Safety operation system, method, equipment, medium and product

Abstract

The embodiment of the invention provides a safety operation system, method and equipment, a medium and a product, and relates to the technical field of safety operation. The system comprises an alarm collection module which is used for collecting alarm records generated by each safety platform and sending the alarm records to a false alarm research and judgment module; the false alarm research and judgment module is used for identifying the alarm record by using a false alarm research and judgment model to determine whether the alarm record is a false alarm; if not, the alarm record is sent to the report generation module; the report generation module is used for generating and displaying an alarm event analysis report based on the alarm record by using the report generation large model, and determining whether the alarm record is a false alarm in response to the study and judgment of the user; if not, the alarm record is sent to the traceability notification module; and the traceability notification module is used for determining corresponding related personnel according to the alarm records and sending the alarm records to the related personnel, so that the human input of a safety operation team is reduced, and the execution efficiency of safety operation is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of security operation technology, and in particular, to a security operation system, method, device, medium and product. Background Art

[0002] In the internal security operation scenario, the large number of internal assets and the high frequency of use can easily lead to security problems. Among them, security operation means that the enterprise takes proactive measures to fully identify, confront, resist and solve technical security risks, and propose reasonable and effective overall security solutions to protect the enterprise's data, systems, applications and infrastructure, prevent external attacks and intrusions, and ensure effective business operations and improve the enterprise's data security protection capabilities. In the current environment, each security team relies on asset security scanners and monitors to reduce manpower investment and improve the efficiency of automated security operations.

[0003] Currently, most automated scanners and monitors monitor suspicious attack behaviors by means of rule matching and condition matching. However, the false alarm rate is too high when using automated scanners and monitors. Due to the lag in rule updates and the low security awareness of internal employees, the existing methods will generate a large number of false alarms. For example, there are generally two reasons for false alarms. One is that internal employees perform operations with extremely high security risks without reporting; the other is the misjudgment of rule matching conditions. The internal security operation team has invested a lot of manpower in troubleshooting false alarms, resulting in a high manpower investment in the security operation team, which is naturally contrary to the original intention of security operation automation.

[0004] Therefore, currently automated internal security operations require a security operations system, method and / or strategy to optimize the security operations process, reduce manpower, and improve the execution efficiency of security operations. Summary of the invention

[0005] Embodiments of the present invention provide a security operation system, method, device, medium and product to reduce the manpower input of the security operation team and improve the execution efficiency of security operations.

[0006] A first aspect of an embodiment of the present invention provides a security operation system, the system comprising at least: an alarm collection module, a false alarm analysis module, a report generation module and a source tracing notification module;

[0007] The alarm collection module is used to collect the alarm records generated by each security platform and send the alarm records to the false alarm analysis module;

[0008] The false alarm analysis module is used to identify the alarm record using the false alarm analysis model to determine whether the alarm record is a false alarm; if the alarm record is not a false alarm, the alarm record is sent to the report generation module;

[0009] The report generation module is used to generate and display an alarm event analysis report based on the alarm record by using a report generation model, and determine whether the alarm record is a false alarm in response to the user's judgment based on the alarm event analysis report; if the alarm record is not a false alarm, send the alarm record to the tracing notification module;

[0010] The tracing notification module is used to determine the corresponding involved personnel according to the alarm record and send the alarm record to the involved personnel.

[0011] A second aspect of an embodiment of the present invention provides a security operation method, which is applied to the security operation system provided by the first aspect of an embodiment of the present invention, and the method includes:

[0012] The alarm collection module collects the alarm records generated by each security platform and sends the alarm records to the false alarm analysis module;

[0013] The false alarm analysis module uses a false alarm analysis model to identify the alarm record and determine whether the alarm record is a false alarm; if the alarm record is not a false alarm, the alarm record is sent to a report generation module;

[0014] By means of the report generation module, an alarm event analysis report is generated and displayed based on the alarm record using a report generation large model, and in response to the user's judgment based on the alarm event analysis report, it is determined whether the alarm record is a false alarm; if the alarm record is not a false alarm, the alarm record is sent to the tracing notification module;

[0015] Through the source tracing notification module, the corresponding involved persons are determined according to the alarm record, and the alarm record is sent to the involved persons.

[0016] A third aspect of an embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the computer program is executed by the processor, it implements the safe operation method of the first aspect of the embodiment of the present invention.

[0017] A fourth aspect of an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the security operation method of the first aspect of the embodiment of the present invention is implemented.

[0018] A fifth aspect of an embodiment of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the security operation method of the first aspect of the embodiment of the present invention.

[0019] In the security operation system provided by the embodiment of the present invention, the alarm collection module collects the alarm records generated by each security platform, and sends the alarm records to the false alarm analysis module; the false alarm analysis module uses the false alarm analysis model to identify the alarm record, and determines whether the alarm record is a false alarm; when the alarm record is not a false alarm, the alarm record is sent to the report generation module; the report generation module uses the report generation large model to generate and display an alarm event analysis report based on the alarm record, and determines whether the alarm record is a false alarm in response to the user's judgment based on the alarm event analysis report; when the alarm record is not a false alarm, the alarm record is sent to the tracing notification module; the tracing notification module determines the corresponding persons involved according to the alarm record, and sends the alarm record to the persons involved. In this way, this embodiment reduces the false alarm generation rate through a pre-trained false alarm analysis model, blocking a large number of false alarms before manual investigation to reduce the manpower input of the security operation team. At the same time, at least a report generation module and a traceability notification module are added to realize an automated process, so that security operation personnel can greatly reduce mechanical and repetitive operations and only need to focus on process approval, which greatly improves the execution efficiency of internal security operations of the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0021] Figure 1 is a structural block diagram of a security operation system shown in one embodiment of the present invention;

[0022] Figure 2 is a flow chart of a security operation method provided by an embodiment of the present invention;

[0023] Figure 3 It is an overall flow chart of an automated internal security operation method based on a security big model proposed in one embodiment of the present invention;

[0024] Figure 4 It is a schematic diagram of an electronic device shown in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] refer to Figure 1 , Figure 1 FIG. 1 is a structural block diagram of a security operation system according to an embodiment of the present invention. Figure 1 As shown, the security operation system of this embodiment includes at least: an alarm collection module, a false alarm analysis module, a report generation module and a tracing notification module.

[0027] Among them, the alarm collection module is used to collect the alarm records generated by each security platform and send the alarm records to the false alarm analysis module.

[0028] In this embodiment, the alarm collection module is connected to multiple security platforms in communication, and the alarm collection module can collect the alarm records generated by each security platform and send the collected alarm records to the false alarm analysis module. Among them, each security platform can refer to a platform set up within an enterprise company for security monitoring, such as a scanner, a monitor, etc., to monitor attack behaviors, record alarm information, and generate corresponding alarm records.

[0029] The false alarm analysis module is used to use the false alarm analysis model to identify the alarm record and determine whether the alarm record is a false alarm; if the alarm record is not a false alarm, the alarm record is sent to the report generation module.

[0030] In this embodiment, after the false alarm analysis module receives the alarm record sent by the alarm collection module, it can use the pre-trained false alarm analysis model to identify the alarm record, identify whether the alarm record is a false alarm, and output the identification result, and the identification result includes: the alarm record is not a false alarm, and the alarm record is a false alarm. Among them, the false alarm analysis model of this embodiment is a false alarm identification model constructed based on a machine learning method, and binary classification training is performed during the training process until the success rate of the model in identifying false alarms reaches a preset threshold (for example, 90%). The trained false alarm analysis model is used to identify false alarms in the alarm records generated by each security platform.

[0031] In this embodiment, when the false alarm analysis module determines that the obtained recognition result is that the alarm record is not a false alarm, it is necessary to send the non-false alarm alarm record to the report generation module for subsequent processing.

[0032] The report generation module is used to generate and display an alarm event analysis report based on the alarm record by using a report generation model, and determine whether the alarm record is a false alarm in response to the user's judgment based on the alarm event analysis report; if the alarm record is not a false alarm, the alarm record is sent to the tracing notification module.

[0033] In this embodiment, a report generation model is deployed in the report generation module, and the report generation model is trained based on the security model and is used to automatically generate an alarm event analysis report based on the alarm record. In one example, the alarm event analysis report may include: original alarm information (i.e., alarm record), relevant threat intelligence, and historical similar alarms. Among them, the security model is a large language model developed for the vertical field of security. It is trained through massive professional security knowledge, giving the machine language intelligence similar to that of security experts, so that it has the ability to process massive security data and perform specific tasks in the security field. The security model is of great significance in protecting the security of organizations and personal information and improving the efficiency of security protection. A large model refers to a machine learning model with large-scale parameters and complex computing structures. These models are usually built from deep neural networks and have billions or even hundreds of billions of parameters. The design purpose of the large model is to improve the expressiveness and predictive performance of the model, and to be able to handle more complex tasks and data. Large models are widely used in various fields, including natural language processing, computer vision, speech recognition, and recommendation systems. Large models learn complex patterns and features by training massive amounts of data, have stronger generalization capabilities, and can make accurate predictions on unseen data.

[0034] The report generation module can use the report generation model to generate and display an alarm event analysis report for the alarm record based on the received alarm record, wherein each alarm record corresponds to an alarm event analysis report. The alarm event analysis report includes at least: alarm records (i.e., the original alarm records generated by each security platform). In this embodiment, the alarm event analysis report is automatically generated by the report generation model, and there is no need to manually check the data, but it is displayed to the operator together with the original alarm information.

[0035] This embodiment uses a large model to generate reports. According to the alarm content, it automatically retrieves historical similar alarm information and related threat intelligence, and then organizes them into a report format. Operators no longer need to manually check the information, but are presented to operators along with the original alarm information, which greatly improves operational efficiency. In addition, after the event is over, it can also help operators organize the final event report based on multi-dimensional situation descriptions, greatly reducing the operational burden.

[0036] The user can make manual judgments based on the displayed alarm event analysis report, such as manual judgments by security experts based on the information reported in the previous step, to ensure the accuracy of alarm processing, determine whether the alarm record corresponding to the alarm event analysis report is a false alarm, and make relevant responses in the security operation system. The report generation module responds to the user's judgment based on the alarm event analysis report, determines whether the alarm record is a false alarm, and obtains manual judgment results, including: the alarm record is not a false alarm, and the alarm record is a false alarm. When the report generation module determines that the manual judgment result obtained is: the alarm record is not a false alarm, it is necessary to send the non-false alarm alarm record to the traceability notification module for subsequent processing.

[0037] The tracing notification module is used to determine the corresponding involved personnel according to the alarm record and send the alarm record to the involved personnel.

[0038] In this embodiment, the traceability notification module will receive alarm records that are determined to be non-false alarms by both the false alarm analysis module and the report generation module. Through the dual verification of the false alarm analysis model and manual analysis, the alarm record can be accurately determined to be a real alarm record that is not a false alarm. At this time, the traceability notification module can determine the person involved in the alarm record based on the received alarm record, and send the alarm record to the person involved to generate an alarm. For example, the notification mechanism can be automatically triggered according to the security event level of the alarm record, and the person involved can be notified in time to respond. Among them, the person involved can refer to the person involved in the key operation corresponding to the alarm record, such as the person involved in the key operation on the asset of the alarm record.

[0039] In this embodiment, the false alarm generation rate is reduced by a pre-trained false alarm analysis model, and a large number of false alarms are blocked before manual investigation to reduce the manpower input of the security operation team. At the same time, at least a report generation module and a traceability notification module are added to realize an automated process, so that security operation personnel can greatly reduce mechanical and repetitive operations and only need to focus on the approval of the process, which greatly improves the execution efficiency of internal security operations of the enterprise. In this way, from the generation of the alarm to the end of the event, the only place where the operator needs to operate manually is the manual analysis of the false alarm: the operator's traceability, information synchronization, report issuance, and other operations are all automatically handled by the intelligent security operation system, without the need for a large amount of manual manpower.

[0040] In combination with the above embodiments, in one implementation, the embodiment of the present invention further provides a security operation system. Specifically, in this embodiment, the false alarm analysis module is further configured to send the alarm record to a false alarm data set when the alarm record is a false alarm.

[0041] In this embodiment, the false alarm analysis model is obtained by training based on false alarm alarm records and real attack data, such as learning separately from previously accumulated false alarm data and malicious attack data, and performing binary classification training, so that the trained false alarm analysis module can determine whether the alarm record is a false alarm through an automatic mechanism. When the false alarm analysis module determines that the recognition result obtained is: the alarm record is a false alarm, the false alarm record (i.e., false alarm data) can be sent to the false alarm data set, and the alarm is blocked to avoid the interference of false alarms on system security. Among them, the false alarm data set of this embodiment is used to train / verify / update the false alarm analysis model in the false alarm analysis module.

[0042] The report generating module is further configured to send the alarm record to the false alarm data set when the alarm record is a false alarm.

[0043] In this embodiment, when the report generation module determines that the manual analysis result is that the alarm record is a false alarm, the false alarm record can be sent to the false alarm data set, and the alarm is blocked to avoid interference with system security by false alarms.

[0044] The false alarm analysis module is also used to update the false alarm analysis model based on the false alarm data set.

[0045] In this embodiment, the false alarm analysis module can also update the false alarm analysis model based on the false alarm data set collected after the false alarm analysis model goes online, so as to further improve the accuracy of false alarm identification by the false alarm analysis model.

[0046] In combination with the above embodiments, in one implementation, the embodiment of the present invention further provides a security operation system. Specifically, in this embodiment, the source tracing notification module is also used to create a group chat for the involved personnel, and display the alarm event analysis report in the group chat.

[0047] In this embodiment, the report generation module sends the alarm record to the source tracing notification module, and also sends the alarm event analysis report corresponding to the alarm record. After determining the involved personnel corresponding to the alarm record, the source tracing notification module can also create a group chat for the involved personnel according to the involved personnel, and display the alarm event analysis report corresponding to the alarm record in the created group. Based on this, this embodiment does not require the involved personnel to manually view the alarm event analysis report, thereby providing a real-time communication platform between security teams to promote information sharing and collaboration.

[0048] In one implementation, the involved personnel include at least: involved personnel (such as account users), security officers, and asset interface persons.

[0049] The tracing notification module is also used to respond to the judgment of the relevant personnel in the group chat to determine whether the alarm event corresponding to the alarm record is manually operated by internal personnel; if the alarm event is not manually operated by internal personnel, an emergency response is performed on the alarm record.

[0050] In this embodiment, in the created group chat, the involved personnel can make judgments on the alarm event analysis report in the group, determine whether the alarm event corresponding to the alarm record is manually operated by an internal person, and make relevant responses in the security operation system. The traceability notification module responds to the judgment of the involved personnel in the group chat, determines whether the alarm event corresponding to the alarm record is manually operated by an internal person, and obtains the result of the manual operation judgment. The manual operation judgment result includes: the alarm event is manually operated by an internal person, and the alarm event is not manually operated by an internal person.

[0051] When the source tracing notification module determines that the result of the human operation is: the alarm event is not a human operation by an internal person (such as it cannot be determined that the alarm record is a human operation by an internal person), it determines that the alarm event corresponding to the alarm record is a human attack. At this time, the source tracing notification module immediately responds to the alarm record.

[0052] In combination with the above embodiments, in another implementation, the embodiment of the present invention further provides a security operation system. Specifically, in this embodiment, the security operation system further includes: an automatic training module.

[0053] The traceability notification module is also used to send the information of the actual operator and the security manager among the personnel involved, as well as the alarm record, to the automatic training module when the alarm event is caused by manual operation of internal personnel.

[0054] In this embodiment, when the traceability notification module determines that the result of the human operation is that the alarm event is caused by human operation by an internal person, the information of the actual operator and the security manager among the personnel involved, as well as the alarm record corresponding to the alarm event, can be sent to the automatic training module.

[0055] The automatic training module is used to utilize the automatic training large model to generate training content based on the alarm record and the information of the actual operator and the security officer, and send the training content to the actual operator and the security officer, and perform training monitoring.

[0056] In this embodiment, an automatic training big model is deployed in the automatic training module. The automatic training module can use the automatic training big model to generate training content for the actual operator and the person in charge of security based on the received alarm records and the information of the actual operator and the person in charge of security. The training content is customized automated training content and programs for the actual operator and the person in charge of security that are automatically provided by the automatic training big model based on the security awareness training needs and relying on the security training knowledge base. The automatic training module can send the generated training content to the actual operator and the person in charge of security, for example, push a link to the automatic training (including the training content) to the actual operator and the person in charge of security, so as to train the actual operator and the person in charge of security and monitor the training. The training must be completed before the alarm process can be terminated.

[0057] The automatic training model of this embodiment can automatically generate training content for the actual operator and the safety manager (such as the operator who operated incorrectly) based on the alarm record corresponding to the alarm event and the information of the actual operator and the safety manager, so as to timely improve the safety awareness of internal personnel. At the same time, operating personnel no longer need to spend energy on safety promotion, but it can be completed by the automatic training module.

[0058] In combination with the above embodiment, in another implementation, the embodiment of the present invention further provides a security operation system. In this embodiment, the automatic training module is further configured to send the training result to the report generation module after monitoring the completion of the training.

[0059] In this embodiment, after monitoring the completion of the training, the automatic training module obtains the training results and sends the training results to the report generation module.

[0060] The traceability notification module is also used to generate a traceability report based on the personnel involved and send it to the report generation module.

[0061] In this embodiment, the traceability notification module will also generate a traceability report based on the personnel involved and send it to the report generation module. The traceability report includes the full process operation steps, node information and personnel information corresponding to the alarm event.

[0062] The report generation module is also used to generate and display a safety operation event report based at least on the training results, the tracing report and the alarm event analysis report.

[0063] In this embodiment, after receiving the training results and the traceability report, the report generation module will also generate and display a security operation event report based on at least the training results, the traceability report, and the alarm event analysis report. In addition, in one embodiment, the report generation module can generate and display a security operation event report based on the training results, the traceability report, the alarm event analysis report, and the account user situation description (i.e., the actual operator among the involved personnel's work situation description for the alarm event).

[0064] In combination with the above embodiments, in one implementation, the embodiment of the present invention further provides a security operation system. Specifically, in this embodiment, the alarm collection module is specifically used to:

[0065] Collect the alarm records generated by each security platform, which include at least one of the following: local privilege escalation, system backdoor monitoring, Web backdoor detection, and password cracking;

[0066] The alarm records are sorted by category through the Kafka cluster to generate a consumption queue;

[0067] By subscribing to the data stream of the Kafka cluster, the alarm record is pulled from the message queue and transferred to the false alarm analysis module.

[0068] In this embodiment, the alarm collection module can collect the alarm records generated by each security platform, wherein the alarm records include at least one of the following: local privilege escalation, system backdoor monitoring, Web backdoor detection, and password cracking, and then all the alarm records are produced to the kafka cluster. Next, the alarm collection module summarizes and organizes the collected alarm records by category through the kafka cluster, generates a consumption queue, and obtains consumption for security analysis and troubleshooting. Finally, the alarm collection module pulls the alarm records from the message queue by subscribing to the data stream of the kafka cluster, and transfers the pulled alarm records to the false alarm analysis module. Among them, when the security platform generates a new alarm shortcut, it can consume data from the message queue one by one and transfer it to the false alarm analysis model of the false alarm analysis module.

[0069] Based on the same inventive concept, an embodiment of the present invention provides a safe operation method. Figure 2 , Figure 2 is a flowchart of a security operation method provided by an embodiment of the present invention. The security operation method of this embodiment is applied to the security operation system described in any of the above embodiments, and the security operation system at least includes: an alarm collection module, a false alarm analysis module, a report generation module and a traceability notification module. Figure 2 As shown, the security operation method includes at least the following steps:

[0070] Step S11: Collect the alarm records generated by each security platform through the alarm collection module, and send the alarm records to the false alarm analysis module;

[0071] Step S12: using the false alarm analysis model to identify the alarm record through the false alarm analysis module, and determining whether the alarm record is a false alarm; if the alarm record is not a false alarm, sending the alarm record to the report generation module;

[0072] Step S13: Generate and display an alarm event analysis report based on the alarm record by using the report generation module and the report generation model, and determine whether the alarm record is a false alarm in response to the user's judgment based on the alarm event analysis report; if the alarm record is not a false alarm, send the alarm record to the tracing notification module;

[0073] Step S14: determining corresponding involved persons according to the alarm record through the source tracing notification module, and sending the alarm record to the involved persons.

[0074] Optionally, in one embodiment, a security operation method is provided. In this embodiment, the false alarm analysis model is obtained by training based on false alarm alarm records and real attack data; the method further includes:

[0075] By means of the false alarm analysis module, when the alarm record is a false alarm, the alarm record is sent to a false alarm data set;

[0076] By means of the report generation module, in the case where the alarm record is a false alarm, the alarm record is sent to the false alarm data set;

[0077] The false alarm analysis model is updated based on the false alarm data set through the false alarm analysis module.

[0078] Optionally, in one embodiment, a security operation method is provided, the method further comprising:

[0079] Through the source tracing notification module, a group chat is created for the persons involved, and the alarm event analysis report is displayed in the group chat;

[0080] Through the tracing notification module, in response to the judgment of the persons involved in the group chat, it is determined whether the alarm event corresponding to the alarm record is manually operated by an internal person; if the alarm event is not manually operated by an internal person, an emergency response is performed on the alarm record.

[0081] Optionally, in one embodiment, a safety operation method is provided, in which the system further comprises: an automatic training module; the method further comprises:

[0082] Through the traceability notification module, when the alarm event is caused by manual operation by internal personnel, the information of the actual operator and the person in charge of safety among the personnel involved, as well as the alarm record, are sent to the automatic training module;

[0083] Through the automatic training module, using the automatic training large model, based on the alarm record and the information of the actual operator and the security officer, the training content is generated and sent to the actual operator and the security officer, and the training is monitored.

[0084] Optionally, in one embodiment, a security operation method is provided, the method further comprising:

[0085] After monitoring the completion of training, the automatic training module sends the training results to the report generation module;

[0086] Generate a traceability report based on the personnel involved through the traceability notification module and send it to the report generation module;

[0087] Through the report generation module, a safety operation event report is generated and displayed based at least on the training results, the tracing report and the alarm event analysis report.

[0088] Optionally, in one embodiment, a safe operation method is provided. In this embodiment, the above step S11 specifically includes the following steps:

[0089] The alarm collection module collects alarm records generated by each security platform, wherein the alarm records include at least one of the following: local privilege escalation, system backdoor monitoring, Web backdoor detection, and password cracking;

[0090] Through the alarm collection module, the alarm records are sorted by category through the Kafka cluster to generate a consumption queue;

[0091] Through the alarm collection module, by subscribing to the data stream of the Kafka cluster, the alarm record is pulled from the message queue and transferred to the false alarm analysis module.

[0092] like Figure 3 As shown, Figure 3 This is an overall flow chart of an automated internal security operation method based on a security big model proposed in one embodiment of the present invention. Figure 3In the process, each security platform generates security platform logs based on the alarm information recorded by scanners, monitors, etc. of each security platform, and all of them are produced to the Kafka cluster; the Kafka cluster summarizes and organizes these alarm logs according to categories, waiting for the alarm collection module to consume, and for security analysis and troubleshooting; the alarm collection module subscribes to the data stream of the Kafka cluster, and when the platform generates a new alarm, it consumes data one by one from the message queue and flows to the false alarm judgment model (i.e., the false alarm judgment model in the aforementioned embodiment). The false alarm judgment model is a false alarm recognition model constructed using a machine learning algorithm. It is learned separately from the false alarm data and malicious attack data accumulated in the previous period, and is trained in two categories until the success rate of the false alarm judgment model in judging false alarms can reach 90%.

[0093] In the small model for false alarm analysis, an automatic mechanism is used to determine whether the alarm is a false alarm: if it is judged to be a non-false alarm (possibly an attack), the alarm data is transmitted to the report generation module for subsequent steps; if it is a false alarm, the alarm is transmitted to the false alarm data set, and the alarm is blocked to avoid interference with system security by false alarms. Among them, the false alarm data set collects new false alarm data generated after the small model is launched, which is used for training, updating and verification of the small model for false alarm analysis.

[0094] In the report generation module, a large report generation model is integrated, and an alarm event analysis report can be automatically generated based on the large report generation model. The alarm event analysis report contains the following content: original alarm information, relevant threat intelligence, and historical similar alarms. In this way, there is no need to manually check the information, but it is displayed to the operation personnel together with the original alarm information. At this time, if the false alarm judgment small model cannot determine that the alarm record is not a false alarm, the security expert can manually judge the false alarm based on the information in the report generated by the report generation module, that is, manual judgment, to ensure the accuracy of the alarm processing. When it is manually judged as a non-false alarm (possibly an attack behavior), the alarm data is transmitted to the operation tracing module for subsequent steps; when it is manually judged as a false alarm, the alarm data is transmitted to the false alarm data set for model update, and this alarm is blocked.

[0095] The operation traceability module can record the list of relevant personnel involved in the key operations on the assets corresponding to the alarm event based on the received alarm information, generate a traceability report and send it to the report generation module, and then automatically trigger the notification mechanism according to the security event level through the automatic notification module to promptly notify relevant personnel to respond. Among them, according to the list of relevant personnel involved (such as the list of involved personnel, the list of security persons in charge, and the list of asset interface persons), a response group chat can be quickly created, and the report information generated by the report generation module can be automatically synchronized, without the need for manual review by relevant personnel. Provide a real-time communication platform between security teams to promote information sharing and collaboration. In addition, in the group chat, all parties can determine whether it is an internal operation: when it is determined to be an internal operation, a link to automatic training is pushed to the actual internal operator and the security person in charge, and the alarm process can only be ended after completing the training through the automatic training system; when it cannot be determined that it is an internal operation, an emergency response should be carried out immediately.

[0096] In the automatic training system (i.e., the automatic training module in the aforementioned embodiment), customized automated training content and plans can be automatically provided based on the deployed automatic training big model for security awareness training needs, relying on the security training knowledge base, and pushed to relevant personnel for training; after the relevant personnel complete the training, the training results are generated and sent to the report generation module. The report generation module generates the final event operation report based on the alarm report, traceability report, training results, and account user description, thereby completing the security operation of this alarm.

[0097] The automated internal security operation method based on the security big model proposed in this embodiment is applicable to enterprises that have deployed various security platforms, scanners, and monitors and need to have the ability to train the security big model. In this embodiment, the model capabilities (big models and machine learning models) are fully utilized and specifically combined with three scenarios for use: the first is the false alarm judgment model, which can greatly reduce the false alarm rate and reduce manual investigation by training the model; the second is the report generation big model, which can automatically retrieve historical similar alarm information and related threat intelligence based on the alarm content, and then organize it into a report format. The operator no longer needs to manually check the information, but displays it to the operator together with the original alarm information, which greatly improves the operation efficiency. In addition, after the event is over, it can also help the operator to organize the final event report based on the multi-dimensional situation description, which greatly reduces the operation burden; the third is the automatic training big model, which can automatically generate training content for the wrong operator based on the content of this alarm event, and timely improve the safety awareness of internal personnel. At the same time, the operator no longer needs to spend energy on promoting safety, but it is completed by the automatic training system.

[0098] In addition, the automated internal security operation method based on the security big model shown in this embodiment proposes an automated event processing process: from the generation of an alarm to the end of the event, the only place where operators need to operate manually is the manual judgment of a false alarm. The operations such as operator tracing, group chat creation, information synchronization, report issuance, and security publicity are all automatically handled by the intelligent system, without the need for a large amount of manual manpower.

[0099] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0100] As for the method embodiment, since it is basically similar to the system embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment.

[0101] Based on the same inventive concept, another embodiment of the present invention provides an electronic device, such as Figure 4 shown. Figure 4 1 is a schematic diagram of an electronic device according to an embodiment of the present invention. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the security operation method according to any of the above embodiments of the present invention when executing the computer program.

[0102] Based on the same inventive concept, another embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the security operation method described in any of the above embodiments of the present invention are implemented.

[0103] Based on the same inventive concept, another embodiment of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the security operation method described in any of the above embodiments of the present invention.

[0104] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0105] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, embodiments of the present invention may take the form of complete hardware embodiments, complete software embodiments, or embodiments combining software and hardware. Furthermore, embodiments of the present invention may take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0106] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0110] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0111] The above is a detailed introduction to a security operation system, method, equipment, medium and product provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A security operation system, characterized in that: The system at least includes: an alarm collection module, a false alarm analysis module, a report generation module and a traceability notification module; The alarm collection module is used to collect the alarm records generated by each security platform and send the alarm records to the false alarm analysis module; The false alarm analysis module is used to identify the alarm record using the false alarm analysis model to determine whether the alarm record is a false alarm; if the alarm record is not a false alarm, the alarm record is sent to the report generation module; The report generation module is used to generate and display an alarm event analysis report based on the alarm record by using a report generation model, and determine whether the alarm record is a false alarm in response to the user's judgment based on the alarm event analysis report; if the alarm record is not a false alarm, send the alarm record to the tracing notification module; The tracing notification module is used to determine the corresponding involved personnel according to the alarm record and send the alarm record to the involved personnel.

2. The security operation system according to claim 1, characterized in that: The false alarm analysis model is trained based on false alarm records and real attack data; The false alarm analysis module is further configured to send the alarm record to a false alarm data set when the alarm record is a false alarm; The report generating module is further configured to send the alarm record to the false alarm data set when the alarm record is a false alarm; The false alarm analysis module is also used to update the false alarm analysis model based on the false alarm data set.

3. The security operation system according to claim 1, characterized in that: The source tracing notification module is further used to create a group chat for the persons involved, and to display the alarm event analysis report in the group chat; The tracing notification module is also used to respond to the judgment of the relevant personnel in the group chat to determine whether the alarm event corresponding to the alarm record is manually operated by internal personnel; if the alarm event is not manually operated by internal personnel, an emergency response is performed on the alarm record.

4. The security operation system according to claim 3, characterized in that: The system also includes: an automatic training module; The tracing notification module is further used to send the information of the actual operator and the security manager among the personnel involved, as well as the alarm record, to the automatic training module when the alarm event is caused by manual operation by internal personnel; The automatic training module is used to utilize the automatic training large model to generate training content based on the alarm record and the information of the actual operator and the security officer, and send the training content to the actual operator and the security officer, and perform training monitoring.

5. The security operation system according to claim 4, characterized in that: The automatic training module is further used to send the training results to the report generation module after monitoring the completion of the training; The traceability notification module is further used to generate a traceability report based on the personnel involved and send it to the report generation module; The report generation module is also used to generate and display a safety operation event report based at least on the training results, the tracing report and the alarm event analysis report.

6. The security operation system according to any one of claims 1 to 5, characterized in that: The alarm collection module is specifically used for: Collect the alarm records generated by each security platform, which include at least one of the following: local privilege escalation, system backdoor monitoring, Web backdoor detection, and password cracking; The alarm records are sorted by category through the Kafka cluster to generate a consumption queue; By subscribing to the data stream of the Kafka cluster, the alarm record is pulled from the message queue and transferred to the false alarm analysis module.

7. A safe operation method, characterized in that: Applied to the security operation system according to any one of claims 1 to 6, the method comprises: The alarm collection module collects the alarm records generated by each security platform and sends the alarm records to the false alarm analysis module; The false alarm analysis module uses a false alarm analysis model to identify the alarm record and determine whether the alarm record is a false alarm; if the alarm record is not a false alarm, the alarm record is sent to a report generation module; By means of the report generation module, an alarm event analysis report is generated and displayed based on the alarm record using a report generation large model, and in response to the user's judgment based on the alarm event analysis report, it is determined whether the alarm record is a false alarm; if the alarm record is not a false alarm, the alarm record is sent to the tracing notification module; Through the source tracing notification module, the corresponding involved persons are determined according to the alarm record, and the alarm record is sent to the involved persons.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is executed by the processor, the security operation method according to claim 7 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the security operation method according to claim 7 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the safe operation method described in claim 7 is implemented.

Images