Network security event response method and device, electronic equipment and storage medium
By automatically generating response plans for network security incidents, the problem of the inability to respond to new network security incidents in the existing technology is solved, and automated and standardized emergency response processing is realized, reducing dependence on experts and manual operations.
Patent Information
- Application Number
- CN202311806004.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-12-25
- Publication Date
- 2025-07-04
AI Technical Summary
The existing technology cannot configure new security emergency response plans in a timely and effective manner, resulting in the inability to respond to network security incidents in a timely manner and is susceptible to security threats and losses.
By obtaining information about network security events, an adaptive response plan is generated, including entities, event titles and types, etc., the pre-trained model is used to extract feature vectors, match and generate corresponding response actions and stages, and automatically execute emergency response processes.
Reliance on security experts is reduced, manual operations are reduced, network security incidents are responded in a timely manner, security threats and losses are reduced, and it is in line with standardized emergency response requirements.
Smart Images
Figure CN120263426A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technologies, and in particular, to a network security event response method, apparatus, electronic device, and storage medium. Background Art
[0002] With the continuous change of network security attack methods, attackers generate new network security events after attacking with new attack methods. The configured response plans cannot respond to the new network security events, and new response plans need to be configured by operation personnel to deal with the new attack methods.
[0003] In the cloud environment, a large number of new security events will be generated. Manually configuring response plans requires rich security experience and is also faced with problems such as complex configuration and lack of security experts. Therefore, new security emergency response plans cannot be configured in a timely and effective manner manually, resulting in the inability to respond to security events in a timely manner and being vulnerable to security threats and losses. Summary of the Invention
[0004] Embodiments of this application provide a network security event response method, apparatus, electronic device, and storage medium to solve the problem that new security emergency response plans cannot be configured in a timely and effective manner manually, resulting in the inability to respond to security events in a timely manner and being vulnerable to security threats and losses.
[0005] In a first aspect, embodiments of this application provide a network security event response method, which includes: obtaining a network security event; if the network security event does not match the existing response plan, generating a response plan corresponding to the network security event based on the event information of the network security event; and performing response processing on the network security event according to the response plan corresponding to the network security event.
[0006] In a second aspect, embodiments of this application provide a network security event response apparatus, which includes: an obtaining module for obtaining a network security event; a generating module for generating a response plan corresponding to the network security event based on the event information of the network security event if the network security event does not match the existing response plan; and a response module for performing response processing on the network security event according to the response plan corresponding to the network security event.
[0007] In a third aspect, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored on the memory, where the processor implements the method according to any one of the above when executing the computer program.
[0008] In a fourth aspect, embodiments of this application provide a computer-readable storage medium, in which a computer program is stored, and the computer program implements the method according to any one of the above when executed by a processor.
[0009] Compared with the prior art, the present application has the following advantages:
[0010] The present application provides a network security event response method, apparatus, electronic device and storage medium. First, a network security event is obtained; if the network security event does not match the existing response plan, then based on the event information of the network security event, a response plan corresponding to the network security event is generated; then, according to the response plan corresponding to the network security event, response processing is performed on the network security event. In this embodiment, in the case where the network security event does not match the existing response plan, a response plan corresponding to the network security event can be generated based on the event information of the network security event, effectively reducing the dependence on security experts and reducing manual operations, and timely performing response processing on the network security event to reduce security threats and losses.
[0011] The above description is only an overview of the technical solution of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present application more obvious and understandable, the following specifically illustrates the specific implementation manners of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0012] In the drawings, unless otherwise specified, the same reference numerals throughout the several views denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments in accordance with the present application and should not be regarded as limiting the scope of the present application.
[0013] Figure 1 FIG. is a schematic diagram of an application scenario of the network security event response method provided by the present application.
[0014] Figure 2 FIG. is a schematic diagram of a response plan according to an embodiment of the present application.
[0015] Figure 3 FIG. is a flowchart of the network security event response method according to an embodiment of the present application.
[0016] Figure 4 FIG. is a flowchart of the network security event response method according to an embodiment of the present application.
[0017] Figure 5 FIG. is a structural block diagram of the network security event response apparatus according to an embodiment of the present application.
[0018] Figure 6 FIG. is a block diagram of an electronic device for implementing the embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0019] In the following text, only some exemplary embodiments are briefly described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the concept or scope of the present application. Therefore, the drawings and the description are considered to be exemplary in nature and not restrictive.
[0020] To facilitate the understanding of the technical solutions of the embodiments of the present application, the related technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all fall within the protection scope of the embodiments of the present application.
[0021] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data that have been authorized by the user or fully authorized by all parties. And the collection, use, and processing of the relevant data need to comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation entrances are provided for the user to choose to authorize or refuse.
[0022] Figure 1 It is a schematic diagram of an application scenario of the network security event response method provided by the present application. As Figure 1 shown, the network security event response method in this embodiment includes:
[0023] Step S101, obtain a network security event.
[0024] Among them, network security events include security violation events that threaten confidentiality, integrity, availability, or sensitive data of an information system. For example, network attack events intentionally carried out by hackers or unauthorized users, and events where legitimate authorized users accidentally violate security policies, etc.
[0025] A network security event can be obtained by using an anomaly detection model. Among them, the anomaly detection model includes detection rules for security events. For example, if there are more than 10 login failures in 1 minute in the user login log, a security event will be generated. This event matches the anomaly model of brute force cracking and belongs to a brute force cracking event. Cloud account and password abnormal call events, etc. can also be obtained through other anomaly detection models.
[0026] Step S102, extract event information.
[0027] Among them, the event information includes: entity, event title, event type, etc. An entity includes relevant objects in a security event, such as an Internet Protocol (IP) address, etc. Each security event can include at least one entity.
[0028] Step S103: Determine whether it matches the existing response plan.
[0029] Specifically, based on the event information, determine whether the security event matches the existing response plan. If so, execute Step S110 and respond according to the response plan, that is, execute the response actions in the response plan. Otherwise, execute Step S104.
[0030] Step S104: Obtain the feature vector.
[0031] Optionally, obtain the response phase information of the cybersecurity event. The response phase information can be the information representing each phase set according to multiple phases of the response plan. Multiple response phases can be set for the response plan of the cybersecurity event. For example, based on the national network defense defender's guidance manual, the response plan is divided into 6 response phases as shown below: analysis and judgment, emergency response, notification and early warning, collaborative linkage, tracing and investigation, and summary. Configure multiple response actions for each response phase. Figure 2 The 6 response phases are: analysis and judgment, emergency response, notification and early warning, collaborative linkage, tracing and investigation, and summary.
[0032] The response action refers to the atomic capability of the response plan. Multiple response actions form a response plan through combination. In this embodiment, a response action can be a script generated by a Security Orchestration, Automation, and Response (SOAR) solution, or an application programming interface, etc. Among them, the SOAR solution can help automate and coordinate various tasks and processes for dealing with cybersecurity threats. A script is a method description for handling a type of security problem, which includes which tools need to be used for processing and how to process. For example, an IP hemostasis script will check the IP and block the IP.
[0033] Among them, the response actions in the analysis and judgment phase include: admission condition judgment, false alarm discrimination, etc.; the response actions in the emergency response phase include: IP hemostasis task, malicious file deletion, etc.; the response actions in the notification and early warning phase include: automatic group creation, hemostasis completion notification, security notification, etc.; the response actions in the collaborative linkage phase include: business party notification, etc.; the response actions in the tracing and investigation phase include: IP tracing, etc.; the response actions in the summary phase include: report summary, etc.
[0034] Tokenize the event information and response phase information, dividing the sentences into multiple words. For example, divide "for IP hemostasis task" into words such as "for", "IP", "hemostasis", and "task". Using a pre-trained word embedding model, such as the Bidirectional Encoder Representation from Transformers (BERT) model based on Transformers, convert the multiple words obtained from the tokenization process into word vectors of a fixed dimension. After performing weighted averaging and concatenation on the word vectors, obtain the concatenated features as the feature vector of the event information plus the phase information.
[0035] Step S105, obtain the response actions.
[0036] Pre-configure the event information and response phase information of multiple response actions, and pre-construct and store the feature vectors according to the vector construction method in step S104. Calculate the similarity between the feature vector of the event information plus the phase information of the current network security event and the pre-stored feature vectors, and screen through a pre-set threshold. Determine the response actions with similarity exceeding the threshold as the response actions corresponding to the current security event.
[0037] Step S106, determine whether the actions in the 6 phases of the response plan are all generated. That is, determine whether the response actions in each phase of the response plan for the current network security event are all matched. If so, execute step S107; otherwise, return to execute step S104 to construct the feature vector based on the event information and the response phase information of the next phase to facilitate obtaining the response actions of the next phase.
[0038] Step S107, obtain all the response actions in the 6 phases.
[0039] Step S108, response action choreography.
[0040] Specifically, choreograph the execution order of all the response actions in the 6 phases, which can be set in sequence according to the 6 response phases as shown in Figure 2 shown.
[0041] Step S109, generate a response plan.
[0042] Generate a response plan from the response actions with the choreographed execution order in step S108.
[0043] Step S110, respond according to the response plan.
[0044] For example, it can be as shown in Figure 2The response actions of each stage in the 6 shown response stages are executed in sequence. First, execute the response actions in the analysis and judgment stage: first perform the access condition judgment, then perform the false alarm discrimination... until all the response actions in the analysis and judgment stage are completed; then execute the response actions in the emergency response stage... until all the response actions in the investigation and summary stage are completed, and the emergency response is completed.
[0045] In this embodiment, according to event information such as the entity of the network security event, event title, event type, and response stage information, a response plan can be automatically generated, which can effectively reduce the dependence on security experts while reducing manual operations, promptly respond to network security events, and reduce security threats and losses. Moreover, based on the national network defense defender's guidance manual, the response process is divided into 6 stages: analysis and judgment, emergency response, notification and early warning, collaborative linkage, traceability, and investigation and summary, comprehensively considering the entire response process, and the emergency response meets the standardized requirements.
[0046] The embodiment of the present application provides a method for responding to network security events. The method in this embodiment can be applied to computing devices, and the computing devices may include: servers, user terminals, etc. As Figure 3 The flowchart of the method for responding to network security events according to an embodiment of the present application is shown, including:
[0047] Step S301, obtain a network security event.
[0048] Among them, network security events include security violation events that threaten the confidentiality, integrity, availability, or sensitive data of information systems. For example, network attack events intentionally carried out by hackers or unauthorized users, and events where legitimate authorized users inadvertently violate security policies, etc.
[0049] A network security event can be obtained by using an anomaly detection model. Among them, the anomaly detection model includes detection rules for security events. For example, if there are more than 10 login failures in 1 minute in the user login log, a security event will be generated, and this event matches the anomaly model of brute force cracking and belongs to a brute force cracking event. Cloud account and password abnormal call events, etc. can also be obtained through other anomaly detection models.
[0050] Step S302, if the network security event does not match the existing response plan, then generate a response plan corresponding to the network security event based on the event information of the network security event.
[0051] If the network security event does not match the existing response plan, it means it is a new security event. Then extract the event information from the network security event and generate a new response plan for emergency response.
[0052] Among them, the event information includes: entities, event titles, event types, etc. Entities include the relevant objects in security events. For example, IP addresses, etc. Each security event may include at least one entity.
[0053] Step S303: According to the response plan corresponding to the network security event, perform response processing on the network security event.
[0054] The response plan is a plan for the emergency response to network security events, including a series of response actions for responding to network security events. Emergency response refers to the processes and technologies used to detect and respond to network threats, security violations, or network attacks. The goal of emergency response is to prevent problems before they occur and to minimize the costs and business disruptions caused by any network attack.
[0055] The network security event response method provided by the embodiments of the present application first obtains a network security event; if the network security event does not match the existing response plan, then based on the event information of the network security event, a response plan corresponding to the network security event is generated; then, according to the response plan corresponding to the network security event, perform response processing on the network security event. In this embodiment, when the network security event does not match the existing response plan, a response plan corresponding to the network security event can be generated based on the event information of the network security event, effectively reducing the dependence on security experts and reducing manual operations, and timely performing response processing on the network security event to reduce security threats and losses.
[0056] The following introduces the specific implementation processes of the above steps through multiple implementation manners.
[0057] In one implementation manner, in step S302, generating a response plan corresponding to the network security event based on the event information of the network security event includes: determining the response actions corresponding to the network security event based on the event information of the network security event; and generating a response plan corresponding to the network security event according to the response actions corresponding to the network security event.
[0058] Specifically, perform word segmentation processing on the event information, divide the sentence into multiple words, and use a pre-trained word embedding model, such as the BERT model, to convert the multiple words obtained by the word segmentation processing into word vectors of a fixed dimension. After performing weighted averaging and concatenation on the word vectors, a concatenated feature is obtained.
[0059] Pre-configure the event information of multiple response actions, and construct and store the splicing features by using the event information of multiple response actions in advance. Calculate the similarity between the splicing features obtained from the event information of the current network security event and the pre-stored splicing features, and screen them through a pre-set threshold. Determine the response actions corresponding to the current security event for the response actions whose similarity exceeds the threshold. Determine the execution order of the response actions corresponding to the current security event, and arrange the response actions corresponding to the current security event according to the execution order to obtain the response plan corresponding to the current network security event.
[0060] In one implementation, the network security event response method further includes: obtaining the response phase information of the network security event; in step S302, generating a response plan corresponding to the network security event based on the event information of the network security event, including: generating a response plan corresponding to the network security event based on the event information and response phase information of the network security event.
[0061] Among them, the response phase information can be the information representing each phase set according to multiple phases of the response plan, and multiple response phases can be set for the response plan according to specific needs. Based on the event information and response phase information of the network security event, a response plan including multiple response phases corresponding to the network security event can be generated.
[0062] In one implementation, generating a response plan corresponding to the network security event based on the event information and response phase information of the network security event includes: determining the response actions corresponding to the network security event in multiple response phases based on the event information and response phase information of the network security event; generating a response plan corresponding to the network security event according to the response actions corresponding to the network security event in multiple response phases.
[0063] Specifically, pre-configure the event information and response phase information of multiple response actions, and use the event information plus phase information of the current network security event to match with the pre-configured event information and response phase information of multiple response actions to obtain the response actions corresponding to the current network security event in multiple response phases, and arrange the response actions corresponding to the current network security event in multiple response phases to obtain the response plan corresponding to the current network security event.
[0064] In one implementation, determining the response actions corresponding to the network security event in multiple response phases based on the event information and response phase information of the network security event includes: performing a matching process on the event information and response phase information of the network security event with the pre-configured event information and response phase information of multiple response actions, and determining the response actions corresponding to the network security event in multiple response phases from multiple response actions according to the matching result.
[0065] Among them, the matching process can be implemented in various ways. For example, text features are extracted, similarities are calculated, and if the similarity meets the requirements, it is considered a match; otherwise, it is not a match. Through the matching process, the response action that matches the current network security event can be determined among multiple response actions. The extraction of text features can be implemented in various ways, and this application does not limit it.
[0066] In one implementation, the event information and response phase information of the network security event are matched with the event information and response phase information of multiple pre-configured response actions, including: based on the event information and response phase information of the network security event, multiple word embedding features are extracted using a pre-trained word embedding model; the multiple word embedding features are concatenated to obtain a concatenated feature; and the concatenated feature is used to perform a matching process with the event information and response phase information of multiple pre-configured response actions.
[0067] Specifically, the event information and response phase information are tokenized, the sentence is divided into multiple words, and using a pre-trained word embedding model, such as the BERT model, the multiple words obtained by the tokenization process are converted into word vectors of a fixed dimension. After weighted averaging and concatenating the word vectors, a concatenated feature is obtained as the feature vector of the event information plus the phase information.
[0068] The event information and response phase information of multiple response actions are pre-configured, and feature vectors are constructed and stored in the same way in advance. The similarity is calculated using the feature vector of the event information plus the phase information of the current network security event and the pre-stored feature vectors, and screened through a pre-set threshold. The response actions with similarity exceeding the threshold are determined as the response actions corresponding to the current security event.
[0069] In one implementation, according to the response actions corresponding to the network security event in multiple response phases, a response plan corresponding to the network security event is generated, including: determining the execution order of the response actions corresponding to multiple response phases; and arranging the response actions corresponding to multiple response phases according to the execution order to obtain a response plan corresponding to the network security event.
[0070] Among them, the execution order of the response actions can be set according to specific needs. For example, it can be set according to the order of the 6 phases in the national network defense guidebook for the defense side, or it can be set according to other standards. This application does not limit it.
[0071] In one implementation, in step S303, according to the response plan corresponding to the network security event, the network security event is responded to, including: executing the response actions according to the execution order of the response actions in the response plan corresponding to the network security event.
[0072] For example, it can be in accordance withFigure 2 Among the six response phases shown, the response actions of each phase are executed in sequence. First, execute the response actions of the analysis and judgment phase: first perform the access condition judgment, and then perform the false alarm discrimination... until all the response actions of the analysis and judgment phase are completed; then execute the response actions of the emergency response phase... until all the response actions of the investigation and summary phase are completed, and the emergency response is completed.
[0073] The embodiment of the present application provides a network security event response method. The method in this embodiment can be applied to a computing device, and the computing device may include: a server, a user terminal, etc. As Figure 4 Shown is a flowchart of the network security event response method according to an embodiment of the present application, including:
[0074] Step S401, obtain network security events and response phase information of the network security events.
[0075] Step S402, based on the event information and response phase information, use a pre-trained word embedding model to extract multiple word embedding features.
[0076] Step S403, splice the multiple word embedding features to obtain a spliced feature.
[0077] Step S404, perform matching processing on the spliced feature with the event information and response phase information of multiple pre-configured response actions, and according to the matching result, determine the response actions corresponding to the network security event in multiple response phases among the multiple response actions.
[0078] Step S405, determine the execution order of the response actions corresponding to multiple response phases.
[0079] Step S406, according to the execution order, arrange the response actions corresponding to multiple response phases to obtain a response plan corresponding to the network security event.
[0080] Step S407, execute the response actions according to the execution order of the response actions in the response plan.
[0081] In this embodiment, a response plan can be automatically generated according to the event information and response phase information of the network security event, which can effectively reduce the dependence on security experts and reduce manual operations at the same time, respond to network security events in a timely manner, and reduce security threats and losses.
[0082] Corresponding to the application scenario and method of the method provided by the embodiment of the present application, the embodiment of the present application also provides a network security event response device. As Figure 5 Shown is a structural block diagram of the network security event response device according to an embodiment of the present application. The device includes:
[0083] An obtaining module 501, configured to obtain a network security event.
[0084] A generating module 502, configured to generate a response plan corresponding to the network security event based on the event information of the network security event if the network security event does not match the existing response plan.
[0085] A response module 503, configured to perform a response process on the network security event according to the response plan corresponding to the network security event.
[0086] The network security event response device provided by the embodiment of the present application first obtains a network security event; if the network security event does not match the existing response plan, it generates a response plan corresponding to the network security event based on the event information of the network security event; then, it performs a response process on the network security event according to the response plan corresponding to the network security event. In this embodiment, when the network security event does not match the existing response plan, a response plan corresponding to the network security event can be generated based on the event information of the network security event, effectively reducing the dependence on security experts and reducing manual operations, and timely performing a response process on the network security event to reduce security threats and losses.
[0087] In one implementation, when generating the response plan corresponding to the network security event based on the event information of the network security event, the generating module 502 is configured to: determine the response action corresponding to the network security event based on the event information of the network security event; and generate the response plan corresponding to the network security event according to the response action corresponding to the network security event.
[0088] In one implementation, the obtaining module 501 is further configured to: obtain the response phase information of the network security event; and the generating module 502 is configured to: generate the response plan corresponding to the network security event based on the event information and the response phase information of the network security event.
[0089] In one implementation, when generating the response plan corresponding to the network security event based on the event information and the response phase information of the network security event, the generating module 502 is configured to: determine the response actions corresponding to the network security event in multiple response phases based on the event information and the response phase information of the network security event; and generate the response plan corresponding to the network security event according to the response actions corresponding to the network security event in multiple response phases.
[0090] In one implementation, when generating module 502 determines response actions corresponding to a network security event in multiple response phases based on the event information and response phase information of the network security event, it is used to: match the event information and response phase information of the network security event with the event information and response phase information of multiple pre-configured response actions, and determine, according to the matching result, the response actions corresponding to the network security event in multiple response phases among the multiple response actions.
[0091] In one implementation, when generating module 502 performs matching processing on the event information and response phase information of the network security event with the event information and response phase information of multiple pre-configured response actions, it is used to: extract multiple word embedding features based on the event information and response phase information of the network security event by using a pre-trained word embedding model; splice the multiple word embedding features to obtain a spliced feature; and perform matching processing on the spliced feature with the event information and response phase information of multiple pre-configured response actions.
[0092] In one implementation, when generating module 502 generates a response plan corresponding to a network security event according to the response actions corresponding to the network security event in multiple response phases, it is used to: determine the execution order of the response actions corresponding to multiple response phases; and arrange the response actions corresponding to multiple response phases according to the execution order to obtain a response plan corresponding to the network security event.
[0093] In one implementation, response module 503 is used to: execute response actions according to the execution order of the response actions in the response plan corresponding to the network security event.
[0094] For the functions of each module in the embodiments of the present application, reference may be made to the corresponding descriptions in the above methods, and they have corresponding beneficial effects, which will not be elaborated here.
[0095] Figure 6 It is a block diagram of an electronic device for implementing the embodiments of the present application. As Figure 6 shown, the electronic device includes: a memory 610 and a processor 620, and a computer program that can run on the processor 620 is stored in the memory 610. When the processor 620 executes the computer program, the methods in the above embodiments are implemented. The number of the memory 610 and the processor 620 can be one or more.
[0096] The electronic device further includes:
[0097] a communication interface 630, which is used to communicate with external devices and perform data interaction and transmission.
[0098] If the memory 610, the processor 620, and the communication interface 630 are implemented independently, the memory 610, the processor 620, and the communication interface 630 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 only a thick line is used to represent it in Figure 6 , but it does not mean that there is only one bus or one type of bus.
[0099] Optionally, in a specific implementation, if the memory 610, the processor 620, and the communication interface 630 are integrated on a single chip, the memory 610, the processor 620, and the communication interface 630 can communicate with each other through an internal interface.
[0100] The embodiment of the present application provides a computer-readable storage medium storing a computer program, which when executed by a processor implements the method provided in the embodiment of the present application.
[0101] The embodiment of the present application further provides a chip, which includes a processor for calling and running instructions stored in a memory, so that a communication device installed with the chip executes the method provided in the embodiment of the present application.
[0102] The embodiment of the present application further provides a chip, including: an input interface, an output interface, a processor, and a memory. The input interface, the output interface, the processor, and the memory are connected through an internal connection path. The processor is used to execute the code in the memory, and when the code is executed, the processor is used to execute the method provided in the embodiment of the application.
[0103] It should be understood that the above-mentioned processor may be a Central Processing Unit (CPU), or it may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor that supports the Advanced RISC Machines (ARM) architecture.
[0104] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory may include a Random Access Memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Sync link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).
[0105] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
[0106] In the description of this specification, the descriptions with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.
[0107] In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" can explicitly or implicitly include at least one of the features. In the description of the present application, "a plurality of" means two or more unless otherwise specifically defined.
[0108] Any process or method described in the flowchart or otherwise described herein can be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a specific logical function or process. And the scope of the preferred embodiments of the present application includes additional implementations, where the functions can be executed in a substantially simultaneous manner or in the reverse order according to the involved functions, rather than in the order shown or discussed.
[0109] The logic and / or steps described in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing a logical function, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device), or in connection with these instruction execution systems, apparatus, or devices.
[0110] It should be understood that each part of the present application can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the method in the above embodiments can be completed by a program instructing relevant hardware. The program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.
[0111] In addition, each functional unit in various embodiments of the present application can be integrated into a processing module, or each unit can exist physically alone, or two or more units can be integrated into one module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a magnetic disk, an optical disc, etc.
[0112] As mentioned above, only the exemplary embodiments of the present application are described, but the protection scope of the present application is not limited thereto. Any person skilled in the art in the technical scope recorded in the present application can easily think of various changes or substitutions, and these should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.
Claims
1. A network security incident response method, characterized in that, The method includes: Obtaining a network security event; If the network security event does not match the existing response plan, then based on the event information of the network security event, generating a response plan corresponding to the network security event; Performing response processing on the network security event according to the response plan corresponding to the network security event.
2. The method according to claim 1, wherein The generating a response plan corresponding to the network security event based on the event information of the network security event includes: Based on the event information of the network security event, determining a response action corresponding to the network security event; Generating a response plan corresponding to the network security event according to the response action corresponding to the network security event.
3. The method according to claim 1, characterized in that, The method further includes: Obtaining response phase information of the network security event; The generating a response plan corresponding to the network security event based on the event information of the network security event includes: Generating a response plan corresponding to the network security event based on the event information and response phase information of the network security event.
4. The method according to claim 3, wherein The generating a response plan corresponding to the network security event based on the event information and response phase information of the network security event includes: Based on the event information and response phase information of the network security event, determining response actions corresponding to the network security event in multiple response phases; Generating a response plan corresponding to the network security event according to the response actions corresponding to the network security event in multiple response phases.
5. The method according to claim 4, wherein The determining response actions corresponding to the network security event in multiple response phases based on the event information and response phase information of the network security event includes: Performing matching processing on the event information and response phase information of the network security event and the event information and response phase information of a plurality of pre-configured response actions, and according to the matching result, determining the response actions corresponding to the network security event in multiple response phases among the plurality of response actions.
6. The method according to claim 5, wherein The performing matching processing on the event information and response phase information of the network security event and the event information and response phase information of a plurality of pre-configured response actions includes: Based on the event information and response phase information of the network security event, using a pre-trained word embedding model to extract a plurality of word embedding features; Concatenating the plurality of word embedding features to obtain a concatenated feature; Performing matching processing on the concatenated feature and the event information and response phase information of a plurality of pre-configured response actions.
7. The method according to claim 4, characterized in that, The generating a response plan corresponding to the network security event according to the response actions corresponding to the network security event in multiple response phases includes: Determining the execution order of the response actions corresponding to the multiple response phases; According to the execution order, arranging the response actions corresponding to the multiple response phases to obtain a response plan corresponding to the network security event.
8. The method according to any one of claims 1 to 7, characterized in that The performing response processing on the network security event according to the response plan corresponding to the network security event includes: Executing the response actions in accordance with the execution order of the response actions in the response plan corresponding to the network security event.
9. A network security incident response device, characterized in that, The apparatus includes: An obtaining module, configured to obtain a network security event; A generation module, configured to generate a response plan corresponding to the network security event based on the event information of the network security event if the network security event does not match an existing response plan; A response module, configured to perform response processing on the network security event according to the response plan corresponding to the network security event.
10. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory. The processor implements the method according to any one of claims 1-8 when executing the computer program.
11. A computer-readable storage medium, in which a computer program is stored. The computer program implements the method according to any one of claims 1-8 when executed by a processor.