Automatic attack handling method implemented by SOAR technology through secure resource pool

Abstract

The embodiment of the invention discloses an automatic attack handling method implemented through a security resource pool by an SOAR technology, and relates to the technical field of network service security, and the method comprises the steps: carrying out the recognition of an attack event based on a security operation platform, and determining the attack type of the attack event; matching the attack category with preset protection rules arranged through the SOAR technology, and taking a preset protection strategy corresponding to the attack category in the preset protection rules as a target protection strategy; and calling a security component in a security resource pool according to the target protection strategy to complete automatic disposal of the attack event. The SOAR technology is combined with the security resource pool, automatic security operation is realized through the dynamic allocation capability of the security operation platform to the security components in the security resource pool and the security capability cooperation advantage between different security resource pools, and the network security event handling efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an automated attack handling method implemented by SOAR technology through a security resource pool. Background Art

[0002] SOAR (Security Orchestration, Automation and Response) is a technology that improves the efficiency of security incident response by integrating security tools, automated processes and standardized workflows. Currently, SOAR technology requires preset protection rules, which need to be written and designed in advance by security experts. It is not flexible enough and cannot adapt to dynamic security threats. The hardware such as security devices integrated by SOAR technology is suitable for static allocation of security resources and cannot dynamically respond to sudden attacks. In large-scale and complex scenarios (scenarios with multiple security resource pools), SOAR technology has problems such as high difficulty in unified management and coordination of multiple lines and difficulty in adapting multiple devices. Summary of the invention

[0003] In view of this, the present invention provides an automated attack handling method realized by SOAR technology through a security resource pool, which is used to solve the problem that the existing SOAR technology needs to preset protection rules. These rules need to be written and designed in advance by security experts, are not flexible enough, and cannot adapt to dynamic security threats; hardware such as security devices integrated by SOAR technology are suitable for static allocation of security resources and cannot dynamically respond to sudden attacks; in large-scale and complex scenarios (scenarios with multiple security resource pools), SOAR technology has problems such as high difficulty in unified management and coordination of multiple lines, and difficulty in adapting multiple devices.

[0004] In a first aspect, an embodiment of the present invention provides an attack automation handling method implemented by SOAR technology through a security resource pool, the method comprising: Identify attack events based on the security operation platform and determine the attack category of the attack events; Matching the attack category with the preset protection rules compiled by SOAR technology, and using the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy; The security components in the security resource pool are called according to the target protection strategy to complete the automatic handling of the attack event.

[0005] Optionally, the step of identifying the attack event based on the security operation platform and determining the attack category of the attack event includes: Acquiring alarm information of a security resource pool and a system where the security resource pool is located based on the security operation platform, and taking an event corresponding to the alarm information as the attack event; Acquire characteristic data of the attack event, and determine the attack category of the attack event based on the characteristic data.

[0006] Optionally, the step of identifying the attack event based on the security operation platform and determining the attack category of the attack event further includes: Invoking the attack event identification model through the security operation platform; Acquire first operation data of a security resource pool and second operation data of a system where the security resource pool is located based on the security operation platform; Substituting the first operation data and the second operation data into the attack event recognition model respectively to obtain a recognition result; When the recognition result indicates that an attack event exists, the attack category of the attack event is determined according to the recognition result.

[0007] Optionally, the method further includes: Determine a treatment plan for the attack category by using a first treatment plan prediction model and the attack category; Matching the treatment plan with the target protection strategy; If the treatment plan is inconsistent with the target protection strategy, a modification suggestion for updating the preset protection rule is generated based on the treatment plan, and the modification suggestion is displayed.

[0008] Optionally, the step of matching the attack category with a preset protection rule arranged by SOAR technology, and using a preset protection strategy corresponding to the attack category in the preset protection rule as a target protection strategy, further includes: Matching the attack category with the preset protection rules compiled by SOAR technology, if there is no preset protection rule corresponding to the attack category in the preset protection rules; Then obtaining context information of the attack event; Inputting the context information into a second disposal solution prediction model to obtain a first target disposal solution corresponding to the attack event; Through SOAR technology, a preset protection rule corresponding to the attack event is generated according to the first target disposal plan to obtain a preset protection rule corresponding to the attack category, and the preset protection strategy corresponding to the attack category in the preset protection rule is used as the target protection strategy.

[0009] Optionally, the step of matching the attack category with a preset protection rule arranged by SOAR technology, and using a preset protection strategy corresponding to the attack category in the preset protection rule as a target protection strategy, further includes: Matching the attack category with the preset protection rules compiled by SOAR technology, if there is no preset protection rule corresponding to the attack category in the preset protection rules; Then obtaining context information of the attack event; Matching the context information with the preset protection data to obtain a second target disposal solution corresponding to the attack event; Through SOAR technology, a preset protection rule corresponding to the attack event is generated according to the second target disposal plan to obtain the preset protection rule corresponding to the attack category, and the preset protection strategy corresponding to the attack category in the preset protection rule is used as the target protection strategy.

[0010] Optionally, the step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event includes: A control instruction is generated according to the target protection strategy, and the control instruction is sent to the security resource pool, so that the security resource pool responds to the control instruction to call the security component and completes the automatic handling of the attack event.

[0011] Optionally, the step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event further includes: Generate a control instruction according to the target protection strategy, and send the control instruction to the security operation platform; Acquire the occurrence point of the attack event based on the security operation platform, determine the security resource pool corresponding to the occurrence point, and use the security resource pool corresponding to the occurrence point as the target security resource pool; The control instruction is sent to the target security resource pool through the security operation platform, so that the target security resource pool responds to the control instruction to call the security component and completes the automated handling of the attack event.

[0012] Optionally, the step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event further includes: Obtaining protection function parameters of each security component in the security resource pool through the security operation platform, and judging whether the security components in the security resource pool can meet the target protection strategy based on the protection function parameters; When the security components in the security resource pool cannot meet the target protection strategy, the security resource pool is updated based on the target protection strategy, and the automatic handling of the attack event is completed based on the updated security resource pool.

[0013] Optionally, the method further comprises: Obtaining process data of the attack event; When the process data indicates that the attack event is over, the updated security resource pool is restored to release the resources occupied when the security resource pool is updated.

[0014] On the other hand, an embodiment of the present invention provides an attack automation handling device implemented by SOAR technology through a security resource pool, the device comprising: An identification module, used to identify attack events based on the security operation platform and determine the attack category of the attack event; A matching module, used to match the attack category with the preset protection rules arranged by SOAR technology, and use the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy; The execution module is used to call the security components in the security resource pool according to the target protection strategy to complete the automatic disposal of the attack event.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising: One or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the attack automation handling method implemented by the SOAR technology through the security resource pool in any embodiment of the present invention.

[0016] In a fourth aspect, an embodiment of the present invention further provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute an automated attack handling method implemented by a security resource pool using the SOAR technology in any of the embodiments of the present invention.

[0017] The technical solution of the embodiment of the present invention is to identify attack events based on a security operation platform and determine the attack category of the attack event; match the attack category with the preset protection rules arranged by SOAR technology, and use the preset protection strategy corresponding to the attack category in the preset protection rules as the target protection strategy; call the security components in the security resource pool according to the target protection strategy to complete the automated handling of the attack event. Combining SOAR technology with the security resource pool, the dynamic allocation capability of the security operation platform to the security components in the security resource pool and the advantages of the security capability collaboration between different security resource pools avoid the limitations of fixed security components in the security resource pool. Dynamically updating the preset protection rules arranged by SOAR technology can protect against different attack events, realize automated security event handling, and improve the handling efficiency of network security event handling. Rapid response and handling of security risks and threatening intrusion behaviors can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] in: Figure 1 A flowchart of an automated attack handling method implemented by a SOAR technology through a security resource pool in an embodiment of the present invention; Figure 2 It is a structural diagram of an automatic attack handling device implemented by a SOAR technology through a security resource pool in an embodiment of the present invention; Figure 3 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention; Figure 4 It is a schematic diagram of a computer-readable storage structure provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] An embodiment of the present invention provides an automated attack handling method implemented by SOAR technology through a security resource pool. SOAR technology is used to implement automated response and handling of attacks through a security resource pool. The capabilities of security components in the security resource pool are utilized to collect traffic, logs, alarms and other information, and aggregate them to a security operation platform. The security operation platform processes and analyzes the above information by calling an attack event identification model, and sends the result (attack category of the attack event) to the SOAR platform. The SOAR platform sends the handling strategy to the corresponding security component in the security resource pool through an orchestrator according to preset protection rules, and completes the automated response and handling of security events through the strategy of the security component.

[0022] In one embodiment, an embodiment of the present invention provides an attack automation handling method implemented by SOAR technology through a security resource pool, and the attack automation handling method implemented by SOAR technology through a security resource pool in the embodiment of the present invention can be executed by an attack automation handling device implemented by SOAR technology through a security resource pool. The attack automation handling device implemented by SOAR technology through a security resource pool can be implemented by software and / or hardware.

[0023] like Figure 1 As shown, the attack automation handling method implemented by the SOAR technology of the embodiment of the present invention through the security resource pool specifically includes the following steps: S110, identifying the attack event based on the security operation platform, and determining the attack category of the attack event; In a possible implementation manner, the step of identifying an attack event based on a security operation platform and determining an attack category of the attack event includes: Acquiring alarm information of a security resource pool and a system where the security resource pool is located based on the security operation platform, and taking an event corresponding to the alarm information as the attack event; Acquire characteristic data of the attack event, and determine the attack category of the attack event based on the characteristic data.

[0024] Exemplarily, a host anomaly detection rule based on the normal distribution method and a traffic anomaly detection rule based on the statistical method are established. The host anomaly detection rule based on the normal distribution method adopts a statistical method based on normal distribution. In the learning phase, the interval thresholds of 24 measurements of each protected host in each time period every day for the past 30 days are calculated, and a traffic rule is established based on the interval threshold. In the working phase, the latest data of each port on each host is calculated for the day, and the latest data is compared with the historical mean. If the displayed activity difference exceeds the preset standard deviation, an alarm will be generated. In order to avoid false alarms of short-term port use, one of the following two conditions must be met: there are at least 50 flow data in the current hour, or the calculated baseline mean has at least 50 flow data. Based on the traffic anomaly detection rule of the statistical method, the anomaly detection first uses the historical flow data of the network flow to establish the normal flow rule, and evaluates the deviation of the current flow through the flow steady-state rule to determine whether the current flow is abnormal. The establishment and update of traditional detection rules is to estimate the characteristics based on the central limit theorem and hypothesis testing theorem, find the confidence interval of the detection rules within a period of time, and then compare whether the current traffic characteristic value is within the confidence interval. If it is satisfied, it means that the current traffic behavior is normal and the queue data is updated; otherwise, an abnormality has occurred, the historical queue data is not updated, and an abnormal error is reported. In addition to the above rules, the security operation platform customizes a variety of analysis rules for terminal logs, traffic logs, and alarm logs to realize the analysis and operation of the operation platform.

[0025] In a possible implementation manner, the step of identifying the attack event based on the security operation platform and determining the attack category of the attack event further includes: Invoking the attack event identification model through the security operation platform; Acquire first operation data of a security resource pool and second operation data of a system where the security resource pool is located based on the security operation platform; Substituting the first operation data and the second operation data into the attack event recognition model respectively to obtain a recognition result; When the recognition result indicates that an attack event exists, the attack category of the attack event is determined according to the recognition result.

[0026] Exemplarily, the trained large language model (as a specific Qwen large model for classification) can be used as the attack recognition model, and the trained Qwen large model can be subsequently deployed on the server.

[0027] Exemplarily, the training of the Qwen large model can use known attack types and operating data corresponding to the known attack types as training sets / validation sets.

[0028] Exemplarily, the first operating data includes but is not limited to logs and event data of the security resource pool; the second operating data includes but is not limited to logs and event data of the system where the security resource pool is located.

[0029] By identifying the attack type in different ways, the method described in this application can be applied to different scenarios.

[0030] S120, matching the attack category with a preset protection rule arranged by SOAR technology, and using a preset protection strategy corresponding to the attack category in the preset protection rule as a target protection strategy; S130. Call the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event.

[0031] By identifying attack events based on the security operation platform and determining the attack category of the attack event; matching the attack category with the preset protection rules arranged by SOAR technology, and using the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy; calling the security components in the security resource pool according to the target protection strategy to complete the automated handling of the attack event. Combining SOAR technology with the security resource pool, the dynamic allocation capability of the security operation platform to the security components in the security resource pool and the advantages of the security capability collaboration between different security resource pools avoid the limitations of fixed security components in the security resource pool. Dynamically updating the preset protection rules arranged by SOAR technology can protect against different attack events, realize automated security event handling, and improve the handling efficiency of network security event handling. Achieve rapid response and handling of security risks and threatening intrusion behaviors.

[0032] In a possible implementation, the method further includes: Determine a treatment plan for the attack category by using a first treatment plan prediction model and the attack category; Matching the treatment plan with the target protection strategy; If the treatment plan is inconsistent with the target protection strategy, a modification suggestion for updating the preset protection rule is generated based on the treatment plan, and the modification suggestion is displayed.

[0033] Exemplarily, the first handling solution prediction model can be understood as a large language model for predicting a handling solution for the attack category.

[0034] For example, with the development of technology, in actual use, there are often better protection methods. For example, the preset protection strategy for attack type A in the preset protection rules orchestrated by SOAR technology requires the mobilization of components X and Y. However, due to the iterative update of security protection technology, component Z has emerged with the same function as component Y and better performance. At this time, a modification suggestion is generated (component Z is recommended to technicians) to ensure the optimal protection effect.

[0035] In a possible implementation, the step of matching the attack category with a preset protection rule arranged by SOAR technology, and using a preset protection strategy corresponding to the attack category in the preset protection rule as a target protection strategy, further includes: Matching the attack category with the preset protection rules compiled by SOAR technology, if there is no preset protection rule corresponding to the attack category in the preset protection rules; Then obtaining context information of the attack event; Inputting the context information into a second disposal solution prediction model to obtain a first target disposal solution corresponding to the attack event; Through SOAR technology, a preset protection rule corresponding to the attack event is generated according to the first target disposal plan to obtain a preset protection rule corresponding to the attack category, and the preset protection strategy corresponding to the attack category in the preset protection rule is used as the target protection strategy.

[0036] Exemplarily, the context information includes but is not limited to the severity of the incident, the affected assets, the attacker's behavior patterns, the current system status, etc., and the second disposal solution prediction model is a large language model trained based on historical context information and historical disposal solutions corresponding to the historical context information.

[0037] Exemplarily, the second disposal solution prediction model and SOAR technology dynamically generate protection strategies, which can automatically generate response strategies based on real-time security events, threat intelligence and environmental changes. The SOAR platform collects security events and threat data in real time through a variety of security tools (such as EDR, firewalls, etc.); threat data can be obtained through external threat intelligence (such as IP blacklists, malicious hash values, etc.); then the second disposal solution prediction model (a large language model trained based on historical context information and historical disposal solutions corresponding to historical context information) is used to analyze historical events (threat data) and response effects, and dynamically generate script content.

[0038] Exemplarily, the attack event recognition model, the first disposal solution prediction model and the second disposal solution prediction model may be three independent large language models, or may be a single large language model that simultaneously has the functions of attack recognition, determining the disposal solution for the attack category according to the attack category, and determining the first target disposal solution corresponding to the attack event according to the context information of the attack event.

[0039] In a possible implementation, the step of matching the attack category with a preset protection rule arranged by SOAR technology, and using a preset protection strategy corresponding to the attack category in the preset protection rule as a target protection strategy, further includes: Matching the attack category with the preset protection rules compiled by SOAR technology, if there is no preset protection rule corresponding to the attack category in the preset protection rules; Then obtaining context information of the attack event; Matching the context information with the preset protection data to obtain a second target disposal solution corresponding to the attack event; Through SOAR technology, a preset protection rule corresponding to the attack event is generated according to the second target disposal plan to obtain the preset protection rule corresponding to the attack category, and the preset protection strategy corresponding to the attack category in the preset protection rule is used as the target protection strategy.

[0040] For example, since the preset protection strategies corresponding to the attack categories obtained through the large language model often lack specificity, in specific scenarios (special security protection requirements), determining the second target handling plan corresponding to the attack event based on the preset protection data pre-set by the technical staff is more in line with actual needs, and can face different scenarios and meet different special needs in different scenarios.

[0041] Exemplarily, the preset protection data includes but is not limited to different attack types and protection strategies corresponding to the different attack types, default scripts, etc.

[0042] In a possible implementation manner, the step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event includes: A control instruction is generated according to the target protection strategy, and the control instruction is sent to the security resource pool, so that the security resource pool responds to the control instruction to call the security component and completes the automatic handling of the attack event.

[0043] Exemplarily, the control instruction is sent to the security resource pool to avoid the control instruction from passing through the data transmission process of the security operation platform, thereby improving response efficiency and reducing resource occupation.

[0044] In a possible implementation manner, the step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event further includes: Generate a control instruction according to the target protection strategy, and send the control instruction to the security operation platform; Acquire the occurrence point of the attack event based on the security operation platform, determine the security resource pool corresponding to the occurrence point, and use the security resource pool corresponding to the occurrence point as the target security resource pool; The control instruction is sent to the target security resource pool through the security operation platform, so that the target security resource pool responds to the control instruction to call the security component and completes the automated handling of the attack event.

[0045] Exemplarily, when there are multiple security resource pools, the occurrence point of the attack event is identified through the security operation platform, and then the control instruction is sent to the security resource pool corresponding to the occurrence point through the security operation platform to ensure targeted protection and avoid erroneous response.

[0046] In a possible implementation manner, the step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event further includes: Obtaining protection function parameters of each security component in the security resource pool through the security operation platform, and judging whether the security components in the security resource pool can meet the target protection strategy based on the protection function parameters; When the security components in the security resource pool cannot meet the target protection strategy, the security resource pool is updated based on the target protection strategy, and the automatic handling of the attack event is completed based on the updated security resource pool.

[0047] Exemplarily, the security resource pool is dynamically updated so that the security components in the security resource pool are not fixed, thereby enabling the security resource pool to protect against different attack events, avoiding the limitations of fixed security components in the security resource pool, and improving the scope of application of the solution described in this application.

[0048] In a possible implementation, the method further includes: Obtaining process data of the attack event; When the process data indicates that the attack event is over, the updated security resource pool is restored to release the resources occupied by updating the security resource pool.

[0049] Exemplarily, when the attack event ends, the temporarily occupied security component resources are released, that is, the security components used to update the security resource pool are no longer occupied, thereby avoiding waste of resources.

[0050] In a possible implementation, Figure 2 As shown, the present application provides an attack automation handling device implemented by SOAR technology through a security resource pool, the device comprising: An identification module 201 is used to identify attack events based on the security operation platform and determine the attack category of the attack event; A matching module 202, configured to match the attack category with a preset protection rule arranged by the SOAR technology, and use a preset protection strategy corresponding to the attack category in the preset protection rule as a target protection strategy; Execution module 203 is used to call the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event It is worth noting that the various modules included in the above-mentioned device are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be realized; in addition, the specific names of the various functional modules are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the embodiments of the present invention.

[0051] In another embodiment of the present invention, an electronic device is also provided. Figure 3 A block diagram of an exemplary electronic device 50 suitable for implementing exemplary embodiments of the present invention is shown. Figure 3 The electronic device 50 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0052] like Figure 3 As shown, the electronic device 50 is in the form of a general-purpose computing device. The components of the electronic device 50 may include, but are not limited to: one or more processors or processing units 501, a system memory 502, and a bus 503 connecting different system components (including the system memory 502 and the processing unit 501).

[0053] Bus 503 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0054] The electronic device 50 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 50, including volatile and non-volatile media, removable and non-removable media.

[0055] The system memory 502 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 504 and / or cache memory 505. The electronic device 50 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 506 may be used to read and write non-removable, non-volatile magnetic media ( Figure 3 not shown, usually called a "hard drive"). Although Figure 3 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 503 via one or more data medium interfaces. The memory 502 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0056] A program / utility 508 having a set (at least one) of program modules 507 may be stored, for example, in the memory 502, such program modules 507 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include an implementation of a network environment. The program modules 507 generally perform the functions and / or methods of the embodiments described herein.

[0057] The electronic device 50 may also communicate with one or more external devices 509 (e.g., keyboards, pointing devices, displays 510, etc.), may communicate with one or more devices that enable a user to interact with the electronic device 50, and / or may communicate with any device that enables the electronic device 50 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface 511. Furthermore, the electronic device 50 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 512. As shown, the network adapter 512 communicates with other modules of the electronic device 50 via the bus 503. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 50, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0058] The processing unit 501 executes various functional applications and data processing by running the programs stored in the system memory 502, such as implementing the automatic attack handling method realized by the SOAR technology provided by the embodiment of the present invention through the security resource pool.

[0059] In another embodiment of the present invention, Figure 4 As shown, a storage medium 400 including a computer program 411 is also provided. When the computer program 411 is executed by a computer processor, it is used to execute an attack automation handling method implemented by SOAR technology through a security resource pool. The method includes: Identify attack events based on the security operation platform and determine the attack category of the attack events; Matching the attack category with the preset protection rules compiled by SOAR technology, and using the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy; The security components in the security resource pool are called according to the target protection strategy to complete the automatic handling of the attack event.

[0060] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device.

[0061] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0062] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0063] Computer program code for performing the operation of the embodiments of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0064] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for automatically handling attacks using SOAR technology through a security resource pool, characterized in that: include: Identify attack events based on the security operation platform and determine the attack category of the attack events; Matching the attack category with the preset protection rules compiled by SOAR technology, and using the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy; The step of matching the attack category with the preset protection rule arranged by the SOAR technology, and taking the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy, further includes: Matching the attack category with the preset protection rules compiled by SOAR technology, if there is no preset protection rule corresponding to the attack category in the preset protection rules; Then obtaining context information of the attack event; Inputting the context information into a second disposal solution prediction model to obtain a first target disposal solution corresponding to the attack event; Generate a preset protection rule corresponding to the attack event according to the first target disposal scheme through SOAR technology, obtain a preset protection rule corresponding to the attack category, and use the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy; The step of matching the attack category with the preset protection rule arranged by the SOAR technology, and taking the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy, further includes: Matching the attack category with the preset protection rules compiled by SOAR technology, if there is no preset protection rule corresponding to the attack category in the preset protection rules; Then obtaining context information of the attack event; Matching the context information with the preset protection data to obtain a second target disposal solution corresponding to the attack event; Generate a preset protection rule corresponding to the attack event according to the second target disposal scheme through SOAR technology, obtain a preset protection rule corresponding to the attack category, and use the preset protection strategy corresponding to the attack category in the preset protection rule as the target protection strategy; The security components in the security resource pool are called according to the target protection strategy to complete the automatic handling of the attack event.

2. The method for automatically handling attacks using the SOAR technology through a security resource pool as claimed in claim 1, characterized in that: The step of identifying the attack event based on the security operation platform and determining the attack category of the attack event includes: Acquiring alarm information of a security resource pool and a system where the security resource pool is located based on the security operation platform, and taking an event corresponding to the alarm information as the attack event; Acquire characteristic data of the attack event, and determine the attack category of the attack event based on the characteristic data.

3. The method for automatically handling attacks using the SOAR technology through a security resource pool as claimed in claim 1, characterized in that: The step of identifying the attack event based on the security operation platform and determining the attack category of the attack event also includes: Invoking the attack event identification model through the security operation platform; Acquire first operation data of a security resource pool and second operation data of a system where the security resource pool is located based on the security operation platform; Substituting the first operation data and the second operation data into the attack event recognition model respectively to obtain a recognition result; When the recognition result indicates that an attack event exists, the attack category of the attack event is determined according to the recognition result.

4. The method for automatically handling attacks using the SOAR technology through a security resource pool as claimed in claim 1, characterized in that: The method further comprises: Determine a treatment plan for the attack category by using a first treatment plan prediction model and the attack category; Matching the treatment plan with the target protection strategy; If the treatment plan is inconsistent with the target protection strategy, a modification suggestion for updating the preset protection rule is generated based on the treatment plan, and the modification suggestion is displayed.

5. The method for automatically handling attacks using the SOAR technology through a security resource pool as claimed in claim 1, characterized in that: The step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event includes: A control instruction is generated according to the target protection strategy, and the control instruction is sent to the security resource pool, so that the security resource pool responds to the control instruction to call the security component and completes the automatic handling of the attack event.

6. The method for automatically handling attacks using the SOAR technology through a security resource pool as claimed in claim 1, characterized in that: The step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event also includes: Generate a control instruction according to the target protection strategy, and send the control instruction to the security operation platform; Acquire the occurrence point of the attack event based on the security operation platform, determine the security resource pool corresponding to the occurrence point, and use the security resource pool corresponding to the occurrence point as the target security resource pool; The control instruction is sent to the target security resource pool through the security operation platform, so that the target security resource pool responds to the control instruction to call the security component and completes the automated handling of the attack event.

7. The method for automatically handling attacks using the SOAR technology through a security resource pool as claimed in claim 1, characterized in that: The step of calling the security components in the security resource pool according to the target protection strategy to complete the automatic handling of the attack event also includes: Obtaining protection function parameters of each security component in the security resource pool through the security operation platform, and judging whether the security components in the security resource pool can meet the target protection strategy based on the protection function parameters; When the security components in the security resource pool cannot meet the target protection strategy, the security resource pool is updated based on the target protection strategy, and the automatic handling of the attack event is completed based on the updated security resource pool.

8. The method for automatically handling attacks using the SOAR technology through a security resource pool as claimed in claim 7, characterized in that: The method further comprises: Obtaining process data of the attack event; When the process data indicates that the attack event is over, the updated security resource pool is restored to release the resources occupied by updating the security resource pool.

Images