Digital arrangement system for dealing with operator network security events

Abstract

The invention provides a digital arrangement system for dealing with a network security event of an operator, and relates to the field of network technology and security technology. The arrangement system comprises at least one GX-Turbo process engine and at least one automatic execution engine. The GX-Turbo process engine decouples the workflow and the script action flow and then manages the workflow and the script action flow; when a network security event processing process is triggered, a corresponding workflow instance is firstly started, and linkage with a basic service system is completed; sequentially starting related script action instances according to configured scripts in the workflow, and operating various network security infrastructures to complete disposal or starting new sub-workflows from script instances; and finally, according to the instance execution state, sequentially returning execution results. And the automatic execution engine performs load balancing on network request traffic, distributes the traffic to a plurality of sets of nodes, and maps a private IP address of the internal network into a public IP address to realize communication between the internal network and the external network.

Description

Technical Field

[0001] The present invention relates to the fields of network technology and security technology, and in particular to a digital orchestration system for coping with network security incidents of operators. Background Art

[0002] The current situation in the cybersecurity space remains increasingly severe.

[0003] As the network security management department within a telecom operator, daily working hours are often occupied by basic business processes such as business assurance, problem handling, and document work. In this case, the time for researching and analyzing security alerts and incidents is relatively short, and there is an even greater lack of manpower and time and energy to research attack and defense technologies. Therefore, they are often at a disadvantage in the game with hackers in cyberspace.

[0004] In order to solve the above problems, many telecom operators have purchased standardized SOAR security products to improve the automation level of their own security operation incident handling. However, from the actual application effect, SOAR products generally have the following technical problems: Problem 1: The built-in script node model is limited The script node models built into standard SOAR products usually only include serial, parallel, judgment, timing, loop, delay, nested and other node models. The event handling scenarios that they can support are very limited and they cannot cope with complex security incidents.

[0005] Problem 2: Not in line with the actual business of operators The process of telecom operators conducting network security incident operations usually includes: alarm collection - alarm filtering - alarm analysis - expert review - collaborative notification - event classification - event handling - event review - alarm cancellation - report compilation and other processes.

[0006] Standard SOAR products usually only support script action flow orchestration, and pay more attention to event classification and specific event handling processes. Although they can write corresponding business scripts based on calls to the underlying security infrastructure API to connect various security capabilities in series and jointly complete the handling of a specific type of related events, they do not support the orchestration of a series of management and control business processes before and after event handling within telecom operators.

[0007] Problem 3: Insufficient flexibility in technical architecture For telecom operators, there are many external security threats and complex internal security scenarios, so the security infrastructure is upgraded quickly. In comparison, the basic business processes are relatively standardized and have changed less after years of operation. However, it is difficult for standardized SOAR products to distinguish between the above two types of processes, and they are often integrated and orchestrated in the same process, resulting in a slight upgrade and adjustment of the script action interface, which will also lead to the rewriting of the entire orchestration process, which is not flexible enough and very inconvenient to use. Summary of the invention

[0008] Purpose of the invention: To propose a digital orchestration system for responding to operator network security incidents to solve the above-mentioned problems existing in the prior art.

[0009] The present invention proposes a digital orchestration system for responding to operator network security incidents, comprising at least one GX-Turbo process engine and at least one automated execution engine.

[0010] The GX-Turbo process engine decouples the workflow from the script action flow and manages them separately; When the network security incident handling process is triggered: the GX-Turbo process engine starts the corresponding workflow instance to complete the linkage with the basic business system; according to the configured scripts in the workflow, the relevant script action instances are started in sequence, and various types of network security infrastructure are operated to complete the handling or start new sub-workflows from the script instances; according to the instance execution status, the execution results are returned in sequence.

[0011] The automation execution engine performs load balancing on network request traffic, distributes the traffic to multiple sets of nodes, and maps the private IP addresses of the internal network to public IP addresses to achieve communication between the internal network and the external network. The automation execution engine can identify the input of dynamic parameters and static parameters.

[0012] In a further embodiment, the decoupled workflow and script action flow are configured in a visual low-code manner.

[0013] In a further embodiment, the workflow includes event description, participating departments, participating personnel, additional form information, handling time limit, script insertion, and associated basic business system in event handling.

[0014] In a further embodiment, the script action flow is used to describe specific handling measures in a security incident, including handling actions, associated infrastructure, handling logic, and insertion into a workflow.

[0015] In a further embodiment, the node configuration process of the decoupled workflow includes: Associate the parent node; Fill in the node name and task description; the task description is divided into single-person tasks and multi-person tasks; the single-person task can only select a single department and related personnel, and the multi-person task can select multiple departments and related personnel; Configure task time limit; Select whether to configure the script action flow. If so, enter the script action flow node configuration process. Otherwise, save the configuration and end the current workflow node configuration process.

[0016] In a further embodiment, the node configuration process of the decoupled script action flow includes: Fill in basic information; Select the node type; Configure node parameters and determine whether the current node parameters are legal: If the current node parameters are legal, determine whether to continue adding. If so, return to select the node type. Otherwise, save the current configuration and end the script action flow node configuration process. If the current node parameters are illegal, the node parameters will be configured again until the current node parameters are legal, and the loop will be exited.

[0017] In a further embodiment, the GX-Turbo process engine first starts the corresponding workflow instance to complete the linkage with the basic business system, wherein the linkage with the basic business system specifically includes: user authentication, sending notifications, pulling monitoring data, and starting work orders.

[0018] Beneficial effects: The core of the present invention lies in the self-developed GX-Turbo process engine, in which two sets of orchestrators are designed for workflows and script action flows respectively. Workflows are mainly used to orchestrate basic business processes within telecom operators, and script action flows are used to orchestrate security incident classification and handling processes. The two sets of orchestrators can call each other on any node. It solves the problem that standardized SOAR products are difficult to implement within telecom operators, while further enriching the node types in the orchestrator and adding an open API interface, so that it can effectively connect various types of security operation production factors used in the handling of daily security operation incidents in the province.

[0019] The present invention supports the mutual introduction and calling of business flow and script action flow, and enhances the processing capability of complex business logic; The present invention supports the activation of two sets of components, workflow and script action flow, to better fit the complex network security incident handling scenarios within telecom operators; The present invention supports independent configuration of workflow and script action flow, and can edit and delete the script action flow introduced therein without changing the business flow, thereby enhancing business flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a functional architecture diagram of a digital orchestration system for responding to operator network security incidents proposed by the present invention.

[0021] Figure 2 This is a schematic diagram of the internal execution sequence of the GX-Turbo process engine.

[0022] Figure 3 It is a workflow node configuration flowchart.

[0023] Figure 4 It is a flowchart of the script action flow node configuration.

[0024] Figure 5 It is a flowchart of how the automated execution engine processes dynamic parameters.

[0025] Figure 6 It is a flow chart for the analysis and disposal of malicious network attacks before implementation.

[0026] Figure 7 It is a flow chart for the analysis and disposal of malicious network attack behaviors after implementation. DETAILED DESCRIPTION

[0027] In the following description, a large number of specific details are provided to provide a more thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present invention, some technical features known in the art are not described.

[0028] This embodiment discloses a digital orchestration system for responding to network security incidents of operators. Figure 1 . The orchestration system's self-developed GX-Turbo process engine decouples workflows from script action flows and manages them separately, thereby improving the availability and flexibility of process orchestration. Among them, workflows are mainly used to describe the business attributes of telecom operators' network security incident handling, such as: event description, participating departments, participating personnel, additional form information, handling time limits, script insertion, and associated basic business systems in incident handling; script action flows are mainly used to describe specific handling measures in security incidents, such as: handling actions, associated infrastructure, handling logic, and workflow insertion.

[0029] See Figure 2In the present invention, when the network security incident handling process is triggered, the corresponding workflow instance is first started to complete the linkage with the basic business system (for example: user authentication, sending notifications, pulling monitoring data, starting work orders, etc.); secondly, according to the configured scripts in the workflow, the relevant script action instances are started in sequence to operate various types of network security infrastructure to complete the handling. At the same time, new sub-workflows can also be started from the script instance (for example: secondary review of certain high-risk operations). Finally, according to the instance execution status, the execution results are returned in sequence.

[0030] The decoupled workflow engine and script action flow engine are still configured in a visual low-code manner. During the configuration process, the main configuration steps of each engine are as follows: Figure 3 and Figure 4 shown.

[0031] See Figure 5 The automated execution engine can load balance network request traffic and distribute traffic to multiple nodes to improve the overall performance and availability of the system. It can also map the private IP address of the internal network to the public IP address to achieve communication between the internal network and the external network, and can also identify the input of dynamic and static parameters to support more types of network security incident handling scenarios.

[0032] Specific embodiments are described below.

[0033] Implementation example: Analysis and disposal of malicious network attack behaviors.

[0034] Example description: see Figure 6 Before the application of this invention, network security operators lacked a panoramic view of the various action links in the analysis and disposal of network malicious attack behaviors. The connection between each link relied on manual operation, and it was impossible to measure the operational work efficiency of each link. In addition, the business workflow and the script action process are coupled in one process, and blockages often occur during execution. After the blockage, the entire process often needs to be withdrawn for readjustment, which seriously affects the advancement of related subsequent work. See the network malicious attack behavior analysis and disposal process after implementation. Figure 7 .

[0035] Implementation results: Achievement 1: The process of analyzing and handling malicious network attacks is solidified, and the departments, people, and situations of handling in each link can be clearly understood at a glance, and can be freely configured; Achievement 2: Strengthen the connection with the basic network security business system and enhance the automation level of the workflow. In particular, reserved interfaces for connection with enterprise OA, identity authentication IAM, work orders, SMS, email and other systems to ensure the upload and delivery of messages; Effect 3: The reserved handling time limit configuration items in each link can urge relevant personnel to complete business handling in a timely manner and improve the efficiency of event handling; Achievement 4: Decoupling of business flows and script action flows is achieved. Script actions focus on interacting with basic security facilities, and blocked handling scripts can be freely replaced without adjusting the overall workflow. Achievement 5: Enrich the logic of script action nodes and support the direct creation of sub-workflows from script action flow engine nodes to adapt to more complex business scenarios.

[0036] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. Although the present invention has been represented and described with reference to specific preferred embodiments, it shall not be interpreted as a limitation of the present invention itself. Various changes can be made to it in form and detail without departing from the spirit and scope of the present invention defined in the attached claims.

Claims

1. A digital orchestration system for responding to operator network security incidents, characterized in that: It includes at least one GX-Turbo process engine; the GX-Turbo process engine decouples the workflow from the script action flow and manages them separately; When the network security incident handling process is triggered: the GX-Turbo process engine starts the corresponding workflow instance and completes the linkage with the basic business system; According to the configured scripts in the workflow, start the relevant script action instances in sequence, operate various network security infrastructures to complete the disposal or start new sub-workflows from the script instances; The execution results are returned in sequence according to the instance execution status.

2. A digital orchestration system for responding to operator network security incidents according to claim 1, characterized in that: The decoupled workflows and script action flows are configured in a visual low-code manner.

3. A digital orchestration system for responding to operator network security incidents according to claim 2, characterized in that: The workflow includes event description, participating departments, participating personnel, additional form information, handling time limit, script insertion, and associated basic business systems in event handling.

4. A digital orchestration system for responding to operator network security incidents according to claim 2, characterized in that: The script action flow is used to describe specific handling measures in security incidents, including handling actions, associated infrastructure, handling logic, and insertion workflow.

5. A digital orchestration system for responding to operator network security incidents according to claim 2, characterized in that: The node configuration process of the decoupled workflow includes: Associate the parent node; Fill in the node name and task description; the task description is divided into single-person tasks and multi-person tasks; the single-person task can only select a single department and related personnel, and the multi-person task can select multiple departments and related personnel; Configure task time limit; Select whether to configure the script action flow. If so, enter the script action flow node configuration process. Otherwise, save the configuration and end the current workflow node configuration process.

6. A digital orchestration system for responding to operator network security incidents according to claim 5, characterized in that: The node configuration process of the decoupled script action flow includes: Fill in basic information; Select the node type; Configure node parameters and determine whether the current node parameters are legal: If the current node parameters are legal, determine whether to continue adding. If so, return to select the node type. Otherwise, save the current configuration and end the script action flow node configuration process. If the current node parameters are illegal, the node parameters will be configured again until the current node parameters are legal, and the loop will be exited.

7. A digital orchestration system for responding to operator network security incidents according to claim 1, characterized in that: The GX-Turbo process engine first starts the corresponding workflow instance to complete the linkage with the basic business system, wherein the linkage with the basic business system specifically includes: User authentication, sending notifications, pulling monitoring data, and initiating work orders.

8. A digital orchestration system for responding to operator network security incidents according to claim 1, characterized in that: It also includes at least one automated execution engine; the automated execution engine performs load balancing on network request traffic, distributes the traffic to multiple sets of nodes, and maps the private IP address of the internal network to a public IP address to achieve communication between the internal network and the external network.

9. A digital orchestration system for responding to operator network security incidents according to claim 8, characterized in that: The automation execution engine can recognize inputs of dynamic parameters and static parameters.

Images