Network security automatic operation method, device, medium and program product

Abstract

The embodiment of the invention provides a network security automatic operation method and device, a medium and a program product, and relates to the technical field of security operation. The method comprises the following steps: monitoring a screen interface of the safety operation terminal in real time, and obtaining screen element data in real time; under the condition that the occurrence of the security event is monitored, planning and generating a security operation task set corresponding to the security event based on the screen element data; generating an operation behavior instruction set corresponding to each operation task; and performing interaction control on a screen interface of the security operation terminal based on each operation behavior instruction set to complete security operation work for the security event. According to the application, the data of the terminal screen interface is identified, the corresponding operation task and the behavior instruction set thereof are generated when the security event occurs, and the automatic security operation work is realized through screen interaction control, so that the operation efficiency is improved in the face of cross-ecosystem or permission sensitive scenes. The automation capability and the response efficiency of network security operation can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of security operation technology, and more specifically, to a method, device, medium and program product for automated network security operation. Background Art

[0002] Cybersecurity operations refer to the use of various cybersecurity technologies and methods based on cybersecurity risk management to ensure the continuous stability of network operations and information security. Traditional cybersecurity operations mainly rely on manual labor, which is not only inefficient and costly, but also with the continuous changes in business needs and the continuous escalation of network threats, the manual processing model can no longer meet the needs of cybersecurity operations. Therefore, various automated cybersecurity operations technologies have emerged.

[0003] At present, AI (Artificial Intelligence) security agents are able to solve specific network security tasks through natural language interaction, environmental perception, and the application of industry knowledge, including: predicting potential security threats by analyzing historical data and current situations, automatically detecting and patching system vulnerabilities, and detecting unknown malware through behavioral analysis and pattern recognition.

[0004] However, existing AI security agents mainly work based on interfaces or databases, which requires reliance on open programming interfaces of security operation platforms or systems. When faced with restrictions such as cross-ecosystems or permission sensitivity, there are problems with insufficient automation capabilities and low response efficiency. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a method, device, medium and program product for automated network security operations, which can improve the automation capability and response efficiency of network security operations when facing cross-ecosystem or permission-sensitive scenarios.

[0006] In a first aspect, an embodiment of the present application provides a method for automated network security operations, including: Perception step: monitor the screen interface of the security operation terminal in real time, and obtain screen element data of the screen interface in real time; Planning step: when a security incident is detected on the screen interface, a security operation task set corresponding to the security incident is planned and generated based on the screen element data; Execution step: generating an operation behavior instruction set corresponding to each operation task in the security operation task set; Interaction step: interactively controlling the screen interface of the security operation terminal based on each of the operation behavior instruction sets to complete the security operation task for the security incident.

[0007] In an embodiment of the present application, by identifying the data on the terminal screen interface and generating a behavioral instruction set for the corresponding operation task based on it, automated security operation operations can be achieved through screen control, thereby effectively improving the automation capability and response efficiency of network security operations when facing cross-ecosystem or permission-sensitive scenarios.

[0008] In some possible embodiments, the method is performed by a pre-built security operation agent; the security operation agent includes a perception agent, a planning agent, an execution agent, and an interaction agent; Among them, the perception step is performed by the perception agent, the planning step is performed by the planning agent, the execution step is performed by the execution agent, and the interaction step is performed by the interaction agent.

[0009] In an embodiment of the present application, functions such as screen perception, task planning, and interactive control are realized through pre-trained intelligent agents, thereby further improving the automation capability and response efficiency of security operations.

[0010] In some possible embodiments, the security operation agent further includes a feedback agent, and the feedback agent is used to: The execution results of the perception agent, the planning agent, the execution agent and the interaction agent are monitored in real time, and when the execution results are identified as erroneous results, adjustment information is fed back to the corresponding agents.

[0011] In an embodiment of the present application, by configuring a feedback agent to monitor the execution results of other agents, and feeding back adjustment information when an erroneous result is identified so that the corresponding agent can re-execute, the reliability and accuracy of automated security operations are further improved.

[0012] In some possible embodiments, real-time monitoring of the screen interface of the security operation terminal and real-time acquisition of screen element data of the screen interface include: Monitor the screen interface of the security operation terminal in real time, and identify and classify the screen elements in the screen interface; Corresponding screen element data are generated for each classified screen element.

[0013] In the embodiment of the present application, by identifying and classifying screen elements and generating corresponding screen element data according to the classified screen elements, the flexibility and accuracy of screen information perception are further improved.

[0014] In some possible embodiments, the method for automated network security operations further includes: Collect the safety operation history data recorded by the safety operation terminal according to a preset period, and construct a reward data set corresponding to each of the safety operation agents based on the safety operation history data; Based on each of the reward data sets, reinforcement learning training is performed on the corresponding security operation intelligent agent.

[0015] In an embodiment of the present application, by periodically collecting historical safety operation data and constructing a corresponding reward data set, reinforcement learning training is performed on the corresponding intelligent agent, thereby further improving the interaction efficiency and accuracy in the safety operation process.

[0016] In some possible embodiments, the method for automated network security operations further includes: Responding to changes in elements of the screen interface in real time and acquiring screen element information after the elements have changed; Based on the screen element information after the element changes, the operation behavior instruction set corresponding to the corresponding operation task is adjusted in real time.

[0017] In an embodiment of the present application, by responding to changes in screen elements in real time and adjusting the operational behavior instruction set of the operational task in real time based on the changed screen element information, the accuracy and reliability of interaction in the safe operation process are further improved.

[0018] In some possible embodiments, the operation behavior instruction set includes position information of a plurality of elements to be interacted with; The method further comprises: Responding to the resolution change of the screen interface in real time and acquiring screen element data after the resolution change; Based on the screen element data after the resolution change, the position information of the corresponding element to be interacted with is adjusted in real time.

[0019] In an embodiment of the present application, by real-time monitoring of the resolution changes of the screen interface and real-time adjustment of the position information of the elements to be interacted in the operation behavior instruction set based on the changed screen element data, the accuracy and reliability of the interaction during the security operation process are further improved.

[0020] In a second aspect, an embodiment of the present application provides a device for automated network security operations, including: A perception module, used to monitor the screen interface of the security operation terminal in real time and obtain screen element data of the screen interface in real time; A planning module, for planning and generating a set of security operation tasks corresponding to a security event based on the screen element data when a security event is detected on the screen interface; An execution module, used to generate an operation behavior instruction set corresponding to each operation task in the security operation task set; The interactive module is used to interactively control the screen interface of the security operation terminal based on each of the operation behavior instruction sets to complete the security operation operation for the security incident.

[0021] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the method described in any embodiment of the first aspect when executing the program.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0023] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flowchart of a method for automated network security operations provided in an embodiment of the present application; Figure 2 A schematic diagram of the interaction relationship between intelligent agents provided in an embodiment of the present application; Figure 3 A schematic diagram of the safety operation process provided for the embodiment of the present application; Figure 4 A schematic diagram of the structure of a device for automated network security operations provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0027] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0028] It should be noted that existing technologies are already able to use AI security agents to automatically perform network security-related tasks, such as predicting potential security threats by analyzing historical data and current situations, automatically detecting and patching system vulnerabilities, and detecting unknown malware through behavioral analysis and pattern recognition. However, existing solutions need to rely on the open programming interface of the security operation system. When faced with restrictions such as cross-ecosystem or permission sensitivity, the automated operation capabilities and real-time response efficiency are often reduced due to poor software compatibility.

[0029] In response to the problems existing in the above-mentioned prior art, an embodiment of the present application provides a method for automated network security operation, which performs data perception and interactive control directly at the front-end interface level of the operation terminal without relying on the programming interface of the security operation software, thereby improving the automation capability and response efficiency of security operations in scenarios such as cross-ecosystems or permission-sensitive scenarios.

[0030] like Figure 1 As shown, the embodiment of the present application provides a method for automated network security operation, which may include the following steps: S1. Perception step: monitor the screen interface of the security operation terminal in real time, and obtain the screen element data of the screen interface in real time.

[0031] It should be noted that the security operation terminal refers to the terminal device used to implement network security operations. One or more security operation software (systems) can be deployed in the security operation terminal, and these security operation software can be visualized through the screen interface of the security operation terminal.

[0032] By real-time monitoring of the screen interface of the security operation terminal, all data information displayed by each security operation software through the screen interface can be obtained, including screen element data. Among them, screen elements refer to various visual elements displayed on the screen interface, such as virtual buttons, function options, text, links, etc. By real-time monitoring of these screen elements and identifying the corresponding data information, the screen element data of each screen element can be obtained.

[0033] S2, planning step: when a security incident is detected on the screen interface, a set of security operation tasks corresponding to the security incident is planned and generated based on the screen element data.

[0034] Specifically, by monitoring the screen interface of the security operation terminal, it is possible to sense whether a security incident has occurred, such as a pop-up warning on the screen interface, a change in security operation status information, etc. At this point, task planning can be performed based on the screen element data of the current screen interface acquired in real time, and a security operation task set corresponding to the current security incident can be generated. Among them, the security operation task set can include one or more operation tasks, and these operation tasks can be, for example, alarm tracing, log investigation, threat determination, and false alarm analysis.

[0035] It should be noted that for the operation menus of different platforms or ecosystems, the operation task items can be split according to different rules and strategies.

[0036] S3, execution step: generating an operation behavior instruction set corresponding to each operation task in the security operation task set.

[0037] Specifically, for each operation task determined in the previous step, a corresponding operation behavior instruction set is generated. The operation behavior instruction set refers to a set of operation instructions for implementing the corresponding operation task. The corresponding operation behavior instruction set can be generated according to different rules and policies based on different platforms and ecosystems.

[0038] Exemplarily, these operation behavior instruction sets may include API calls or behavior tools for simulating user operation behaviors, including action instructions of input devices such as a mouse or keyboard that simulate user operations (such as click operations, text input operations, etc.); for example, based on the VNC (Virtual Network Computing) protocol, a simulation environment or a virtual environment is created so that the corresponding tools can be successfully called and executed correctly.

[0039] S4, interactive step: interactively control the screen interface of the security operation terminal based on each operation behavior instruction set to complete the security operation task for the security incident.

[0040] Specifically, based on the operation behavior instruction set corresponding to each operation task, the screen interface of the security operation terminal can be interactively controlled, such as simulating a user to click a security operation software function button in the interface, or simulating a user to enter a specific operation instruction into an input box in the interface, etc. It is understandable that each operation task can be executed in parallel in different display areas in the interface, or can be executed serially in sequence.

[0041] Based on this, by identifying the data on the terminal screen interface and generating a behavioral instruction set for the corresponding operational tasks, automated security operations are finally achieved through screen interactive control without relying on the open programming interface of the security operation software. This can effectively improve the automation capabilities and response efficiency of network security operations when facing cross-ecosystem or permission-sensitive scenarios.

[0042] In some possible embodiments, the method for automated network security operation is performed by a pre-built security operation agent; the security operation agent includes a perception agent, a planning agent, an execution agent, and an interaction agent; Among them, the perception step is performed by the perception agent, the planning step is performed by the planning agent, the execution step is performed by the execution agent, and the interaction step is performed by the interaction agent.

[0043] Specifically, an agent refers to a system that can perceive the environment, make decisions and take actions, and has basic characteristics such as autonomy, interactivity, responsiveness and adaptability. Among them, the security operation agent can be divided into multiple sub-agents: perception agent, planning agent, execution agent and interaction agent, etc. These agents can be used as a separate training and security operation system.

[0044] Each intelligent agent can realize interactive behaviors. For example, the interactive relationship between each intelligent agent can be as follows: Figure 2 Specifically, the security operation process of the embodiment of the present application can be as follows Figure 3 shown.

[0045] It should be noted that each agent can have multimodal capabilities or world model capabilities. For example, the construction process of each security operation agent is as follows: 1. Construct multimodal pre-training data; pre-training data includes but is not limited to Chinese Internet texts, security blog articles, English texts, attack event knowledge, code data, attack tactics and techniques (TTP) knowledge, vulnerability information, basic network security knowledge, papers and PDF documents, cross-platform or cross-ecological screenshots, etc.; among them, cross-platform or cross-ecological screenshots mainly include cross-platform, cross-system and cross-ecological website screenshots, device screenshots, operating system screenshots, public video data, etc.

[0046] 2. Construct a fine-tuning dataset; including but not limited to the correspondence between icons and their semantic descriptions, the relationship between UI elements (such as buttons, text input boxes, etc.) and associated text labels, UI interface screenshots and bounding boxes containing actual location information extracted through the DOM tree, network security operation workflow-related text, attack scenario description text, and security operation tool descriptions.

[0047] 3. Build reinforcement learning data; including but not limited to: UI interaction behavior reward data set, network security operation process reward data set, troubleshooting reward data set, tool call reward data set, etc.

[0048] 4. Perform model pre-training based on the pre-processed pre-training data, where the model infrastructure can adopt Transformer, LSTM, RWKV, VIT, VLM and other models.

[0049] 5. Perform model post-training (model fine-tuning) based on the preprocessed fine-tuning dataset. The model fine-tuning process can be divided into multi-stage fine-tuning, and the fine-tuning parameters can be full or non-full.

[0050] 6. Based on the preprocessed reinforcement learning data, the model is trained and fine-tuned. The reinforcement learning method can be RLHF, DPO, RFT, etc.

[0051] 7. After training or fine-tuning based on step 4, 5 or 6, a multimodal large model can be generated, and a corresponding security operation intelligent agent can be constructed based on the multimodal large model. The processes of steps 5 and 6 can be repeatedly iterated in actual applications, and the order is not limited.

[0052] In some possible embodiments, the security operation agent further includes a feedback agent, and the feedback agent is used to: Monitor the execution results of the perception agent, planning agent, execution agent and interaction agent in real time, and feedback adjustment information to the corresponding agent when the execution result is identified as an erroneous result.

[0053] It should be noted that the security operation agent may also include a feedback agent, which may be constructed based on the model training, fine-tuning or reinforcement learning methods of the above-mentioned other agents.

[0054] The feedback agent is used to monitor the execution results of other agents in real time, and identify whether these execution results are correct based on the knowledge it has learned. If an incorrect result is found, the feedback adjustment information is fed back to enable the corresponding agent to re-execute, so that each agent can complete its own operational task actions more accurately, thereby further improving the reliability and accuracy of automated security operations.

[0055] In some possible embodiments, real-time monitoring of the screen interface of the security operation terminal and real-time acquisition of screen element data of the screen interface include: Monitor the screen interface of the security operation terminal in real time, and identify and classify the screen elements in the screen interface; Corresponding screen element data are generated for each classified screen element.

[0056] It should be noted that when screen elements in the screen interface are identified, these screen elements can be classified. Exemplarily, they can be divided into interactive elements and non-interactive elements, where interactive elements refer to areas that can be clicked, input or touched by users, such as icons, input boxes, links, etc.; non-interactive elements refer to parts without interactive functions, such as text boxes and pictures that cannot be input.

[0057] It should be noted that, depending on the pixels and image coordinates on the screen, various screen elements of the screen interface can be accurately identified. In addition, in order to improve the accuracy and comprehensiveness of screen element recognition, the perception agent can also call other tools for auxiliary recognition, for example, it can call target detection models (such as VGG series models, etc.) and OCR recognition models, etc.

[0058] For each screen element after classification, corresponding screen element data can be generated respectively. For example, the screen element data can be divided into structured data and unstructured data. Among them, structured data can include data information such as element location information, function description, interaction condition restrictions, and expected interaction impact; unstructured data can include interpretation of operation data in the screen, analysis results of alarm or event status, etc.

[0059] Based on this, by identifying and classifying screen elements and generating corresponding screen element data according to the classified screen elements, the flexibility and accuracy in the security automation operation process can be further improved.

[0060] In some possible embodiments, the method for automated network security operations may further include: Collect the historical security operation data recorded by the security operation terminal according to the preset period, and build a reward data set corresponding to each security operation agent based on the historical security operation data; Based on each reward data set, reinforcement learning training is performed on the corresponding security operation agent.

[0061] It should be noted that in the process of network security automation operation, the historical data of security operation can also be recorded in real time. These data include relevant data of execution processes such as interactive control process, fault identification and troubleshooting process, tool calling process, etc., which are used to characterize the correctness of each execution process, for example: whether the corresponding interactive elements can be successfully interactively controlled based on the acquired location information, whether the results of fault identification can verify that the corresponding fault situation does exist, whether the called tool can successfully execute the corresponding task item, etc.

[0062] Then, by collecting these security operation historical data according to the preset period, and constructing the reward data sets corresponding to each security operation agent, including UI interaction behavior reward data set, network security operation process reward data set, troubleshooting reward data set, tool call reward data set, etc.; finally, based on the reward data set, reinforcement learning training is performed on the corresponding security operation agents.

[0063] Based on this, by setting up a reinforcement learning environment and strategy, the operation strategy of each intelligent agent can be continuously optimized during the interaction process, thereby further improving the interaction efficiency and accuracy during the security operation process.

[0064] In some possible embodiments, the method for automated network security operations further includes: Respond to changes in screen elements in real time and obtain screen element information after the elements change; Based on the screen element information after the element changes, the operation behavior instruction set corresponding to the corresponding operation task is adjusted in real time.

[0065] It should be noted that during the security operation process, when interactive control is performed based on the operation behavior instruction set, the screen elements in the screen interface will also change in real time.

[0066] Therefore, it is possible to monitor the changes in elements of the screen interface in real time, obtain information about the changed screen elements, and then make real-time adjustments to the previously generated operation behavior instruction set based on this, thereby further improving the accuracy and reliability of interaction during security operations.

[0067] In some possible embodiments, the operation behavior instruction set includes position information of a plurality of elements to be interacted with; Other approaches to automating cybersecurity operations include: Respond to changes in screen resolution in real time and obtain screen element data after the resolution changes; Based on the screen element data after the resolution change, the position information of the corresponding element to be interacted with is adjusted in real time.

[0068] It should be noted that since the security operation terminal may run different operation software at the same time, when the operation software is switched or the display mode of the security operation terminal needs to be adjusted, the resolution of the screen interface may change accordingly, resulting in the screen element position information in the previously generated operation behavior instruction set no longer being used.

[0069] Therefore, by monitoring the resolution change of the screen interface in real time and acquiring the screen element data after the resolution change, the position information of the corresponding to-be-interacted element is adjusted in real time based on the changed screen element data.

[0070] Based on this, when the screen interface resolution changes, the interactive control of the corresponding elements to be interacted with can be accurately achieved based on the position information, thereby further improving the accuracy and reliability of the interaction during the security operation process.

[0071] The following specific examples are given to explain in detail the method of automated network security operation of this application: 1. On the front page (screen interface) of the security operation terminal, there is an alarm message about the malicious file "Silver Fox" that needs to be checked; 2. The perceptual intelligent agent detects the above-mentioned alarm information appearing on the screen interface, that is, it detects a security incident on the screen interface; it classifies the elements according to the screen element data of the screen interface acquired in real time, and generates structured and unstructured data (including the location information of interactive elements) containing relevant screen elements and relevant UI function information.

[0072] 3. Based on the screen element data provided by the perception agent, the planning agent formulates troubleshooting tasks (generates a set of security operation tasks corresponding to the current security incident). For example, the operation work can be split into alarm tracing, log analysis, file detection and intelligence query.

[0073] 4. The execution agent generates corresponding operation behavior instruction sets for each operation task, including creating tools that can be used to simulate mouse and keyboard operation behaviors, file detection and intelligence query APIs, etc. 5. The interactive agent uses the generated operation behavior instruction set and UI to implement interactive behaviors, which may include: (1) clicking to trigger the alarm tracing function, tracking the behavior chain of the "Silver Fox" malicious file, and locating the location of abnormal terminal behavior and abnormal domain name access on the behavior chain; (2) detecting the domain name of abnormal access based on the results of intelligence query, and confirming that it is a malicious domain name; (3) detecting the "Silver Fox" malicious file based on the file detection tool, and the detection result indicates that it is indeed a "Silver Fox" family and a malicious file; (4) clearing or isolating the malicious file; (5) recording or uploading the detection results and operation results.

[0074] 6. The feedback agent monitors the execution results of other agents in real time during the process of network security automation operation, and provides feedback and adjustments to the corresponding agents in the event of erroneous execution results.

[0075] Please refer to Figure 4 , Figure 4 The following is a block diagram showing the composition of the network security automation operation device provided by some embodiments of the present application. It should be understood that the network security automation operation device is similar to the above-mentioned Figure 1Corresponding to the method embodiment, the various steps involved in the above method embodiment can be executed. The specific functions of the device for network security automated operation can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0076] Figure 4 The network security automated operation device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the network security automated operation device, and the network security automated operation device includes: The perception module 410 is used to monitor the screen interface of the security operation terminal in real time and obtain the screen element data of the screen interface in real time; The planning module 420 is used to plan and generate a set of security operation tasks corresponding to the security event based on the screen element data when a security event occurs on the screen interface; An execution module 430 is used to generate an operation behavior instruction set corresponding to each operation task in the security operation task set; The interactive module 440 is used to interactively control the screen interface of the security operation terminal based on each operation behavior instruction set to complete the security operation task for the security incident.

[0077] It can be understood that the above-mentioned device item embodiment corresponds to the method item embodiment of the present invention. The device for automated network security operation provided by the embodiment of the present invention can implement the method for automated network security operation provided by any method item embodiment of the present invention.

[0078] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0079] like Figure 5 As shown, some embodiments of the present application provide an electronic device 500, which includes: a memory 510, a processor 520, and a computer program stored in the memory 510 and executable on the processor 520, wherein the processor 520 reads the program from the memory 510 through a bus 530 and executes the program to implement a method of any embodiment included in the method for automated network security operations as described above.

[0080] Processor 520 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 520 can be a microprocessor.

[0081] The memory 510 may be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 520 of the disclosed embodiment may be used to execute instructions in the memory 510 to implement the method shown above. The memory 510 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0082] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. The computer program is executed by a processor to execute the method described in the method embodiment.

[0083] Some embodiments of the present application further provide a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0084] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0085] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0086] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0087] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0088] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0089] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0090] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for automated network security operations, characterized in that: include: Perception step: monitor the screen interface of the security operation terminal in real time, and obtain screen element data of the screen interface in real time; Planning step: when a security incident is detected on the screen interface, a security operation task set corresponding to the security incident is planned and generated based on the screen element data; Execution step: generating an operation behavior instruction set corresponding to each operation task in the security operation task set; Interaction step: interactively controlling the screen interface of the security operation terminal based on each of the operation behavior instruction sets to complete the security operation task for the security incident.

2. The method for automated network security operation according to claim 1, characterized in that: The method is performed by a pre-built security operation agent; the security operation agent includes a perception agent, a planning agent, an execution agent and an interaction agent; Among them, the perception step is performed by the perception agent, the planning step is performed by the planning agent, the execution step is performed by the execution agent, and the interaction step is performed by the interaction agent.

3. The method for automated network security operation according to claim 2, characterized in that: The security operation agent also includes a feedback agent, which is used to: The execution results of the perception agent, the planning agent, the execution agent and the interaction agent are monitored in real time, and when the execution results are identified as erroneous results, adjustment information is fed back to the corresponding agents.

4. The method for automated network security operation according to claim 1, characterized in that: The real-time monitoring of the screen interface of the security operation terminal and the real-time acquisition of screen element data of the screen interface include: Monitor the screen interface of the security operation terminal in real time, and identify and classify the screen elements in the screen interface; Corresponding screen element data are generated for each classified screen element.

5. The method for automated network security operation according to claim 2, characterized in that: Also includes: Collect the safety operation history data recorded by the safety operation terminal according to a preset period, and construct a reward data set corresponding to each of the safety operation agents based on the safety operation history data; Based on each of the reward data sets, reinforcement learning training is performed on the corresponding security operation intelligent agent.

6. The method for automated network security operation according to claim 1, characterized in that: Also includes: Responding to changes in elements of the screen interface in real time and acquiring screen element information after the elements have changed; Based on the screen element information after the element changes, the operation behavior instruction set corresponding to the corresponding operation task is adjusted in real time.

7. The method for automated network security operation according to claim 1, characterized in that: The operation behavior instruction set includes position information of several elements to be interacted with; The method further comprises: Responding to the resolution change of the screen interface in real time and acquiring screen element data after the resolution change; Based on the screen element data after the resolution change, the position information of the corresponding element to be interacted with is adjusted in real time.

8. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for automated network security operation described in any one of claims 1 to 7 can be implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for automated network security operation according to any one of claims 1 to 7 is executed.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the method for automated network security operation according to any one of claims 1 to 7 is implemented.

Images