Security event handling method and device, equipment and storage medium

Abstract

The invention discloses a security event handling method and device, equipment and a storage medium. Comprising the steps of constructing a detection rule base; when a security event alarm is detected, an alarm rule for triggering the alarm is determined, a target template corresponding to the alarm rule is matched through the detection rule base, and a structured processing task is generated according to the target template; and obtaining a query result based on the structured processing task, and carrying out artificial decision making based on the query result. By constructing a detection rule base containing detection rules and corresponding process templates, direct association of the rules and the disposal process can be realized. After the security event alarm is detected, the alarm rule is determined, the target template is matched, and the structured processing task is generated, so that the processing starting time can be shortened, the processing flow is unified, and the problem of flow fragmentation is solved. The query result is obtained based on the structured processing task, and manual decision making is performed, so that repeated labor can be reduced, data errors are reduced, decision making accuracy is improved, and the problem that knowledge reuse is difficult to separate from man-machine cooperation is solved.

Description

Technical Field

[0001] This invention relates to the field of security operation and maintenance, and in particular to a method, apparatus, equipment and storage medium for handling security incidents. Background Technology

[0002] Currently, financial institutions face challenges in cybersecurity operations, including a surge in security incidents, complex attack methods, and a shortage of professional talent. Traditional operations rely heavily on human experience, resulting in fragmented handling processes, difficulty in reusing expert knowledge, and a disconnect between human and machine collaboration. Therefore, it is still necessary to build a system of associated detection rules and handling processes to improve efficiency.

[0003] The industry currently has fully automated security operations (SOAR) platforms, which automate operations by pre-setting standardized scripts, such as phishing email handling and IP blocking. When a detection rule triggers an alarm, the script is automatically invoked to perform actions such as isolating terminals and blocking connections, thereby reducing manual intervention and improving the speed of handling.

[0004] However, the existing SOAR platform has poor process adaptability. Static scripts cannot cope with new or derivative events, requiring manual rewriting which leads to delays. Furthermore, it lacks a risk classification mechanism, and fully automated execution of high-risk operations is prone to errors, which does not meet financial risk control requirements. In addition, the existing methods are knowledge-closed and lack empowerment, failing to accumulate analytical logic. Junior analysts lack decision-making guidance and still rely on experts. Summary of the Invention

[0005] This invention provides a method, apparatus, equipment, and storage medium for handling security incidents, establishes a three-level human-machine collaborative security boundary control mechanism and a closed-loop feedback-driven knowledge self-evolution model, and solves the technical problems of poor process adaptability, loss of control in high-risk operations, difficulty in knowledge reuse, and insufficient empowerment of junior personnel in traditional platforms.

[0006] According to one aspect of the present invention, a method for handling security incidents is provided, the method comprising:

[0007] Build a detection rule base, which includes each detection rule and its corresponding process template;

[0008] When a security event alarm is detected, the alarm rule that triggered the alarm is determined, and the target template corresponding to the alarm rule is matched with the detection rule base. A structured handling task is generated based on the target template.

[0009] The query results are obtained based on the structured processing tasks, and manual decisions are made based on the query results.

[0010] Optionally, the method further comprises: constructing a detection rule library, including: obtaining a security event handling process document, parsing the security event handling process document through a structured engine, extracting core elements and performing label processing, and generating a process template in a specified format; obtaining a detection rule, binding the detection rule and the process template, and generating the detection rule library.

[0011] Optionally, the method further comprises: generating a structured handling task according to the target template, including: obtaining core elements in the target process template, wherein the core elements include a step sequence, a node type label, an input / output rule, and a decision branch condition; generating a template element list to be split according to the core elements, and generating two types of sub-nodes according to the node type label, wherein the node type label includes an automatic query node and a manual decision node; combining each sub-node according to the step sequence, and generating a structured handling task according to the decision branch condition, wherein the structured handling task includes task basic information, a node list, and execution logic.

[0012] Optionally, the method further comprises: obtaining information of the automatic query node in the structured handling task, and generating a query task list to be executed; based on the query task list, initiating a query request to a corresponding platform according to a preset parameter format, and obtaining returned original query data; converting the original query data according to a specified format, and generating standardized query results.

[0013] Optionally, the method further comprises: obtaining information of the manual decision node in the structured handling task, generating a decision reference interface according to the information of the manual decision node and the query results; obtaining a decision option input by a user based on the decision reference interface, and taking the decision option as a preliminary decision result; performing integrity verification on the preliminary decision result, and generating a final decision instruction if the verification is passed.

[0014] Optionally, the method further comprises: when the decision option is a high-risk operation, obtaining a work order number input by the user; and generating a preliminary decision result according to the work order number and the decision option.

[0015] Optionally, the method further comprises: when the event handling is completed, obtaining a handling full-process record; obtaining a step validity label based on the query results and the handling full-process record, and optimizing the process template according to the step validity label.

[0016] According to another aspect of the present application, a security event handling device is provided, which comprises:

[0017] A detection rule library construction module is configured to construct a detection rule library, wherein the detection rule library includes detection rules and corresponding process templates.

[0018] The structured handling task generation module is used to determine the alarm rule that triggered the alarm when a security event alarm is detected, and to match the target template corresponding to the alarm rule with the detection rule base, and generate a structured handling task based on the target template.

[0019] The human decision-making module is used to obtain query results based on structured processing tasks and to make human decisions based on the query results.

[0020] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0021] At least one processor;

[0022] and a memory communicatively connected to the at least one processor;

[0023] The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform a security incident handling method according to any embodiment of the present invention.

[0024] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement a security incident handling method according to any embodiment of the present invention.

[0025] The technical solution of this invention, by constructing a detection rule library containing detection rules and corresponding process templates, enables direct association between rules and handling processes. Upon detecting a security event alarm, the alarm rules are determined, the target template is matched, and a structured handling task is generated. This shortens the handling initiation time, unifies the handling process, and solves the problem of process fragmentation. Obtaining query results based on structured handling tasks and making manual decisions reduces repetitive work, lowers data errors, improves decision accuracy, and solves the problems of difficulty in knowledge reuse and disconnect between human and machine collaboration.

[0026] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a flowchart of a security incident handling method provided in Embodiment 1 of the present invention;

[0029] Figure 2 This is a flowchart of another security incident handling method provided in Embodiment 2 of the present invention;

[0030] Figure 3 This is a schematic diagram of the structure of a security incident handling device according to Embodiment 3 of the present invention;

[0031] Figure 4 This is a schematic diagram of the structure of an electronic device that implements a security incident handling method according to an embodiment of the present invention. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] Example 1

[0035] Figure 1 This is a flowchart illustrating a security incident handling method provided in Embodiment 1 of the present invention. This embodiment is applicable to network security operation and maintenance scenarios. The method can be executed by a security incident handling device, which can be implemented in hardware and / or software and can be configured in a computer controller. Figure 1 As shown, the method includes:

[0036] S110. Construct a detection rule base, which includes each detection rule and its corresponding process template.

[0037] The detection rule base refers to a collection of security event detection rules, providing a basis for judgment for the security operations system. When the system detects network behavior or anomalies that match the rules, it triggers a security event alarm. The base not only contains the detection rules but also associates each rule with a corresponding process template, enabling rapid connection from alarm triggering to the initiation of the handling process. Detection rules are used to identify the judgment criteria for security events and run in the detection rule engine of the security operations system. A new process template ID field has been added to the rules. For example, a detection rule with rule ID R2025 is associated with the process template T_phishing email_v1. When this rule triggers an alarm, the corresponding handling template can be directly located. The process template is generated by the knowledge management platform, transforming unstructured security event handling process documents into machine-executable structured templates. Presented in JSON format with tags, such as {"Step Type":"Query","Input":"Asset IP","Output":"Host Owner"}), the process templates cover four scenarios: terminal external connections, host external connections, phishing emails, and network attacks.

[0038] Optionally, a detection rule base is constructed, including: obtaining security incident handling process documents, parsing the security incident handling process documents through a structured engine, extracting core elements and performing tagging processing, and generating process templates in a specified format; obtaining detection rules, binding the detection rules and process templates, and generating a detection rule base.

[0039] Among them, the security incident handling process document refers to the unstructured Standard Operating Procedure (SOP) document compiled by experts. This document contains the complete steps, decision-making basis, and operational actions for handling security incidents, serving as the raw material for the process template. The structured engine decomposes the unstructured SOP, extracting four core elements: handling steps (e.g., querying email logs, searching threat intelligence databases); decision points (e.g., whether it matches known malware, whether the result is uncertain); action items (e.g., automatically executed Application Programming Interface (API) calls and manual approval actions); and dependent resources (e.g., the data sources required for the asset database and threat intelligence database).

[0040] Specifically, the extracted core elements are tagged and templates are generated. First, a unified tag dictionary is called through the tag system management module. For example, action tags are divided into automatic execution and manual approval, and step type tags are divided into query and handling. Each core element is tagged accordingly. Then, the tagged elements are integrated into a JSON-formatted process template, for example, {"Step Type":"Query","Input":"Asset IP","Output":"Host Owner"}. When binding detection rules to process templates to generate a detection rule library, the detection rule engine of the security operations system and the template output function of the knowledge management platform must be combined. Detection rules are the judgment criteria used in the security operations system to identify security events. Then, through system configuration, the acquired detection rules are associated with the corresponding generated process templates. For example, the rule for detecting phishing emails, rule ID: R2025, is bound to the phishing email handling process template, template ID: T_phishing_v1, so that each detection rule corresponds to a unique process template. Finally, all bound detection rules and process templates are integrated to form a complete detection rule library.

[0041] S120. When a security event alarm is detected, determine the alarm rule that triggered the alarm, match the target template corresponding to the alarm rule through the detection rule base, and generate a structured handling task based on the target template.

[0042] Security incident alerts are warning signals issued by the security operations system when potentially security-risk behaviors occur on the network and match a detection rule in the detection rule base, indicating the need for action on potential security incidents. Alert rules are the detection rules that trigger security incident alerts; they are specific entries in the detection rule base. Target templates are process templates corresponding to the current security incident, matched against the alert rule that triggered the alert, based on the detection rule base. The target template specifies the specific steps, decision points, and actions for handling the incident, serving as a direct reference for generating structured handling tasks. Structured handling tasks are clear, step-by-step tasks generated by the security operations system's task scheduling center based on the matched target template. These tasks are then pushed to the human-machine collaborative handling interface, guiding analysts to carry out the handling work according to the process.

[0043] Optionally, a structured processing task is generated based on the target template, including: obtaining the core elements in the target process template, wherein the core elements include a sequence of steps, node type markers, input / output rules, and decision branch conditions; generating a list of template elements to be split based on the core elements, and generating two types of sub-nodes according to the node type markers, wherein the node type markers include automatically queried nodes and manually decided nodes; combining each sub-node according to the sequence of steps, and combining the decision branch conditions to generate a structured processing task, wherein the structured processing task includes basic task information, a node list, and execution logic.

[0044] Specifically, the system first extracts core elements from the matched target process template. These core elements include the step sequence, node type markers, input / output rules, and decision branch conditions. Then, these extracted core elements are integrated into a list of template elements to be split. This list details the sequence number, node type, input / output rules, and decision branch conditions for each step. Next, based on the node type markers, the steps in the list are split into two types of sub-nodes: those marked for automatic execution are classified as automatic query nodes (requiring no manual intervention); those marked for manual approval are classified as manual decision nodes (requiring analyst participation and associated with risk warnings and work order requirements). Finally, the two types of sub-nodes are arranged sequentially according to the step sequence, and the decision branch conditions are embedded into the node execution logic. For example, if the result of a manual decision node is uncertain, it will automatically connect to subsequent sub-nodes of the network attack template. Based on this, the system generates a structured handling task, which includes basic task information, a node list, and execution logic. For example, the basic information of the task can be alarm ID, association rule ID and priority, etc. The node list refers to the name, type, input and output and dependent resources of each child node, and the execution logic refers to the order of child nodes, branch triggering conditions, API call failure retry mechanism, etc. Finally, the generated structured handling task will be pushed to the human-machine collaborative handling interface for analysts to use.

[0045] S130. Obtain query results based on structured processing tasks, and make manual decisions based on the query results.

[0046] The query results refer to the information related to the security incident returned by the system after executing scripted operations in the structured handling task in the automatic query area of ​​the human-machine collaborative handling interface. Human decision-making refers to the judgment made by analysts based on the query results obtained from the automatic query area, combined with their own experience and reference information such as the similarity of historical cases provided by the interface, in the human approval area or key decision points of the human-machine collaborative handling interface, regarding the direction of handling the security incident and whether to perform high-risk operations.

[0047] Optionally, obtaining query results based on structured processing tasks includes: obtaining information about automatic query nodes in the structured processing tasks and generating a list of query tasks to be executed; based on the list of query tasks, initiating a query request to the corresponding platform according to preset parameter formats and obtaining the returned raw query data; and converting the raw query data according to a specified format to generate standardized query results.

[0048] The structured processing task's node list clearly labels the type of each node, and the system extracts information from nodes marked as automatic query nodes. This information includes the operational purpose of each automatic query node, such as querying the owner of the host corresponding to an asset IP or retrieving threat intelligence from attachment hashes; the platforms to be invoked, such as asset databases, threat intelligence databases, and email log systems; and the input parameter format, such as asset IPs being passed in the format xxx.xxx.xxx.xxx, and hashes being passed in SHA256 encoding. This information is then organized step-by-step to form a final list of query tasks to be executed.

[0049] Specifically, the system queries the task list, initiates query requests to the corresponding platforms according to preset parameter formats, and retrieves raw data. The system calls the preset API interfaces in the process template, processing the input parameters for each query task in the list according to the target platform's required format before initiating a request. For example, when querying the host administrator, it sends a standardized asset IP address to the asset database API, requesting the name and contact information of the host administrator corresponding to that IP address; when retrieving threat intelligence, it sends an attached SHA256 format hash to the threat intelligence database API, requesting information such as whether the hash belongs to known malware or associated attack families. After each request is initiated, the system receives the raw query data returned by the corresponding platform. Finally, the system refers to the output rules defined in the target process template, performs format standardization and information filtering on the raw data, generates standardized query results, and directly displays these results in the automatic query area of ​​the human-machine collaborative processing interface, allowing analysts to quickly obtain key information.

[0050] Optionally, the method also includes: after the event is handled, obtaining the entire handling process record; obtaining step validity markers based on the query results and the entire handling process record; and optimizing the process template based on the step validity markers.

[0051] The full-process record of the handling refers to all operational data generated from the triggering of the alarm to the closure of the task, including the execution trajectory of the structured handling task, the final handling result, and basic information related to the event. The full-process record of the handling will be automatically summarized and stored by the system to form a complete data archive of the event handling, providing the original basis for subsequent evaluation of the effectiveness of the steps.

[0052] Specifically, the system first correlates the standardized query results from automated query nodes with the decision-making logic and final results recorded throughout the entire handling process. For example, if an automated query node returns an unknown risk from the threat intelligence database, but subsequent manual decision-making, combined with other information, determines the event to be a malicious attack, it indicates that the intelligence coverage of that query node is insufficient. Analysts can mark this step as inaccurate intelligence querying on the human-machine collaborative handling interface and give it a 2 / 5 validity rating. If a manual decision-making node's branch selection ultimately successfully blocks the attack, analysts can mark this step as effective decision guidance and give it a 5 / 5 rating. The validity rating not only includes the analyst's subjective rating but also correlates with corresponding abnormal query result data and decision deviation records to ensure that the rating is supported by objective data.

[0053] Furthermore, the system will flag the validity of all steps and feed it back to the knowledge management platform, which will then categorize and statistically analyze the flags. Inefficient nodes with scores below 3 / 5 will automatically trigger an expert review process, inviting security experts to analyze the root cause of the problem based on the corresponding query results and handling records. For example, if it is determined that the human decision-making node lacks sufficient guidance, an auxiliary information module displaying the handling results of similar historical cases will be added to the template. The optimized content will generate new versions of the process templates, such as upgrading the original phishing email template v1 to v2, updating the detection rule base, and replacing the old version template. This ensures that subsequent handling of similar incidents can directly use the optimized process, achieving self-evolution of knowledge.

[0054] The technical solution of this invention, by constructing a detection rule library containing detection rules and corresponding process templates, enables direct association between rules and handling processes. Upon detecting a security event alarm, the alarm rules are determined, the target template is matched, and a structured handling task is generated. This shortens the handling initiation time, unifies the handling process, and solves the problem of process fragmentation. Obtaining query results based on structured handling tasks and making manual decisions reduces repetitive work, lowers data errors, improves decision accuracy, and solves the problems of difficulty in knowledge reuse and disconnect between human and machine collaboration.

[0055] Example 2

[0056] Figure 2 This is a flowchart of a security incident handling method provided in Embodiment 2 of the present invention. This embodiment adds a specific process of manual decision-making based on query results to the above-described Embodiment 1. The specific content of steps S210-S220 is largely the same as steps S110-S120 in Embodiment 1, therefore, it will not be described again in this embodiment. Figure 2 As shown, the method includes:

[0057] S210. Construct a detection rule base, which includes each detection rule and its corresponding process template.

[0058] Optionally, a detection rule base is constructed, including: obtaining security incident handling process documents, parsing the security incident handling process documents through a structured engine, extracting core elements and performing tagging processing, and generating process templates in a specified format; obtaining detection rules, binding the detection rules and process templates, and generating a detection rule base.

[0059] S220. When a security event alarm is detected, determine the alarm rule that triggered the alarm, match the target template corresponding to the alarm rule through the detection rule base, and generate a structured handling task based on the target template.

[0060] Optionally, a structured processing task is generated based on the target template, including: obtaining the core elements in the target process template, wherein the core elements include a sequence of steps, node type markers, input / output rules, and decision branch conditions; generating a list of template elements to be split based on the core elements, and generating two types of sub-nodes according to the node type markers, wherein the node type markers include automatically queried nodes and manually decided nodes; combining each sub-node according to the sequence of steps, and combining the decision branch conditions to generate a structured processing task, wherein the structured processing task includes basic task information, a node list, and execution logic.

[0061] S230. Obtain query results based on structured processing tasks.

[0062] Optionally, obtaining query results based on structured processing tasks includes: obtaining information about automatic query nodes in the structured processing tasks and generating a list of query tasks to be executed; based on the list of query tasks, initiating a query request to the corresponding platform according to preset parameter formats and obtaining the returned raw query data; and converting the raw query data according to a specified format to generate standardized query results.

[0063] S240. Obtain information on human decision-making nodes in the structured processing task, and generate a decision reference interface based on the information of human decision-making nodes and query results.

[0064] Specifically, the first step is to acquire information on human decision-making nodes in the structured processing task and generate a decision reference interface based on the query results. The node list for the structured processing task clearly marks the location, decision objective, and required reference basis of each human decision-making node. The system first extracts the information of the human decision-making nodes and then associates it with standardized query results already generated in the automatic query area. For example, for the decision node determining whether an email is malicious, the system can integrate the sender's IP threat intelligence matching results, attachment HASH malicious attribute determination, and sending path in the email log with the node's preset historical case similarity data to generate a decision reference interface in the human-machine collaborative processing interface. The interface clearly displays query results, historical cases, and decision options to be selected, preventing analysts from missing key information. Decision options include determining it as malicious email, performing isolation, determining it as a false alarm, ending processing, and determining the result is uncertain, along with a network attack template.

[0065] S250. Obtain the decision options input by the user based on the decision reference interface, and use the decision options as the preliminary decision results.

[0066] Specifically, analysts will combine the query results displayed on the interface with historical cases to select the corresponding action from the options at the manual decision-making node. For example, after seeing the query result that the sender's IP is a known malicious IP and the attachment's hash matches ransomware characteristics, they will choose the option to determine it as a malicious email and execute isolation. The system will capture the analyst's input decision options in real time, record them as preliminary decision results, and automatically associate the corresponding operation instructions. For example, when isolation is selected, the interface will pop up a risk warning that isolation will affect user Zhang San's email reception, ensuring that the analyst understands the business impact of the decision.

[0067] S260. Perform integrity verification on the preliminary decision results, and generate the final decision instruction after passing the verification.

[0068] Specifically, integrity verification includes verifying the correlation between decision options and query results, and verifying additional information for high-risk operations. Verifying the correlation between decision options and query results confirms whether the preliminary decision is supported by objective data. Verifying additional information for high-risk operations means that if the preliminary decision involves high-risk operations such as blocking core business IPs or isolating important terminals, the system will check if an approval work order number has been entered; if not, it will prompt for supplementation. After successful verification, the system will convert the preliminary decision into a machine-executable final decision instruction and trigger subsequent actions. Simultaneously, the decision-making process will be recorded in the entire handling process archive, providing a basis for validating subsequent steps.

[0069] Optionally, the method also includes: when the decision option is a high-risk operation, obtaining the work order number entered by the user; and generating a preliminary decision result based on the work order number and the decision option.

[0070] High-risk operations can be identified based on action tags defined in the knowledge management platform's tag system. For example, operations marked as requiring manual approval and associated with business-related risks, such as blocking core business IP connections, isolating all employee email accounts, and deleting suspicious system files, all fall under the high-risk category. When an analyst selects a high-risk operation option on the decision reference interface, a mandatory pop-up window immediately appears on the human-machine collaborative processing interface, prompting: "This operation requires an approval work order number; submission will fail without it." A work order number format example is also provided to ensure analysts understand the input requirements. By binding the tag system to the interface interaction logic, the approval requirements for high-risk operations are transformed into mandatory system verification rules, preventing the execution of high-risk operations without an approval process.

[0071] Specifically, analysts need to enter a valid work order number generated through the internal approval process in a pop-up window. After input, the system first verifies whether the work order number conforms to the preset format, and then quickly queries the status and corresponding approval items of the work order number by calling the API interface of the internal work order system. If the work order number format is incorrect or the status is invalid, the system will display a pop-up window indicating the error reason and requiring re-entry; if the verification is successful, it confirms that the work order number can be associated with the current decision operation. Finally, the system integrates the verified work order number and decision options to generate a preliminary decision result. Integration includes binding the operation instructions corresponding to the decision options and the associated valid work order number, while supplementing basic information such as the decision time and the name of the analyst performing the operation, forming a complete preliminary decision result. This result will be synchronously stored in the entire process record.

[0072] Optionally, the method also includes: after the event is handled, obtaining the entire handling process record; obtaining step validity markers based on the query results and the entire handling process record; and optimizing the process template based on the step validity markers.

[0073] The technical solution of this invention provides analysts with a centralized view of key information needed for decision-making, avoiding the inefficiency caused by fragmented information. Using user-inputted decision options as preliminary decision results through a decision reference interface ensures a close connection between decision-making operations and processing procedures, reducing decision bias. Generating final decision instructions after verifying the completeness of the preliminary decision results filters out unfounded decisions, ensuring compliance and accuracy. When a decision option is a high-risk operation, the approval process can be linked through a work order number, effectively preventing high-risk operations from spiraling out of control and meeting the risk control requirements of financial institutions.

[0074] Example 3

[0075] Figure 3 This is a schematic diagram of a security incident handling device provided in Embodiment 3 of the present invention. Figure 3As shown, the device includes: a detection rule base construction module 310, used to construct a detection rule base, wherein the detection rule base includes various detection rules and corresponding process templates;

[0076] The structured handling task generation module 320 is used to determine the alarm rule that triggers the alarm when a security event alarm is detected, and to match the target template corresponding to the alarm rule through the detection rule base, and generate a structured handling task based on the target template.

[0077] The manual decision-making module 330 is used to obtain query results based on structured processing tasks and make manual decisions based on the query results.

[0078] Optionally, the detection rule base construction module 310 is specifically used for: obtaining security incident handling process documents, parsing the security incident handling process documents through a structured engine, extracting core elements and performing tagging processing, and generating process templates in a specified format; obtaining detection rules, binding the detection rules and process templates, and generating a detection rule base.

[0079] Optionally, the structured processing task generation module 320 is specifically used for: obtaining the core elements in the target process template, wherein the core elements include the step sequence, node type markers, input / output rules, and decision branch conditions; generating a list of template elements to be split based on the core elements, and generating two types of sub-nodes according to the node type markers, wherein the node type markers include automatically queried nodes and manually decided nodes; combining each sub-node according to the step sequence, and generating a structured processing task based on the decision branch conditions, wherein the structured processing task includes basic task information, a node list, and execution logic.

[0080] Optionally, the manual decision-making module 330 specifically includes: a query result acquisition unit, used to: acquire information of automatic query nodes in structured processing tasks, generate a list of query tasks to be executed; based on the query task list, initiate query requests to the corresponding platform according to preset parameter formats, and acquire the returned raw query data; convert the raw query data according to a specified format to generate standardized query results.

[0081] Optionally, the manual decision-making module 330 specifically includes: a manual decision-making unit, used to: acquire information on manual decision-making nodes in the structured processing task; generate a decision reference interface based on the information on the manual decision-making nodes and the query results; acquire user-input decision options based on the decision reference interface; use the decision options as preliminary decision results; perform integrity verification on the preliminary decision results; and generate a final decision instruction after passing the verification.

[0082] Optionally, the device also includes a high-risk operation module, used to: obtain the work order number entered by the user when the decision option is a high-risk operation; and generate a preliminary decision result based on the work order number and the decision option.

[0083] Optionally, the device also includes: a validity marking module, used to: obtain the entire process record of the handling after the event is handled; obtain the step validity marking based on the query results and the entire process record of the handling; and optimize the process template according to the step validity marking.

[0084] The technical solution of this invention, by constructing a detection rule library containing detection rules and corresponding process templates, enables direct association between rules and handling processes. Upon detecting a security event alarm, the alarm rules are determined, the target template is matched, and a structured handling task is generated. This shortens the handling initiation time, unifies the handling process, and solves the problem of process fragmentation. Obtaining query results based on structured handling tasks and making manual decisions reduces repetitive work, lowers data errors, improves decision accuracy, and solves the problems of difficulty in knowledge reuse and disconnect between human and machine collaboration.

[0085] The security incident handling device provided in this embodiment of the invention can execute a security incident handling method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0086] Example 4

[0087] Figure 4 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0088] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0089] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0090] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as a security incident handling method.

[0091] In some embodiments, a security incident handling method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the security incident handling method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform a security incident handling method by any other suitable means (e.g., by means of firmware).

[0092] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0093] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0094] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0095] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0096] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0097] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0098] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0099] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for handling security incidents, characterized in that, include: Construct a detection rule base, wherein the detection rule base includes each detection rule and the corresponding process template; When a security event alarm is detected, the alarm rule that triggered the alarm is determined, and the target template corresponding to the alarm rule is matched with the detection rule base. A structured handling task is generated based on the target template. The query results are obtained based on the structured processing task, and manual decision-making is made based on the query results.

2. The method according to claim 1, characterized in that, The construction of the detection rule base includes: Obtain the security incident handling process document, parse the security incident handling process document through a structured engine, extract the core elements and perform tagging processing, and generate a process template in a specified format; Obtain the detection rules, bind the detection rules to the process template, and generate a detection rule library.

3. The method according to claim 2, characterized in that, The step of generating a structured processing task based on the target template includes: Obtain the core elements from the target process template, wherein the core elements include step sequence, node type markers, input / output rules, and decision branch conditions; Based on the core elements, a list of template elements to be split is generated, and two types of sub-nodes are generated according to node type markings, wherein the node type markings include automatic query nodes and manual decision-making nodes; By combining the sub-nodes according to the step sequence and combining the decision branch conditions, a structured processing task is generated. The structured processing task includes basic task information, a node list, and execution logic.

4. The method according to claim 3, characterized in that, The process of obtaining query results based on the structured processing task includes: Obtain information about the automatic query nodes in the structured processing task and generate a list of query tasks to be executed; Based on the query task list, a query request is sent to the corresponding platform according to the preset parameter format, and the returned raw query data is obtained; The original query data is converted according to a specified format to generate standardized query results.

5. The method according to claim 3, characterized in that, The manual decision-making based on the query results includes: Obtain information about the human decision-making nodes in the structured processing task, and generate a decision reference interface based on the information of the human decision-making nodes and the query results; Based on the decision reference interface, the user input decision options are obtained, and the decision options are used as preliminary decision results; The preliminary decision results are verified for completeness, and a final decision instruction is generated upon successful verification.

6. The method according to claim 5, characterized in that, The method further includes: When the decision option is a high-risk operation, obtain the work order number entered by the user; A preliminary decision result is generated based on the work order number and the decision options.

7. The method according to claim 1, characterized in that, The method further includes: Once the incident has been resolved, obtain the complete record of the entire resolution process; Based on the query results and the full process record of the processing, the validity markers of the steps are obtained, and the process template is optimized according to the validity markers of the steps.

8. A security incident handling device, characterized in that, include: The detection rule base construction module is used to construct the detection rule base, wherein the detection rule base includes each detection rule and the corresponding process template; The structured handling task generation module is used to determine the alarm rule that triggers the alarm when a security event alarm is detected, and to match the target template corresponding to the alarm rule with the detection rule base, and generate a structured handling task according to the target template. The manual decision-making module is used to obtain query results based on the structured processing task and to make manual decisions based on the query results.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

10. A computer storage medium, characterized in that, The computer storage medium stores computer instructions that are used to cause a processor to execute the method of any one of claims 1-7.

Images