Network security emergency disposal tool box, method, equipment and storage medium

Abstract

The invention discloses a network security emergency disposal toolbox, method and equipment and a storage medium. The network security emergency disposal toolbox comprises a notebook computer and mobile storage equipment, the notebook computer is used for obtaining abnormal information of each network asset on the target industrial control network in response to the target security event, and determining a target network asset in each network asset according to the abnormal information; an emergency disposal software tool built in the mobile storage device is used for collecting security event data corresponding to the target security event for the target network assets; the notebook computer is further used for diagnosing the target security event according to the abnormal information and the security event data through the first offline deep learning model; and the notebook computer is also used for selecting a target emergency disposal template matched with the target security event according to the security event diagnosis result, and performing emergency disposal on the target security event according to an emergency disposal task generated by the target emergency disposal template, so that the emergency disposal efficiency and effect are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security emergency response toolbox, method, device and storage medium. Background Art

[0002] With the widespread application of the Internet of Things, cloud computing and big data technologies, the integration of industrial control systems and the Internet is becoming increasingly profound. As a product of the deep integration of new-generation information technology and manufacturing, the Industrial Internet has greatly improved production efficiency while also bringing unprecedented network security challenges.

[0003] At present, industrial control networks are usually protected by network security devices such as firewalls, intrusion detection systems and intrusion prevention systems. However, since the above-mentioned network security devices have weak detection and defense capabilities for new threats such as internal threats, covert channels and social engineering attacks, network security incidents still occur.

[0004] In the prior art, security personnel usually handle network security incidents in an emergency. However, the prior art relies on the security personnel's own experience and judgment to formulate emergency response plans, which increases the difficulty and risk of decision-making. Secondly, emergency response by security personnel may lead to inaccurate response results, and even cause secondary security incidents due to human errors. Summary of the invention

[0005] The present invention provides a network security emergency handling toolbox, method, device and storage medium, which improves the efficiency of emergency handling of target security events and ensures the effect of emergency handling of target security events.

[0006] In a first aspect, an embodiment of the present invention provides a network security emergency response toolbox, the network security emergency response toolbox comprising: a laptop computer and a mobile storage device;

[0007] Wherein, the mobile storage device has at least one emergency disposal software tool built in;

[0008] A laptop computer, used for obtaining, in response to a target security event, each network asset on a target industrial control network, and an Internet Protocol Address (IP address) and a Media Access Control Address (MAC address) respectively corresponding to each network asset, obtaining abnormal information respectively corresponding to each network asset according to the IP address and the MAC address, and determining a target network asset among the network assets according to the abnormal information;

[0009] Emergency response software tools, used to collect security incident data corresponding to the target security incident for the target network assets;

[0010] The laptop computer is further used to diagnose the target security event to obtain a security event diagnosis result based on the abnormal information corresponding to each network asset and the security event data corresponding to the target network asset through a pre-trained first offline deep learning model;

[0011] The laptop computer is also used to select a target emergency response template that matches a target security event from a pre-built emergency response template library based on the security event diagnosis result, generate an emergency response task corresponding to the target security event based on the target emergency response template, and perform emergency response on the target security event based on the emergency response task.

[0012] Optionally, the laptop computer is specifically used for: after creating a new vulnerability scanning task according to the IP address to be scanned and the scanning policy, detecting whether the authorization password corresponding to the IP address to be scanned is invalid; if the authorization password corresponding to the IP address to be scanned is invalid, performing password tests according to the preset passwords in the preset password list in turn; if the password test is successful, obtaining the vulnerability information corresponding to the IP address to be scanned according to the scanning policy; obtaining the MAC address to be scanned corresponding to the IP address to be scanned, and the network assets to be scanned corresponding to the IP address to be scanned and the MAC address to be scanned, and adding the vulnerability information corresponding to the IP address to be scanned to the exception information corresponding to the network assets to be scanned.

[0013] Optionally, the laptop computer is specifically used to: obtain the traffic data to be analyzed in the target industrial control network according to a preset analysis time and / or a preset traffic type; parse each piece of traffic data to be analyzed to obtain key data information corresponding to each piece of traffic data to be analyzed; perform anomaly detection on each piece of traffic data to be analyzed according to the key data information to obtain abnormal traffic data, and record an abnormal log corresponding to the abnormal traffic data; obtain the source IP address and the destination IP address from the key data information corresponding to the abnormal traffic data, and determine the abnormal network assets corresponding to the abnormal traffic data according to the source IP address and the destination IP address; and add the abnormal log corresponding to the abnormal traffic data to the abnormal information corresponding to the abnormal network assets.

[0014] Optionally, the emergency response software tool includes a log analysis tool; the laptop is also used to: identify the log files collected by the log analysis tool through a pre-trained second offline deep learning model, according to pre-stored error log keywords and network security events corresponding to the error log keywords, to obtain target security events.

[0015] Optionally, after receiving a user's query request, the laptop computer is also used to retrieve material information related to the query request in pre-built knowledge bases through a retriever according to the query request; wherein the material information includes documents related to the query request and links to the documents; through a generator, a text answer corresponding to the query request is generated according to the material information, and the material information and text answer corresponding to the query request are displayed in association.

[0016] Optionally, the laptop is also used to build a user portrait based on the query request and user information input by the user through a pre-trained third offline deep learning model; and recommend training courses and test question banks to the user based on the user portrait through a pre-trained fourth offline deep learning model.

[0017] Optionally, the laptop is also used to construct a network topology map or a network asset list corresponding to each network asset after acquiring each network asset on the target industrial control network.

[0018] In a second aspect, an embodiment of the present invention further provides a network security emergency response method, which is executed by a laptop computer in a network security emergency response toolbox as in any embodiment of the present invention, and the method includes:

[0019] In response to a target security event, obtain each network asset on the target industrial control network, as well as the IP address and MAC address corresponding to each network asset;

[0020] Obtaining abnormal information corresponding to each network asset according to the IP address and the MAC address, and determining the target network asset among the network assets according to the abnormal information;

[0021] Obtain security event data corresponding to the target security event collected by the emergency response software tool for the target network assets;

[0022] Using a pre-trained first offline deep learning model, according to the abnormal information corresponding to each network asset and the security event data corresponding to the target network asset, a target security event is diagnosed to obtain a security event diagnosis result;

[0023] According to the security incident diagnosis results, a target emergency response template that matches the target security incident is selected from the pre-built emergency response template library, an emergency response task corresponding to the target security incident is generated according to the target emergency response template, and emergency response is performed on the target security incident according to the emergency response task.

[0024] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network security emergency response method provided by any embodiment of the present invention.

[0025] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the network security emergency response method provided by any embodiment of the present invention when executed.

[0026] The technical solution of the present invention diagnoses the target security incident through a first offline deep learning model to obtain a security incident diagnosis result, selects a target emergency disposal template matching the target security incident according to the security incident diagnosis result, and generates an emergency disposal task corresponding to the target security incident according to the target emergency disposal template. It can automatically recommend the optimal disposal plan for the target security incident, avoids the need to rely on the security personnel's own experience and judgment to handle the target security incident in an emergency, resulting in poor emergency disposal effects, and improves the efficiency and accuracy of emergency disposal of target security incidents.

[0027] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 is a schematic diagram of a network security emergency response toolbox provided according to Embodiment 1 of the present invention;

[0030] Figure 2 is a composition structure diagram of a preferred network security emergency response toolbox provided according to an embodiment of the present invention;

[0031] Figure 3 is a flowchart of a network security emergency response method provided according to Embodiment 3 of the present invention;

[0032] Figure 4It is a schematic diagram of the structure of an electronic device provided by Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] Embodiment 1

[0036] Figure 1 1 is a schematic diagram of a network security emergency response toolbox provided according to Embodiment 1 of the present invention. This embodiment is applicable to emergency response to network security incidents in industrial control networks.

[0037] like Figure 1 As shown, a network security emergency response toolbox 11 disclosed in this embodiment includes: a laptop computer 101 and a mobile storage device 102 .

[0038] In this embodiment, the laptop computer 101 may have waterproof, dustproof and shockproof properties to ensure its reliability and durability in harsh environments. The mobile storage device 102 may have at least one built-in emergency disposal software tool 201, such as a log analysis tool, a process analysis tool, a virus detection tool, a security reinforcement tool, a ransomware decryption tool, and a security audit tool. There may be many types of mobile storage devices 102, such as a USB flash drive (U disk).

[0039] Specifically, the laptop computer 101 is used to obtain each network asset on the target industrial control network and the IP address and MAC address corresponding to each network asset in response to the target security event, obtain the abnormal information corresponding to each network asset according to the IP address and MAC address, and determine the target network asset among the network assets according to the abnormal information.

[0040] In a specific implementation, after receiving the target security event, the network assets on the target industrial control network and the IP addresses and MAC addresses corresponding to the network assets can be obtained according to the network asset detection instructions triggered by the user on the front-end page. Alternatively, after receiving the target security event, it can be detected whether the user calls the network asset detection model through natural language. If so, the network assets on the target industrial control network and the IP addresses and MAC addresses corresponding to the network assets can be obtained according to the Internet Control Message Protocol (ICMP) and the Simple Network Management Protocol (SNMP). Among them, there can be many target security events, such as downtime, ransomware, blue screen and file leakage. Then, the abnormal information corresponding to each network asset can be obtained according to the IP address and MAC address. Among them, the network assets can include hosts, network devices and security devices, etc. The network devices include but are not limited to routers and switches, and the security devices include but are not limited to firewalls. The abnormal information includes but is not limited to the total number of vulnerabilities, abnormal alarms, vulnerable accounts, abnormal logs and virus Trojans of network assets. Finally, the target network asset can be determined from each network asset based on at least one of the total number of vulnerabilities, abnormal alarms, vulnerable accounts, abnormal logs, and viruses and trojans. Among them, the target network asset can be the network asset that is most likely to cause the target security incident, and there can be multiple target network assets. Exemplarily, the target network asset can be determined from each network asset based on the total number of vulnerabilities. Specifically, if the total number of vulnerabilities of a network asset is outside a preset vulnerability numerical range, the network asset is determined to be a target network asset. The preset vulnerability numerical range can be greater than a preset lower limit of the total number of vulnerabilities and less than a preset upper limit of the total number of vulnerabilities. Preferably, the preset lower limit of the total number of vulnerabilities can be 1.

[0041] Optionally, the relevant information of each network asset can be summarized and displayed using IP address and MAC address as dimensions, making it convenient for users to query the relevant information of each network asset.

[0042] The emergency response software tool 201 is used to collect security event data corresponding to a target security event for a target network asset.

[0043] Specifically, when the mobile storage device 102 includes the following emergency response software tools 201: log analysis tool, process analysis tool, virus detection tool, security reinforcement tool, ransomware decryption tool and security audit tool, security event data corresponding to the target security event can be collected for the target network assets based on the log analysis tool, process analysis tool, virus detection tool, security reinforcement tool, ransomware decryption tool and security audit tool.

[0044] In a specific embodiment, a log analysis tool can be used to collect and parse operating system level log data, and the format of the log data can be converted from unstructured to structured to generate a structured log report. The above log report can be exported in Comma-Separa ted Values ​​(CSV) format or lightweight data exchange (JavaScript Object Notation, JSON) format. A process analysis tool can be used to monitor all processes in the operating system in real time, displaying information such as the unique identifier, name, path, startup time, CPU usage and memory occupancy of the process. The process analysis tool can also be used to establish a process tree view based on the parent-child relationship between processes so that users can quickly identify potential malicious processes. A virus detection tool can be used to perform a full disk scan or on-demand scan on the virus library, and isolate and delete malicious files based on the scan results, generate a detailed virus detection report, and record the virus detection results and suggestions. A security reinforcement tool can be used to reinforce the system and software services to prevent unauthorized access and malicious attacks. A ransomware decryption tool can be used to decrypt files encrypted by ransomware, generate decryption logs and recovery files, to help users quickly recover damaged data and reduce losses. Security audit tools can be used to record the operation of all files and provide detailed audit reports to help administrators track the operation of files and ensure compliance and security. The operation of files may include execution time, operator, and operation results. Finally, the analysis results of each tool can be summarized into a target log file, and the target log file can be uploaded to the laptop computer 101 as security event data corresponding to the target security event.

[0045] The laptop computer 101 is also used to diagnose the target security event to obtain a security event diagnosis result based on the abnormal information corresponding to each network asset and the security event data corresponding to the target network asset through a pre-trained first offline deep learning model.

[0046] In a specific embodiment, each abnormal information and security event data after data cleaning and format conversion can be input into a pre-trained first offline deep learning model for processing to obtain a security event diagnosis result corresponding to the target security event. The first offline deep learning model uses the abnormal information and security event data corresponding to the historical security events as samples to train the preset neural network model. The security event diagnosis result may include the type, nature, location, scope of impact, severity, possible causes and potential risks of the target security event.

[0047] The advantage of this setting is that by diagnosing the target security incident through the first offline deep learning model, it is possible to diagnose the target security incident even under poor network conditions, thereby expanding the scope of application of the network security emergency response toolbox.

[0048] Laptop computer 101 is also used to select a target emergency response template that matches the target security event from a pre-built emergency response template library based on the security event diagnosis result, generate an emergency response task corresponding to the target security event based on the target emergency response template, and perform emergency response on the target security event based on the emergency response task.

[0049] In a specific implementation, a target emergency response template that matches the target security event can be selected from the candidate emergency response templates in the emergency response template library according to the security event diagnosis results. The target emergency response template may include detailed handling steps, required resources, risk points, and countermeasures. Then, an emergency response task corresponding to the target security event can be automatically generated according to the task name, event description, security event diagnosis results, and target emergency response template. Alternatively, a custom agent of a pre-trained task establishment model can be called to create an emergency response task according to the natural language input by the user. The content of the emergency response task may include the task name, security event level, task location, security event type, time of receiving the task, planned deadline, event description, task plan, and task executor. Finally, the target security event can be emergency handled according to the emergency response task to obtain the emergency response result, and an emergency response report can be generated according to the emergency response result.

[0050] Optionally, the emergency response task can be subdivided into six stages: preparation, detection, suppression, eradication, recovery and tracking. Each stage can be automated to reduce manual intervention and improve the speed and efficiency of emergency response.

[0051] Optionally, in response to a user's instruction to temporarily store the emergency handling task, the execution operation of the emergency handling task may be canceled. In response to a user's instruction to complete the emergency handling task, the emergency handling task may be converted into an emergency handling template and stored in the emergency handling template library.

[0052] Optionally, the first offline deep learning model can be retrained based on the emergency response results to continuously optimize the accuracy of the diagnosis results of the first offline deep learning model and the applicability of the target emergency response template.

[0053] Optionally, in response to the user performing a measure adding operation on the target emergency response template, a measure title may be added to the target emergency response template, and corresponding tools and attachments may be added.

[0054] The technical solution of the embodiment of the present invention provides a network security emergency response toolbox, which includes: a laptop computer and a mobile storage device; wherein the mobile storage device has at least one built-in emergency response software tool; the laptop computer is used to obtain each network asset on the target industrial control network in response to a target security event, and the IP address and MAC address corresponding to each network asset, respectively, and then obtain the abnormal information corresponding to each network asset according to the IP address and the MAC address, and determine the target network asset from each network asset according to the abnormal information; the emergency response software tool is used to collect security event data corresponding to the target security event for the target network asset; the laptop computer is also used to collect the security event data corresponding to the target security event for the target network asset through a pre-trained first offline deep learning model The laptop computer is used to diagnose the target security incident according to the abnormal information corresponding to each network asset and the security incident data corresponding to the target network asset to obtain the security incident diagnosis result; the laptop computer is also used to select the target emergency disposal template matching the target security incident in the pre-built emergency disposal template library according to the security incident diagnosis result, generate the emergency disposal task corresponding to the target security incident according to the target emergency disposal template, and perform emergency disposal on the target security incident according to the emergency disposal task, which solves the problem that the existing technology needs to rely on the experience and judgment of the security personnel themselves to carry out emergency disposal on the target security incident, resulting in poor effect of emergency disposal, improves the efficiency of emergency disposal on the target security incident, and ensures the effect of emergency disposal on the target security incident.

[0055] Embodiment 2

[0056] This embodiment is a further optimization and expansion based on the above embodiments, and can be combined with various optional technical solutions in the above implementation modes. This embodiment can be applied to emergency response to network security incidents of industrial control networks, or to security reinforcement of industrial control networks to discover and handle network security incidents.

[0057] The present embodiment discloses a network security emergency handling toolbox 11, comprising: a laptop computer 101 and a mobile storage device 102. The mobile storage device 102 has at least one emergency handling software tool 201 built in it.

[0058] The laptop computer 101, when obtaining the exception information corresponding to each network asset according to the IP address and the MAC address, is specifically used for: after creating a new vulnerability scanning task according to the IP address to be scanned and the scanning policy, detecting whether the authorization password corresponding to the IP address to be scanned is invalid; if the authorization password corresponding to the IP address to be scanned is invalid, performing password tests according to the preset passwords in the preset password list in turn; if the password test is successful, obtaining the vulnerability information corresponding to the IP address to be scanned according to the scanning policy; obtaining the MAC address to be scanned corresponding to the IP address to be scanned, and the network assets to be scanned corresponding to the IP address to be scanned and the MAC address to be scanned, and adding the vulnerability information corresponding to the IP address to be scanned to the exception information corresponding to the network assets to be scanned.

[0059] In a specific implementation, a new vulnerability scanning task can be created based on the task name, scan IP address, and scan strategy, and it can be detected whether the authorization password corresponding to the IP address to be scanned is invalid. If the authorization password corresponding to the IP address to be scanned is invalid, it can be considered that the user has forgotten the authorization password or the authorization password has been illegally tampered with. At this time, the password test can be performed in sequence according to the preset passwords in the preset password list. If the password test is successful, the advanced parameter configuration page can be entered to obtain the vulnerability information corresponding to the IP address to be scanned according to the scan strategy. Among them, the scan strategy can be used to specify the port range to be scanned, the scan speed, and whether to perform a survival test. The vulnerability information may include the type, location, severity, and scope of impact of the vulnerability.

[0060] Optionally, after the vulnerability scanning task is established, the vulnerability scanning task can be saved in the task list in response to the vulnerability scanning task saving instruction triggered by the user, and the vulnerability scanning task can be started at any time. When the vulnerability scanning task is executed, the real-time progress percentage can be displayed so that the user can check the scanning progress at any time. When the vulnerability scanning task is completed, a vulnerability scanning report and vulnerability repair suggestions can be generated based on the vulnerability information.

[0061] Optionally, you can create a new vulnerability scanning task based on the network segment to be scanned and the scanning strategy to increase the vulnerability scanning rate.

[0062] Furthermore, when the laptop computer 101 obtains the abnormal information corresponding to each network asset according to the IP address and the MAC address, it is also specifically used to: obtain the traffic data to be analyzed in the target industrial control network according to the preset analysis time and / or the preset traffic type; parse each traffic data to be analyzed to obtain the key data information corresponding to each traffic data to be analyzed; perform anomaly detection on each traffic data to be analyzed according to the key data information to obtain the abnormal traffic data, and record the abnormal log corresponding to the abnormal traffic data; obtain the source IP address and the destination IP address from the key data information corresponding to the abnormal traffic data, and determine the abnormal network asset corresponding to the abnormal traffic data according to the source IP address and the destination IP address; add the abnormal log corresponding to the abnormal traffic data to the abnormal information corresponding to the abnormal network asset.

[0063] In a specific embodiment, the traffic analysis network port of the laptop computer 101 can be connected to the mirror port of the switch to ensure that the traffic analysis tool on the laptop computer 101 can capture all traffic data in the target industrial control network. Then, a new traffic analysis task can be created through natural language or a web page dialog box to monitor traffic. Among them, the traffic analysis task can include an offline traffic analysis task and an online traffic analysis task. The offline traffic analysis task parses the traffic message by uploading an Ethernet packet sniffer file (Ethereal Ethernet Packet sniffer file, PCAP). The online traffic analysis task can set a preset analysis duration and / or a preset traffic type.

[0064] When the online traffic analysis task is executed, the traffic data to be analyzed in the industrial control network can be obtained through the traffic analysis tool according to the preset analysis time and / or preset traffic type. Then, each piece of traffic data to be analyzed can be parsed to obtain key data information corresponding to each piece of traffic data to be analyzed. Among them, the key data information may include the source IP address, the destination IP address, the port number, the protocol type, and the data packet size. Afterwards, the abnormal traffic data can be determined according to at least one of the source IP address, the destination IP address, the port number, the protocol type, and the data packet size. Exemplarily, if the protocol type of the traffic data to be analyzed is unknown or the data packet is too large, the traffic data to be analyzed can be used as abnormal traffic data. After determining the abnormal traffic data, an alarm message can be sent to the user, and an abnormal log corresponding to the abnormal traffic data can be recorded. Finally, the abnormal log corresponding to the abnormal traffic data can be added to the abnormal information corresponding to the abnormal network asset.

[0065] Optionally, after the traffic analysis task is established, the traffic analysis task can be saved in the task list in response to a traffic analysis task save instruction triggered by the user, and the traffic analysis task can be started at any time. When the traffic analysis task is executed, the real-time progress percentage can be displayed so that the user can view the scanning progress at any time.

[0066] Optionally, the traffic data to be analyzed can be analyzed and counted to generate a traffic report including traffic statistics analysis, abnormal logs and historical task records, and displayed to the user. The traffic statistics analysis part can include information such as the change trend, peak value and average value of the target industrial control network traffic to help users fully understand the traffic status of the target industrial control network.

[0067] Optionally, when the emergency response software tool 201 includes a log analysis tool, the laptop computer 101 is also used to: identify the log files collected by the log analysis tool through a pre-trained second offline deep learning model, according to pre-stored error log keywords and network security events corresponding to the error log keywords, to obtain target security events.

[0068] In a specific implementation, all log files corresponding to the target industrial control network collected by the log analysis tool can be imported into the laptop computer 101. Then, all log files corresponding to the target industrial control network can be input into the second offline deep learning model, and the second offline deep learning model can be used to identify the error log keywords contained in the log files according to the pre-stored error log keywords, and determine the target security event according to the corresponding relationship between the error log keywords and the network security event.

[0069] Optionally, the log files corresponding to each network asset collected by the log analysis tool can be imported into the laptop computer 101. Among them, the most recently imported log file will be displayed at the top of all log files. Then, in response to the log analysis details viewing instruction triggered by the user on the log file display page, the log analysis details page can be entered. Among them, the log classification is displayed in the log analysis details page, including system logs, security logs, and application logs. In response to the log classification instruction triggered by the user on the log analysis details page, the log details of the corresponding classification can be viewed. Afterwards, the log file is identified according to the pre-stored error log keywords through the pre-trained abnormal log recognition model to obtain the abnormal log file. A log analysis report is generated based on the abnormal log files corresponding to each network asset, the log classification situation, and the potential security impact of the abnormal log files. Finally, the log analysis report can be added to the abnormal information of the network asset based on the correspondence between the log file and the network asset.

[0070] Optionally, in response to a user's instruction to preview the log analysis report, the log analysis report can be displayed to the user, and the log analysis report can be exported to a portable document format (PDF) for further analysis and archiving by the user.

[0071] Optionally, the laptop computer 101 is also used to: after receiving a query request from a user, retrieve data information related to the query request in each pre-built knowledge base according to the query request through a retriever; wherein the data information includes documents related to the query request and links to the documents; and generate a text answer corresponding to the query request according to the data information through a generator, and associate and display the data information corresponding to the query request and the text answer. Among them, the pre-built knowledge bases may include a disposal template library, a device fingerprint library, an emergency knowledge base, a vulnerability information library, a malicious code library, a security incident library, and a threat intelligence library, etc., and the content of each knowledge base may be dynamically changing.

[0072] In a specific implementation, after receiving a user's query request, the retriever can retrieve information related to the query request in various pre-built knowledge bases according to the query request. Alternatively, after selecting a target knowledge base from various knowledge bases in response to a user's selection instruction for each knowledge base, the retriever can retrieve information related to the query request in the target knowledge base according to the query request. The query request can be used to reflect user needs, such as "how to deal with system time tampering" and "recommended emergency response templates for botnets". The retrieval process of the retriever is based on a vector space model, and the query request and the documents in the knowledge base are both represented as vectors. The retriever can retrieve the most relevant documents by calculating the similarity between the query request and the document.

[0073] Then, the generator can generate a text answer corresponding to the query request based on the information, and display the document, document link and text answer corresponding to the query request to the user so that the user can click the document link to view the complete document content. The generator can be a sequence-to-sequence model, and optionally, the retriever and generator can be fine-tuned end-to-end together to ensure that the retriever and generator can work together to generate high-quality output. By fine-tuning the retriever and generator, the performance of the model can be continuously optimized, and the accuracy of the query and the quality of the response can be improved.

[0074] Optionally, since the content of each knowledge base can be dynamically changed, the application programming interface (API) of each knowledge base can be called when a new query request is received to ensure that the queried knowledge base is always the latest.

[0075] The advantage of this setting is that by dynamically maintaining each knowledge base, the timeliness and accuracy of the text answers can be ensured, thereby improving the overall security situation awareness capabilities.

[0076] Optionally, the laptop computer 101 is also used to: construct a user portrait based on the query request and user information input by the user through a pre-trained third offline deep learning model; and recommend training courses and question banks to the user based on the user portrait through a pre-trained fourth offline deep learning model.

[0077] Among them, the user information may include the user's learning needs and interests, etc. The third offline deep learning model can be obtained by training the preset neural network model using the historical query requests and historical user information input by the historical users as training samples. The fourth offline deep learning model can be obtained by training the preset neural network model using the historical user portraits as training samples.

[0078] The advantage of this setting is that training courses and question banks are recommended to users through user portraits, which takes into account the user's learning needs and interests and improves the accuracy of the recommendation results.

[0079] Optionally, the laptop computer 101 is further used to construct a network topology map or a network asset list corresponding to each network asset after acquiring each network asset on the target industrial control network.

[0080] Specifically, the process of constructing the network topology is as follows: Step 1: Search the routing information table of the target industrial control network according to the SNMP protocol to obtain the main network topology; Step 2: Obtain the terminal devices in the subnet of the target industrial control network according to the ICMP protocol, and construct the network sub-topology according to the terminal devices in the subnet. Step 3: Obtain the network topology according to the main network topology and the network sub-topology. The process of constructing the network asset list is as follows: Generate a network asset list according to the acquisition order of each network asset.

[0081] The technical solution of the embodiment of the present invention detects whether the authorization password corresponding to the IP address to be scanned is invalid after creating a new vulnerability scanning task according to the IP address to be scanned and the scanning strategy; if the authorization password corresponding to the IP address to be scanned is invalid, the password test is performed in turn according to the preset passwords in the preset password list; if the password test is successful, the vulnerability information corresponding to the IP address to be scanned is obtained according to the scanning strategy; the MAC address to be scanned corresponding to the IP address to be scanned, and the network assets to be scanned corresponding to the IP address to be scanned and the MAC address to be scanned are obtained, and the vulnerability information corresponding to the IP address to be scanned is added to the abnormal information corresponding to the network assets to be scanned, so as to realize automatic discovery of various security vulnerabilities, provide a basis for subsequent vulnerability repair, and improve the overall network security level. Secondly, by analyzing the traffic data in the industrial control network, it is convenient for users to fully understand network activities and discover potential security threats in a timely manner. Finally, the retriever retrieves the data information related to the query request in the pre-built knowledge bases according to the query request, and the generator generates the text answer corresponding to the query request according to the data information. It is possible to instantly obtain professional answers about security emergency response technologies, processes and the latest security trends, greatly enhancing the professional capabilities and emergency response level of security personnel.

[0082] In a preferred embodiment, Figure 2 As shown, the network security emergency response toolbox may include a laptop, a USB flash drive, and a gigabit network cable. The laptop can be connected to the gigabit network cable to obtain various network assets on the target industrial control network and abnormal information of each network asset. The USB flash drive has built-in log analysis tools, process analysis tools, virus detection tools, security reinforcement tools, ransomware decryption tools, and security audit tools. The laptop includes a network asset detection module, a vulnerability scanning and assessment module, a network traffic monitoring module, a log analysis module, an event diagnosis and response module, an emergency task scheduling module, and an intelligent question and answer module.

[0083] Among them, the network asset detection module can be used to obtain each network asset on the target industrial control network, as well as the Internet Protocol address and LAN address corresponding to each network asset, and call the vulnerability scanning and assessment module, the network traffic monitoring module and the log parsing module to obtain the abnormal information corresponding to each network asset. The network asset detection module can also be used to build a network topology map or network asset list corresponding to the target industrial control network according to the ICMP protocol and the SNMP protocol.

[0084] The vulnerability scanning and assessment module can be used to detect whether the authorization password corresponding to the Internet Protocol address to be scanned is invalid after a new vulnerability scanning task is created according to the Internet Protocol address to be scanned and the scanning strategy; if the authorization password corresponding to the Internet Protocol address to be scanned is invalid, the password test is performed in turn according to the preset passwords in the preset password list; if the password test is successful, the vulnerability information corresponding to the Internet Protocol address to be scanned is obtained according to the scanning strategy; the local area network address to be scanned corresponding to the Internet Protocol address to be scanned, and the network assets to be scanned corresponding to the Internet Protocol address to be scanned and the local area network address to be scanned are obtained, and the vulnerability information corresponding to the Internet Protocol address to be scanned is added to the abnormal information corresponding to the network assets to be scanned. The vulnerability scanning and assessment module can also be used to save the vulnerability scanning task in the task list in response to the vulnerability scanning task saving instruction triggered by the user after the vulnerability scanning task is established, and support the vulnerability scanning task to be started at any time. The vulnerability scanning and assessment module can also be used to display the real-time progress percentage when the vulnerability scanning task is executed, so that the user can check the scanning progress at any time. The vulnerability scanning and assessment module can also be used to generate a vulnerability scanning report and vulnerability repair suggestions based on the vulnerability information when the vulnerability scanning task is completed. The vulnerability scanning and assessment module can also be used to create new vulnerability scanning tasks based on the network segments to be scanned and the scanning strategy to increase the vulnerability scanning rate.

[0085] The network traffic monitoring module can be used to establish online traffic analysis tasks and offline traffic analysis tasks. When executing the online traffic analysis task, the network traffic monitoring module is specifically used to: obtain the traffic data to be analyzed in the target industrial control network according to the preset analysis time and / or preset traffic type; parse each traffic data to be analyzed to obtain the key data information corresponding to each traffic data to be analyzed; perform anomaly detection on each traffic data to be analyzed according to the key data information, obtain abnormal traffic data, and record the abnormal log corresponding to the abnormal traffic data; obtain the source Internet Protocol address and the destination Internet Protocol address in the key data information corresponding to the abnormal traffic data, and determine the abnormal network asset corresponding to the abnormal traffic data according to the source Internet Protocol address and the destination Internet Protocol address; add the abnormal log corresponding to the abnormal traffic data to the abnormal information corresponding to the abnormal network asset.

[0086] The log parsing module can be used to import the log files corresponding to each network asset collected by the log analysis tool into a laptop; identify the log files according to the pre-stored error log keywords through the pre-trained abnormal log recognition model to obtain abnormal log files; add the log analysis report to the abnormal information of the network assets according to the correspondence between the log files and the network assets. The log parsing module can also be used to identify all log files corresponding to the target industrial control network collected by the log analysis tool according to the pre-stored error log keywords and the network security events corresponding to the error log keywords through the pre-trained second offline deep learning model to obtain the target security events.

[0087] The event diagnosis and response module can be used to diagnose the target security event to obtain the security event diagnosis result based on the abnormal information corresponding to each network asset and the security event data corresponding to the target network asset through the pre-trained first offline deep learning model. The event diagnosis and response module can also be used to select a target emergency response template that matches the target security event in the pre-built emergency response template library according to the security event diagnosis result, generate an emergency response task corresponding to the target security event according to the target emergency response template, and perform emergency response on the target security event according to the emergency response task.

[0088] The emergency task scheduling module can be used to call a custom agent of a pre-trained task establishment model to create an emergency response task based on the natural language input by the user, and subdivide the emergency response tasks generated by the event diagnosis and response module and / or the emergency task scheduling module into six stages: preparation, detection, suppression, eradication, recovery and tracking. The emergency task scheduling module can also be used to add a measure title to the target emergency response template in response to the user's measure addition operation on the target emergency response template during the preparation stage, and add corresponding tools and attachments. The emergency task scheduling module can also be used to cancel the execution operation of the emergency response task in response to the user's temporary storage instruction for the emergency response task; in response to the user's completion instruction for the emergency response task, the emergency response task is converted into an emergency response template and stored in the emergency response template library. The emergency task scheduling module can also be used to call the intelligent question and answer module for intelligent question and answer at each stage, so as to use relevant tools to perform emergency response on the target security incident.

[0089] The intelligent question-answering module can be used to retrieve information related to the query request from pre-built knowledge bases through a retriever according to the query request after receiving the user's query request; wherein the information includes documents related to the query request and links to the documents; through a generator, a text answer corresponding to the query request is generated according to the information, and the information and text answer corresponding to the query request are displayed in association. The intelligent question-answering module can also be used to construct a user profile according to the query request and user information input by the user through a pre-trained third offline deep learning model; and to recommend training courses and question banks to the user according to the user profile through a pre-trained fourth offline deep learning model.

[0090] The advantage of this setting is that, through the event diagnosis and response module, the first offline deep learning model is used to diagnose the target security event, and the emergency disposal task is automatically generated according to the security event diagnosis results to deal with the target security event, which reduces the decision-making difficulty and risk of security personnel, improves the efficiency of emergency disposal, and ensures the effect of emergency disposal. Secondly, through the vulnerability scanning and assessment module, the network traffic monitoring module and the log parsing module, the abnormal information corresponding to each network asset is obtained, which reduces manual intervention, reduces the time cost of emergency response, and avoids secondary security events caused by human errors. Thirdly, through the intelligent question and answer module to build a user portrait, and recommend training courses and question banks to users based on the user portrait, a personalized learning plan can be tailored for users to help security personnel quickly improve their professional skills. Generating text answers corresponding to query requests through the intelligent question and answer module can help security personnel obtain targeted training and practical experience, and significantly improve the ability to quickly identify, make decisions and respond to various security events. Finally, through the mutual cooperation of network asset detection module, vulnerability scanning and assessment module, network traffic monitoring module, log analysis module, event diagnosis and response module, emergency task scheduling module and intelligent question and answer module, the emergence of information island phenomenon is avoided and the efficiency and effectiveness of emergency response are improved.

[0091] Embodiment 3

[0092] Figure 3 This is a flow chart of a network security emergency response method provided according to Example 3 of the present invention. This embodiment can be applied to situations where emergency response is performed on network security incidents in industrial control networks. The method can be executed by a network security emergency response device. The network security emergency response device can be implemented in the form of hardware and / or software. The network security emergency response device can be configured in an electronic device such as a computer.

[0093] like Figure 3As shown, this embodiment discloses a network security emergency response method, which is executed by a laptop computer in the network security emergency response toolbox of embodiment 1 or embodiment 2, and includes:

[0094] S110. In response to a target security event, obtain each network asset on the target industrial control network, and an IP address and a MAC address respectively corresponding to each network asset.

[0095] Optionally, before responding to a target security event and obtaining each network asset on the target industrial control network, as well as the IP address and MAC address corresponding to each network asset, it also includes: obtaining all log files collected by a log analysis tool, and selecting a target log file from all log files; identifying the target log file through a pre-trained second offline deep learning model based on pre-stored error log keywords and network security events corresponding to the error log keywords, to obtain a target security event.

[0096] Optionally, after acquiring each network asset on the target industrial control network, the method further includes: after acquiring each network asset on the target industrial control network, constructing a network topology map or a network asset list corresponding to each network asset.

[0097] S120: Acquire abnormal information corresponding to each network asset according to the IP address and the MAC address, and determine a target network asset among the network assets according to the abnormal information.

[0098] Optionally, abnormal information corresponding to each network asset is obtained according to the IP address and MAC address, including: after creating a new vulnerability scanning task according to the IP address to be scanned and the scanning policy, checking whether the authorization password corresponding to the IP address to be scanned is invalid; if the authorization password corresponding to the IP address to be scanned is invalid, performing password tests according to the preset passwords in the preset password list in turn; if the password test is successful, obtaining the vulnerability information corresponding to the IP address to be scanned according to the scanning policy; obtaining the MAC address to be scanned corresponding to the IP address to be scanned, and the network assets to be scanned corresponding to the IP address to be scanned and the MAC address to be scanned, and adding the vulnerability information corresponding to the IP address to be scanned to the abnormal information corresponding to the network assets to be scanned.

[0099] Optionally, abnormal information corresponding to each network asset is obtained according to the IP address and the MAC address, including: according to a preset analysis time and / or a preset traffic type, obtaining the traffic data to be analyzed in the industrial control network; parsing each piece of traffic data to be analyzed to obtain key data information corresponding to each piece of traffic data to be analyzed; performing anomaly detection on each piece of traffic data to be analyzed according to the key data information to obtain abnormal traffic data, and recording an abnormal log corresponding to the abnormal traffic data; obtaining the source IP address and the destination IP address from the key data information corresponding to the abnormal traffic data, and determining the abnormal network asset corresponding to the abnormal traffic data according to the source IP address and the destination IP address; and adding the abnormal log corresponding to the abnormal traffic data to the abnormal information corresponding to the abnormal network asset.

[0100] S130: Obtain security event data corresponding to the target security event collected by the emergency response software tool for the target network asset.

[0101] S140. Using a pre-trained first offline deep learning model, diagnose a target security event according to the abnormal information corresponding to each network asset and the security event data corresponding to the target network asset to obtain a security event diagnosis result.

[0102] S150. According to the security incident diagnosis result, a target emergency response template matching the target security incident is selected from a pre-built emergency response template library, an emergency response task corresponding to the target security incident is generated according to the target emergency response template, and emergency response is performed on the target security incident according to the emergency response task.

[0103] Optionally, the method also includes: after receiving a user's query request, searching for material information related to the query request in pre-built knowledge bases according to the query request through a retriever; wherein the material information includes documents related to the query request and links to the documents; generating a text answer corresponding to the query request according to the material information through a generator, and displaying the material information and text answer corresponding to the query request in association.

[0104] Optionally, the method also includes: building a user portrait based on the query request and user information input by the user through a pre-trained third offline deep learning model; and recommending training courses and question banks to the user based on the user portrait through a pre-trained fourth offline deep learning model.

[0105] The technical solution of this embodiment obtains each network asset on the target industrial control network and the IP address and MAC address corresponding to each network asset in response to the target security event; obtains the abnormal information corresponding to each network asset according to the IP address and MAC address, and determines the target network asset in each network asset according to the abnormal information; obtains the security event data corresponding to the target security event collected by the emergency response software tool for the target network asset; diagnoses the target security event to obtain the security event diagnosis result according to the abnormal information corresponding to each network asset and the security event data corresponding to the target network asset through a pre-trained first offline deep learning model; according to the security event diagnosis result, selects a target emergency response template matching the target security event from a pre-built emergency response template library, generates an emergency response task corresponding to the target security event according to the target emergency response template, and performs emergency response on the target security event according to the emergency response task. The technical means solves the problem that the prior art needs to rely on the experience and judgment of the security personnel themselves to perform emergency response on the target security event, resulting in poor emergency response effect, improves the efficiency of emergency response to the target security event, and ensures the effect of emergency response to the target security event.

[0106] It should be noted that the user information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0107] Embodiment 4

[0108] Figure 4 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown.

[0109] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0110] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0111] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a network security emergency response method.

[0112] In some embodiments, the network security emergency response method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network security emergency response method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the network security emergency response method in any other appropriate manner (e.g., by means of firmware).

[0113] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0114] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0115] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0116] To provide interaction with a client user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the client user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the client user can provide input to the electronic device. Other types of devices may also be used to provide interaction with a client user; for example, the feedback provided to the client user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the client user may be received in any form (including acoustic input, voice input, or tactile input).

[0117] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a client user computer with a graphical client user interface or a web browser through which a client user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0118] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0119] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0120] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security emergency response toolbox, characterized in that: The network security emergency response toolbox includes: a laptop computer and a mobile storage device; Wherein, the mobile storage device has at least one emergency handling software tool built in; The laptop computer is used to obtain each network asset on the target industrial control network and the Internet Protocol address and the local area network address respectively corresponding to each network asset in response to the target security event, obtain the abnormal information respectively corresponding to each network asset according to the Internet Protocol address and the local area network address, and determine the target network asset among the network assets according to the abnormal information; The emergency response software tool is used to collect security event data corresponding to the target security event for the target network asset; The laptop is further used to diagnose the target security event to obtain a security event diagnosis result based on the abnormal information corresponding to each network asset and the security event data corresponding to the target network asset through a pre-trained first offline deep learning model; The laptop computer is also used to select a target emergency response template that matches the target security event from a pre-built emergency response template library based on the security event diagnosis result, generate an emergency response task corresponding to the target security event based on the target emergency response template, and perform emergency response on the target security event based on the emergency response task.

2. The network security emergency response toolbox according to claim 1, characterized in that: The laptop computer is specifically used for: After creating a vulnerability scanning task according to the Internet Protocol address to be scanned and the scanning strategy, detecting whether the authorization password corresponding to the Internet Protocol address to be scanned is invalid; If the authorization password corresponding to the Internet Protocol address to be scanned is invalid, password tests are performed according to the preset passwords in the preset password list in turn; If the password test is successful, vulnerability information corresponding to the Internet Protocol address to be scanned is obtained according to the scanning strategy; Obtain the local area network address to be scanned corresponding to the Internet Protocol address to be scanned, and the network assets to be scanned corresponding to the Internet Protocol address to be scanned and the local area network address to be scanned, and add the vulnerability information corresponding to the Internet Protocol address to be scanned to the exception information corresponding to the network assets to be scanned.

3. The network security emergency response toolbox according to claim 1, characterized in that: The laptop computer is specifically used for: Obtain the traffic data to be analyzed in the target industrial control network according to the preset analysis time and / or preset traffic type; Analyze each piece of traffic data to be analyzed to obtain key data information corresponding to each piece of traffic data to be analyzed; According to the key data information, anomaly detection is performed on each flow data to be analyzed to obtain abnormal flow data, and an abnormal log corresponding to the abnormal flow data is recorded; Obtaining a source Internet Protocol address and a destination Internet Protocol address from key data information corresponding to the abnormal traffic data, and determining an abnormal network asset corresponding to the abnormal traffic data based on the source Internet Protocol address and the destination Internet Protocol address; The abnormal log corresponding to the abnormal traffic data is added to the abnormal information corresponding to the abnormal network asset.

4. The network security emergency response toolbox according to claim 1, characterized in that: The emergency response software tool includes a log analysis tool; The laptop computer is also used for: Through the pre-trained second offline deep learning model, the log files collected by the log analysis tool are identified according to the pre-stored error log keywords and the network security events corresponding to the error log keywords to obtain the target security events.

5. The network security emergency response toolbox according to claim 1, characterized in that: The laptop computer is also used for: After receiving the query request from the user, the search engine searches for information related to the query request in the pre-built knowledge bases according to the query request; The data information includes documents related to the query request and links to the documents; A text answer corresponding to the query request is generated according to the data information by the generator, and the data information corresponding to the query request and the text answer are displayed in association.

6. The network security emergency response toolbox according to claim 5, characterized in that: The laptop computer is also used for: Through the pre-trained third offline deep learning model, a user profile is constructed based on the query request and user information input by the user; Through the pre-trained fourth offline deep learning model, training courses and test question banks are recommended to users based on their user portraits.

7. The network security emergency response toolbox according to any one of claims 1 to 6, characterized in that: The laptop is also used to construct a network topology map or a network asset list corresponding to each network asset after acquiring each network asset on the target industrial control network.

8. A network security emergency response method, characterized in that: The method is performed by a laptop computer in the network security emergency response toolbox according to any one of claims 1 to 7, and the method comprises: In response to a target security event, obtaining each network asset on the target industrial control network, and an Internet Protocol address and a local area network address corresponding to each network asset; Acquire abnormal information corresponding to each network asset according to the Internet Protocol address and the local area network address, and determine the target network asset among the network assets according to the abnormal information; Obtain security event data corresponding to the target security event collected by the emergency response software tool for the target network assets; Using a pre-trained first offline deep learning model, according to the abnormal information corresponding to each network asset and the security event data corresponding to the target network asset, a target security event is diagnosed to obtain a security event diagnosis result; According to the security incident diagnosis results, a target emergency response template that matches the target security incident is selected from the pre-built emergency response template library, an emergency response task corresponding to the target security incident is generated according to the target emergency response template, and emergency response is performed on the target security incident according to the emergency response task.

9. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network security emergency response method described in claim 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network security emergency response method described in claim 8 when executed.

Images