Security resource management method, system and device, storage medium and program product

Abstract

The invention relates to a security resource management method, system and device, a storage medium and a program product. The method comprises the steps of determining a target security component according to event information carried by a security resource exception event under the condition that the security resource exception event in a system operation process is received; obtaining threat information, asset information and resource information related to the security resource abnormal event through the target security component, and determining a risk score according to the threat information, the asset information and the resource information; under the condition that the risk score exceeds a preset threshold value, determining a disposal template matched with the event type and the risk score; correcting the disposal template according to the real-time load information of the target security component, and executing a corresponding disposal action according to the corrected disposal template to obtain a disposal result; the disposal result is used for indicating whether the security resource exception event is completely disposed. By adopting the method, the security resource management efficiency can be improved in the face of abnormal attacks.

Description

Technical Field

[0001] The present application relates to the technical field of security resource management of power grid systems, and in particular to a security resource management method, system, device, storage medium and program product. Background Art

[0002] Traditional security infrastructure is often based on firewalls, intrusion detection, host hardening, and identity authentication. Each type of device or system is typically provided by a different vendor, deployed in different network areas, and has different management interfaces and data formats. This decentralized architecture creates typical information silos and policy fragmentation. There is a lack of linkage between various security resources, and configuration management relies on manual operations, alarm processing relies on human judgment, and policy delivery is highly coupled to specific devices. This leads to inefficient security resource management when responding to unusual attacks. Summary of the Invention

[0003] Based on this, it is necessary to provide a security resource management method, system, computer device, computer-readable storage medium and computer program product to address the above technical problems, which can improve the efficiency of security resource management when facing abnormal attacks.

[0004] In a first aspect, the present application provides a security resource management method, comprising:

[0005] When receiving a security resource abnormality event during system operation, determine the target security component corresponding to the security resource abnormality event based on the event information carried by the security resource abnormality event;

[0006] Obtain threat information, asset information, and resource information related to security resource anomaly events through target security components, and determine the risk score of security resource anomaly events based on the threat information, asset information, and resource information;

[0007] When the risk score exceeds a preset threshold, a handling template matching the event type and risk score of the security resource abnormal event is determined;

[0008] The disposal template is modified according to the real-time load information of the target security component, and the corresponding disposal action is performed according to the modified disposal template to obtain the disposal result; the disposal result is used to indicate whether the disposal of the security resource abnormal event is completed.

[0009] In one embodiment, performing corresponding treatment actions according to the modified treatment template to obtain treatment results includes:

[0010] Generate an operation flow chart based on the revised disposal template;

[0011] Determine the execution components corresponding to the multiple operation nodes in the operation flow chart, and execute the processing actions corresponding to each operation node in sequence through the corresponding execution components according to the order of the multiple operation nodes to obtain the processing results.

[0012] In one embodiment, according to the order of multiple operation nodes, the corresponding execution components sequentially execute the processing actions corresponding to the operation nodes to obtain the processing results, including:

[0013] Traverse each operation node in the order of multiple operation nodes, and for the current operation node, execute the processing action corresponding to the current operation node through the execution component corresponding to the current operation node to obtain the node processing result corresponding to the current operation node;

[0014] When the node handling result corresponding to the current operation node is successful, continue to traverse the next operation node until the node handling results corresponding to all operation nodes are successful, and determine that the handling result is that the security anomaly event handling is completed.

[0015] In one embodiment, the security resource management method further includes:

[0016] If the node handling result corresponding to the current operation node is a handling failure, the execution component corresponding to the current operation node is returned to execute the handling action corresponding to the current operation node to continue the execution;

[0017] If the node disposal result corresponding to the current operation node after re-execution is disposal failure, the current operation node is sent to the manual disposal node for further execution, and if the disposal result sent by the manual review node indicates that the disposal is successful, the next operation node is traversed.

[0018] In one embodiment, determining a risk score for a security resource abnormality event based on threat information, asset information, and resource information includes:

[0019] Determine the threat score based on threat information, the asset score based on asset information, and the anomaly score based on resource information;

[0020] The threat score, asset score, and anomaly score are weighted to obtain the risk score of security resource anomaly events.

[0021] In one embodiment, obtaining threat information, asset information, and resource information related to security resource abnormal events through a target security component includes:

[0022] Obtain abnormal information related to abnormal events of security resources through target security components;

[0023] Perform data cleaning and format conversion on abnormal information to obtain standardized information;

[0024] Determine threat information, asset information, and resource information from standardized information.

[0025] In a second aspect, the present application also provides a security resource management system, including:

[0026] A first determining module is configured to, upon receiving a security resource abnormality event during system operation, determine a target security component corresponding to the security resource abnormality event based on event information carried by the security resource abnormality event;

[0027] The risk scoring module is used to obtain threat information, asset information, and resource information related to security resource abnormal events through the target security component, and determine the risk score of the security resource abnormal event based on the threat information, asset information, and resource information;

[0028] A second determination module is configured to determine a handling template that matches the event type and risk score of the security resource abnormal event when the risk score exceeds a preset threshold;

[0029] The disposal module is used to modify the disposal template according to the real-time load information of the target security component, and perform corresponding disposal actions according to the modified disposal template to obtain the disposal result; the disposal result is used to indicate whether the disposal of the security resource abnormal event is completed.

[0030] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0031] When receiving a security resource abnormality event during system operation, determine the target security component corresponding to the security resource abnormality event based on the event information carried by the security resource abnormality event;

[0032] Obtain threat information, asset information, and resource information related to security resource anomaly events through target security components, and determine the risk score of security resource anomaly events based on the threat information, asset information, and resource information;

[0033] When the risk score exceeds a preset threshold, a handling template matching the event type and risk score of the security resource abnormal event is determined;

[0034] The disposal template is modified according to the real-time load information of the target security component, and the corresponding disposal action is performed according to the modified disposal template to obtain the disposal result; the disposal result is used to indicate whether the disposal of the security resource abnormal event is completed.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0036] When receiving a security resource abnormality event during system operation, determine the target security component corresponding to the security resource abnormality event based on the event information carried by the security resource abnormality event;

[0037] Obtain threat information, asset information, and resource information related to security resource anomaly events through target security components, and determine the risk score of security resource anomaly events based on the threat information, asset information, and resource information;

[0038] When the risk score exceeds a preset threshold, a handling template matching the event type and risk score of the security resource abnormal event is determined;

[0039] The disposal template is modified according to the real-time load information of the target security component, and the corresponding disposal action is performed according to the modified disposal template to obtain the disposal result; the disposal result is used to indicate whether the disposal of the security resource abnormal event is completed.

[0040] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps:

[0041] When receiving a security resource abnormality event during system operation, determine the target security component corresponding to the security resource abnormality event based on the event information carried by the security resource abnormality event;

[0042] Obtain threat information, asset information, and resource information related to security resource anomaly events through target security components, and determine the risk score of security resource anomaly events based on the threat information, asset information, and resource information;

[0043] When the risk score exceeds a preset threshold, a handling template matching the event type and risk score of the security resource abnormal event is determined;

[0044] The disposal template is modified according to the real-time load information of the target security component, and the corresponding disposal action is performed according to the modified disposal template to obtain the disposal result; the disposal result is used to indicate whether the disposal of the security resource abnormal event is completed.

[0045] The above-mentioned security resource management method, system, computer device, computer-readable storage medium and computer program product, upon receiving a security resource anomaly event during system operation, determine the target security component corresponding to the security resource anomaly event based on the event information carried by the security resource anomaly event; obtain threat information, asset information and resource information related to the security resource anomaly event through the target security component, and determine the risk score of the security resource anomaly event based on the threat information, asset information and resource information; when the risk score exceeds a preset threshold, determine a handling template that matches the event type and risk score of the security resource anomaly event, modify the handling template based on the real-time load information of the target security component, and execute corresponding handling actions based on the modified handling template to obtain a handling result, which is used to indicate whether the security resource anomaly event has been handled; this method of unified management through the target security component, when the risk score of the security resource anomaly event exceeds the preset threshold, determines and modifies the handling template, thereby executing corresponding handling actions to handle the security resource anomaly event, and can quickly handle the security resource anomaly event, thereby improving the efficiency of security resource management. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 A diagram of an application environment of a secure resource management method in one embodiment;

[0048] Figure 2 A schematic diagram of a flow chart of a secure resource management method according to an embodiment;

[0049] Figure 3 Schematic diagram of the composition of a security resource management system in one embodiment;

[0050] Figure 4 1 is a schematic diagram of the overall process of a security resource management method in one embodiment;

[0051] Figure 5 A structural block diagram of a security resource management system in one embodiment;

[0052] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0054] The security resource management method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store data that server 104 needs to process. The data storage system can be integrated on server 104, or placed on a cloud or other network server. This embodiment uses the method applied to server 104 as an example for illustration. It is understood that the method can also be applied to a server, or to a system including a terminal and a server, and implemented through interaction between the terminal and the server. Upon receiving a security resource anomaly event during system operation, server 104 determines the target security component corresponding to the security resource anomaly event based on the event information carried by the security resource anomaly event. The server 104 obtains threat information, asset information, and resource information related to the security resource anomaly event from the target security component, and determines a risk score for the security resource anomaly event based on the threat information, asset information, and resource information. If the risk score exceeds a preset threshold, a handling template matching the event type and risk score of the security resource anomaly event is determined. The handling template is modified based on the real-time load information of the target security component, and corresponding handling actions are executed based on the modified handling template to obtain a handling result. The handling result indicates whether the security resource anomaly event has been handled. Terminal 102 may include, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, smart car devices, and projectors. Portable wearable devices may include smart watches, smart bracelets, and head-mounted devices. Head-mounted devices may include virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, and the like. Server 104 may be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0055] In an exemplary embodiment, Figure 2 As shown, a security resource management method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate the process, including the following steps 202 to 208.

[0056] Step 202: upon receiving a security resource abnormality event during system operation, determining a target security component corresponding to the security resource abnormality event based on event information carried by the security resource abnormality event.

[0057] Among them, the security resource management method runs on the security resource management system. Figure 3 Figure 1 shows the components of a security resource management system in some embodiments. The security resource management system includes a security service platform, system management, data analysis, service management, component capability management, and component access management. The "security service platform" is the top-level design of the master control core, and explicitly establishes a "unified portal" as the sole entry point for user interaction and management scheduling. "Component access management" not only encompasses operations such as component scheduling, integration testing, and information collection, but more importantly, introduces an "adapter mechanism," comprising a two-tiered structure of universal adapters and component adapters. This mechanism demonstrates that, from the outset, the system abstracts the ability to access heterogeneous systems into "component capability units" and provides them with structured encapsulation entry points. This means that the platform possesses adaptive access capabilities that can flexibly accommodate diverse devices, multiple protocols, and multi-layer deployment architectures. "Component capability management," as an independent core module, establishes a triple management mechanism for capability registration, capability encapsulation, and capability scheduling for each security component. These mechanisms are standardized through "policy encapsulation management," resulting in uniformly invoked interface semantics and operational behavior. This not only enables cross-component capability abstraction but also provides the operational foundation for subsequent policy combination, process orchestration, and automated response. The system's "Service Management" consists of three components: the "Security Service Marketplace," "Service Function Management," and "Service Monitoring." These components encapsulate all abstracted component capabilities as "services" and centrally publish and subscribe to them through the marketplace. This design enables the system to deliver "ready-to-use security services" similar to cloud services. Services can be orchestrated, dynamically deployed, and elastically scaled within the system on demand. "Data Analysis" primarily summarizes statistics such as report data and event counts, emphasizing a more granular presentation. Data Analysis encompasses three structural areas: service analysis, component analysis, and policy analysis. It also serves as input for policy decision-making, participating in policy template optimization and capability scheduling. The "System Management" module introduces common platform management capabilities such as "cascade management" and "data dictionary management," demonstrating the system's adaptability to multi-tenant, multi-region, and distributed deployments. This makes it suitable for deployment in large-scale, multi-organizational security governance scenarios, and offers strong horizontal scalability and organizational management capabilities.

[0058] Security resource anomaly events refer to alarm events detected during the operation of the security resource management system. These are primarily high-priority alarms proactively triggered by the monitoring system, threat detection system, and business systems when operational security or availability anomalies occur. For example, in infrastructure scenarios, security resource anomaly events can involve device or network link anomalies. For example, a firewall session table in a data center may be exhausted, resulting in widespread north-south traffic packet drops; a switch optical module temperature may exceed a threshold, causing the interface to automatically slow down. Alternatively, they can involve cloud host / container / application instance anomalies in workload scenarios. For example, a core pod may restart a preset number of times, causing Kubernetes to report a CrashLoopBackOff; or a database connection pool utilization rate may exceed a preset rate, causing a service write request to fail 504. Alternatively, they can involve network or host threat behaviors in security incident scenarios. For example, the same source IP may initiate SMB (Server Message Block) null session detections to multiple hosts within a preset period; or cloud account credentials may be compromised, leading to remote logins and the execution of high-risk API calls.

[0059] Security resources primarily refer to the various security protection devices and infrastructure within a system, such as firewalls, intrusion detection systems, terminal management systems, network switching and routing equipment, and other security-related infrastructure. These devices often come from different manufacturers and utilize different data formats and interface protocols.

[0060] Event information refers to the information contained in security resource anomaly events, such as the address, asset tag, and account ID. Security components are the underlying capability carriers controllable by the system. They can be hardware devices (firewalls, IPS (Intrusion Prevention System), WAF (Web Application Firewall)), system daemons (EDR agents, log collectors), or SaaS APIs (cloud security groups, DDoS protection services). Generation methods include adapter packaging, capability registration, and runtime instantiation. Adapter packaging involves the system first creating an adapter for each native interface (REST, CLI, SNMP, SDK, etc.), mapping the platform's unified call protocol to a vendor-specific protocol. Capability registration involves the adapter writing metadata such as the name, type, input / output parameters, and health probe address to the capability registry. Runtime instantiation involves locating the required component in the first step. The platform generates a "handle" based on the ID and endpoint in the registry and writes it into the ticket context. The target security component is the security component corresponding to the security resource anomaly event. Each security component records logs, traffic segments, configurations or performance indicators during system operation according to a pre-agreed collection contract, and determines the target security component that matches the security resource abnormal event based on the event information carried by the abnormal event.

[0061] Step 204: Acquire threat information, asset information, and resource information related to the security resource abnormality event through the target security component, and determine a risk score for the security resource abnormality event based on the threat information, asset information, and resource information.

[0062] Among them, the server can obtain information related to security resource anomaly events from the target security component. Threat information refers to information about the attack that caused the security resource anomaly, including but not limited to attack source reputation, signature severity, CVSS (Common Vulnerability Scoring System) base score, current attack frequency, and other information. Asset information refers to information about the operation of services, networks, etc. when security resource anomalies occur, including but not limited to business level, data confidentiality level, external network exposure, and the most recent SLA (Service Level Agreement) penalty coefficient. Resource information refers to information about the usage of various resources when security resource anomalies occur, including but not limited to CPU / IO deviation rate, traffic surge multiple, session failure rate, historical baseline difference, and other information.

[0063] The risk score indicates the risk level of a security resource anomaly event. In some embodiments, the greater the risk score, the higher the risk level of the security resource anomaly event. The risk score can be determined based on threat information, asset information, and resource information to improve the accuracy of the risk score.

[0064] Step 206 : When the risk score exceeds a preset threshold, a handling template matching the event type and risk score of the abnormal security resource event is determined.

[0065] If the risk score exceeds the preset threshold, it indicates a high risk of a security resource anomaly event. Security resource anomaly events include, but are not limited to, CPU / memory anomalies, network traffic anomalies, disk I / O anomalies, service response delays, and system load anomalies.

[0066] A response template is a predefined set of automated response steps for security incidents of different types. Similar to an emergency response plan, it specifies a standardized operational process from incident triggering to resolution completion. For example, it can be a YAML / JSON / DSL file.

[0067] In some embodiments, the server has a preset mapping relationship that represents the correspondence between event type, risk score, and treatment template. Therefore, by querying the preset mapping relationship, the treatment template that matches the event type and risk score of the abnormal security resource event can be determined. Table 1 shows a table of preset mapping relationships in some embodiments.

[0068] Table 1 Preset mapping relationship table

[0069]

[0070] Step 208 , the handling template is modified according to the real-time load information of the target security component, and the corresponding handling action is executed according to the modified handling template to obtain a handling result; the handling result is used to indicate whether the handling of the security resource abnormal event is completed.

[0071] The handling template includes multiple handling nodes. Each handling node is the smallest operational unit in the handling template and is used to indicate a specific handling action, such as banning an IP address, expanding resources, or limiting traffic. As shown in Table 1, for a medium-risk network traffic surge, the handling template includes multiple handling nodes: limiting traffic, notifying administrators, and manual review.

[0072] To effectively handle security resource anomalies, nodes in the handling template can be modified to adapt to the real-time load information of the target security component. For example, if the real-time component load exceeds 90%, resource-intensive operations such as deep traffic analysis can be skipped. In some embodiments, the handling template can also be modified based on real-time load information and tenant authorization. For example, if the tenant has not authorized "automatic blocking", the blocked IP node can be removed and replaced with manual review.

[0073] Since each treatment node has a corresponding treatment action, the server can determine multiple treatment actions based on the multiple treatment nodes in the modified treatment template, and execute each treatment action in sequence according to the multiple treatment nodes to obtain a treatment result. The treatment result includes treatment completion and treatment incomplete.

[0074] In the above-mentioned security resource management method, when a security resource anomaly event is received during the system operation process, the target security component corresponding to the security resource anomaly event is determined based on the event information carried by the security resource anomaly event; the threat information, asset information and resource information related to the security resource anomaly event are obtained through the target security component, and the risk score of the security resource anomaly event is determined based on the threat information, asset information and resource information; when the risk score exceeds a preset threshold, a handling template that matches the event type and risk score of the security resource anomaly event is determined, the handling template is corrected according to the real-time load information of the target security component, and the corresponding handling action is executed according to the corrected handling template to obtain a handling result, which is used to indicate whether the security resource anomaly event has been handled; this method of unified management through the target security component, when the risk score of the security resource anomaly event exceeds a preset threshold, determines the handling template and corrects it, thereby executing the corresponding handling action to handle the security resource anomaly event. When faced with a security resource anomaly event, it can be handled quickly, thereby improving the efficiency of security resource management.

[0075] In an exemplary embodiment, corresponding treatment actions are performed according to the revised treatment template to obtain treatment results, including: generating an operation flowchart according to the revised treatment template; determining the execution components corresponding to each of the multiple operation nodes in the operation flowchart, and executing the treatment actions corresponding to each operation node in sequence through the corresponding execution components in the order of the multiple operation nodes to obtain treatment results.

[0076] Among them, the operation flow chart can be a directed graph, including operation nodes and directed edges. Each processing node in the revised processing template serves as an operation node in the operation flow chart, and the pointing relationship of each processing node is used as a directed edge. Each operation node has a corresponding execution component, and each execution component has a corresponding processing action. For example, the operation node is current limiting, the execution component is a traffic management component, and the processing action is to limit the inlet bandwidth to 50% of the baseline value to prevent abnormal traffic impact. The order of multiple operation nodes is the same as the order of each processing node. The server executes the processing actions corresponding to each operation node in sequence through the corresponding execution components in the order of multiple operation nodes, obtains the security resource information after the processing action is executed, and determines the processing result based on the security resource information. For example, if the CPU load drops from 90% to 60% and the network traffic stabilizes at the baseline position, the processing result is that the processing is completed.

[0077] In this embodiment, the revised handling template is converted into an operation flow chart, which intuitively displays the content and sequence of the operation process; multiple operation nodes are used to respectively correspond to the execution components to execute the corresponding handling actions, and different execution components perform their respective functions to avoid functional interference and improve the handling efficiency of security resources.

[0078] In an exemplary embodiment, according to the order of multiple operation nodes, the disposal actions corresponding to each operation node are executed in sequence by the corresponding execution component to obtain the disposal result, including: traversing each operation node in the order of multiple operation nodes, and for the current operation node, executing the disposal action corresponding to the current operation node by the execution component corresponding to the current operation node to obtain the node disposal result corresponding to the current operation node; when the node disposal result corresponding to the current operation node is a successful disposal, continue to traverse the next operation node until the node disposal results corresponding to all operation nodes are successful, and determine that the disposal result is that the security anomaly event disposal is completed.

[0079] The server traverses each operation node in the order of multiple operation nodes. The current operation node is the currently traversed operation node. For the current operation node, the execution component corresponding to the current operation node executes the corresponding treatment action, obtaining a node treatment result corresponding to the current operation node. The node treatment result indicates whether the treatment of the current operation node was successful. After executing the treatment action corresponding to the current operation node, the server can obtain security resource information related to the treatment action and determine the node treatment result based on the security resource information.

[0080] When the node handling result corresponding to the current operation node is a successful handling, continue to traverse the next operation node until all operation nodes are handled successfully, and then determine that the handling result is completed.

[0081] In this embodiment, by traversing multiple operation nodes to perform corresponding handling actions on each operation node, the node handling results of each operation node are obtained. When the node handling results of all operation nodes are successful, it can be determined that the handling result is that the security anomaly event handling is completed. Multiple operation nodes are executed to ensure that the security anomaly event is effectively handled and improve the efficiency of security resource management.

[0082] In an exemplary embodiment, the security resource management method also includes: when the node disposal result corresponding to the current operation node is disposal failure, returning to execute the disposal action corresponding to the current operation node through the execution component corresponding to the current operation node to continue execution; when the node disposal result corresponding to the current operation node is disposal failure after re-execution, sending the current operation node to the manual disposal node to continue execution, and when receiving the disposal result sent by the manual review node indicating that the disposal is successful, continuing to traverse the next operation node.

[0083] Among them, if the node disposal result of any operation node is disposal failure, the disposal action corresponding to the current operation node is re-executed. If the node disposal result after re-execution is disposal success, continue to traverse the next operation node until all operation nodes are disposed successfully, and then determine that the disposal result is disposal completion.

[0084] If the node processing result after re-execution is processing failure, the current operation node will be sent to the manual processing node to manually process the current operation node to ensure the smooth progress of each operation node.

[0085] When the processing result sent by the manual review node is received as successful processing, continue to traverse the next operation node until all operation nodes are successfully processed, and then determine that the processing result is completed.

[0086] In this embodiment, when the node handling result is a handling failure, the corresponding handling action is re-executed to ensure that each operation node is handled successfully, so as to continue to complete subsequent operation nodes and improve the handling success rate of security resource abnormal events.

[0087] In an exemplary embodiment, a risk score for a security resource abnormal event is determined based on threat information, asset information, and resource information, including: determining a threat score based on threat information, determining an asset score based on asset information, and determining an anomaly score based on resource information; and weighting the threat score, asset score, and anomaly score to obtain a risk score for a security resource abnormal event.

[0088] Threat information includes attack source reputation, signature severity, CVSS base score, and current attack frequency. Entropy weighting is used to process each threat information to generate a threat score. Asset information includes business level, data confidentiality level, external network exposure, and recent SLA penalty coefficient. Entropy weighting is used to process each asset information to generate an asset score. Resource information includes CPU / IO deviation rate, traffic surge multiple, session failure rate, and historical baseline difference. Entropy weighting is used to process each resource information to generate an anomaly score.

[0089] The server weights the threat score, asset score, and anomaly score to obtain the risk score of the security resource anomaly event. The risk score formula can be expressed as:

[0090] Rt=w1×ThreatScore+w2×AssetValue+w3×AnomalyScore

[0091] Among them, Rt represents the risk score, ThreatScore represents the threat score, AssetValue represents the asset score, AnomalyScore represents the anomaly score, and w1, w2, and w3 represent weights respectively.

[0092] In some embodiments, the security resource management method further includes: adjusting the weight of the risk score based on the handling result of the security resource abnormality event, and the adjusted weight is used for the next risk score. Specifically, the handling result also includes multiple indicators, such as success rate, resource cost, and delay. The multiple indicators are used as inputs of the trained weight adjustment model to obtain the adjustment amount of each weight. The corresponding weight is adjusted according to each adjustment amount to obtain multiple adjusted weights, namely w1', w2', and w3'. Among them, the trained weight adjustment model can be a machine learning model.

[0093] In some embodiments, threat scores, asset scores, anomaly scores, success rates, resource costs, and delays are continuously added to the policy profile library. Each prediction interval triggers an offline Spark task to perform the following processing on the profile library for the past N hours:

[0094] 1. Sample cleaning: Filter out abnormal rows to ensure that the sample only reflects real online processing behavior.

[0095] 2. Posterior parameter estimation: Consider cases where Succ = 1 and both Cost and Delay are below the 95th percentile as "valid"; all others are considered "invalid." Then, use the frequency of each score combination falling into the "valid" bucket to update the Beta-Bernoulli conjugate distribution, thereby obtaining P(valid | ThreatScore, AssetValue, AnomalyScore).

[0096] 3. Weight correction: Let .

[0097] in, represents the learning rate, This represents the efficiency when "only considering the i-th category score interval." Intuitively, if samples with a high ThreatScore are successful and have a high proportion of low costs, a positive increment is given. Conversely, if samples with a high AssetValue consistently fail or consume resources, a negative increment is given.

[0098] The updated weights are expressed as follows:

[0099]

[0100] The updated weights are written to the ETCD key-value pair / risk_model / weights and automatically loaded by the streaming risk engine during the next checkpoint. Therefore, when the risk engine next evaluates the risk, it receives weights that have already absorbed the actual cost of the previous execution. Because the profile library is updated daily, the model is fine-tuned daily based on actual business performance: successful and inexpensive resolution paths receive higher weights, while failed or expensive paths receive lower weights. This repetitive process allows the system to narrow the gap between the "theoretically most dangerous" and the "actually most feasible," ensuring that risk scores reflect not only the intensity of the threat but also the efficiency and resource cost of resolution.

[0101] In this embodiment, the threat score, asset score, and anomaly score are determined respectively by threat information, asset information, and resource information, and then the risk score is obtained through weighted processing. Since the risk score is determined by combining threat information, asset information, and resource information, the accuracy of the risk score is improved.

[0102] In an exemplary embodiment, threat information, asset information, and resource information related to security resource abnormal events are obtained through a target security component, including: obtaining abnormal information related to security resource abnormal events through a target security component; performing data cleaning and format conversion on the abnormal information to obtain standardized information; and determining threat information, asset information, and resource information from the standardized information.

[0103] The information obtained from the target security component often requires data cleaning and format conversion. The server obtains abnormal information related to the security resource abnormal event through the target security component. For example, it can include logs, traffic fragments, configuration or performance indicators directly related to the security resource abnormal event.

[0104] Data cleaning includes deleting irrelevant fields, correcting abnormal timestamps, and merging cross-source duplicate records. Format conversion refers to converting abnormal data after data cleaning into a preset format to obtain standardized information.

[0105] Then determine threat information, asset information and resource information from the standardized information.

[0106] In this embodiment, abnormal information related to abnormal events of security resources is obtained through the target security component. After data cleaning and format conversion, the threat information, asset information and resource information are determined to avoid interference from irrelevant data, which is conducive to improving the efficiency of security resource management.

[0107] To illustrate the security resource management method and its effects in this solution in detail, the following is a detailed example:

[0108] like Figure 4 The diagram shows an overall flow chart of a security resource management method in some embodiments. Upon receiving a security resource anomaly event during system operation, the method determines the target security component corresponding to the security resource anomaly event based on the event information carried by the security resource anomaly event. The method obtains threat information, asset information, and resource information related to the security resource anomaly event through the target security component, and determines a risk score for the security resource anomaly event based on the threat information, asset information, and resource information. If the risk score exceeds a preset threshold, the risk level is determined to be high, and a handling template matching the event type and risk score of the security resource anomaly event is determined. The handling template is modified based on the real-time load information of the target security component, and corresponding handling actions are executed based on the modified handling template to obtain a handling result. The handling result indicates whether the security resource anomaly event has been handled.

[0109] In one embodiment, corresponding treatment actions are performed according to the revised treatment template to obtain treatment results, including: generating an operation flowchart according to the revised treatment template; determining the execution components corresponding to each of the multiple operation nodes in the operation flowchart, and executing the treatment actions corresponding to each operation node in sequence through the corresponding execution components in the order of the multiple operation nodes to obtain treatment results.

[0110] In one embodiment, the processing actions corresponding to each operation node are executed in sequence by the corresponding execution component in the order of multiple operation nodes to obtain the processing result, including: traversing each operation node in the order of multiple operation nodes, and for the current operation node, executing the processing action corresponding to the current operation node by the execution component corresponding to the current operation node to obtain the node processing result corresponding to the current operation node; when the node processing result corresponding to the current operation node is successful processing, continue to traverse the next operation node until the node processing results corresponding to all operation nodes are successful processing, and determine that the processing result is that the security anomaly event processing is completed.

[0111] In one embodiment, the security resource management method also includes: when the node disposal result corresponding to the current operation node is disposal failure, returning to execute the disposal action corresponding to the current operation node through the execution component corresponding to the current operation node to continue execution; when the node disposal result corresponding to the current operation node is disposal failure after re-execution, sending the current operation node to the manual disposal node to continue execution, and when receiving the disposal result sent by the manual review node indicating that the disposal is successful, continuing to traverse the next operation node.

[0112] In one embodiment, a risk score for a security resource abnormal event is determined based on threat information, asset information, and resource information, including: determining a threat score based on threat information, determining an asset score based on asset information, and determining an anomaly score based on resource information; and weighting the threat score, asset score, and anomaly score to obtain a risk score for a security resource abnormal event.

[0113] In one embodiment, threat information, asset information, and resource information related to security resource abnormal events are obtained through a target security component, including: obtaining abnormal information related to security resource abnormal events through a target security component; performing data cleaning and format conversion on the abnormal information to obtain standardized information; and determining threat information, asset information, and resource information from the standardized information.

[0114] The above-mentioned security resource management method, when receiving a security resource abnormality event during the system operation process, determines the target security component corresponding to the security resource abnormality event based on the event information carried by the security resource abnormality event; obtains threat information, asset information and resource information related to the security resource abnormality event through the target security component, and determines the risk score of the security resource abnormality event based on the threat information, asset information and resource information; when the risk score exceeds a preset threshold, determines a handling template that matches the event type and risk score of the security resource abnormality event, modifies the handling template based on the real-time load information of the target security component, and executes corresponding handling actions based on the modified handling template to obtain a handling result, which is used to indicate whether the security resource abnormality event has been handled; this method of unified management through target security components, when the risk score of the security resource abnormality event exceeds a preset threshold, determines and modifies the handling template, thereby executing corresponding handling actions to handle the security resource abnormality event. When faced with a security resource abnormality event, it can be handled quickly, thereby improving the efficiency of security resource management.

[0115] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0116] Based on the same inventive concept, embodiments of the present application also provide a secure resource management system for implementing the secure resource management method described above. The implementation solution provided by this system is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations in one or more secure resource management system embodiments provided below can be found in the above-mentioned limitations on the secure resource management method and will not be further elaborated here.

[0117] In an exemplary embodiment, Figure 5 As shown, a security resource management system 100 is provided, comprising: a first determination module 120, a risk scoring module 140, a second determination module 160 and a handling module 180, wherein:

[0118] The first determining module 120 is configured to, upon receiving a security resource abnormality event during system operation, determine a target security component corresponding to the security resource abnormality event based on event information carried by the security resource abnormality event;

[0119] The risk scoring module 140 is configured to obtain threat information, asset information, and resource information related to the security resource abnormality event through the target security component, and determine a risk score for the security resource abnormality event based on the threat information, asset information, and resource information;

[0120] A second determination module 160 is configured to determine a handling template that matches the event type and risk score of the security resource abnormal event when the risk score exceeds a preset threshold;

[0121] The handling module 180 is used to modify the handling template according to the real-time load information of the target security component, and perform corresponding handling actions according to the modified handling template to obtain a handling result; the handling result is used to indicate whether the security resource abnormal event is handled.

[0122] The above-mentioned security resource management system, when receiving a security resource anomaly event during the system operation process, determines the target security component corresponding to the security resource anomaly event based on the event information carried by the security resource anomaly event; obtains threat information, asset information and resource information related to the security resource anomaly event through the target security component, and determines the risk score of the security resource anomaly event based on the threat information, asset information and resource information; when the risk score exceeds a preset threshold, determines a handling template that matches the event type and risk score of the security resource anomaly event, modifies the handling template based on the real-time load information of the target security component, and executes corresponding handling actions based on the modified handling template to obtain a handling result, which is used to indicate whether the security resource anomaly event has been handled; this method of unified management through the target security component, when the risk score of the security resource anomaly event exceeds a preset threshold, determines and modifies the handling template, thereby executing corresponding handling actions to handle the security resource anomaly event, and can quickly handle the security resource anomaly event, thereby improving the efficiency of security resource management.

[0123] In one embodiment, the corresponding treatment actions are performed according to the revised treatment template to obtain the treatment results. The treatment module 180 is also used to: generate an operation flow chart according to the revised treatment template; determine the execution components corresponding to each of the multiple operation nodes in the operation flow chart, and execute the treatment actions corresponding to each operation node in sequence through the corresponding execution components in the order of the multiple operation nodes to obtain the treatment results.

[0124] In one embodiment, according to the order of multiple operation nodes, the corresponding processing actions of each operation node are executed in sequence by the corresponding execution component to obtain the processing result. The processing module 180 is also used to: traverse each operation node in the order of multiple operation nodes, and for the current operation node, execute the processing action corresponding to the current operation node by the execution component corresponding to the current operation node to obtain the node processing result corresponding to the current operation node; when the node processing result corresponding to the current operation node is successful processing, continue to traverse the next operation node until the node processing results corresponding to all operation nodes are successful processing, and determine that the processing result is that the security anomaly event processing is completed.

[0125] In one embodiment, the security resource management system also includes a re-processing module, which is used to: when the node processing result corresponding to the current operation node is a processing failure, return to the execution component corresponding to the current operation node to execute the processing action corresponding to the current operation node to continue execution; when the node processing result corresponding to the current operation node after re-execution is a processing failure, send the current operation node to the manual processing node to continue execution, and continue to traverse the next operation node when receiving the processing result sent by the manual review node indicating that the processing is successful.

[0126] In one embodiment, the risk score of the security resource abnormal event is determined based on the threat information, asset information and resource information. The risk scoring module 140 is also used to: determine the threat score based on the threat information, determine the asset score based on the asset information, and determine the abnormality score based on the resource information; and weight the threat score, asset score and abnormality score to obtain the risk score of the security resource abnormal event.

[0127] In one embodiment, threat information, asset information, and resource information related to security resource abnormal events are obtained through the target security component, and the risk scoring module 140 is also used to: obtain abnormal information related to security resource abnormal events through the target security component; perform data cleaning and format conversion on the abnormal information to obtain standardized information; and determine threat information, asset information, and resource information from the standardized information.

[0128] Each module in the aforementioned security resource management system may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0129] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, memory and I / O interface are connected via a system bus, and the communication interface is connected to the system bus via the I / O interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store event information carried by security resource anomaly events, threat information related to security resource anomaly events, asset information, resource information, disposal templates and disposal results, etc. The I / O interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, a security resource management method is implemented.

[0130] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0131] In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0132] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0133] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0134] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0135] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0136] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0137] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A security resource management method, characterized in that: The method comprises: In the case of receiving a security resource abnormality event during system operation, determining a target security component corresponding to the security resource abnormality event according to event information carried by the security resource abnormality event; Acquire threat information, asset information, and resource information related to the security resource abnormal event through the target security component, and determine a risk score for the security resource abnormal event based on the threat information, the asset information, and the resource information; When the risk score exceeds a preset threshold, determining a handling template that matches the event type of the security resource abnormal event and the risk score; The handling template is modified according to the real-time load information of the target security component, and a corresponding handling action is performed according to the modified handling template to obtain a handling result; the handling result is used to indicate whether the handling of the security resource abnormal event is completed.

2. The method according to claim 1, characterized in that The step of executing corresponding treatment actions according to the modified treatment template to obtain treatment results includes: Generate an operation flow chart based on the revised disposal template; Determine the execution components corresponding to the multiple operation nodes in the operation flow chart, and execute the processing actions corresponding to each operation node in sequence through the corresponding execution components according to the order of the multiple operation nodes to obtain the processing results.

3. The method according to claim 2, characterized in that The processing actions corresponding to the operation nodes are executed in sequence by the corresponding execution components in the order of the multiple operation nodes to obtain the processing results, including: Traversing each operation node in order of the multiple operation nodes, and for a current operation node, executing a processing action corresponding to the current operation node through an execution component corresponding to the current operation node, to obtain a node processing result corresponding to the current operation node; When the node handling result corresponding to the current operation node is successful, continue to traverse the next operation node until the node handling results corresponding to all operation nodes are successful, and determine that the handling result is that the security anomaly event handling is completed.

4. The method according to claim 3, characterized in that The method further comprises: If the node handling result corresponding to the current operation node is a handling failure, returning to execute the handling action corresponding to the current operation node through the execution component corresponding to the current operation node to continue execution; If the node handling result corresponding to the current operation node after re-execution is a handling failure, the current operation node is sent to the manual handling node for further execution, and if the handling result sent by the manual review node indicates a successful handling, the next operation node is traversed.

5. The method according to claim 1, wherein The determining, based on the threat information, the asset information, and the resource information, a risk score of the security resource abnormal event includes: Determine a threat score based on the threat information, determine an asset score based on the asset information, and determine an anomaly score based on the resource information; The threat score, the asset score, and the anomaly score are weighted to obtain a risk score for the security resource anomaly event.

6. The method according to claim 1, characterized in that The acquiring, through the target security component, threat information, asset information, and resource information related to the security resource abnormal event includes: Acquire abnormal information related to the abnormal event of the security resource through the target security component; Performing data cleaning and format conversion on the abnormal information to obtain standardized information; Threat information, asset information, and resource information are determined from the standardized information.

7. A security resource management system, characterized in that: The system comprises: A first determining module is configured to, upon receiving a security resource abnormality event during system operation, determine a target security component corresponding to the security resource abnormality event based on event information carried by the security resource abnormality event; a risk scoring module, configured to obtain threat information, asset information, and resource information related to the security resource abnormal event through the target security component, and determine a risk score for the security resource abnormal event based on the threat information, the asset information, and the resource information; A second determining module is configured to determine, when the risk score exceeds a preset threshold, a handling template that matches the event type of the security resource abnormal event and the risk score; The handling module is used to modify the handling template according to the real-time load information of the target security component, and perform corresponding handling actions according to the modified handling template to obtain a handling result; the handling result is used to indicate whether the handling of the security resource abnormal event is completed.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images