
[0072] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0073] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.
[0074] like Figure 1 FIG. 1 is a flowchart of a method for handling a network security incident provided by an embodiment of the present application, comprising the following steps:
[0075] S101: Collect multiple network security events of network security devices.
[0076] Among them, network security events include but are not limited to: firewall logs, intrusion detection system (IDS) alarms, and terminal security system data.
[0077] Optionally, multiple network security events of network security devices can be collected through the intelligent agent, and the data collection frequency and data type can be adaptively adjusted according to different network environments.
[0078] It can be understood that the intelligent agent is connected to the network security device through a pre-configured API and network communication protocol, and then the network security events of the network security device can be collected through the intelligent agent. The collected network security events can be encrypted and transmitted using the TLS1.3 protocol to ensure the security and integrity of data during network transmission.
[0079] It should be noted that multiple network security events of network security devices can be collected through the data collection module, and the data collection module supports multiple data formats (such as Syslog format, XML format, JSON format, etc.).
[0080] In addition, the data collection module can be a dedicated hardware or virtualized deployed software component that communicates through a pre-configured API and network communication protocol to collect multiple network security events of the network security device.
[0081] S102: For each network security event, convert the format of the network security event to obtain a standard network security event.
[0082] Among them, standard network security events refer to network security events in a standardized format.
[0083] It is understandable that since network security events may come from different logs and monitoring tools, there may be deviations in the format of each network security event. In order to better analyze network security events in the future, it is necessary to convert network security events in different formats into standardized formats.
[0084] S103: Filter out abnormal network security events from all standard network security events and mark them as target network security events.
[0085] Among them, abnormal network security events include but are not limited to: behavior models contained in network security events and specific malicious behavior keywords.
[0086] It can be understood that abnormal network security events are screened out from all standard network security events. Specifically, all standard network security events are analyzed to obtain the analysis result of each standard network security event, and abnormal network security events are screened out from all standard network security events based on the analysis result of each network security event.
[0087] Optionally, in another embodiment of the present application, the specific implementation of step S103 is as follows: Figure 2 As shown, the following steps are included:
[0088] S201: For each standard network security event, input the standard network security event into the big model to obtain relevant information.
[0089] Among them, relevant information includes the types and characteristics of standard cybersecurity incidents.
[0090] The types of standard network security events include, but are not limited to: network traffic data, log data (system log, security log, application log), host information data (operating system information, CPU, memory usage, etc.), and security event alarm data (alarm information of intrusion detection system (IDS), firewall or anti-virus software).
[0091] The characteristics of standard network security events are used to distinguish and identify events, including time characteristics, network characteristics, behavioral characteristics, attack characteristics, etc.
[0092] For example, network security types include network attacks, malware, and data leaks, and the characteristics of network security events include timestamp, source IP, and protocol type.
[0093] It is understandable that the standard network security events are input into a large model (such as a large language model) so that the large model can parse the standard network security events to obtain the types and characteristics of the standard network security events.
[0094] It should be noted that the large model is a pre-trained model, which is based on sample network security events as input and takes the sample types and sample features of the sample network security events manually annotated as training targets, and is pre-trained.
[0095] In addition, the big model can not only process structured data (i.e., standard network security events), but also understand unstructured data (such as natural language logs, reports, etc.) through semantic analysis.
[0096] S202: Filter out prompt words corresponding to relevant information from the prompt word library.
[0097] It can be understood that the prompt words corresponding to the relevant information are selected from the prompt word library. Specifically, the basic structure of the prompt words corresponding to the type is generated first, and then the corresponding prompt words are selected from the prompt word library according to the features and the basic structure of the prompt words.
[0098] S203: Input the prompt word into the large model to obtain the parsing result.
[0099] Among them, the analysis results include the potential threat level of standard network security incidents.
[0100] It can be understood that the large model is a pre-trained model, which is pre-trained based on sample prompt words as input and sample parsing results manually annotated with the sample prompt words as training targets.
[0101] S204: Filter out standard network security events whose potential threat level is greater than a preset level from all standard network security events, and mark them as target network security events.
[0102] Specifically, assuming there are three standard network security events, namely the first network security event (potential threat level is severe), the second network security event (potential threat level is low), and the third network security event (potential threat level is low), and the preset level is medium, the standard network security event with a potential threat level greater than the preset level is screened out from all standard network security events as the first network security event, and is identified as the target network security event.
[0103] S104: For each target network security event, evaluate the target network security event to obtain a priority of the target network security event.
[0104] The priorities of target security events include, but are not limited to: high priority, medium priority, and low priority.
[0105] It can be understood that the target network security event is evaluated. Specifically, the historical network security events corresponding to the target network security event are obtained, and the target network security time is compared with the historical network security events to obtain the comparison result; the target security event is evaluated according to the comparison result to obtain the priority of the target network security event.
[0106] Optionally, in another embodiment of the present application, the specific implementation of step S104 is as follows: Figure 3 As shown, the following steps are included:
[0107] S301: Classify all target network security events to obtain multiple groups of sets.
[0108] Among them, a set of collections contains target network security events of the same type.
[0109] Optionally, the big model can be used to perform in-depth semantic analysis on the target network security events, understand the characteristics and context of the target network security events, and classify them into specific security event types to obtain multiple sets. For example, they can be divided into several sets such as distributed denial of service (DDoS) attacks, malware intrusions, and abnormal network traffic.
[0110] S302: For each set, select historical network security events corresponding to the set from the historical event library.
[0111] It is understandable that each set contains target network security events of the same type, so you only need to find the historical network security events corresponding to this type, that is, filter out the historical network security events corresponding to the set from the historical event library, and compare all the target network security events in the set based on the historical network security events.
[0112] S303: For each target network security event in the set, compare the target network security event with historical network security events to obtain the impact scope of the target network security event.
[0113] It is understandable that by comparing the target cybersecurity event with historical cybersecurity events, the degree of similarity between the target cybersecurity event and historical cybersecurity events can be determined through their characteristics, patterns and contexts, which can be used to determine whether the current event repeats past attack types and risk levels. The processing results of historical cybersecurity events, including the response measures at the time and the losses or impacts caused, can also be used to make a reference assessment of the potential impact of the current event, that is, to obtain the impact scope of the target cybersecurity event.
[0114] S304: Acquire the current network load status and the current network security device status.
[0115] S305: Evaluate the target network security event using the current network load status and the current network security device status to obtain the impact scope of the network environment.
[0116] It is understandable that the current network load status and the current network security device status are used to evaluate the target network security event. That is, under high load or vulnerable state, it will be more vulnerable to attack events, and the urgency of the event will be given a higher weight, that is, the impact range of the network environment will be larger; if it is under low load state, it is difficult to be affected by the attack time, and the urgency of time will be given a lower weight, that is, the impact range of the network environment will be smaller.
[0117] S306: Determine the priority of the target network security event based on the impact scope of the network security event and the impact scope of the network environment.
[0118] It should be noted that the impact of different types of network security events will vary under different network loads and device states. For example, under high load, events that consume a lot of resources (such as DDoS attacks) need to be handled first, while under low load, unauthorized access to certain specific ports may have a higher priority.
[0119] Optionally, in another embodiment of the present application, the specific implementation of step S306 includes:
[0120] Determine whether the impact scope of the network security incident is greater than the preset incident impact scope.
[0121] Among them, the preset event impact scope refers to the preset impact scope of the network security incident.
[0122] If the impact scope of the network security incident is greater than the preset incident impact scope, then determine whether the impact scope of the network environment is greater than the preset environment impact scope.
[0123] Among them, the preset environmental impact range indicates the preset impact range of the network security event on the network environment.
[0124] If the impact scope of the network environment is greater than the preset environmental impact scope, the priority of the target network security event is determined to be high priority.
[0125] It can be understood that if the impact scope of the network security event is greater than the preset event impact scope, and the impact scope of the network environment is greater than the preset environment impact scope, the priority of the target network security event is determined to be high priority.
[0126] If the impact scope of the network security incident is not greater than the preset incident impact scope, or the impact scope of the network environment is not greater than the preset environment impact scope, the priority of the target network security incident is determined to be medium priority.
[0127] It can be understood that if the impact scope of the network security incident is not greater than the preset incident impact scope and the impact scope of the network environment is greater than the preset environment impact scope, or the impact scope of the network environment is not greater than the preset environment impact scope and the impact scope of the network security incident is greater than the preset incident impact scope, then the priority of the target network security incident is determined to be medium priority.
[0128] If the impact scope of the network security incident is not greater than the preset incident impact scope, and the impact scope of the network environment is not greater than the preset environment impact scope, the priority of the target network security incident is determined to be low priority.
[0129] S105: When the priority of the target network security event is high, generate and feedback alarm information based on the target network security event.
[0130] It is understandable that when the priority of the target network security event is high, an alarm message is generated based on the target network security event, the alarm message is fed back through the event management system, and corresponding defense measures are executed, such as isolating infected devices, blocking abnormal traffic, or automatically adjusting firewall rules.
[0131] It can be seen that the above approach can ensure that high-priority target network security incidents can be handled in a timely manner to reduce the impact of potential dangers.
[0132] S106: When the priority of the target network security event is not a high priority, the target network security event is sent to a target network security system, so that the target network security system processes the target network security event.
[0133] Among them, the target network security system is the network security system with the lowest resource utilization rate among all network security systems.
[0134] Optionally, the target cybersecurity events can be sent to the target cybersecurity system via blockchain technology or distributed database architecture, ensuring that the data shared in all cybersecurity systems is highly consistent and can be updated in real time.
[0135] It is understandable that lower priority network security incidents usually only need to be distributed to the network security system for routine processing without triggering the early warning mechanism to avoid excessive interference or alarms caused by handling low priority incidents.
[0136] It should be noted that before sending the target network security event to the target network security system, all network security systems need to be verified. Only after passing the verification can the target network security event be sent to the target network security system. At the same time, when sending the target network security event, TLS1.3 encryption is used before sending it to protect the data from man-in-the-middle attacks during transmission and ensure that the data will not be obtained by unauthorized entities.
[0137] In addition, after the target network security incident is processed, the target network security system is added to the historical event library to form a new historical network security incident. The latest data status can also be obtained in real time to ensure that the respective decisions and processing strategies can be adjusted based on the latest information.
[0138] Optionally, in another embodiment of the present application, the specific implementation of step S106 is as follows: Figure 4 As shown, the following steps are included:
[0139] S401: When the priority of the target network security event is not high priority, obtain resource usage rates of all network security systems.
[0140] The resource utilization rate includes, but is not limited to, CPU utilization rate, memory utilization rate, network bandwidth utilization rate, and task queue processing status.
[0141] It should be noted that the resource utilization rate of all network security systems can be obtained through intelligent agents (i.e., selecting intelligent agents suitable for processing tasks from all intelligent agents). Before obtaining the resource utilization rate of all network security systems, it is necessary to record the task types and resource capabilities that each network security system can handle.
[0142] S402: Filter out the network security system with the lowest resource utilization rate from the resource utilization rates of all network security systems, and mark it as the target network security system.
[0143] Among them, the intelligent agent can schedule and allocate network security-related tasks according to complexity and resource requirements based on distributed scheduling algorithms (such as ant colony algorithm, load balancing algorithm, etc.), that is, from the resource utilization rates of all network security systems, the network security system with the lowest resource utilization rate can be screened out.
[0144] S403: Send the target network security event to the target network security system, so that the target network security system processes the target network security event.
[0145] It is understandable that after completing the processing of the target network security incident, the classification and task allocation strategy of the network security incident will be adjusted according to the processing results to optimize work efficiency.
[0146] In addition, smart contracts are generated. The execution of smart contracts is based on preset conditions and rules, which exist in the form of code in the blockchain or distributed ledger. When specific conditions are met (for example, the occurrence of a security incident, or the arrival of a specific time point), the smart contract will be automatically triggered to perform relevant operations. The execution of the contract ensures that the cybersecurity incident handling process is carried out in full accordance with the set security protocol, reducing the need for human intervention, thereby reducing the risk of errors and delays.
[0147] Smart contracts have the ability to monitor the execution status of tasks in real time. This includes tracking the initiation, progress, and completion of tasks to ensure that all activities are under the control of the contract. This monitoring function can detect problems in a timely manner and take measures to ensure a smooth collaboration process. The execution of all operations and events will be recorded in detail in the smart contract to form a traceable execution log. This not only provides basic data for auditing, but also enhances the transparency of the system.
[0148] During the collaboration process, if the smart contract detects an abnormal situation (such as failure to complete a task as expected, inconsistent data, or increased security risks), the exception handling mechanism will be immediately activated to automatically adjust the collaboration process, including pausing the current task, reallocating tasks, or switching to alternative plans.
[0149] To summarize, by screening out abnormal network security events from standard network security events, marking them as target network security events, and evaluating the priority of target network security events, if high-priority events can be handled quickly, even if the attack method is very covert or complex, the attacker's behavior will often still deviate from the normal behavior pattern. In this way, abnormal network security events can be screened out from standard network security events, network security events can be quickly discovered and handled, thereby improving the efficiency of handling network security events.
[0150] like Figure 5 As shown, it is a schematic diagram of the architecture of a network security event processing device provided in an embodiment of the present application, and the processing device includes: a collection unit 100, a conversion unit 200, a screening unit 300, an evaluation unit 400, a generation unit 500 and a sending unit 600.
[0151] The collection unit 100 is used to collect multiple network security events of network security devices.
[0152] The conversion unit 200 is used to convert the format of each network security event to obtain a standard network security event.
[0153] The screening unit 300 is used to screen out abnormal network security events from all standard network security events and mark them as target network security events.
[0154] The screening unit 300 is specifically used for: for each standard network security event, inputting the standard network security event into the big model to obtain relevant information; the relevant information includes the type and characteristics of the standard network security event; screening out prompt words corresponding to the relevant information from the prompt word library; inputting the prompt words into the big model to obtain parsing results; the parsing results include the potential threat level of the standard network security event; screening out standard network security events with a potential threat level greater than a preset level from all standard network security events, and marking them as target network security events.
[0155] The evaluation unit 400 is used to evaluate each target network security event to obtain a priority of the target network security event.
[0156] The evaluation unit 400 is specifically used to: classify all target network security events to obtain multiple groups of collections; wherein one group of collections contains target network security events of the same type; for each group of collections, filter out historical network security events corresponding to the collection from the historical event library; for each target network security event in the collection, compare the target network security event with the historical network security events to obtain the impact scope of the target network security event; obtain the current network load status and the current network security device status; use the current network load status and the current network security device status to evaluate the target network security event to obtain the impact scope of the network environment; determine the priority of the target network security event based on the impact scope of the network security event and the impact scope of the network environment.
[0157] The evaluation unit 400 is specifically used to: determine whether the impact scope of the network security event is greater than the preset event impact scope; if the impact scope of the network security event is greater than the preset event impact scope, determine whether the impact scope of the network environment is greater than the preset environment impact scope; if the impact scope of the network environment is greater than the preset environment impact scope, determine the priority of the target network security event as high priority; if the impact scope of the network security event is not greater than the preset event impact scope, or the impact scope of the network environment is not greater than the preset environment impact scope, determine the priority of the target network security event as medium priority; if the impact scope of the network security event is not greater than the preset event impact scope, and the impact scope of the network environment is not greater than the preset environment impact scope, determine the priority of the target network security event as low priority.
[0158] The generating unit 500 is used to generate and feed back alarm information based on the target network security event when the priority of the target network security event is high priority.
[0159] The sending unit 600 is used to send the target network security event to the target network security system when the priority of the target network security event is not high priority, so that the target network security system processes the target network security event; the target network security system is the network security system with the lowest resource utilization rate among all network security systems.
[0160] The sending unit 600 is specifically used to: when the priority of the target network security event is not a high priority, obtain the resource utilization rate of all network security systems; filter out the network security system with the lowest resource utilization rate from the resource utilization rates of all network security systems, and identify it as the target network security system; send the target network security event to the target network security system so that the target network security system processes the target network security event.
[0161] To summarize, by screening out abnormal network security events from standard network security events, marking them as target network security events, and evaluating the priority of target network security events, if high-priority events can be handled quickly, even if the attack method is very covert or complex, the attacker's behavior will often still deviate from the normal behavior pattern. In this way, abnormal network security events can be screened out from standard network security events, network security events can be quickly discovered and handled, thereby improving the efficiency of handling network security events.
[0162] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.
[0163] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0164] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for handling network security incidents, characterized in that: include: Collect multiple network security events of network security devices; For each of the network security events, convert the format of the network security event to obtain a standard network security event; Filter out abnormal cybersecurity events from all standard cybersecurity events and identify them as target cybersecurity events; For each of the target network security events, evaluating the target network security event to obtain a priority of the target network security event; When the priority of the target network security event is high, generating and feeding back alarm information based on the target network security event; When the priority of the target network security event is not the high priority, sending the target network security event to a target network security system so that the target network security system processes the target network security event; The target network security system is a network security system with the lowest resource usage rate among all network security systems.
2. The method according to claim 1, characterized in that The step of screening out abnormal network security events from all standard network security events and identifying them as target network security events includes: For each of the standard network security events, the standard network security event is input into the large model to obtain relevant information; the relevant information includes the type and characteristics of the standard network security event; Filtering prompt words corresponding to the relevant information from a prompt word library; Inputting the prompt word into the large model to obtain a parsing result; the parsing result includes a potential threat level of a standard network security event; Standard network security events with a potential threat level greater than a preset level are screened out from all standard network security events and identified as target network security events.
3. The method according to claim 1, characterized in that For each of the target network security events, evaluating the target network security event to obtain a priority of the target network security event includes: Classify all target network security events to obtain multiple sets; wherein one set contains target network security events of the same type; For each set of the collections, filter out historical network security events corresponding to the collection from the historical event library; For each target network security event in the set, compare the target network security event with the historical network security events to obtain the impact scope of the target network security event; Get the current network load status and current network security device status; Using the current network load status and the current network security device status to evaluate the target network security event, and obtain the impact range of the network environment; Based on the impact scope of the network security event and the impact scope of the network environment, a priority of the target network security event is determined.
4. The method according to claim 3, characterized in that The determining the priority of the target network security event based on the impact scope of the network security event and the impact scope of the network environment includes: Determine whether the impact scope of the network security incident is greater than the preset incident impact scope; If the impact scope of the network security event is greater than the preset event impact scope, determining whether the impact scope of the network environment is greater than the preset environment impact scope; If the impact range of the network environment is greater than the preset environmental impact range, determining the priority of the target network security event as a high priority; If the impact scope of the network security event is not greater than the preset event impact scope, or the impact scope of the network environment is not greater than the preset environment impact scope, then the priority of the target network security event is determined to be medium priority; If the impact scope of the network security event is not greater than the preset event impact scope, and the impact scope of the network environment is not greater than the preset environment impact scope, the priority of the target network security event is determined to be a low priority.
5. The method according to claim 1, characterized in that When the priority of the target network security event is not the high priority, sending the target network security event to a target network security system so that the target network security system processes the target network security event, including: When the priority of the target network security event is not the high priority, obtaining resource usage rates of all network security systems; From the resource utilization rates of all network security systems, select the network security system with the lowest resource utilization rate and mark it as the target network security system; The target network security event is sent to a target network security system so that the target network security system processes the target network security event.
6. A network security incident processing device, characterized in that: include: A collection unit, used to collect multiple network security events of network security devices; A conversion unit, configured to convert the format of each network security event to obtain a standard network security event; A screening unit, used to screen out abnormal network security events from all standard network security events and mark them as target network security events; An evaluation unit, configured to evaluate each target network security event to obtain a priority of the target network security event; A generating unit, configured to generate and feed back warning information based on the target network security event when the priority of the target network security event is high priority; a sending unit, configured to send the target network security event to a target network security system when the priority of the target network security event is not the high priority, so that the target network security system processes the target network security event; The target network security system is a network security system with the lowest resource usage rate among all network security systems.
7. The device according to claim 6, characterized in that The screening unit is specifically used for: For each of the standard network security events, the standard network security event is input into the large model to obtain relevant information; the relevant information includes the type and characteristics of the standard network security event; Filtering prompt words corresponding to the relevant information from a prompt word library; Inputting the prompt word into the large model to obtain a parsing result; the parsing result includes a potential threat level of a standard network security event; Standard network security events with a potential threat level greater than a preset level are screened out from all standard network security events and identified as target network security events.
8. The device according to claim 6, characterized in that The evaluation unit is specifically used for: Classify all target network security events to obtain multiple sets; wherein one set contains target network security events of the same type; For each set of the collections, filter out historical network security events corresponding to the collection from the historical event library; For each target network security event in the set, compare the target network security event with the historical network security events to obtain the impact scope of the target network security event; Get the current network load status and current network security device status; Using the current network load status and the current network security device status to evaluate the target network security event, and obtain the impact range of the network environment; Based on the impact scope of the network security event and the impact scope of the network environment, a priority of the target network security event is determined.
9. The device according to claim 8, characterized in that The evaluation unit is specifically used for: Determine whether the impact scope of the network security incident is greater than the preset incident impact scope; If the impact scope of the network security event is greater than the preset event impact scope, determining whether the impact scope of the network environment is greater than the preset environment impact scope; If the impact range of the network environment is greater than the preset environmental impact range, determining the priority of the target network security event as a high priority; If the impact scope of the network security event is not greater than the preset event impact scope, or the impact scope of the network environment is not greater than the preset environment impact scope, then the priority of the target network security event is determined to be medium priority; If the impact scope of the network security event is not greater than the preset event impact scope, and the impact scope of the network environment is not greater than the preset environment impact scope, the priority of the target network security event is determined to be a low priority.
10. The device according to claim 6, characterized in that The sending unit is specifically used for: When the priority of the target network security event is not the high priority, obtaining resource usage rates of all network security systems; From the resource utilization rates of all network security systems, select the network security system with the lowest resource utilization rate and mark it as the target network security system; The target network security event is sent to a target network security system so that the target network security system processes the target network security event.