Security text execution method and device, equipment and storage medium

Abstract

The invention discloses a security text execution method and device, equipment and a storage medium. The method comprises the following steps: determining an abnormal event and a system state corresponding to the abnormal event; determining a plurality of execution tasks operated when an abnormal event occurs based on the system state; performing risk identification on the plurality of execution tasks, and determining a risk task from the plurality of execution tasks; querying a security text corresponding to the risk task from a security text library; wherein the security text comprises a process definition file; responding to the risk task according to the inquired security text, and executing the security text; the accuracy of responding to the risk task corresponding to the abnormal event by the security text and the efficiency of executing the security text are effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device, equipment and storage medium for executing a secure text. Background Art

[0002] With the acceleration of digital transformation and the construction of new power systems, a large number of new energy sites and third-party market players have been connected, and the cyberspace has moved from closed to open. The exposure of network risks has expanded dramatically, the protection boundaries have become increasingly blurred, and the difficulty of security management has increased. The analysis and application of massive data information has led to the emergence of data security issues, which has brought new challenges to the existing protection system. In the new power system scenario, the network security of distributed energy systems lacks effective assessment and defense methods, and there are security risks in the main station network. The existing protection architecture has not yet adapted to the needs of building a new energy system, and the security protection and security service supply capabilities are still insufficient. In particular, in the process of handling abnormal network security events, it involves rapid response and effective handling of network attacks, data leaks, malware infections and other events. Generally, security texts are used to integrate existing security capabilities to automatically respond to security anomalies.

[0003] A Security Playbook is a documented guide that defines the process for an organization to prevent, detect, and respond to cybersecurity incidents. This type of text usually includes descriptions of various potential abnormal scenarios and specific action steps for these anomalies. It can define processes based on the security playbook to implement text matching task execution. When the security abnormal event meets the triggering rules of the security playbook, the workflow defined in the playbook automatically executes the task. This type of task represents a task that can be automatically executed by a computer program, service, or system. It is often used to perform automated operations such as data processing, integrating external systems, executing scripts, etc.

[0004] However, currently, the efficiency and accuracy of text responses of security texts to abnormal events in the existing technology are low. Summary of the invention

[0005] The present invention provides a method, device, equipment and storage medium for executing a security text, so as to solve the problem of low efficiency and accuracy of text response of the security text to abnormal events in the prior art.

[0006] In a first aspect, an embodiment of the present invention provides a method for executing a security text, comprising:

[0007] Determine an abnormal event and a system state corresponding to the abnormal event;

[0008] Determine, based on the system state, a plurality of execution tasks to be run when an abnormal event occurs;

[0009] Performing risk identification on the multiple execution tasks, and determining risky tasks from the multiple execution tasks;

[0010] Querying the security text corresponding to the risk task from the security text library; wherein the security text includes a process definition file;

[0011] The risk task is responded to according to the retrieved safety text, and the safety text is executed.

[0012] Optionally, determining an abnormal event and a system state corresponding to the abnormal event includes:

[0013] Detect network traffic. If the network traffic is greater than the preset alarm traffic threshold, it is determined that an abnormal event has occurred.

[0014] Query the system log, and determine the system status corresponding to the abnormal event according to the system log.

[0015] Optionally, performing risk identification on the multiple execution tasks and determining risky tasks from the multiple execution tasks includes:

[0016] Acquire task information corresponding to the multiple execution tasks, wherein the task information includes: process information, service information, and planned task information;

[0017] Judging the task information based on a preset judgment condition to determine whether the multiple executed tasks have any abnormal task behavior;

[0018] If there is abnormal task behavior, the execution task with the abnormal task behavior is determined to be a risky task.

[0019] Optionally, the querying the security text corresponding to the risk task from the security text library includes:

[0020] Identify the risk task type and determine the task type corresponding to the risk task;

[0021] Based on the task type, a security text corresponding to the task type is searched from a security text library.

[0022] Optionally, the performing task type identification on the risk task to determine the task type corresponding to the risk task includes:

[0023] Pre-set multiple task type topic dictionaries;

[0024] Extracting keywords from the task name of the risk task;

[0025] The keyword is matched with each task type subject dictionary to determine the task type subject corresponding to the keyword, and the task type corresponding to the task type subject is used as the task type corresponding to the risk task.

[0026] Optionally, responding to the risk task according to the queried security text and executing the security text includes:

[0027] Obtaining a process definition file of the queried security text;

[0028] Based on the task configuration in the process definition file, the task configured in the security context is executed.

[0029] Optionally, after responding to the risk task according to the retrieved safety text and executing the safety text, the method further includes:

[0030] Obtaining and recording the execution result of the security text, wherein the execution result includes the execution status, timestamp, and executor;

[0031] A graph is generated based on the execution result and / or the execution result is used as input data for mapping and transferring between the execution tasks.

[0032] In a second aspect, an embodiment of the present invention provides a secure text execution device, including:

[0033] A first determination module, used to determine an abnormal event and a system state corresponding to the abnormal event;

[0034] A second determination module, configured to determine, based on the system state, a plurality of execution tasks to be run when an abnormal event occurs;

[0035] An identification module, configured to identify risks of the plurality of execution tasks and determine risky tasks from the plurality of execution tasks;

[0036] A query module, used to query the security text corresponding to the risk task from the security text library; wherein the security text includes a process definition file;

[0037] An execution module is used to respond to the risk task according to the queried safety text and execute the safety text.

[0038] In a third aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:

[0039] at least one processor; and

[0040] a memory communicatively connected to the at least one processor; wherein,

[0041] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security text execution method described in any embodiment of the present invention.

[0042] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for executing the security text described in any embodiment of the present invention when executing the computer instructions.

[0043] The technical solution of the embodiment of the present invention solves the problem of low text response efficiency and accuracy of security text to abnormal events in the prior art, and effectively improves the accuracy of security text in responding to risk tasks corresponding to abnormal events and the efficiency of executing security text.

[0044] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 A flowchart of a method for executing a security text provided in Embodiment 1 of the present invention;

[0047] Figure 2 A flowchart of a method for executing a security text provided in Embodiment 2 of the present invention;

[0048] Figure 3 A schematic diagram of the structure of a secure text execution device provided in Embodiment 3 of the present invention;

[0049] Figure 4 A schematic diagram of the structure of an electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0051] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0052] Embodiment 1

[0053] Figure 1 This is a flowchart of a method for executing a security text provided in the first embodiment of the present invention. This embodiment is applicable to the case of executing a security text. The method can be executed by a security text execution device. The execution device can be implemented in the form of hardware and / or software. The execution device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0054] S110: Determine an abnormal event and a system state corresponding to the abnormal event.

[0055] Among them, an abnormal event may refer to an event in which network data is abnormal, such as network attacks, data leaks, malware infections, etc.; a system state may refer to a state record of all tasks executed in a system host. Specifically, a system state corresponding to an abnormal event may refer to a state record of all tasks executed in a system host when the abnormal event occurs.

[0056] In this embodiment, the abnormal event that occurred can be determined by detecting the system host, as well as the status records of all executed tasks in the system host when the abnormal event occurred.

[0057] S120: Determine, based on the system state, a plurality of execution tasks to be run when an abnormal event occurs.

[0058] Among them, executing a task can refer to the process in which the system automatically performs a series of operations according to a predetermined plan or real-time needs. These operations can be data processing, file management, network communication, etc.

[0059] In this embodiment, by recording the status of all execution tasks in the system host when the abnormal event occurs, it is possible to determine all execution tasks that are running in the system host when the abnormal event occurs.

[0060] S130: Perform risk identification on the multiple execution tasks, and determine risky tasks from the multiple execution tasks.

[0061] Among them, risk identification can refer to the identification of abnormalities in task execution; risk tasks can refer to abnormal execution tasks.

[0062] In this embodiment, abnormalities can be identified for all the execution tasks running in the system host when the abnormal event occurs, and abnormal execution tasks can be determined as risky tasks from all the execution tasks running in the system host when the abnormal event occurs.

[0063] S140. Query the security text corresponding to the risk task from the security text library; wherein the security text includes a process definition file.

[0064] Among them, the security text library can refer to a database that stores various security texts; the security text can refer to a documented guide that defines the process for organizations to prevent, detect and respond to cybersecurity incidents; the process definition file can refer to a file that describes and defines the business process, which can specifically include a series of steps, rules, conditions, data and other relevant information.

[0065] In this embodiment, the safety text corresponding to the risk task can be queried from the safety text library according to the risk task.

[0066] S150: respond to the risk task according to the retrieved safety text, and execute the safety text.

[0067] Specifically, the risk task can be responded to according to the queried security text corresponding to the risk task, and the multiple main processes contained in the security text can be executed according to the process definition file in the security script; wherein each main process includes multiple sub-processes, and the sub-process can include multiple sub-tasks and sub-activities to form an independent sub-process. Specifically, the sub-process can be a nested Business Process Modeling Notation (BPMN) process. In addition, during the execution of the security text, the business process task described and defined in the process definition file can be executed, and the task can send messages, notifications or signals to external systems or participants.

[0068] In the present embodiment, by determining an abnormal event and a system state corresponding to the abnormal event; determining multiple execution tasks running when the abnormal event occurs based on the system state; performing risk identification on the multiple execution tasks, and determining the risk task from the multiple execution tasks; querying the security text corresponding to the risk task from a security text library; wherein the security text includes a process definition file; responding to the risk task according to the queried security text, and executing the security text, the problem of low efficiency and accuracy of text response of security text to abnormal events in the prior art is solved, and the accuracy of security text response to risk tasks corresponding to abnormal events and the efficiency of executing security text are effectively improved.

[0069] Optionally, determining an abnormal event and a system state corresponding to the abnormal event includes:

[0070] Detect network traffic. If the network traffic is greater than the preset alarm traffic threshold, it is determined that an abnormal event has occurred.

[0071] The network traffic may refer to the amount of data transmitted on the network; the preset alarm traffic threshold may refer to the preset minimum network traffic value for triggering an alarm.

[0072] In this embodiment, the network traffic may be detected in real time. If the network traffic is greater than a preset alarm traffic threshold, it may be determined that an abnormal event has occurred.

[0073] Query the system log, and determine the system status corresponding to the abnormal event according to the system log.

[0074] The system log can refer to the information recording the hardware, software and system problems in the system, and can also monitor the events occurring in the system and the tasks performed.

[0075] In this embodiment, the system log can be queried in real time, and all the execution tasks running in the system host when the abnormal event occurs can be determined based on the information recorded in the system log.

[0076] Optionally, performing risk identification on the multiple execution tasks and determining risky tasks from the multiple execution tasks includes:

[0077] Acquire task information corresponding to the multiple execution tasks, wherein the task information includes: process information, service information, and planned task information;

[0078] Among them, task information may refer to detailed data and parameters related to the execution of tasks; process information may refer to instances of programs running in the system, each process has a unique process identifier; service information may refer to long-term tasks running in the system, usually running in the background, providing continuous functions such as network connection and printing support; scheduled task information may refer to tasks scheduled to be executed at a certain point in the future or on a periodic basis.

[0079] Specifically, task information corresponding to multiple execution tasks may be obtained from the system log.

[0080] Judging the task information based on a preset judgment condition to determine whether the multiple executed tasks have any abnormal task behavior;

[0081] The preset judgment condition may refer to a pre-set condition for judging whether there is abnormal task behavior in the task information; and the abnormal task behavior may refer to abnormal behavior in the task information corresponding to the execution of the task.

[0082] Specifically, the preset judgment conditions may include: judging based on process information whether there are processes of unknown origin or unauthorized running, whether there are processes occupying a large amount of CPU or memory resources, whether the process has made abnormal network connection attempts; whether there are processes that have modified system files or sensitive configuration files; judging based on service information whether there are abnormally started services or hidden services; judging based on scheduled task information whether there are scheduled tasks that have been modified or created.

[0083] If there is abnormal task behavior, the execution task with the abnormal task behavior is determined to be a risky task.

[0084] Specifically, the task information may be judged according to a preset judgment condition. If it is judged that there is abnormal task behavior, the execution task with the abnormal task behavior is determined to be a risky task.

[0085] In this embodiment, after determining the multiple execution tasks running when the abnormal event occurs, the task information corresponding to the multiple execution tasks can be obtained, and the task information can be judged according to preset judgment conditions. If it is determined that there is abnormal task behavior, the execution task with abnormal task behavior is determined to be a risky task, which effectively improves the efficiency and accuracy of determining risky tasks from multiple execution tasks.

[0086] Embodiment 2

[0087] Figure 2 This is a flowchart of a method for executing a secure text provided in the second embodiment of the present invention. The technical solution of this embodiment is further refined on the basis of the above embodiment. Figure 2 As shown, the method includes:

[0088] S210: Determine an abnormal event and a system state corresponding to the abnormal event.

[0089] S220: Determine, based on the system state, a plurality of execution tasks to be run when an abnormal event occurs.

[0090] S230: Perform risk identification on the multiple execution tasks, and determine risky tasks from the multiple execution tasks.

[0091] S240, identifying the task type of the risk task to determine the task type corresponding to the risk task;

[0092] The task type may refer to the task type of the risk task, and the task type identification may refer to identifying the task type of the risk task. Specifically, the task type of the risk task may include a workflow task type, a compliance task type, an application task type, a user and identity management task type, a temporary task type, and a scheduled task type.

[0093] In this embodiment, after the risk task is determined, the task type of the risk task may be identified to determine the task type corresponding to the risk task.

[0094] S250: Based on the task type, query a security text library for a security text corresponding to the task type.

[0095] Specifically, the security text library stores security texts corresponding to various task types. Exemplarily, the security texts include workflow security texts, compliance security texts, application security texts, user and identity management security texts, and scheduled task security texts.

[0096] In this embodiment, after the task type corresponding to the risk task is determined, the safety text corresponding to the task type can be queried from the safety text library according to the task type.

[0097] S260: respond to the risk task according to the retrieved safety text, and execute the safety text.

[0098] In the present embodiment, by determining an abnormal event and a system state corresponding to the abnormal event; determining multiple execution tasks running when the abnormal event occurs based on the system state; performing risk identification on the multiple execution tasks and determining the risk task from the multiple execution tasks; performing task type identification on the risk task and determining the task type corresponding to the risk task; based on the task type, querying the security text corresponding to the task type from a security text library; responding to the risk task according to the queried security text and executing the security text, the problem of low efficiency and accuracy of text response of security text to abnormal events in the prior art is solved, and the accuracy of security text response to risk tasks corresponding to abnormal events and the efficiency of executing security text are effectively improved.

[0099] Optionally, the performing task type identification on the risk task to determine the task type corresponding to the risk task includes:

[0100] Pre-set multiple task type topic dictionaries;

[0101] The task type subject dictionary may refer to a vocabulary set classified and summarized according to different task type themes; specifically, a plurality of task type subject dictionaries may be pre-set according to different task types.

[0102] Extracting keywords from the task name of the risk task;

[0103] The task name may refer to a name that identifies and describes the risk task; specifically, keyword extraction may be performed on the task name of the risk task to extract at least one keyword.

[0104] The keyword is matched with each task type subject dictionary to determine the task type subject corresponding to the keyword, and the task type corresponding to the task type subject is used as the task type corresponding to the risk task.

[0105] Exemplarily, a workflow task is used to process daily business processes, such as order processing, approval process, etc. The task name and description of the workflow task can be viewed through the task manager, and keywords such as "workflow" and "approval" can be extracted.

[0106] Compliance tasks are designed to ensure that systems and applications comply with security policies and regulatory requirements, such as regular security scans, audit log backups, etc. You can view the task names of compliance tasks through the Task Manager and extract keywords such as "compliance", "audit", and "security".

[0107] Application tasks are usually related to specific applications and are responsible for the normal operation of the application, such as database backup, cache cleanup, etc. You can view the application name or related words contained in the task name of the application task as a keyword through the Task Manager.

[0108] User and Identity Management Tasks are related to user account management, including account creation, password reset, permission allocation, etc. You can view the task names of user and identity management tasks through the Task Manager and extract keywords such as "user", "account", "permission", etc.

[0109] Scheduled tasks usually refer to tasks that are executed according to a predetermined schedule, such as regular system backup, data synchronization, etc. You can view the task names of scheduled tasks through the Task Manager and extract keywords such as "scheduled", "backup", "sync", etc.

[0110] Specifically, for risk tasks where no corresponding words are found and it is difficult to extract keywords, dedicated tools, such as Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools, can be used to identify the task type of the risk task.

[0111] In this embodiment, multiple task type subject dictionaries can be pre-set; keywords are extracted from the task name of the risk task; the keywords are matched with each task type subject dictionary to determine the task type subject corresponding to the keyword, and the task type corresponding to the task type subject is used as the task type corresponding to the risk task; based on the task type, the security text corresponding to the task type is queried from the security text library; the risk task is responded to according to the queried security text, and the security text is executed, which effectively improves the accuracy of the security text in responding to the risk task corresponding to the abnormal event and the efficiency of executing the security text.

[0112] Optionally, responding to the risk task according to the queried security text and executing the security text includes:

[0113] Obtaining a process definition file of the queried security text;

[0114] Based on the task configuration in the process definition file, the task configured in the security context is executed.

[0115] Among them, task configuration can refer to the tasks configured in the process definition file corresponding to the security text. Specifically, the process definition file includes business rules, and the tasks configured in the security text are executed according to the business rules, and corresponding decisions can be made according to the business rules, such as IP blocking, alarming, etc.

[0116] In this embodiment, the security text corresponding to the task type is queried from the security text library, and the process definition file of the queried security text is obtained. According to the task configuration in the process definition file, the tasks configured in the corresponding security text are executed and corresponding decisions are made, which effectively improves the accuracy of the security text in responding to the risk tasks corresponding to abnormal events and the efficiency of executing the security text.

[0117] Optionally, the process definition file can include boundary event tasks and compensation tasks.

[0118] Among them, boundary event tasks can refer to unforeseen or non-standard network security events and tasks outside the security script. Whether a boundary event task exists is usually determined based on the process definition file; different process definition files contain one or more boundary event definitions and their triggering conditions. Specifically, you can find the definition of boundary events and their triggering conditions by viewing the process definition file, such as the BPMN XML file. When the conditions related to the boundary event are met, the boundary event task associated with it will be executed. The types of boundary events include signal events, message events, timer events, error events, compensation events, interrupt events, etc.

[0119] For example, if there is a "risk review" task in the security process, for the accuracy of the review, an "interrupt event" can be defined next to the task to check whether there is a cancellation request from the user. If a cancellation request is received from the user during the review process, the interrupt event is triggered, the current review process is stopped, and the "risk review" task is canceled instead.

[0120] Among them, the compensation task can refer to undoing the previously executed operation to return the system to a previous state. In complex business processes, it is very important to ensure data consistency. The compensation task helps to restore data consistency when problems occur. Whether a compensation task exists is usually determined based on the process definition file; different process definition files can contain the definition of one or more compensation tasks and their triggering conditions. For example, when an activity fails, a compensation task can be triggered. When an error is detected in the execution of a security text through an error detection mechanism, such as command execution failure, timeout, etc., the compensation task can be triggered. By viewing the process definition file, such as the BPMN XML file, find the definition of the compensation event and its triggering conditions. When the conditions related to the execution of the security text compensation task are met, the compensation task will be executed. Among them, a BPM engine that supports the compensation mechanism, such as Camunda BPM, jBPM, etc., can be used to execute the compensation task process.

[0121] For example, if there is a trigger process that fails to execute a command, a rollback operation needs to be performed. The process needs to be rolled back to the time before the task failed, and the system or device needs to be restored to the state before the command was executed, including canceling the operation, restoring the configuration, or isolating the infected device. In addition, if there is an error that requires manual intervention, the system can provide a manual intervention option so that the staff can take appropriate error correction measures.

[0122] Optionally, after responding to the risk task according to the retrieved safety text and executing the safety text, the method further includes:

[0123] Obtaining and recording the execution result of the security text, wherein the execution result includes the execution status, timestamp, and executor;

[0124] Among them, the execution result may refer to the result of executing the security text configuration task; the execution status may refer to the status when the security text is executed, for example, successful execution or failed execution; the timestamp may refer to the time point when the security text starts to execute, which may be a 13-digit value; the executor may refer to the executor's ID.

[0125] Specifically, when the security text is executed, the execution result of the security text is output: whether the security text is executed successfully or failed, a timestamp, and the ID of the executor and other information.

[0126] A graph is generated based on the execution result and / or the execution result is used as input data for mapping and transferring between the execution tasks.

[0127] Among them, mapping transfer can refer to the process of mapping the execution result to another execution task. Specifically, a chart can be generated based on the execution status, timestamp, and executor included in the execution result to convey the execution result to the relevant staff or system. The execution result can be used as input data to map and transfer between various execution tasks. The output of the execution result needs to record the execution information of the script for data transfer, which can ensure the complete backup of the data and provide data support for rapid recovery after an abnormal event occurs.

[0128] For example, when the execution result is transferred between the execution tasks, a flag field, such as a fixed bit, a unique identifier, etc., can be added to the execution result input into the execution task; and mapped to the output data of the execution task, thereby ensuring the consistency and correctness of data transfer. Specifically, an expression language (such as XPath, EL expression) can be used to define mapping rules for data mapping transfer.

[0129] Optional, secure text verification process includes:

[0130] Determine the preset simulation security text and verify the correctness of the execution logic of the simulation security text; wherein, the verification of the execution logic of the simulation security text includes: single-step execution, step-by-step execution, breakpoint setting, variables, status and data viewing of the current execution step; generation log and output data viewing of each execution step.

[0131] Specifically, single-step execution (Step Over) can refer to executing one line of code at a time and observing the execution flow of the program. Step Into / Out includes: Step Into, when encountering a function call, you can choose to enter the function and execute it line by line instead of skipping it directly; Step Out, if you have already entered the function, you can use this function to jump out of the current function and continue to execute the code that called the function. Breakpoint setting (Breakpoints) can refer to pausing execution at a specific location in the code to check the variable value, stack trace and other information at that moment. The variables of the current execution step can include the local variables and global variables of the current execution step, the status of the current execution step can include execution success or failure, and the data of the current execution step can refer to the detailed data and parameters of the current execution step. The generation log and output data viewing of each execution step can refer to inserting a logging statement at the key execution step position to facilitate tracking the execution process of the program. By viewing the generated log file and console output data, you can understand the running track of the simulated security text program and the data changes at each stage of the simulated security text.

[0132] In this embodiment, the correctness of the simulated security text execution logic can be verified through single-step execution, step-by-step execution, breakpoint setting, variable, status and data viewing of the current execution step; generating logs for each execution step and viewing output data, etc.

[0133] The simulation process of secure text includes:

[0134] Execute the simulated security text process to obtain a simulated execution result;

[0135] The simulation execution result may refer to the result obtained by executing the simulation security text.

[0136] Determine whether the simulation execution result is consistent with the preset expected execution result;

[0137] The preset expected execution result may refer to the result that should be obtained by executing the simulated security text in advance. Specifically, the simulation execution result is compared with the preset expected execution result to determine whether the simulation execution result is consistent with the preset expected execution result.

[0138] If the execution logic verification of the simulated security text is correct, and the simulated execution result of the simulated security text is consistent with the preset expected execution result, the simulated security text is stored in the security text library;

[0139] Otherwise, an alarm is issued and the simulated security text is corrected and updated until the execution logic of the updated simulated security text is verified to be correct and the simulation execution result is consistent with the preset expected execution result, and the updated simulated security text is stored in the security text library.

[0140] In this embodiment, by verifying the execution logic of the simulated security text and simulating the simulated security text, if the execution logic of the simulated security text is verified correctly and the simulation execution result of the simulated security text is consistent with the preset expected execution result, the simulated security text is stored in the security text library, thereby ensuring the accuracy of the security text in the security text library.

[0141] Embodiment 3

[0142] Figure 3 This is a schematic diagram of the structure of a secure text execution device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0143] A first determination module 310, configured to determine an abnormal event and a system state corresponding to the abnormal event;

[0144] A second determination module 320, configured to determine, based on the system state, a plurality of execution tasks to be run when an abnormal event occurs;

[0145] An identification module 330, configured to identify risks of the plurality of execution tasks and determine risky tasks from the plurality of execution tasks;

[0146] A query module 340 is used to query the security text corresponding to the risk task from the security text library; wherein the security text includes a process definition file;

[0147] The execution module 350 is used to respond to the risk task according to the retrieved safety text and execute the safety text.

[0148] Optionally, the first determining module 310 is specifically configured to:

[0149] Detect network traffic. If the network traffic is greater than the preset alarm traffic threshold, it is determined that an abnormal event has occurred.

[0150] Query the system log, and determine the system status corresponding to the abnormal event according to the system log.

[0151] Optionally, the identification module 330 is specifically configured to:

[0152] Acquire task information corresponding to the multiple execution tasks, wherein the task information includes: process information, service information, and planned task information;

[0153] Judging the task information based on a preset judgment condition to determine whether the multiple executed tasks have any abnormal task behavior;

[0154] If there is abnormal task behavior, the execution task with the abnormal task behavior is determined to be a risky task.

[0155] Optionally, the query module 340 includes:

[0156] A determination unit, configured to identify the task type of the risk task and determine the task type corresponding to the risk task;

[0157] The query unit is used to query the security text corresponding to the task type from the security text library based on the task type.

[0158] Optionally, determine the unit, specifically for:

[0159] Pre-set multiple task type topic dictionaries;

[0160] Extracting keywords from the task name of the risk task;

[0161] The keyword is matched with each task type subject dictionary to determine the task type subject corresponding to the keyword, and the task type corresponding to the task type subject is used as the task type corresponding to the risk task.

[0162] Optionally, the execution module 350 includes:

[0163] An acquisition unit, used for acquiring a process definition file of the queried security text;

[0164] The execution unit is used to execute the task configured in the security text based on the task configuration in the process definition file.

[0165] Optionally, the security text execution device further includes a transmission module, which is used to:

[0166] Obtaining and recording the execution result of the security text, wherein the execution result includes the execution status, timestamp, and executor;

[0167] A graph is generated based on the execution result and / or the execution result is used as input data for mapping and transferring between the execution tasks.

[0168] The security text execution device provided in the embodiment of the present invention can execute the security text execution method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0169] Embodiment 4

[0170] Figure 4 A schematic diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0171] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by the at least one processor 11, and the computer program is executed by the at least one processor 11 so that the at least one processor 11 can execute the method provided by the present invention.

[0172] The processor 11 can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 12 or a computer program loaded from a storage unit 18 into a random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0173] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0174] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the execution method of the secure text.

[0175] In some embodiments, the execution method of the secure text may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the execution method of the secure text described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the execution method of the secure text in any other appropriate manner (e.g., by means of firmware).

[0176] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard parts (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0177] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0178] In the context of the present invention, a computer-readable storage medium stores a computer instruction, and the computer instruction is used to implement the execution method of the security text provided by the present invention when the processor is executed. A computer-readable storage medium can be a tangible medium, which can contain or store a computer program for use by an instruction execution system, a device or an equipment or used in combination with an instruction execution system, a device or an equipment. A computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0179] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD monitor)) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which the user may provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0180] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by digital data communication (e.g., a communication network) in any form or medium. Examples of communication networks include: Local Area Network (LAN), Wide Area Network (WAN), blockchain network, and the Internet.

[0181] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

[0182] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0183] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for executing a security text, characterized in that: include: Determine an abnormal event and a system state corresponding to the abnormal event; Determine, based on the system state, a plurality of execution tasks to be run when an abnormal event occurs; Performing risk identification on the multiple execution tasks, and determining risky tasks from the multiple execution tasks; Querying the security text corresponding to the risk task from the security text library; wherein the security text includes a process definition file; The risk task is responded to according to the retrieved safety text, and the safety text is executed.

2. The method according to claim 1, characterized in that Determining an abnormal event and a system state corresponding to the abnormal event includes: Detect network traffic. If the network traffic is greater than the preset alarm traffic threshold, it is determined that an abnormal event has occurred. Query the system log, and determine the system status corresponding to the abnormal event according to the system log.

3. The method according to claim 1, characterized in that Performing risk identification on the multiple execution tasks and determining risky tasks from the multiple execution tasks includes: Acquire task information corresponding to the multiple execution tasks, wherein the task information includes: process information, service information, and planned task information; Judging the task information based on a preset judgment condition to determine whether the multiple executed tasks have any abnormal task behavior; If there is abnormal task behavior, the execution task with the abnormal task behavior is determined to be a risky task.

4. The method according to claim 1, characterized in that: The step of querying the security text corresponding to the risk task from the security text library includes: Identify the risk task type and determine the task type corresponding to the risk task; Based on the task type, a security text corresponding to the task type is searched from a security text library.

5. The method according to claim 4, characterized in that The step of identifying the task type of the risk task and determining the task type corresponding to the risk task includes: Pre-set multiple task type topic dictionaries; Extracting keywords from the task name of the risk task; The keyword is matched with each task type subject dictionary to determine the task type subject corresponding to the keyword, and the task type corresponding to the task type subject is used as the task type corresponding to the risk task.

6. The method according to claim 1, characterized in that Responding to the risk task according to the retrieved security text and executing the security text includes: Obtaining a process definition file of the queried security text; Based on the task configuration in the process definition file, the task configured in the security context is executed.

7. The method according to claim 6, characterized in that After responding to the risk task according to the queried safety text and executing the safety text, the method further includes: Obtaining and recording the execution result of the security text, wherein the execution result includes the execution status, timestamp, and executor; A graph is generated based on the execution result and / or the execution result is used as input data for mapping and transferring between the execution tasks.

8. A secure text execution device, characterized in that: include: A first determination module, used to determine an abnormal event and a system state corresponding to the abnormal event; A second determination module, configured to determine, based on the system state, a plurality of execution tasks to be run when an abnormal event occurs; An identification module, configured to identify risks of the plurality of execution tasks and determine risky tasks from the plurality of execution tasks; A query module, used to query the security text corresponding to the risk task from the security text library; wherein the security text includes a process definition file; An execution module is used to respond to the risk task according to the queried safety text and execute the safety text.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security text execution method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for executing the security text according to any one of claims 1 to 7 when executed.

Images