Automatic network security event processing method and device based on orchestration technology
Through the automated processing method of network security incidents based on orchestration technology, the processing scripts are obtained and executed, and the problems of low efficiency and slow response in the existing technology are solved, and more efficient and real-time network security incident processing is achieved.
Patent Information
- Application Number
- CN202411526316.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-30
- Publication Date
- 2025-02-25
AI Technical Summary
In the prior art, the handling of network security events mainly relies on manual manual, and there are problems such as many repetitive operations and time-consuming, and the real-time response of network security events cannot be achieved, resulting in low network security.
The automated processing method of network security incidents based on orchestration technology is adopted. By obtaining the processing script of the target network security incident, candidate applications are bound, and the application is started through the execution engine, and network security components are called to execute the processing script to achieve automated processing.
It improves the processing efficiency and real-time response capabilities of network security incidents, enhances network security, and reduces the need for manual intervention.
Smart Images
Figure CN119520036A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the fields of energy and network security technology, and in particular to an automated processing method, device, electronic device and storage medium for network security incidents based on orchestration technology. Background Art
[0002] At present, with the development of cloud computing and Internet of Things technology, the generation and spread of network security incidents are getting faster and faster. Timely handling of network security incidents is crucial to network security. However, in related technologies, most of them are handled manually, which has many repetitive operations and is time-consuming. It is impossible to achieve real-time response to network security incidents, resulting in low network security. Summary of the invention
[0003] The present application aims to solve one of the technical problems in the related art at least to some extent.
[0004] To this end, the first objective of this application is to propose an automated processing method for network security incidents based on orchestration technology.
[0005] The second objective of this application is to propose an automated processing device for network security incidents based on orchestration technology.
[0006] The third objective of the present application is to provide an electronic device.
[0007] A fourth objective of the present application is to provide a computer-readable storage medium.
[0008] A fifth object of the present application is to provide a computer program product.
[0009] To achieve the above-mentioned objectives, the first aspect of the present application proposes an automated processing method for network security incidents based on orchestration technology, including: obtaining a target processing script for a target network security incident; using candidate applications bound to processing actions contained in the target processing script as N target applications to be started, where N is a positive integer; starting the N target applications through an execution engine, and calling the network security component corresponding to the i-th target application through the i-th target application, where i is a positive integer not greater than N; executing the target processing script through the called network security component to process the target network security incident.
[0010] To achieve the above-mentioned purpose, the second aspect embodiment of the present application proposes an automatic processing device for network security incidents based on orchestration technology, including: an acquisition module, used to obtain a target processing script for a target network security incident; a determination module, used to bind candidate applications to processing actions contained in the target processing script as N target applications to be started, wherein N is a positive integer; a calling module, used to start N target applications through an execution engine, and through the i-th target application, call the network security component corresponding to the i-th target application, wherein i is a positive integer not greater than N; an execution module, used to execute the target processing script through the called network security component to process the target network security incident.
[0011] To achieve the above-mentioned purpose, the third aspect embodiment of the present application proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method described in the first aspect embodiment above.
[0012] To achieve the above-mentioned purpose, the fourth aspect embodiment of the present application proposes a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the method described in the first aspect embodiment above.
[0013] To achieve the above-mentioned purpose, the fifth aspect of the present application proposes a computer program product, including a computer program, which, when executed by a processor, implements the method described in the first aspect of the present application.
[0014] The method, device, electronic device and storage medium for automatically processing network security incidents based on orchestration technology provided by the present application can take into account the processing actions included in the processing script of the network security incident and the binding relationship between the processing actions and the candidate applications, determine the N target applications to be started, and start the N target applications through the execution engine to call the network security component, and then execute the processing script. Compared with the related art that mostly handles network security incidents manually, the present solution can realize automatic processing of network security incidents based on orchestration technology, improve the processing efficiency and real-time response capability of network security incidents, and help improve network security.
[0015] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:
[0017] Figure 1 A flowchart of a method for automatically processing network security incidents based on orchestration technology provided in an embodiment of the present application;
[0018] Figure 2 A flowchart of another method for automatically processing network security incidents based on orchestration technology provided in an embodiment of the present application;
[0019] Figure 3 A flowchart of another method for automatically processing network security incidents based on orchestration technology provided in an embodiment of the present application;
[0020] Figure 4 A flowchart of another method for automatically processing network security incidents based on orchestration technology provided in an embodiment of the present application;
[0021] Figure 5 A flowchart of another method for automatically processing network security incidents based on orchestration technology provided in an embodiment of the present application;
[0022] Figure 6 A schematic diagram of a network security incident automation processing system based on orchestration technology provided in an embodiment of the present application;
[0023] Figure 7 A schematic diagram of a method for automatically processing network security incidents based on orchestration technology provided in an embodiment of the present application;
[0024] Figure 8 A schematic diagram of the structure of a network security incident automatic processing device based on orchestration technology provided in an embodiment of the present application. DETAILED DESCRIPTION
[0025] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.
[0026] The following describes the method, device, electronic device and storage medium for automatically processing network security incidents based on orchestration technology in embodiments of the present application with reference to the accompanying drawings.
[0027] Figure 1 A flowchart of a method for automatically handling network security incidents based on orchestration technology provided in an embodiment of the present application.
[0028] At present, with the development of cloud computing and Internet of Things technology, the generation and spread of network security incidents are getting faster and faster. Timely handling of network security incidents is crucial to network security. However, in related technologies, most of them are handled manually, which has many repetitive operations and is time-consuming. It is impossible to achieve real-time response to network security incidents, resulting in low network security.
[0029] To address this problem, the embodiment of the present application provides an automated processing method for network security incidents based on orchestration technology, which can take into account the processing actions contained in the processing script of the network security incident, as well as the binding relationship between the processing actions and the candidate applications, determine the N target applications to be started, and start the N target applications through the execution engine to call the network security component, and then execute the processing script. Compared with the related art that mostly processes network security incidents manually, this solution can realize automated processing of network security incidents based on orchestration technology, improve the processing efficiency and real-time response capability of network security incidents, and help improve network security. Figure 1 As shown, the method comprises the following steps:
[0030] S101, obtaining a target processing script for a target network security event.
[0031] It should be noted that there are no excessive restrictions on network security incidents, for example, they may include software infection, network attack, unauthorized access, data leakage, etc. The processing script refers to the business process used to handle network security incidents. The processing script can be set in advance by the operation and maintenance personnel, or it can be updated dynamically. The processing script can contain multiple processing actions, which may include executing security disposal operations through the called network security components, collecting event information and processing information, event analysis, alarming, etc. Different processing scripts may contain different processing actions.
[0032] It should be noted that there are not too many restrictions on network security components, such as firewalls, vulnerability scanners, IDS (Intrusion Detection System), IPS (Intrusion Prevention System), antivirus, data leakage protection components, identity and access management components, etc.
[0033] It is understandable that different network security components may perform different security processing operations. For example, a firewall may perform packet filtering operations, a vulnerability scanner may perform vulnerability scanning operations, an IDS may perform intrusion detection operations, and an IPS may perform intrusion blocking operations.
[0034] In one embodiment, obtaining a target processing script for a target network security event includes obtaining target event information of the target network security event and candidate event information of each of a plurality of candidate processing scripts in a script library, obtaining the similarity between the target event information and the candidate event information, and determining the target processing script from the script library based on the similarity. Thus, the similarity between the target event information and the candidate event information can be taken into account to determine the target processing script from the script library, which helps to obtain a target processing script that better matches the target event information, thereby improving the success rate of network security event processing.
[0035] It should be noted that the script library includes multiple candidate processing scripts, and the multiple candidate processing scripts include the target processing script.
[0036] In some examples, based on similarity, a target processing script is determined from a script library, including selecting a candidate processing script corresponding to the greatest similarity as the target processing script.
[0037] In some examples, a target processing script is determined from a script library based on similarity, including obtaining a target score for the candidate processing scripts based on similarity, and selecting the candidate processing script corresponding to the largest target score as the target processing script.
[0038] Exemplarily, based on the similarity, a target score of the candidate treatment script is obtained, including obtaining the target score of the candidate treatment script based on the similarity and the initial score of the candidate treatment script. For example, the candidate treatment scripts may be scored in advance to obtain the initial scores of the plurality of candidate treatment scripts. For example, the similarity and the initial score may be weighted and summed to obtain the target score.
[0039] It should be noted that there are not too many restrictions on event information, for example, it may include event identification, event type, event duration, cause of event, event risk level, etc.
[0040] S102, taking the candidate applications bound to the processing actions contained in the target processing script as N target applications to be started, where N is a positive integer.
[0041] It is understandable that different candidate applications for processing action binding may be different.
[0042] For example, taking the execution subject of the network security incident automation processing method based on the orchestration technology as a server, the script scheduling engine and the execution engine can be pre-deployed in the server, and steps S101-S102 can be executed by the script scheduling engine. For example, the script scheduling engine can send an event processing request to the execution engine, wherein the event processing request is used to instruct the startup of N target applications.
[0043] For example, the target processing script A of the target network security event 1 may be obtained, and the candidate application bound to the processing action contained in the target processing script A may be used as the target application to be started.
[0044] For example, the target processing script B of the target network security event 2 can be obtained, and the candidate application bound to the processing action contained in the target processing script B can be used as the target application to be started.
[0045] S103, start N target applications through the execution engine, and call the network security component corresponding to the i-th target application through the i-th target application, where i is a positive integer not greater than N.
[0046] It should be noted that there is a corresponding relationship between applications and network security components. Different applications may correspond to different network security components. One application may correspond to one or more network security components, and no excessive restrictions are made here.
[0047] For example, taking the server as the executor of the method for automated processing of network security incidents based on orchestration technology, applications and network security components can be pre-deployed in the server, for example, the application can be pre-deployed in the execution engine.
[0048] In one embodiment, starting N target applications through the execution engine includes scheduling the running environment of the ith target application through the execution engine, and starting the ith target application in the running environment of the ith target application through the execution engine.
[0049] In one embodiment, calling the network security component corresponding to the i-th target application through the i-th target application includes executing a setting code through the i-th target application, and calling the network security component corresponding to the i-th target application through the setting code. The setting code is used to call the network security component corresponding to the i-th target application.
[0050] In one embodiment, calling the network security component corresponding to the i-th target application through the i-th target application includes sending a calling instruction to the network security component corresponding to the i-th target application through the i-th target application. The calling instruction carries the security handling operation, event information of the target network security event, etc.
[0051] S104, executing the target processing script through the called network security component to process the target network security event.
[0052] In one embodiment, executing the target processing script by the called network security component includes executing the security processing operation by the called network security component. It should be noted that the relevant content of the security processing operation can be referred to the above embodiment, which will not be repeated here.
[0053] In one embodiment, executing the target processing script also includes collecting event information and processing information of the target network security event, analyzing the target network security event based on the event information and processing information of the target network security event, and obtaining the analysis result of the target network security event. Therefore, the processing action of collecting information and event analysis can be set in advance in the processing script, so that when executing the processing script, the event information and processing information of the network security event can be collected to perform event analysis on the network security event, and the automatic collection of event information and processing information of the network security event and the automatic analysis of the network security event can be realized, thereby improving the efficiency of information collection and event analysis. In addition, information collection and event analysis can be performed according to a unified and standardized processing script, which can ensure that data is collected and analyzed in the same way each time it is executed, thereby greatly improving the accuracy and consistency of event analysis.
[0054] It should be noted that there are not too many restrictions on the processing information. For example, it may include the execution results of the called network security components, the processing status and processing results of the network security events, etc. Among them, the execution results may include successful execution, failed execution, etc., the processing status may include unprocessed, processing, processing completed, etc., and the processing results may include successful processing, failed processing, etc.
[0055] In summary, according to the automatic processing method of network security incidents based on orchestration technology in the embodiment of the present application, the target processing script of the target network security incident is obtained, and the candidate application bound to the processing action contained in the target processing script is used as the N target applications to be started, where N is a positive integer, and the N target applications are started by the execution engine, and the network security component corresponding to the i-th target application is called through the i-th target application, where i is a positive integer not greater than N, and the target processing script is executed by the called network security component to process the target network security incident. Therefore, considering the processing actions contained in the processing script of the network security incident, and the binding relationship between the processing actions and the candidate applications, the N target applications to be started can be determined, and the N target applications can be started by the execution engine to call the network security component, and then the processing script is executed. Compared with the related art, which mostly processes network security incidents manually, the present solution can realize automatic processing of network security incidents based on orchestration technology, improve the processing efficiency and real-time response capability of network security incidents, and help improve network security.
[0056] An embodiment of the present application provides another method for automatically processing network security incidents based on orchestration technology.
[0057] like Figure 2 As shown, the method may include the following steps:
[0058] S201, obtaining a target processing script for a target network security event.
[0059] S202, taking the candidate applications bound to the processing actions contained in the target processing script as N target applications to be started, where N is a positive integer.
[0060] For the relevant contents of steps S201 - S202 , please refer to the above embodiment and will not be described again here.
[0061] S203, based on the candidate codes bound to the processing actions contained in the target processing script, as M target codes to be executed, where M is a positive integer.
[0062] It is understandable that different processing actions may be bound to different candidate codes. The candidate code is used to call a network security component, and different candidate codes may call different network security components. The multiple candidate codes include a target code.
[0063] For example, the target processing script A of the target network security event 1 can be obtained, and the candidate code bound to the processing action contained in the target processing script A is used as the target code to be executed.
[0064] For example, the target processing script B of the target network security event 2 can be obtained, and the candidate code bound to the processing action contained in the target processing script B can be used as the target code to be executed.
[0065] In one embodiment, the method further includes obtaining configuration information of the jth target code, sending the configuration information of the jth target code to the ith target application through the execution engine, and configuring the jth target code based on the configuration information of the jth target code through the ith target application. Thus, the configuration information of the target code can be sent to the target application to which the target code belongs through the execution engine, and the target application can configure the parameters of the target code based on the configuration information.
[0066] Exemplarily, the script scheduling engine may send an event processing request to the execution engine, wherein the event processing request is used to instruct the startup of N target applications and the execution of M target codes, and the event processing request carries the configuration information of each of the M target codes.
[0067] Exemplarily, sending the configuration information of the j-th target code to the ith target application includes sending the configuration information of the j-th target code to the ith target application through an API (Application Programming Interface) of the ith target application.
[0068] It is understandable that the configuration information of different target codes may be different.
[0069] In some examples, obtaining the configuration information of the j-th target code includes obtaining at least one of the identity information, address information, and information of the security handling operation to be performed of the network security component corresponding to the j-th target code as the configuration information of the j-th target code. It should be noted that the identity information is not too limited, for example, it may include the identifier, version number, authentication information (such as a key) of the network security component, and the information of the security handling operation is not too limited, for example, it may include the operation type (such as detection, scanning), operation range, operation parameters (such as timeout period, number of retries), and operation object (such as IP address, port).
[0070] S204, starting N target applications through the execution engine, and in response to the jth target code belonging to the ith target application, executing the jth target code through the ith target application, where j is a positive integer not greater than M.
[0071] S205: Call the network security component corresponding to the j-th target code through the j-th target code.
[0072] It is understandable that there is a subordinate relationship between the candidate code and the candidate application, and different candidate codes may belong to different candidate applications, for example, one candidate code only belongs to one candidate application. There is a corresponding relationship between the candidate code and the network security component, and different candidate codes may correspond to different network security components, for example, one candidate code only corresponds to one network security component.
[0073] It should be noted that the network security component corresponding to the target application refers to the network security component corresponding to each target code belonging to the target application.
[0074] For example, in response to the target code 1 belonging to the target application 1, the target code 1 is executed through the target application 1 to call the firewall corresponding to the target code 1.
[0075] For example, in response to the target code 2 belonging to the target application 1, the target code 2 is executed by the target application 1 to call the vulnerability scanner corresponding to the target code 2.
[0076] For example, in response to the target code 3 belonging to the target application 2, the target code 3 is executed by the target application 2 to call the IDS corresponding to the target code 3.
[0077] For example, in response to the target code 4 belonging to the target application 3, the target code 4 is executed by the target application 3 to call the IPS corresponding to the target code 4.
[0078] S206, executing the target processing script through the called network security component to process the target network security event.
[0079] For the relevant contents of step S206, please refer to the above embodiment, which will not be repeated here.
[0080] In summary, according to the automated network security incident processing method based on orchestration technology of the embodiment of the present application, the candidate code bound to the processing action contained in the target processing script is used as the M target codes to be executed, where M is a positive integer, and in response to the jth target code belonging to the ith target application, the jth target code is executed through the ith target application, where j is a positive integer not greater than M, and the network security component corresponding to the jth target code is called through the jth target code. Therefore, the processing actions contained in the processing script of the network security incident and the binding relationship between the processing actions and the candidate codes can be taken into account to determine the M target codes to be executed, and the affiliation between the target code and the target application can be taken into account, and the target code is executed through the target application to which a certain target code belongs to call the network security component, and then execute the processing script.
[0081] An embodiment of the present application provides another method for automatically processing network security incidents based on orchestration technology.
[0082] like Figure 3 As shown, the method may include the following steps:
[0083] S301, identifying whether a target processing script for a target network security event is obtained.
[0084] If yes, execute step S302; if no, execute step S306.
[0085] S302, taking the candidate applications bound to the processing actions contained in the target processing script as N target applications to be started, where N is a positive integer.
[0086] S303, start N target applications through the execution engine, and call the network security component corresponding to the i-th target application through the i-th target application, where i is a positive integer not greater than N.
[0087] S304, executing the target processing script through the called network security component to process the target network security event.
[0088] For the relevant contents of steps S302 - S304 , please refer to the above embodiment and will not be described again here.
[0089] S305: Identify whether the target network security event is successfully processed.
[0090] If yes, then end this processing flow; if no, execute step S306.
[0091] S306: Send the processing work order of the target network security event to the client of the operation and maintenance personnel.
[0092] In an embodiment of the present disclosure, when the target processing script for the target network security event is not obtained, and / or the target network security event is not processed successfully (i.e., the processing fails), the processing work order for the target network security event can be sent to the client of the operation and maintenance personnel, that is, the operation and maintenance personnel are relied upon to process the target network security event.
[0093] In one embodiment, the method further includes obtaining target event information of the target network security event and candidate event information of each of the plurality of candidate processing scripts in the script library, obtaining the similarity between the target event information and the candidate event information, and determining that the target processing script does not exist in the script library in response to the similarity corresponding to each candidate processing script being less than a set threshold. Thus, when the candidate event information of each candidate processing script is significantly different from the target event information, it can be determined that the target processing script does not exist in the script library, that is, the target processing script has not been obtained at this time.
[0094] In summary, according to the automated method for processing network security incidents based on orchestration technology according to the embodiment of the present application, when the target processing script is not obtained and / or when the network security incident processing fails, the processing work order of the network security incident can be sent to the client of the operation and maintenance personnel, that is, the network security incident is processed manually.
[0095] On the basis of any of the above embodiments, executing the target processing script also includes, in response to the target processing script containing a processing action manually executed, generating a processing work order for the target network security event based on the processing action manually executed contained in the target processing script, and sending the processing work order for the target network security event to the client of the operation and maintenance personnel. Thus, the processing action for work order dispatching can be set in advance in the processing script, so that when the processing script is executed and the processing script contains a processing action manually executed, the processing action manually executed contained in the processing script can be taken into account, and a processing work order can be generated and sent to the client of the operation and maintenance personnel, that is, the network security event is processed manually.
[0096] On the basis of any of the above embodiments, executing the target processing script also includes collecting event information of the target network security event, generating alarm information and a processing work order for the target network security event based on the event information of the target network security event, and sending the alarm information and the processing work order for the target network security event to the client of the operation and maintenance personnel. Thus, the processing actions of collecting information, alarming, and dispatching work orders can be set in advance in the processing script, so that when executing the processing script, the event information of the network security event can be collected to generate alarm information and processing work orders, and sent to the client of the operation and maintenance personnel, so that real-time alarms of network security events can be realized, and network security events can be processed manually.
[0097] An embodiment of the present application provides another method for automatically processing network security incidents based on orchestration technology.
[0098] like Figure 4 As shown, the method may include the following steps:
[0099] S401, during the arrangement of candidate processing scripts, controlling the display of multiple candidate selection items on an interactive page, wherein the candidate selection items are used to represent processing actions.
[0100] S402, in response to detecting a selection operation, adding a processing action corresponding to the candidate selection item selected by the selection operation to the processing actions included in the candidate processing script.
[0101] It is understandable that different candidate selection items may represent different processing actions, for example, candidate selection items correspond to processing actions one by one. There are no excessive restrictions on the selection operation, for example, it may include click operation, drag operation, etc. There are no excessive restrictions on the display mode of candidate selection items, for example, it may include pop-up window display, notification bar display, floating window display, etc.
[0102] It is understandable that the user can perform click operations, drag operations, etc. on the candidate selection items on the interactive page.
[0103] For example, during the arrangement of candidate processing script C, candidate options 1 to 5 can be controlled to be displayed on the interactive interface, where candidate option k is used to represent processing action k, and k is a positive integer not greater than 5.
[0104] In response to detecting a selection operation, processing action 1 corresponding to candidate selection item 1 selected by the selection operation and processing action 5 corresponding to candidate selection item 5 selected by the selection operation are added to the processing actions included in candidate processing script C.
[0105] S403, in response to detecting the first input operation, obtaining event information input by the first input operation as candidate event information of the candidate processing script.
[0106] It is understandable that the user can enter event information on the interactive page.
[0107] For example, during the arrangement of candidate processing script C, an input box can be controlled to be displayed on the interactive interface, and in response to detecting a first input operation, event information entered by the first input operation is obtained as candidate event information of candidate processing script C.
[0108] In summary, according to the automated network security incident processing method based on the choreography technology of the embodiment of the present application, in the process of choreography of the candidate processing script, a plurality of candidate selection items are controlled to be displayed on the interactive page, wherein the candidate selection items are used to represent the processing action, and in response to detecting the selection operation, the processing action corresponding to the candidate selection item selected by the selection operation is added to the processing action contained in the candidate processing script, and in response to detecting the first entry operation, the event information entered by the first entry operation is obtained as the candidate event information of the candidate processing script. Thus, the processing action selected by the user can be added to the processing action contained in the processing script, and the event information entered by the user can be used as the event information of the processing script to realize the script arrangement, and the visualization and personalized arrangement of the processing script of the network security incident can be realized.
[0109] An embodiment of the present application provides another method for automatically processing network security incidents based on orchestration technology.
[0110] like Figure 5 As shown, the method may include the following steps:
[0111] S501, in the process of arranging candidate processing scripts, in response to detecting a second input operation, obtaining the processing action, candidate code and application identifier entered by the second input operation.
[0112] S502, adding the entered processing action to the processing actions included in the candidate processing script.
[0113] S503: Bind the entered processing action with the entered candidate code and the candidate application identified by the entered application identifier respectively.
[0114] S504: Establish a subordinate relationship between the entered candidate code and the candidate application identified by the entered application identifier.
[0115] It is understandable that the user can enter the processing action, candidate code and application identifier on the interactive page. Establishing the subordinate relationship between the entered candidate code and the candidate application identified by the entered application identifier means that the entered candidate code is subordinate to the candidate application identified by the entered application identifier.
[0116] In one embodiment, the method further includes storing the entered candidate code in a local storage space.
[0117] For example, in the process of editing the candidate processing script C, the input box can be controlled to be displayed on the interactive interface, and in response to detecting the second input operation, the processing action X, the candidate code Y and the application identifier entered by the second input operation are obtained. Among them, the candidate application identified by the entered application identifier is the candidate application Z.
[0118] The entered processing action X is added to the processing actions included in the candidate processing script C.
[0119] The entered processing action X is bound to the entered candidate code Y and candidate application Z respectively.
[0120] A subordinate relationship between the input candidate code Y and the candidate application Z is established, that is, the input candidate code Y is subordinate to the candidate application Z.
[0121] The entered candidate code Y is stored in the local storage space.
[0122] In one embodiment, the method further includes, in response to detecting a third input operation, obtaining configuration information of the candidate application input by the third input operation, and configuring the candidate application based on the input configuration information of the candidate application. The input configuration information of the candidate application includes a candidate code belonging to the candidate application. Thus, the application can be configured taking into account the configuration information of the application input by the user, and personalized configuration of the application can be achieved.
[0123] For example, the configuration information of the candidate application also includes configuration description information, rendering information, help information, etc. of the candidate application.
[0124] In summary, according to the automatic processing method of network security incidents based on the orchestration technology of the embodiment of the present application, in the process of arranging the candidate processing script, in response to detecting the second input operation, the processing action, candidate code and application identifier entered by the second input operation are obtained, the input processing action is added to the processing action contained in the candidate processing script, and the input processing action is respectively bound to the input candidate code and the candidate application identified by the input application identifier, and the affiliation between the input candidate code and the candidate application identified by the input application identifier is established. Thus, the processing action entered by the user can be added to the processing action contained in the processing script to realize the script arrangement, and the visualization and personalized arrangement of the processing script of the network security incident can be realized, and the input processing action is respectively bound to the input candidate code and the candidate application identified by the input application identifier, so as to subsequently obtain the candidate code and candidate application respectively bound to the input processing action, and establish the affiliation between the input candidate code and the candidate application identified by the input application identifier, so as to subsequently obtain the candidate application to which the input candidate code belongs.
[0125] On the basis of any of the above embodiments, the method further includes updating the arrangement knowledge base and the arrangement rule base based on the event information and processing information of the historical network security events, and obtaining the candidate processing script based on the candidate event information, the arrangement knowledge base and the arrangement rule base of the candidate processing script. Thus, the event information and processing information of the historical network security events can be taken into account, and the arrangement knowledge base and the arrangement rule base can be updated in real time, thereby improving the accuracy and real-time performance of the arrangement knowledge base and the arrangement rule base, and the candidate processing script can be obtained by comprehensively considering the candidate event information, the arrangement knowledge base and the arrangement rule base of the candidate processing script, and the automatic script arrangement can be realized based on artificial intelligence technology, thereby improving the script arrangement efficiency.
[0126] In some examples, a candidate processing script is obtained based on candidate event information, an orchestration knowledge base, and an orchestration rule base of the candidate processing script, including determining orchestration knowledge that matches the candidate event information from the orchestration knowledge base, determining an orchestration rule that matches the candidate event information from the orchestration rule base, and obtaining the candidate processing script based on the matched orchestration knowledge and the matched orchestration rules.
[0127] In some examples, based on the candidate event information of the candidate processing script, the orchestration knowledge base and the orchestration rule base, the candidate processing script is obtained, including training the orchestration model based on the orchestration knowledge base and the orchestration rule base, inputting the candidate event information of the candidate processing script into the orchestration model, and outputting the candidate processing script by the orchestration model. Therefore, the orchestration knowledge base and the orchestration rule base can be taken into consideration to train the orchestration model, and the candidate event information can be processed by the orchestration model to obtain the candidate processing script. The orchestration model has the advantages of high automation and high efficiency, which improves the efficiency of script arrangement.
[0128] For example, Figure 6 As shown, the network security incident automation processing system based on orchestration technology includes a management module, a control module and a service module. The system interface of the processing system includes function icons such as script editing, incident management, work order management, manual disposal, and alarm management.
[0129] The management module is used to arrange the scripts through human-computer interaction to obtain candidate processing scripts. The management module is also used to manage the script library and the response library. The response library is composed of the processing actions contained in each of the multiple candidate processing scripts in the script library. The management module is also used to send execution tasks to the control module based on alarm information.
[0130] The control module is used to call the security service API interface through the execution engine according to the execution task to realize the scheduling of various security services, so as to issue risk control instructions and event information to various network security components (such as IDS / IPS, firewalls, vulnerability scanners, anti-virus, password equipment, etc.). Among them, security service refers to the application in this solution, and vulnerability scanner can be referred to as vulnerability scanner. The control module is also used to create work orders.
[0131] The service module is composed of various network security components. Based on risk management instructions and event information, various network security components perform various security disposal operations to handle network security events. The execution responses of various network security components can be fed back to the control module, and then fed back to the management module through the control module. It can be understood that the security operation and maintenance of alarm information is achieved through various network security components.
[0132] For example, Figure 7 As shown, candidate processing script D includes processing actions 1 to 4, the candidate code bound to processing action 1 is candidate code 1-1, the candidate code bound to processing action 2 is candidate code 2-1, the candidate code bound to processing action 3 is candidate code 2-2, the candidate code bound to processing action 4 is candidate code 3-2, candidate codes 1-1 to 1-Q belong to candidate application 1, candidate codes 2-1 to 2-Q belong to candidate application 2, and candidate codes 3-1 to 3-Q belong to candidate application 3. Wherein, Q is a positive integer.
[0133] The network security component corresponding to candidate code 1-1 is a firewall, the network security component corresponding to candidate code 2-1 is a vulnerability scanner, the network security component corresponding to candidate code 2-2 is an IDS, and the network security component corresponding to candidate code 3-2 is an IPS. Candidate code 1-1 is used to call a firewall, candidate code 2-1 is used to call a vulnerability scanner, candidate code 2-2 is used to call an IDS, and candidate code 3-2 is used to call an IPS.
[0134] It should be noted that Figure 7 The processing actions 1 to 4 are shown to be in a serial relationship. It is understandable that the processing actions included in the processing script can be in a serial relationship or in a parallel relationship, and no further limitation is made here.
[0135] In order to implement the above embodiments, the present application also proposes an automatic processing device for network security incidents based on orchestration technology.
[0136] Figure 8 A schematic diagram of the structure of an automatic network security incident processing device based on orchestration technology provided in an embodiment of the present application.
[0137] like Figure 8 As shown, the network security incident automatic processing device 100 based on orchestration technology includes: an acquisition module 110, a determination module 120, a calling module 130 and an execution module 140.
[0138] An acquisition module 110 is used to acquire a target processing script for a target network security event;
[0139] A determination module 120, configured to use candidate applications bound to processing actions included in the target processing script as N target applications to be started, where N is a positive integer;
[0140] The calling module 130 is used to start N target applications through the execution engine, and call the network security component corresponding to the i-th target application through the i-th target application, where i is a positive integer not greater than N;
[0141] The execution module 140 is used to execute the target processing script through the called network security component to process the target network security event.
[0142] Further, in a possible implementation of the embodiment of the present application, the determination module 120 is further used to: select candidate codes bound to processing actions contained in the target processing script as M target codes to be executed, where M is a positive integer;
[0143] The calling module 130 is further used to: in response to the jth target code belonging to the ith target application, execute the jth target code through the ith target application, wherein j is a positive integer not greater than M; and call the network security component corresponding to the jth target code through the jth target code.
[0144] Furthermore, in a possible implementation of an embodiment of the present application, the calling module 130 is also used to: obtain configuration information of the j-th target code; send the configuration information of the j-th target code to the ith target application through the execution engine; and configure the j-th target code based on the configuration information of the j-th target code through the ith target application.
[0145] Furthermore, in a possible implementation of an embodiment of the present application, the calling module 130 is also used to obtain at least one of the identity information, address information, and information on security disposal operations to be performed of the network security component corresponding to the j-th target code as configuration information of the j-th target code.
[0146] Furthermore, in a possible implementation of an embodiment of the present application, the acquisition module 110 is also used to: obtain target event information of the target network security event, and candidate event information of each of multiple candidate processing scripts in a script library; obtain the similarity between the target event information and the candidate event information; and determine the target processing script from the script library based on the similarity.
[0147] Furthermore, in a possible implementation of the embodiment of the present application, the execution module 140 is also used to: collect event information and processing information of the target network security event; based on the event information and processing information of the target network security event, analyze the target network security event to obtain the analysis result of the target network security event.
[0148] Further, in a possible implementation of the embodiment of the present application, after the target processing script is executed by the called network security component, the execution module 140 is further used to: in response to the failure of processing the target network security event, send a processing work order of the target network security event to a client of the operation and maintenance personnel;
[0149] The execution module 140 is further configured to: in response to failure to obtain the target processing script, send a processing work order for the target network security event to a client of the operation and maintenance personnel.
[0150] Furthermore, in a possible implementation of an embodiment of the present application, the device 100 also includes an orchestration module, which is used to: during the orchestration of candidate processing scripts, control the display of multiple candidate selection items on an interactive page, wherein the candidate selection items are used to represent processing actions; in response to detecting a selection operation, add the processing action corresponding to the candidate selection item selected by the selection operation to the processing actions contained in the candidate processing script; in response to detecting a first entry operation, obtain the event information entered by the first entry operation as candidate event information of the candidate processing script.
[0151] Furthermore, in a possible implementation of an embodiment of the present application, the device 100 also includes an orchestration module, which is used to: in the orchestration process of the candidate processing script, in response to detecting a second entry operation, obtain the processing action, candidate code and application identifier entered by the second entry operation; add the entered processing action to the processing actions contained in the candidate processing script; bind the entered processing action to the candidate application identified by the entered candidate code and the entered application identifier respectively; and establish a subordinate relationship between the entered candidate code and the candidate application identified by the entered application identifier.
[0152] Furthermore, in a possible implementation of an embodiment of the present application, the device 100 also includes an orchestration module, which is used to: update an orchestration knowledge base and an orchestration rule base based on event information and processing information of historical network security events; and obtain the candidate processing script based on the candidate event information of the candidate processing script, the orchestration knowledge base and the orchestration rule base.
[0153] Furthermore, in a possible implementation of an embodiment of the present application, the device 100 also includes an orchestration module, which is used to: train an orchestration model based on the orchestration knowledge base and the orchestration rule base; input candidate event information of a candidate processing script into the orchestration model, and the orchestration model outputs the candidate processing script.
[0154] It should be noted that the aforementioned explanation of the embodiment of the method for automatically processing network security incidents based on orchestration technology is also applicable to the automatic network security incident processing device based on orchestration technology of this embodiment, and will not be repeated here.
[0155] In summary, the automatic processing device for network security events based on orchestration technology in the embodiment of the present application obtains the target processing script for the target network security event, and uses the candidate application bound to the processing action contained in the target processing script as the N target applications to be started, where N is a positive integer, and starts the N target applications through the execution engine, and calls the network security component corresponding to the i-th target application through the i-th target application, where i is a positive integer not greater than N, and executes the target processing script through the called network security component to process the target network security event. Therefore, considering the processing actions contained in the processing script of the network security event, and the binding relationship between the processing actions and the candidate applications, the N target applications to be started can be determined, and the N target applications can be started through the execution engine to call the network security component, and then the processing script is executed. Compared with the related art, which mostly processes network security events manually, the present solution can realize automatic processing of network security events based on orchestration technology, improve the processing efficiency and real-time response capability of network security events, and help improve network security.
[0156] In order to implement the above embodiments, the present application also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.
[0157] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.
[0158] In order to implement the above embodiments, the present application also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.
[0159] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.
[0160] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.
[0161] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.
[0162] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.
[0163] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood to control or imply relative importance or implicitly indicate the number of technical features controlled. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.
[0164] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.
[0165] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.
[0166] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.
[0167] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.
[0168] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.
[0169] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.
Claims
1. A method for automatically processing network security incidents based on orchestration technology, characterized in that: include: Obtain the target processing script for the target network security incident; The candidate applications bound to the processing actions contained in the target processing script are used as N target applications to be started, where N is a positive integer; Start N target applications through the execution engine, and call the network security component corresponding to the i-th target application through the i-th target application, where i is a positive integer not greater than N; The target processing script is executed by the called network security component to process the target network security event.
2. The method according to claim 1, characterized in that The method further comprises: Candidate codes bound to processing actions contained in the target processing script are used as M target codes to be executed, where M is a positive integer; The calling of the network security component corresponding to the i-th target application through the i-th target application includes: In response to the jth target code belonging to the ith target application, executing the jth target code through the ith target application, wherein j is a positive integer not greater than M; The network security component corresponding to the j-th target code is called through the j-th target code.
3. The method according to claim 2, characterized in that The method further comprises: Obtaining configuration information of the j-th target code; Sending the configuration information of the j-th target code to the i-th target application program through the execution engine; The jth target code is configured through the i-th target application based on the configuration information of the j-th target code.
4. The method according to claim 3, characterized in that The obtaining of the configuration information of the j-th target code comprises: Obtain at least one of identity information, address information, and information of security disposal operations to be performed of a network security component corresponding to the j-th target code as configuration information of the j-th target code.
5. The method according to claim 1, characterized in that: The target processing script for obtaining the target network security event includes: Obtain target event information of the target network security event and candidate event information of each of multiple candidate processing scripts in the script library; Obtaining the similarity between the target event information and the candidate event information; Based on the similarity, the target processing script is determined from the script library.
6. The method according to claim 1, characterized in that Executing the target processing script also includes: Collecting event information and processing information of the target network security event; Based on the event information and processing information of the target network security event, the target network security event is analyzed to obtain an analysis result of the target network security event.
7. The method according to claim 1, characterized in that After the target processing script is executed by the called network security component, the method further includes: In response to a failure in processing the target network security event, sending a processing work order for the target network security event to a client of an operation and maintenance personnel; The method further comprises: In response to not obtaining the target processing script, a processing work order for the target network security event is sent to a client of the operation and maintenance personnel.
8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: In the process of arranging the candidate processing scripts, controlling to display a plurality of candidate selection items on the interactive page, wherein the candidate selection items are used to represent the processing actions; In response to detecting a selection operation, adding a processing action corresponding to the candidate selection item selected by the selection operation to the processing actions included in the candidate processing script; In response to detecting a first input operation, event information input by the first input operation is obtained as candidate event information of the candidate processing script.
9. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: In the process of arranging the candidate processing scripts, in response to detecting a second input operation, obtaining the processing action, candidate code and application identifier entered by the second input operation; Adding the entered processing action to the processing actions included in the candidate processing script; Binding the entered processing action to the entered candidate code and the candidate application identified by the entered application identifier respectively; A subordinate relationship between the entered candidate code and the candidate application identified by the entered application identifier is established.
10. The method according to any one of claims 1 to 7, characterized in that The method further comprises: Update the orchestration knowledge base and orchestration rule base based on the event information and processing information of historical network security events; The candidate processing script is obtained based on the candidate event information of the candidate processing script, the orchestration knowledge base and the orchestration rule base.
11. The method according to claim 10, characterized in that The step of obtaining the candidate processing script based on the candidate event information of the candidate processing script, the orchestration knowledge base, and the orchestration rule base includes: Based on the orchestration knowledge base and the orchestration rule base, training an orchestration model; The candidate event information of the candidate processing script is input into the orchestration model, and the candidate processing script is output by the orchestration model.
12. A network security incident automatic processing device based on orchestration technology, characterized in that: include: An acquisition module is used to acquire a target processing script for a target network security event; A determination module, used to use the candidate applications bound to the processing actions contained in the target processing script as N target applications to be started, where N is a positive integer; A calling module, used to start N target applications through an execution engine, and call a network security component corresponding to the i-th target application through the i-th target application, where i is a positive integer not greater than N; An execution module is used to execute the target processing script through the called network security component to process the target network security event.
13. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 11.
14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 11 when executed by a processor.
15. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 11.