Risk governance scheme generation method and device, equipment, medium and program product

Abstract

The embodiment of the invention discloses a risk management scheme generation method and device, equipment, a medium and a program product. The method comprises the following steps: acquiring a risk alarm generated by a target device with a security risk and routing inspection data on which the risk alarm is generated; determining a target attack stage corresponding to the risk alarm and target attack technology identification information used in the target attack stage based on an alarm category corresponding to the risk alarm and a mapping relationship between attack technology identification information used in each attack stage in an attack knowledge base and the alarm category; determining attack link data based on the risk alarm, the inspection data, the target attack stage and the target attack technology identification information; and generating a target risk management scheme corresponding to the target device based on the scheme generation network model and the attack link data. Through the technical scheme of the embodiment of the invention, automatic and rapid generation of the risk management scheme can be realized, so that the generation efficiency and the generation accuracy of the risk management scheme are improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to computer technology, and in particular to a method, device, equipment, medium and program product for generating a risk management solution. Background Art

[0002] With the rapid development of computer technology, computer equipment needs to be inspected and warned of security risks. When an alarm is generated, professionals usually analyze it based on experience, determine and execute a series of emergency response actions. After an attack occurs, professionals conduct a review and analysis to identify possible risk items for governance and form a risk governance plan for reference and execution next time a similar alarm is generated.

[0003] However, in the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art:

[0004] The existing risk governance plan generation method is time-consuming and labor-intensive, which reduces the efficiency of risk governance plan generation, and thus reduces the response efficiency of risk governance. It is also highly dependent on professional experience and has high requirements for professional experience, and cannot effectively guarantee the accuracy of risk governance plan generation. Summary of the invention

[0005] The embodiments of the present invention provide a risk management solution generation method, apparatus, device, medium and program product to realize automatic and rapid generation of risk management solutions, thereby improving the generation efficiency and generation accuracy of risk management solutions.

[0006] In a first aspect, an embodiment of the present invention provides a method for generating a risk management solution, including:

[0007] Obtain risk warnings generated by target devices with security risks and inspection data based on which the risk warnings were generated;

[0008] Determine the target attack stage corresponding to the risk alert and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alert category corresponding to the risk alert and the attack technology identification information used in each attack stage in the attack knowledge base and the alert category;

[0009] Determine attack link data corresponding to the target device based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm, and the target attack technology identification information used in the target attack stage;

[0010] Based on the solution generation network model and the attack link data, a target risk management solution corresponding to the target device is generated.

[0011] In a second aspect, an embodiment of the present invention further provides a risk management solution generation device, including:

[0012] A risk warning acquisition module is used to acquire risk warnings generated by target devices with security risks and inspection data based on which the risk warnings are generated;

[0013] An attack technology determination module, used to determine the target attack stage corresponding to the risk alert and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alert category corresponding to the risk alert and the attack technology identification information used in each attack stage in the attack knowledge base and the alert category;

[0014] An attack link data determination module, used to determine the attack link data corresponding to the target device based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm, and the target attack technology identification information used in the target attack stage;

[0015] The risk management solution generation module is used to generate a target risk management solution corresponding to the target device based on the solution generation network model and the attack link data.

[0016] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0017] one or more processors;

[0018] A memory for storing one or more programs;

[0019] When the one or more programs are executed by the one or more processors, the one or more processors implement the risk management solution generation method provided by any embodiment of the present invention.

[0020] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a risk management solution generating method as provided in any embodiment of the present invention.

[0021] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements a risk management solution generating method as provided in any embodiment of the present invention.

[0022] One embodiment of the above invention has the following advantages or beneficial effects:

[0023] By determining the target attack stage corresponding to the risk alarm and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alarm category corresponding to the risk alarm generated by the target device and the attack technology identification information used in each attack stage in the attack knowledge base, and determining the detailed attack link data based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm and the target attack technology identification information used in the target attack stage, and using the solution to generate the network model and the attack link data, the target risk management solution corresponding to the target device can be automatically and accurately generated, thereby eliminating the need to rely on expert experience, achieving automatic and rapid generation of risk management solutions, and improving the generation efficiency and accuracy of risk management solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 It is a flow chart of a method for generating a risk management solution provided by an embodiment of the present invention;

[0026] Figure 2 is a flow chart of another risk management solution generation method provided by an embodiment of the present invention;

[0027] Figure 3 It is a structural schematic diagram of a risk management solution generation device provided by an embodiment of the present invention;

[0028] Figure 4 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0030] Figure 1 This is a flow chart of a method for generating a risk management solution provided by an embodiment of the present invention. This embodiment is applicable to the case of automatically generating a risk management solution for an alarm device. The method can be executed by a risk management solution generating device, which can be implemented by software and / or hardware and integrated into an electronic device. Figure 1 As shown, the method specifically comprises the following steps:

[0031] S110: Obtain risk warnings generated by target devices with security risks and inspection data based on which the risk warnings are generated.

[0032] Among them, the target device refers to a computer device with security risks, that is, an alarm device that generates a risk alarm. The risk alarm refers to the specific security risk of the target device. The number of risk alarms generated by the target device can be one or more. Different risk alarms correspond to alarms of different risk categories. Inspection data refers to device data that can cause risk alarms. For example, inspection data can refer to formatted information such as processes, files, logs, and users collected from the target device. Different risk alarms can correspond to different inspection data. For example, the risk alarm is an alarm for SSH (Secure Shell) login blasting, and the corresponding inspection data is the collected user login information, such as user name, user group, login time, login IP address, login status, and login protocol. By analyzing the collected user login information, it is known that a user failed to log in through SSH 10 times within 1 minute, and a risk alarm for SSH login blasting can be generated at this time.

[0033] Specifically, during the operation of the target device, the inspection data of the target device is collected, and the inspection data is analyzed to determine whether the target device generates a risk alarm. When the target device generates a risk alarm, it indicates that the target device has a security risk. At this time, all risk alarms generated by the target device and the inspection data based on which each risk alarm is generated can be obtained.

[0034] S120: Determine the target attack stage corresponding to the risk alert and the target attack technology identification information used in the target attack stage based on the alert category corresponding to the risk alert and the mapping relationship between the attack technology identification information used in each attack stage in the attack knowledge base and the alert category.

[0035] Among them, all risk alerts are classified in advance to obtain risk alerts under each alert category. For example, if the risk alert is an alert for SSH login blasting, the corresponding alert category is: password blasting alert. The attack knowledge base is a knowledge base based on the observation of attacker tactics and techniques in a real environment. The attack knowledge base describes and classifies the attacker's tactics and technical means in detail. The attack knowledge base includes various attack stages used by attackers and attack techniques used in each attack stage, which can be represented in the form of a technology matrix. For example, the attack knowledge base can be an ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) matrix. Among them, the attack stage can refer to the tactical goal of the attacker's action, that is, the attack purpose that the attacker wants to achieve. Classification can be performed in advance based on the attack purpose to obtain multiple attack stages. The attack stage is a tactic. For example, the attack stage can include reconnaissance information, resource development, initial access, code execution, continuous harm, privilege escalation, defense evasion, credential access, information discovery, lateral movement, information collection, command and control, data leakage and impact. Among them, the attack phase of reconnaissance information refers to the attacker's attempt to collect information that can be used to plan future actions. The attack phase of resource development refers to the attacker's attempt to establish resources that they can use to support actions. And so on. Attack technology is the technical means used to achieve the tactical goals of the attack phase. There can be multiple attack technologies to achieve the same attack phase, that is, there are multiple attack technologies in each attack phase. Attack technology identification information is the ID information used to uniquely identify the attack technology in order to distinguish different attack technologies. The mapping relationship between the attack technology identification information and the alarm category can be pre-constructed based on the attack technology used by each alarm category. For example, when the alarm category is a password blasting alarm, the corresponding target attack phase is "credential access", the target attack technology used in "credential access" is "blasting", and the corresponding target attack technology identification information is the identification information of the "blasting" technology.

[0036] Specifically, based on the alarm category corresponding to each risk alarm generated by the target device and the pre-built mapping relationship between the attack technology identification information used in each attack stage and the alarm category, the target attack technology identification information used by the alarm category corresponding to each risk alarm can be determined, and the attack stage where the target attack technology identification information is located can be determined as the target attack stage corresponding to the risk alarm, thereby achieving accurate and rapid identification of the attack stage and attack technology of the risk alarm.

[0037] S130. Determine attack link data corresponding to the target device based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm, and the target attack technology identification information used in the target attack stage.

[0038] Among them, the attack link data is the detailed data used to describe the attack link existing in the target device. The attack link is an attack sequence obtained by arranging the attack stages in the attack knowledge base in the order of precedence. The attack link can be used to characterize the attack path of the attacker. The attack link can include one or more attack stages. If there is only one risk alarm or all existing risk alarms correspond to the same attack stage, there is only one attack stage in the attack link.

[0039] Specifically, if only one risk alarm is generated in the target device, the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm, and the target attack technology identification information used in the target attack stage can be directly combined to obtain the attack link data corresponding to the target device. If multiple risk alarms are generated in the target device, the target attack stages corresponding to each risk alarm are sorted in order to obtain the attack link, and according to the attack link, the risk alarm, inspection data, and target attack technology identification information generated in each target stage are combined to obtain detailed attack link data. The attack link data can be formatted to obtain the formatted attack link data, further ensuring the efficiency and accuracy of the solution generation.

[0040] S140: Generate a network model and attack link data based on the solution, and generate a target risk management solution corresponding to the target device.

[0041] The solution generation network model may be a pre-trained neural network model used to generate risk management solutions corresponding to attack link data. The target risk management solution is a solution that can manage security risks existing in the target device, which may include response actions that can deal with existing security risks, so as to ensure that the target device is protected from these security risks, thereby ensuring the network security of the target device.

[0042] Exemplarily, the solution generation network model can be obtained by fine-tuning and initializing the generative pre-trained model with prompt words based on the attack knowledge base and the defense knowledge base.

[0043] Among them, the defense knowledge base can be a knowledge base for describing network countermeasure technology, which can be represented by a knowledge graph. For example, the defense knowledge base can refer to the D3FEND (Defend, Detect, and Deny: Framework for Enterprise Network Defense) knowledge base. The generative pre-trained model can refer to any pre-trained model that can generate a text solution. The pre-trained model is a general model that has been pre-trained on a large data set. By introducing the attack knowledge base and the defense knowledge base into the generative pre-trained model for model fine-tuning, the fine-tuned generative pre-trained model is suitable for the field of network security. In the generative pre-trained model that has been fine-tuned by the professional field knowledge base, the input prompt word (such as a natural language format, describing the format of the input content, the output content template, the output content instruction, etc.) is initialized to the working state so that it can format the output. The generative pre-trained model obtained by fine-tuning and prompt word initialization is a solution generation network model, which has the function of automatically generating accurate risk governance solutions based on attack link data.

[0044] Exemplarily, the target risk governance scheme includes multiple risk governance stages and risk governance methods corresponding to each risk governance stage. Among them, the risk governance stage may refer to each governance stage in the full-link risk governance process. For example, the risk governance stage may refer to the risk governance stage divided in the defense knowledge base. The risk governance stage may include: reinforcement stage, detection stage, isolation stage, deception stage, expulsion stage and recovery stage. The risk governance method refers to the response action collected in the risk governance stage. For example, the risk governance method in the reinforcement stage may be: credential reinforcement (such as setting a one-time password) or platform reinforcement (such as setting sensitive file permissions to only be viewed by the root user). The risk governance method in the detection stage may be: platform monitoring (such as setting weak password detection and setting sensitive file monitoring policies) or network traffic analysis (such as continuously monitoring traffic and finding non-whitelist addresses to alarm). The risk governance method in the isolation stage may be: execution isolation (such as only allowing whitelist executable files to run) or network isolation (such as setting the host to be open only to specific IPs). The risk governance method in the deception stage may be: bait objects (such as deploying honeypots). Risk management methods in the expulsion phase can be: credential expulsion (such as locking the account) or program expulsion (such as stopping the agent software process). Risk management methods in the recovery phase can be: restoring access (such as changing the user password to a complex password).

[0045] Specifically, the attack link data or the formatted attack link data can be input into the pre-trained solution generation network model to automatically generate the risk governance solution. Based on the output of the solution generation network model, an accurate target risk governance solution can be quickly obtained, thereby improving the generation efficiency and accuracy of the risk governance solution. The target risk governance solution can include multiple risk governance stages in the full-link risk governance process and the risk governance methods corresponding to each risk governance stage, so that the full-link risk governance can be achieved by using the target risk governance solution, which improves the systematization and comprehensiveness of security risk governance.

[0046] For example, after generating the target risk management plan corresponding to the target device, the target risk management plan and the corresponding risk link data can be stored in the database, and a word document can be generated and stored in OSS (Object Storage Service), thereby achieving secure and reliable cloud storage. The target risk management plan can also be pushed to relevant personnel through a subscription link, so that the relevant personnel can systematically manage the security risks of the target device based on the target risk management plan, thereby improving the network security of the target device.

[0047] The technical solution of this embodiment determines the target attack stage corresponding to the risk alarm and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alarm category corresponding to the risk alarm generated by the target device and the attack technology identification information used in each attack stage in the attack knowledge base and the alarm category, and determines detailed attack link data based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm and the target attack technology identification information used in the target attack stage. The network model and attack link data are generated using the solution, so that the target risk management solution corresponding to the target device can be automatically and accurately generated, thereby eliminating the need to rely on expert experience, realizing automatic and rapid generation of risk management solutions, and improving the generation efficiency and accuracy of risk management solutions.

[0048] On the basis of the above technical solution, before step S110, it can also include: collecting inspection data of each device through an intrusion detection system or an intrusion prevention system, and analyzing the inspection data; generating a risk alarm when the analysis result is an abnormal result, and storing the risk alarm and the inspection data based on which the risk alarm is generated in a search database.

[0049] Among them, the intrusion detection system (IDS) is a network security device that monitors network transmission in real time and issues an alarm or takes active response measures when suspicious transmission is found. The intrusion prevention system (IPS) is a computer network security device that can monitor the network data transmission behavior of the network or network equipment, and can timely interrupt, adjust or isolate some abnormal or harmful network data transmission behaviors.

[0050] Specifically, by using an intrusion detection system or an intrusion prevention system, the information of each device can be collected in real time to obtain formatted inspection data, such as process, file, user, log and other formatted information. The collected inspection data is analyzed to detect whether there is abnormal risk data, and a corresponding risk alarm is generated when there is abnormal risk data, and each risk alarm generated by the device and the corresponding risk data (i.e., the inspection data based on which the risk alarm is generated) are stored in the search database, so that based on the identification information of the target device with security risks, a search can be performed in the search database to quickly obtain all risk alarms generated by the target device and the inspection data based on which each risk alarm is generated.

[0051] Figure 2 A flowchart of another risk management solution generation method provided by an embodiment of the present invention. Based on the above embodiments, this embodiment describes in detail the process of determining the attack link data of the target device when the number of risk alarms generated by the target device is multiple. The explanations of the terms that are the same or corresponding to the above embodiments are not repeated here.

[0052] See also Figure 2 Another risk management solution generation method provided in this embodiment specifically includes the following steps:

[0053] S210: Acquire multiple risk alarms generated by target devices with security risks and the inspection data on which each risk alarm is generated.

[0054] Specifically, based on the identification information of the target device with security risks, a search can be performed in the search database to quickly obtain all risk alarms generated by the target device and the inspection data based on which each risk alarm is generated.

[0055] S220: Determine the target attack stage corresponding to each risk alert and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alert category corresponding to each risk alert and the attack technology identification information used in each attack stage in the attack knowledge base and the alert category.

[0056] It should be noted that different risk alerts may correspond to different target attack stages, or may correspond to the same target attack stage. For example, by using different attack techniques in the same attack stage, different risk alerts may be generated in the attack stage.

[0057] S230. For each risk alarm, perform alarm association detection based on the first inspection data based on which the current risk alarm is generated and the second inspection data based on which other risk alarms are generated, and determine associated risk alarms in other risk alarms that are associated with the current risk alarm.

[0058] Among them, the current risk alarm can refer to one of all risk alarms, and each risk alarm generated is used as the current risk alarm for alarm association detection to determine the associated risk alarm corresponding to each risk alarm. Other risk alarms refer to the remaining risk alarms except the current risk alarm. Associated risk alarms refer to risk alarms that are associated with the current risk alarm, that is, the current risk alarm and the associated risk alarm will be generated on the same attack link.

[0059] Specifically, by detecting whether there is a data correlation between the first inspection data on which the current risk alarm is based and the second inspection data on which other risk alarms are based, it can be determined whether the current risk alarm and other risk alarms are mutually related alarms, and then all associated risk alarms that are associated with the current risk alarm can be determined from all other risk alarms.

[0060] Exemplarily, before step S230, the method may further include: determining other target attack stages except the current target attack stage based on the current target attack stage corresponding to the current risk warning; and determining risk warnings generated in other target attack stages as other risk warnings.

[0061] Specifically, since the associated risk alarm associated with the current risk alarm corresponds to different target attack stages, when determining other risk alarms, the current target attack stage in which the current risk alarm is located can be determined first, and then all other target attack stages except the current target attack stage, and the risk alarms generated in each other target attack stage can be determined as other risk alarms, so as to determine the associated risk alarm corresponding to the current risk alarm within the scope of risk alarms generated in other target attack stages, thereby narrowing the determination scope and improving the determination efficiency of associated risk alarms.

[0062] Exemplarily, step S230 may include: determining key information corresponding to the current risk alarm based on the first inspection data on which the current risk alarm is generated; detecting whether key information exists in the second inspection data on which other risk alarms are generated, and determining based on the detection results whether the other risk alarms are associated risk alarms that are associated with the current risk alarm.

[0063] Among them, the key information may refer to the core information based on which the current risk alarm is generated. For example, the key information corresponding to the password cracking alarm is the user name admin. Specifically, the key information corresponding to the current risk alarm is obtained from the first inspection data based on which the current risk alarm is generated, and it is detected whether the key information also exists in the second inspection data based on which each other risk alarm is generated. If so, it indicates that the other risk alarm and the current risk alarm are alarms caused by the same attacker. At this time, the other risk alarm can be determined as an associated risk alarm associated with the current risk alarm. By using the detection of key information, the associated risk alarm corresponding to the current risk alarm can be quickly obtained.

[0064] S240: Integrate the associated risk warnings corresponding to each risk warning to determine an associated target risk warning set.

[0065] The target risk alarm set refers to a set of target risk alarms generated on the same attack link. The target risk alarm set may include one or more target risk alarms. The number of target risk alarm sets may be one or more, that is, corresponding to one or more attack links.

[0066] Specifically, based on the key risk warnings corresponding to each risk warning, all risk warnings are associated and grouped to obtain a target risk warning set consisting of target risk warnings with associated relationships. Any target risk warning in the target risk warning set is associated with at least one other target risk warning. For example, the generated risk warnings include: risk warning A, risk warning B, risk warning C and risk warning D. If risk warning A is associated with risk warning B, risk warning B is associated with risk warning C, and risk warning D is associated with risk warning A, then a target risk warning set obtained by integration is: "risk warning A, risk warning B, risk warning C and risk warning D". If risk warning A is associated with risk warning B, risk warning B is associated with risk warning C, and risk warning D is not associated with the other three risk warnings, then the first target risk warning set obtained by integration is "risk warning A, risk warning B and risk warning C", and the second target risk warning set is "risk warning D".

[0067] S250. Determine the attack link data corresponding to the target device based on each target risk alarm in the target risk alarm set, the inspection data based on which the target risk alarm is generated, the target attack stage corresponding to the target risk alarm, and the target attack technology identification information used in the target attack stage.

[0068] Specifically, each target risk alarm, inspection data and target attack technology identification information may be combined according to the sequence of target attack stages corresponding to each target risk alarm in the target risk alarm set to obtain attack link data corresponding to the target risk alarm set.

[0069] Exemplarily, step S250 may include: determining the attack link corresponding to the target risk alarm set based on the sequence of target attack stages corresponding to each target risk alarm in the target risk alarm set; according to the attack link, combining data of each target risk alarm, the inspection data based on which the target risk alarm is generated, and the target attack technology identification information used in the target attack stage to obtain the attack link data corresponding to the target device.

[0070] Specifically, the target attack phases corresponding to each target risk alarm in the target risk alarm set are sorted in order to obtain the attack link corresponding to the target risk alarm set. A target risk alarm set can correspond to an attack link. According to the attack link, each target risk alarm, the corresponding inspection data and the target attack technology identification information are combined to obtain the detailed attack link data corresponding to the attack link in the target device.

[0071] S260: Generate a network model and attack link data based on the solution, and generate a target risk management solution corresponding to the target device.

[0072] Specifically, if there are multiple attack links, the attack link data corresponding to each attack link can be input into the pre-trained solution generation network model to automatically generate a risk management solution. Based on the output of the solution generation network model, the target risk management solution corresponding to each attack link can be quickly obtained. By using the attack link data based on different attack links, a more accurate risk management solution corresponding to each attack link can be determined, thereby improving the risk management effect and further ensuring network security.

[0073] It should be noted that if the target risk alarm set includes only one target risk alarm, that is, there is only one attack stage on an attack link, it is possible that the target risk alarm is a risk alarm caused by the user's own misoperation. At this time, the target risk alarm can also be pushed to professionals for analysis to determine whether it is a real risk alarm.

[0074] The technical solution of this embodiment determines the associated risk alarms in other risk alarms that are associated with the current risk alarm by performing alarm association detection based on the first inspection data based on which the current risk alarm is generated and the second inspection data based on which other risk alarms are generated; integrates the associated risk alarms corresponding to each risk alarm to determine a set of associated target risk alarms; and based on each target risk alarm, inspection data, target attack stage and target attack technology identification information in the target risk alarm set, the attack link data belonging to the same attack link can be more accurately determined, thereby further improving the accuracy of generating risk governance solutions.

[0075] The following is an embodiment of a risk management solution generation device provided in an embodiment of the present invention. The device and the risk management solution generation methods of the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the risk management solution generation device, please refer to the embodiment of the above-mentioned risk management solution generation method.

[0076] Figure 3 This is a schematic diagram of the structure of a risk management solution generation device provided by an embodiment of the present invention. This embodiment is applicable to the case of automatically generating a risk management solution for an alarm device. Figure 3 As shown, the device specifically includes: a risk warning acquisition module 310, an attack technology determination module 320, an attack link data determination module 330 and a risk management solution generation module 340.

[0077] Among them, the risk alarm acquisition module 310 is used to obtain the risk alarm generated by the target device with security risks and the inspection data based on which the risk alarm is generated; the attack technology determination module 320 is used to determine the target attack stage corresponding to the risk alarm and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alarm category corresponding to the risk alarm and the attack technology identification information used in each attack stage in the attack knowledge base and the alarm category; the attack link data determination module 330 is used to determine the attack link data corresponding to the target device based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm and the target attack technology identification information used in the target attack stage; the risk governance plan generation module 340 is used to generate a target risk governance plan corresponding to the target device based on the plan generation network model and the attack link data.

[0078] The technical solution of this embodiment determines the target attack stage corresponding to the risk alarm and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alarm category corresponding to the risk alarm generated by the target device and the attack technology identification information used in each attack stage in the attack knowledge base and the alarm category, and determines detailed attack link data based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm and the target attack technology identification information used in the target attack stage. The network model and attack link data are generated using the solution, so that the target risk management solution corresponding to the target device can be automatically and accurately generated, thereby eliminating the need to rely on expert experience, realizing automatic and rapid generation of risk management solutions, and improving the generation efficiency and accuracy of risk management solutions.

[0079] Optionally, the scheme generation network model is obtained by fine-tuning the generative pre-trained model and initializing the prompt words based on the attack knowledge base and the defense knowledge base in advance;

[0080] The target risk management plan includes multiple risk management stages and risk management methods corresponding to each risk management stage.

[0081] Optionally, the number of the risk warning is multiple;

[0082] The attack link data determination module 330 includes:

[0083] An associated risk alarm determination unit is used to perform an alarm association detection for each of the risk alarms based on the first inspection data based on which the current risk alarm is generated and the second inspection data based on which the other risk alarms are generated, and determine an associated risk alarm in the other risk alarms that is associated with the current risk alarm;

[0084] A target risk alarm set determination unit is used to integrate the associated risk alarms corresponding to each risk alarm to determine an associated target risk alarm set;

[0085] An attack link data determination unit is used to determine the attack link data corresponding to the target device based on each target risk alarm in the target risk alarm set, the inspection data based on which the target risk alarm is generated, the target attack stage corresponding to the target risk alarm, and the target attack technology identification information used in the target attack stage.

[0086] Optionally, the attack link data determination module 330 further includes:

[0087] The other risk alarm determination unit is used to determine other target attack stages other than the current target attack stage based on the current target attack stage corresponding to the current risk alarm before performing correlation detection based on the inspection data based on which the current risk alarm is generated and the inspection data based on which other risk alarms are generated; and determine the risk alarms generated in the other target attack stages as other risk alarms.

[0088] Optionally, the associated risk warning determination unit is specifically configured to:

[0089] Based on the first inspection data on which the current risk alarm is generated, determine the key information corresponding to the current risk alarm; detect whether the key information exists in the second inspection data on which other risk alarms are generated, and determine based on the detection results whether the other risk alarms are associated risk alarms that are associated with the current risk alarm.

[0090] Optionally, the attack link data determining unit is specifically configured to:

[0091] Based on the sequence of target attack stages corresponding to each target risk alarm in the target risk alarm set, the attack link corresponding to the target risk alarm set is determined; according to the attack link, each target risk alarm, the inspection data based on which the target risk alarm is generated, and the target attack technology identification information used in the target attack stage are combined to obtain the attack link data corresponding to the target device.

[0092] Optionally, the device further comprises:

[0093] A risk data storage module is used to collect the inspection data of each device through an intrusion detection system or an intrusion prevention system before obtaining the risk alarm generated by the target device with security risks and the inspection data based on which the risk alarm is generated, and analyze the inspection data; generate a risk alarm when the analysis result is an abnormal result, and store the risk alarm and the inspection data based on which the risk alarm is generated in the search database.

[0094] The risk management solution generation device provided in the embodiment of the present invention can execute the risk management solution generation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the risk management solution generation method.

[0095] It is worth noting that in the embodiment of the above-mentioned risk management solution generation device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0096] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 4 A block diagram of an exemplary electronic device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 4 The electronic device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0097] like Figure 4 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0098] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0099] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0100] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory 30 (RAM) and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 not shown, usually called a "hard drive"). Although Figure 4 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0101] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0102] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), may communicate with one or more devices that enable a user to interact with the electronic device 12, and / or may communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the electronic device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the electronic device 12 via a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0103] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing a risk management solution generation method provided by any embodiment of the present invention, the method comprising:

[0104] Obtain risk warnings generated by target devices with security risks and inspection data based on which the risk warnings were generated;

[0105] Determine the target attack stage corresponding to the risk alert and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alert category corresponding to the risk alert and the attack technology identification information used in each attack stage in the attack knowledge base and the alert category;

[0106] Determine attack link data corresponding to the target device based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm, and the target attack technology identification information used in the target attack stage;

[0107] Based on the solution generation network model and the attack link data, a target risk management solution corresponding to the target device is generated.

[0108] Of course, those skilled in the art can understand that the processor can also implement the technical solution of the risk management solution generation method provided by any embodiment of the present invention.

[0109] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the steps of the risk management solution generation method provided in any embodiment of the present invention are implemented. The method includes:

[0110] Obtain risk warnings generated by target devices with security risks and inspection data based on which the risk warnings were generated;

[0111] Determine the target attack stage corresponding to the risk alert and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alert category corresponding to the risk alert and the attack technology identification information used in each attack stage in the attack knowledge base and the alert category;

[0112] Determine attack link data corresponding to the target device based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm, and the target attack technology identification information used in the target attack stage;

[0113] Based on the solution generation network model and the attack link data, a target risk management solution corresponding to the target device is generated.

[0114] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0115] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0116] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0117] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0118] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements a risk management solution generating method as provided in any embodiment of the present invention.

[0119] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0120] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0121] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for generating a risk management solution, characterized in that: include: Obtain risk warnings generated by target devices with security risks and inspection data based on which the risk warnings were generated; Determine the target attack stage corresponding to the risk alert and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alert category corresponding to the risk alert and the attack technology identification information used in each attack stage in the attack knowledge base and the alert category; Determine attack link data corresponding to the target device based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm, and the target attack technology identification information used in the target attack stage; Based on the solution generation network model and the attack link data, a target risk management solution corresponding to the target device is generated.

2. The method according to claim 1, characterized in that The scheme generation network model is obtained by fine-tuning the generative pre-trained model and initializing the prompt words based on the attack knowledge base and the defense knowledge base in advance; The target risk management plan includes multiple risk management stages and risk management methods corresponding to each risk management stage.

3. The method according to claim 1, characterized in that The number of risk warnings is multiple; The determining of the attack link data corresponding to the target device based on the risk warning, the inspection data based on which the risk warning is generated, the target attack stage corresponding to the risk warning, and the target attack technology identification information used in the target attack stage includes: For each of the risk alarms, an alarm association detection is performed based on the first inspection data based on which the current risk alarm is generated and the second inspection data based on which the other risk alarms are generated, to determine an associated risk alarm among the other risk alarms that is associated with the current risk alarm; Integrate the associated risk alerts corresponding to each risk alert to determine the associated target risk alert set; Based on each target risk alarm in the target risk alarm set, the inspection data based on which the target risk alarm is generated, the target attack stage corresponding to the target risk alarm, and the target attack technology identification information used in the target attack stage, the attack link data corresponding to the target device is determined.

4. The method according to claim 3, characterized in that Before performing correlation detection based on the inspection data based on which the current risk alarm is generated and the inspection data based on which other risk alarms are generated, it also includes: Based on the current target attack stage corresponding to the current risk alert, determining other target attack stages other than the current target attack stage; The risk warnings generated in the other target attack phase are determined as other risk warnings.

5. The method according to claim 3, characterized in that: The alarm association detection is performed based on the first inspection data based on which the current risk alarm is generated and the second inspection data based on which the other risk alarms are generated, and the associated risk alarms among the other risk alarms that are associated with the current risk alarm are determined, including: Determine key information corresponding to the current risk alarm based on the first inspection data based on which the current risk alarm is generated; It is detected whether the key information exists in the second inspection data based on which other risk alarms are generated, and it is determined based on the detection result whether the other risk alarms are associated risk alarms associated with the current risk alarm.

6. The method according to claim 3, characterized in that The determining the attack link data corresponding to the target device based on each target risk alarm in the target risk alarm set, the inspection data based on which the target risk alarm is generated, the target attack stage corresponding to the target risk alarm, and the target attack technology identification information used in the target attack stage, includes: Determining an attack link corresponding to the target risk alarm set based on a sequence of target attack stages corresponding to each target risk alarm in the target risk alarm set; According to the attack link, each target risk alarm, the inspection data based on which the target risk alarm is generated, and the target attack technology identification information used in the target attack phase are combined to obtain the attack link data corresponding to the target device.

7. The method according to any one of claims 1 to 6, characterized in that: Before obtaining the risk alarm generated by the target device with security risk and the inspection data based on which the risk alarm is generated, the method further includes: Collecting inspection data of each device through an intrusion detection system or an intrusion prevention system, and analyzing the inspection data; When the analysis result is an abnormal result, a risk alarm is generated, and the risk alarm and the inspection data based on which the risk alarm is generated are stored in a search database.

8. A risk management solution generation device, characterized in that: include: A risk warning acquisition module is used to acquire risk warnings generated by target devices with security risks and inspection data based on which the risk warnings are generated; An attack technology determination module, used to determine the target attack stage corresponding to the risk alert and the target attack technology identification information used in the target attack stage based on the mapping relationship between the alert category corresponding to the risk alert and the attack technology identification information used in each attack stage in the attack knowledge base and the alert category; An attack link data determination module, used to determine the attack link data corresponding to the target device based on the risk alarm, the inspection data based on which the risk alarm is generated, the target attack stage corresponding to the risk alarm, and the target attack technology identification information used in the target attack stage; The risk management solution generation module is used to generate a target risk management solution corresponding to the target device based on the solution generation network model and the attack link data.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the risk management solution generation method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the risk management solution generation method as described in any one of claims 1-7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the risk management solution generation method as described in any one of claims 1-7.

Images