Network security operation monitoring method and system and computer readable medium

Abstract

The invention relates to a network security operation monitoring method and system and a computer readable medium. The method comprises the following steps: acquiring alarm information of network security; inputting the alarm information into a pre-trained large model to obtain an alarm disposal scheme output by the large model; the network and / or the network equipment are / is forbidden according to the alarm processing scheme; and judging whether the alarm information can be obtained or not, and if not, deblocking the network and / or the network equipment and generating a notification message. According to the invention, the network security event can be quickly processed, the blocking and unblocking instructions can be issued in time, and the processing time efficiency and the processing capability of the security event are improved.

Description

Technical Field

[0001] The present invention mainly relates to the field of network information security technology, and specifically relates to a network security operation monitoring method, system and computer-readable medium. Background Art

[0002] In the current network security operation scenario, there are many types of security equipment and complex scenario analysis. When encountering security incidents, the handling process is usually cumbersome, requiring staff to log in to different security devices to perform source analysis, policy formulation and issuance, etc. Especially in terms of Internet attacks, daily Internet scanning, penetration attacks and other security incidents occur very frequently. The current commonly used method is to rely on experienced security engineers to manually operate firewalls and other security devices for blocking, but this method is not only time-consuming and labor-intensive, but also prone to errors. How to quickly and effectively respond to these security incidents in network security operation scenarios has become an urgent problem to be solved. Summary of the invention

[0003] The technical problem to be solved by the present application is to provide a network security operation monitoring method, system and computer-readable medium, which can quickly handle network security incidents, issue blocking and unblocking instructions in a timely manner, and improve the processing timeliness and processing capabilities of security incidents.

[0004] The technical solution adopted by the present application to solve the above-mentioned technical problems is a network security operation monitoring method, including: obtaining network security alarm information; inputting the alarm information into a pre-trained large model to obtain an alarm handling plan output by the large model; blocking the network and / or network equipment according to the alarm handling plan; and determining whether the alarm information can still be obtained. If not, unblocking the network and / or network equipment and generating a notification message.

[0005] In one embodiment of the present application, the step of obtaining network security alarm information includes: obtaining network security alarm information from one or any combination of distributed stream processing platform Kafka, system log Syslog, and remote API interface.

[0006] In one embodiment of the present application, after the step of inputting the alarm information into the pre-trained large model, it also includes: the large model extracts the alarm key fields from the alarm information; the large model generates an alarm handling plan based on the alarm key fields and custom configuration information.

[0007] In one embodiment of the present application, the custom configuration information is related to the intranet environment architecture, intranet segment, and network scanning operation.

[0008] In one embodiment of the present application, after the step of obtaining network security alarm information, it also includes: parsing the alarm information according to a preset parsing method to obtain alarm key fields; extracting alarm codes from alarm key fields using regular expressions; and the step of inputting the alarm information into a pre-trained large model further includes: inputting the alarm information and the alarm code into the pre-trained large model.

[0009] In one embodiment of the present application, after the step of obtaining the alarm handling solution output by the large model, it also includes: denoising the alarm handling solution according to the retrieval enhancement generation method to obtain a denoised alarm handling solution; and using the denoised alarm handling solution as the alarm handling solution.

[0010] In one embodiment of the present application, in the process of training the big model, the input of the big model is the content of the network security log file, and the output of the big model is structured alarm key fields and alarm handling solutions.

[0011] In one embodiment of the present application, the steps of banning a network and / or network device according to an alarm handling plan include: simulating a login to a network system backend; intercepting network data packets and / or disconnecting a network device's network connection, thereby performing a ban operation; recording the results of the ban operation; and monitoring similar requests from the network and / or network device within a preset time period, and if similar requests exist, repeating the ban operation.

[0012] In order to solve the above technical problems, the present application also proposes a network security operation monitoring system, including: an RPA robot, configured to: obtain network security alarm information; input the alarm information into a pre-trained large model to obtain an alarm handling plan output by the large model; block the network and / or network equipment according to the alarm handling plan; determine whether the alarm information can still be obtained, and if not, unblock the network and / or network equipment and generate a notification message; the pre-trained large model is configured to: generate an alarm handling plan according to the alarm information; a memory for storing instructions executable by a processor; a processor for executing instructions to implement the above network security operation monitoring method.

[0013] In order to solve the above technical problems, the present application also proposes a computer-readable medium storing computer program codes, and the computer program codes implement the above network security operation monitoring method when executed by a processor.

[0014] The technical solution of the present application can be executed by an RPA robot, which can quickly identify potential security incidents by obtaining network security alarm information in real time; by utilizing the powerful analytical capabilities of the pre-trained large model, it can accurately judge the nature and severity of the alarm information and generate an effective alarm handling plan; by issuing a ban command in a timely manner and continuously monitoring whether there is any alarm information generated, once it is determined that the security threat has been resolved, it will automatically issue an unblocking command and generate a notification message to inform relevant personnel. In complex security operation scenarios, the closed-loop mechanism of dynamic monitoring and automatic unblocking based on a large model framework in the present application can not only quickly handle security incidents, but also avoid the negative impact that may be caused by long-term bans. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are described in detail below with reference to the accompanying drawings, wherein:

[0016] Figure 1 is an exemplary flow chart of a network security operation monitoring method according to an embodiment of the present application;

[0017] Figure 2 is an exemplary flow chart of a network security operation monitoring method according to another embodiment of the present application;

[0018] Figure 3 This is a flow chart of monitoring the blocking situation in one embodiment of the present application;

[0019] Figure 4 It is a system block diagram of a network security operation monitoring system according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are described in detail below with reference to the accompanying drawings.

[0021] In the following description, many specific details are set forth to facilitate a full understanding of the present application, but the present application may also be implemented in other ways different from those described herein, and therefore the present application is not limited to the specific embodiments disclosed below.

[0022] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0023] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously. At the same time, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0024] The present application proposes a network security operation monitoring method, which can be applied to scenarios where network security incidents need to be handled quickly. The network security operation monitoring method of the present application can be executed by an RPA (Robotic Process Automation) robot configured in a local computer.

[0025] Figure 1 is an exemplary flow chart of a network security operation monitoring method according to an embodiment of the present application, with reference to Figure 1 As shown, the network security operation monitoring method of this embodiment includes the following steps:

[0026] Step S110: Obtain network security alarm information.

[0027] Step S120: Input the alarm information into the pre-trained large model to obtain the alarm handling plan output by the large model.

[0028] Step S130: Block the network and / or network equipment according to the alarm handling plan.

[0029] Step S140: determine whether the alarm information can still be obtained. If not, unblock the network and / or network device and generate a notification message.

[0030] The above steps S110 to S140 are described in detail below:

[0031] In step S110, network security alarm information is obtained. In some embodiments, the step of obtaining network security alarm information includes: obtaining network security alarm information from one or any combination of distributed stream processing platform Kafka, system log Syslog, and remote API interface. Exemplarily, the alarm information can be obtained automatically or according to manual instructions of staff.

[0032] Figure 2 FIG. 1 is an exemplary flow chart of a network security operation monitoring method according to another embodiment of the present application. Figure 2 As shown, for example, for the input side, the above step S110 corresponds to Figure 2 Step S220, step S2201, and step S2202 in . Figure 2In the process, the RPA robot can receive the configuration input of the staff in step S210; generate an information notification in step S2203, and generate an alarm record in step S2204, so that the staff can subsequently analyze the occurrence of the security incident.

[0033] In some embodiments, after the step of obtaining the network security warning information, the method further includes:

[0034] Step S111: parse the alarm information according to a preset parsing method to obtain alarm key fields.

[0035] Step S112: extract the alarm code from the alarm key field using a regular expression.

[0036] For example, step S111 and step S112 may be performed according to manual instructions of a staff member or may be performed automatically. These two steps may correspond to Figure 2 Step S231, step S232, step S2321. Subsequently, the alarm information and alarm code can be input into the pre-trained big model, which helps the big model to generate a more accurate alarm handling plan.

[0037] In step S120, the alarm information is input into the pre-trained large model to obtain the alarm handling solution output by the large model. Figure 2 Step S2322 and step S240 in .

[0038] In some embodiments, after the step of inputting the alarm information into the pre-trained large model, the method further includes:

[0039] Step S121: The large model extracts alarm key fields from the alarm information.

[0040] Step S122: The large model generates an alarm handling solution based on the alarm key fields and the custom configuration information. For example, step S122 corresponds to Figure 2 Step S2401 and step S240 in the above. In practical applications, additional information (i.e., custom configuration information) may be added for situations where alarms need to be processed (e.g., the number of alarms reaches a preset number of times). In some embodiments, the custom configuration information is related to the intranet environment architecture, intranet segments, and network scanning operations, and additional instructions may be given not to block some intranet segments. The custom configuration information is equivalent to the prompt information input into the large model, and the large model will embed the custom configuration information.

[0041] In some embodiments, after the step of obtaining the alarm handling solution output by the large model, the method further includes:

[0042] Step S123: De-noise the alarm handling solution according to the retrieval-augmented generation (RAG) method to obtain a de-noised alarm handling solution. Exemplarily, the retrieval-augmented generation model combines a language model with information retrieval technology. When the model needs to generate text or answer questions, it first retrieves relevant information from a preset document collection, and then uses the retrieved information to guide the generation of text, thereby improving the quality and accuracy of the prediction.

[0043] Step S124: using the noise reduction alarm handling solution as the alarm handling solution.

[0044] Exemplarily, the large model can generate two types of alarm handling solutions, one type is a solution that requires blocking and information notification at the same time, and the other type is a solution that does not require blocking and information notification at the same time.

[0045] In some embodiments, during the process of training the big model, the input of the big model is the content of the network security log file, and the output of the big model is structured alarm key fields and alarm handling solutions.

[0046] In step S130, the network and / or network device is blocked according to the alarm handling solution. Figure 2 Step S250.

[0047] In some embodiments, the steps of blocking a network and / or a network device according to an alarm handling solution include:

[0048] Step S131: Simulate logging into the backend of the network system. Exemplarily, after logging into the backend, a blocking instruction can be issued through the authority of the backend.

[0049] Step S132: intercepting network data packets and / or disconnecting network devices from the network, thereby performing a blocking operation. For example, after performing the blocking operation, the alarm handling situation (corresponding to Figure 2 , or step S260 in the above procedure.

[0050] Step S133: Record the result of the blocking operation.

[0051] Step S134: monitor similar requests from the network and / or network devices within a preset time period, and if similar requests exist, repeat the blocking operation (eg, switch to executing step S132).

[0052] Figure 3 This is a flow chart of monitoring the blocking situation in one embodiment of the present application. Figure 3As shown, illustratively, after blocking the network and / or network device in step S250, a record may be generated in step S2501, and in step S2502, it may be determined whether the blocking fails through the record and the timer. If yes, the blocking is repeated N times (N is an integer greater than or equal to 1) and the report is notified; if no, the successful blocking is notified. In step S260, the alarm handling situation is notified. If the blocking still fails, the staff may be notified for manual handling. The staff may be notified by email, SMS, application message, etc.

[0053] In step S140, it is determined whether the alarm information can still be obtained. If it is determined not, the network and / or network device is unblocked and a notification message is generated. For example, if no repeated alarm information is received, it means that the blocking is successful.

[0054] The technical solution of the present application can be executed by an RPA robot, which can quickly identify potential security incidents by obtaining network security alarm information in real time; by utilizing the powerful analytical capabilities of the pre-trained large model, it can accurately judge the nature and severity of the alarm information and generate an effective alarm handling plan; by issuing a ban command in a timely manner and continuously monitoring whether there is any alarm information generated, once it is determined that the security threat has been resolved, it will automatically issue an unblocking command and generate a notification message to inform relevant personnel. In complex security operation scenarios, the closed-loop mechanism of dynamic monitoring and automatic unblocking based on a large model framework in the present application can not only quickly handle security incidents, but also avoid the negative impact that may be caused by long-term bans.

[0055] This application uses the characteristics of RPA robots and large model processing capabilities to achieve automated closed-loop processing of security alerts, which can improve the efficiency and timeliness of processing. Compared with manual processing methods, this application can reduce the production risks brought by manual changes on the one hand, and improve the processing failure on the other hand. By using a multi-terminal method to quickly block or unblock, it can effectively respond to security incidents.

[0056] The present application also includes a network security operation monitoring system, including an RPA robot (not shown), which is configured to: obtain network security alarm information; input the alarm information into a pre-trained large model to obtain an alarm handling plan output by the large model; block the network and / or network equipment according to the alarm handling plan; determine whether the alarm information can still be obtained, and if the judgment is no, unblock the network and / or network equipment and generate a notification message; the pre-trained large model (not shown) is configured to: generate an alarm handling plan according to the alarm information. It also includes a memory and a processor, wherein the memory is used to store instructions that can be executed by the processor; the processor is used to execute the instructions to implement the network security operation monitoring method described above.

[0057] Figure 4is a system block diagram of a network security operation monitoring system according to an embodiment of the present application. Figure 4 As shown, the network security operation monitoring system 400 may include an internal communication bus 401, a processor 402, a read-only memory (ROM) 403, a random access memory (RAM) 404, and a communication port 405. The network security operation monitoring system 400 may also include a hard disk 406. The internal communication bus 401 can realize data communication between the components of the network security operation monitoring system 400. The processor 402 can make judgments and issue prompts. In some embodiments, the processor 402 can be composed of one or more processors. The communication port 405 can realize data communication between the network security operation monitoring system 400 and the outside. In some embodiments, the network security operation monitoring system 400 can send and receive information and data from the network through the communication port 405. The network security operation monitoring system 400 may also include different forms of program storage units and data storage units, such as a hard disk 406, a read-only memory (ROM) 403 and a random access memory (RAM) 404, which can store various data files used for computer processing and / or communication, and possible program instructions executed by the processor 402. The processor executes these instructions to implement the main part of the method. The processing result of the processor is transmitted to the user device through the communication port and displayed on the user interface.

[0058] The above-mentioned network security operation monitoring method can be implemented as a computer program, stored in the hard disk 406, and loaded into the processor 402 for execution to implement the network security operation monitoring method of the present application.

[0059] The present application also includes a computer-readable medium storing a computer program code, which, when executed by a processor, implements the network security operation monitoring method described above.

[0060] When the network security operation monitoring method is implemented as a computer program, it can also be stored in a computer-readable storage medium as an article of manufacture. For example, a computer-readable storage medium may include, but is not limited to, a magnetic storage device (e.g., a hard disk, a floppy disk, a magnetic strip), an optical disk (e.g., a compact disk (CD), a digital versatile disk (DVD)), a smart card, and a flash memory device (e.g., an electrically erasable programmable read-only memory (EPROM), a card, a stick, a key drive). In addition, the various storage media described herein can represent one or more devices and / or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media (and / or storage media) that can store, contain and / or carry code and / or instructions and / or data.

[0061] It should be understood that the embodiments described above are only illustrative. The embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or any combination thereof. For hardware implementation, the processor may be implemented in one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, and / or other electronic units designed to perform the functions described herein, or a combination thereof.

[0062] Some aspects of the present application may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks", "modules", "engines", "units", "components" or "systems". The processor may be one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present application may be expressed as computer products located in one or more computer-readable media, which include computer-readable program codes. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes ...), optical disks (e.g., compact disks CDs, digital versatile disks DVDs ...), smart cards, and flash memory devices (e.g., cards, sticks, key drives ...).

[0063] A computer-readable medium may include a propagated data signal containing computer program code, such as in baseband or as part of a carrier wave. The propagated signal may have a variety of manifestations, including electromagnetic, optical, etc., or a suitable combination. A computer-readable medium may be any computer-readable medium other than a computer-readable storage medium, which may be connected to an instruction execution system, device or apparatus to communicate, propagate or transmit a program for use. The program code on the computer-readable medium may be propagated via any suitable medium, including radio, cable, fiber optic cable, radio frequency signal, or similar medium, or any combination of the above mediums.

[0064] The basic concepts have been described above. Obviously, for those skilled in the art, the above application disclosure is only an example and does not constitute a limitation of the present application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements and amendments to the present application. Such modifications, improvements and amendments are suggested in the present application, so such modifications, improvements and amendments still belong to the spirit and scope of the exemplary embodiments of the present application.

[0065] At the same time, the present application uses specific words to describe the embodiments of the present application. For example, "one embodiment", "an embodiment", and / or "some embodiments" refer to a certain feature, structure or characteristic related to at least one embodiment of the present application. Therefore, it should be emphasized and noted that "one embodiment" or "an embodiment" or "an alternative embodiment" mentioned twice or more in different positions in this specification does not necessarily refer to the same embodiment. In addition, some features, structures or characteristics in one or more embodiments of the present application can be appropriately combined.

[0066] In some embodiments, numbers describing the number of components and attributes are used. It should be understood that such numbers used in the description of the embodiments are modified by the modifiers "about", "approximately" or "substantially" in some examples. Unless otherwise specified, "about", "approximately" or "substantially" indicate that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximate values, which may change according to the required features of individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and adopt the general method of retaining digits. Although the numerical domains and parameters used to confirm the breadth of their range in some embodiments of the present application are approximate values, in specific embodiments, the setting of such numerical values ​​is as accurate as possible within the feasible range.

Claims

1. A network security operation monitoring method, characterized in that: include: Obtain network security warning information; Input the alarm information into a pre-trained large model to obtain an alarm handling solution output by the large model; Block the network and / or network equipment according to the alarm handling plan; as well as It is determined whether the alarm information can still be obtained. If it is determined not, the network and / or the network device are unblocked and a notification message is generated.

2. The network security operation monitoring method according to claim 1, characterized in that: The step of obtaining the network security alarm information includes: obtaining the network security alarm information from one or any combination of the distributed stream processing platform Kafka, the system log Syslog, and the remote API interface.

3. The network security operation monitoring method according to claim 1, characterized in that: After the step of inputting the alarm information into the pre-trained large model, the method further includes: The large model extracts the alarm key fields from the alarm information; The large model generates the alarm handling solution according to the alarm key fields and the custom configuration information.

4. The network security operation monitoring method according to claim 3, characterized in that: The custom configuration information is related to the intranet environment architecture, intranet segment, and network scanning operations.

5. The network security operation monitoring method according to claim 1, characterized in that: After the step of obtaining the network security alarm information, it also includes: Parse the alarm information according to a preset parsing method to obtain alarm key fields; extracting the alarm code from the alarm key field using a regular expression; and The step of inputting the alarm information into the pre-trained large model further includes: inputting the alarm information and the alarm code into the pre-trained large model.

6. The network security operation monitoring method according to claim 1, characterized in that: After the step of obtaining the alarm handling solution output by the large model, the method further includes: Performing noise reduction processing on the alarm handling solution according to the retrieval enhancement generation method to obtain a noise reduction alarm handling solution; The noise reduction alarm handling solution is used as the alarm handling solution.

7. The network security operation monitoring method according to claim 1, characterized in that: In the process of training the large model, the input of the large model is the content of the network security log file, and the output of the large model is structured alarm key fields and alarm handling solutions.

8. The network security operation monitoring method according to claim 1, characterized in that: The steps of blocking a network and / or a network device according to the alarm handling solution include: Simulate login to the network system backend; Intercepting data packets of the network and / or disconnecting the network connection of the network device, thereby performing the blocking operation; Recording the result of the blocking operation; The same type of requests from the network and / or the network device are monitored within a preset time period, and if the same type of requests exist, the blocking operation is repeatedly performed.

9. A network security operation monitoring system, characterized in that: include: The RPA robot is configured to: obtain network security warning information; Input the alarm information into a pre-trained large model to obtain an alarm handling solution output by the large model; block the network and / or network device according to the alarm handling solution; determine whether the alarm information can still be obtained, and if not, unblock the network and / or network device and generate a notification message; The pre-trained large model is configured to: generate an alarm handling plan according to the alarm information; a memory for storing instructions executable by a processor; A processor, configured to execute the instructions to implement the network security operation monitoring method as described in any one of claims 1-8.

10. A computer readable medium storing computer program code, characterized in that: When the computer program code is executed by a processor, the computer program code implements the network security operation monitoring method according to any one of claims 1 to 8.

Images