Intelligent management system and method applied to network information security

Abstract

The invention discloses an intelligent management system and method applied to network information security, and relates to the technical field of information security management, and the method comprises the steps: collecting security event data, determining a preliminary disposal action based on the confidence, severity and evidence integrity of an event, and generating a case snapshot; calculating an explosion radius value and determining an explosion radius grade in combination with the asset dependency graph; predicting a threat upgrading probability and a mishandling rate by using a decision tree model, screening an optimal handling action according to a priority, and outputting a handling level; a minimum cut candidate set is generated in an upgrade or degradation scene, priority and strength are controlled in a grading manner, and control parameters and effect data are written back to calibrate a model and a threshold value after shadow mode and gradient execution verification.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security management, and more particularly to an intelligent management system and method applied to network information security. BACKGROUND

[0002] With the popularity of cloud computing, Internet of Things and distributed micro-service architecture, the network environment of enterprises is becoming more and more complex, and the traditional single boundary protection has been difficult to meet the security needs. Once a node is broken, the attacker can often quickly penetrate horizontally along the permission chain or network topology, causing a large area of system to be affected. This range of influence is called explosion radius in the industry. Related research shows that the explosion radius is a measure of the potential influence range that a security incident may cause, which covers the range of systems, data and business operations affected by the incident. In actual deployment, the security team usually evaluates the explosion radius according to the number of customers affected, the degree of function affected, and the area affected by the failure. However, most existing security systems only provide static response and simple alarm aggregation based on rules, lack of dynamic assessment of event severity and collateral effects, and lack of adaptive adjustment of control strategies. The current explosion radius evaluation often relies on qualitative judgment or post-mortem, lacking a consistent quantitative method. In terms of control, the strategy update of security devices is mostly decided by adding or deleting rules through manual analysis, lacking a closed-loop optimization mechanism, and is prone to over-protection or neglecting hidden dangers. The present application aims to address these issues and proposes an intelligent management method applied to network information security, which introduces multi-dimensional event scoring, collateral effect assessment, quantitative criteria for increase and decrease control, and automatic write-back mechanism to build a full-process closed loop from acquisition to disposal to strategy optimization, improving the response speed to attacks and reducing the risk of misdisposal. To solve the above problems, the present application proposes a solution. SUMMARY

[0003] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present application provide an intelligent management system and method applied to network information security to solve the problems raised in the background art.

[0004] To achieve the above-mentioned purpose, the present application provides the following technical solutions: An intelligent management method applied to network information security, comprising the following steps: acquiring security event data, and determining a preliminary disposal action according to the event confidence, severity and evidence integrity in the security event data to generate a case snapshot containing an event identifier and a preliminary disposal action result; the preliminary disposal action includes isolation, speed limit, observation; Based on case snapshots and pre-built asset dependency graphs, an explosion radius value is calculated. This explosion radius value is used to quantify the scope of collateral impact of a security incident, and the explosion radius level is determined based on historical data. The asset dependency graph represents the nodes in the network and the dependencies between them. The decision tree model is used to predict the threat escalation probability and mishandling rate of different initial response actions. The threat escalation probability and mishandling rate are compared and combined with the explosion radius level to determine the optimal response action through priority screening. Based on the comparison of the strength of the optimal response action and the initial response action, the response level is output, which includes escalation, maintenance, or de-escalation. Based on the level of action, when upgrading, a minimum cut candidate set is generated and the control priority and intensity are determined in stages. When downgrading, the existing control set is processed in stages. When the explosion radius level is high, the control intensity is automatically reduced. The operation is executed according to the optimized control strategy. The effectiveness is verified by shadow mode and gradient execution. After execution, the control parameters and effect data are fed back to the previous steps for calibration.

[0005] In a preferred embodiment, the preliminary action determination includes: calculating a comprehensive action score based on linear weighting of event confidence, severity, and evidence completeness; comparing the comprehensive action score with an action trigger threshold; performing an isolation action when the comprehensive action score is greater than or equal to the high action trigger threshold; performing a rate limiting action when the comprehensive action score is between the low action trigger threshold and the high action trigger threshold; and performing an observation action when the comprehensive action score is less than the low action trigger threshold.

[0006] In a preferred embodiment, event confidence Bayesian calibration is performed based on the historical performance of the detection model, using the following calibration formula: Where TPR is the true positive rate, FPR is the false positive rate, and p is the initial probability output by the detection model; The severity is calculated by multiplying the asset criticality score and the behavioral threat score. The evidence completeness score uses an evidence weighting model to assign a basic weight to each type of evidence and adjust it according to the quality of the evidence. The asset criticality score is determined based on data sensitivity, service dependence, and recovery time target.

[0007] In a preferred embodiment, the explosion radius value is calculated using the formula... Achieve; where H is the explosion radius value, The total number of affected nodes is the set of nodes inferred by a breadth-first search algorithm, starting from the attack source node in the case snapshot and following the dependencies and active session connections in the asset dependency graph. Number of elements ; The number of critical nodes affected, i.e., the set of nodes. The set of core asset nodes selected and marked by business impact analysis. Number of elements Core asset nodes include database nodes that store sensitive data and service nodes that support core business operations.

[0008] In a preferred embodiment, determining the blast radius level based on historical data includes: statistically analyzing the actual blast radius values ​​of various historical safety incidents; and determining a high-impact threshold. Influence threshold The blast radius is classified according to the following rules: when When the explosion radius is high, the corresponding explosion radius level is high. when When the explosion radius is at that time, its corresponding explosion radius level is medium. when When the explosion radius is low, the corresponding explosion radius level is low.

[0009] In a preferred embodiment, when using a decision tree model to predict the probability of threat escalation and the mishandling rate, the following steps are included: the input features of the decision tree model include core features and auxiliary features. The core features are event confidence, severity, evidence completeness, and overall handling score. The auxiliary feature is the ratio of abnormal sessions recorded in the case snapshot. New high-risk alerts Initial handling actions Types and invalidation markers for actions requiring optimization and adjustment; model training data uses historical security event data, supplemented with full information on invalidation events; model parameters are optimized through cross-validation during training; model outputs are the threat escalation probability and mishandling rate for three actions: observation, rate limiting, and isolation; the mishandling rate is calculated based on historical handling records and corrected using a conditional probability table combined with a decision tree model; where the threat escalation probability refers to the conditional probability that, after performing a certain initial handling action, the scope of harm of the security event will expand or its impact will intensify within the subsequent assessment window.

[0010] In a preferred embodiment, determining the optimal action through priority screening includes: a first priority, comparing the threat escalation probability of each preliminary action, and selecting the action with the lowest threat escalation probability; if the difference in threat escalation probability between different actions is less than a preset threshold... The process proceeds to the second priority level. In the second priority level, the error rates of each initial response action are compared, and the response action with the lowest error rate is selected. If there are still ties, the process proceeds to the third priority level. In the third priority level, it is determined whether the response action will trigger a high cascading effect, and the response action that will not cause the explosion radius level to rise to a high level is selected first. Simultaneously set a binary switch When the explosion radius level is high At this point, the optimal response level will be automatically reduced by one level, i.e., isolation will be reduced to speed limit, and speed limit will be reduced to observation. When the explosion radius level is medium or low... Maintain the strength of the selected optimal treatment actions.

[0011] In a preferred embodiment, generating the minimum cut candidate set includes: defining the source node as the attack source node in the case snapshot, and defining the target node as the core asset node marked by business impact analysis in the asset dependency graph; using the attack source node and the core asset node as the start and end points, solving the maximum flow from the source node to the target node based on the asset dependency graph using the Edmonds-Karp algorithm; and obtaining the minimum cut set according to the maximum flow minimum cut theorem, i.e., the set of control edges that cut off all paths from the source node to the target node after deletion and has the fewest number of control edges, denoted as the minimum cut candidate set. ;in, Represents the candidate set of minimum cuts The control edge identifiers in the minimum cut candidate set are the basic elements constituting the minimum cut candidate set, representing the specific control objects that can be used to cut off attack paths; n represents the number of control edges in the minimum cut candidate set, i.e., the minimum cut candidate set. The total number of control edges included.

[0012] In a preferred embodiment, determining control priority and intensity by tiers includes: for scenarios with an escalation level of action, calculating the increase index of each control edge in the minimum cut candidate set. The threat improvement value is categorized based on the threat improvement value and the increase in mishandling; the threat improvement value This refers to enabling the control edge. After executing the optimal handling action, compared to when the control edge is not enabled, the decrease in the probability of threat escalation is measured; a positive value indicates a reduction in threat. The increase in mishandling... This refers to enabling the control edge. After executing the optimal handling action, the increase in the false handling rate compared to when the control edge is not enabled is calculated. A positive value indicates an increase in false handling. The tiering logic is as follows: when and At that time, increase the index For high; when but At that time, increase the index For the middle; when At that time, increase the index For low; prioritize control edges with higher exponents; among them, and These are the mishandling tolerance threshold and the escalation and improvement threshold, respectively. For scenarios where the handling level is downgraded, calculate the existing control set. The control edge is identified as The removal index of each control edge is graded based on the threat escalation value and the false handling improvement value; wherein m is the total number of control edges contained in the existing control set; the threat escalation value refers to the increase in threat escalation probability after simulating the removal of the control edge compared to when the control edge is enabled, and the value is positive indicating threat escalation; the false handling improvement value refers to the decrease in false handling rate after simulating the removal of the control edge compared to when the control edge is enabled, and the value is positive indicating false handling reduction; The grading logic is: when and the removal index is high; when but the removal index is medium; when the removal index is low; the control edge with high removal index is preferentially selected; wherein is the risk tolerance threshold , is the false handling improvement threshold; The control strength mapping is that when the increase index or the removal index is high, the corresponding isolation action is selected; when the increase index or the removal index is medium, the corresponding speed limit action is selected; when the increase index or the removal index is low, the corresponding shadow mode or retention is selected.

[0013] An intelligent management system applied to network information security, comprising the following modules: a data acquisition module for acquiring security event data and performing preliminary handling actions to generate a case snapshot; A cascading effect evaluation module for calculating an explosion radius value and an explosion radius level based on the security event data and asset dependency graph; A handling level determination module for predicting threat escalation probability and false handling rate, determining optimal handling actions and handling levels; A control quantification module for generating a minimum cut candidate set, grading control priority and strength, and verifying effectiveness through shadow mode and gradient execution; A control execution module for feeding control parameters and effect data back to the previous module for model and threshold calibration.

[0014] The technical effects and advantages of the intelligent management system and method applied to network information security of the application are as follows: the application preliminarily disposes actions and case snapshots according to multi-dimensional event scoring specifications, quantifies the influence of explosion radius value and explosion radius level, and prevents excessive disposal in a high-influence scenario through a binary switch; threat escalation probability and mis-disposal rate output based on a decision tree model are used for hierarchical priority screening to ensure that the optimal disposal action and disposal level are interpretable; the minimum cut candidate set is used to locate control edges and is divided according to threat improvement value and mis-disposal amplification to establish a deterministic mapping of intensity and action; shadow mode and gradient execution are used to reduce mis-disposal risk and business impact; the execution result is written back to calibrate weights, thresholds and model parameters to support continuous iteration of strategies; at the system level, a closed loop is formed by data acquisition, collateral influence evaluation, disposal level determination, control quantification and control execution to improve response speed and strategy accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 A flowchart of the intelligent management method applied to network information security of the application is shown. Figure 2 A structural diagram of the intelligent management system applied to network information security of the application is shown. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0017] EMBODIMENT Please refer to Figure 1 The application discloses an intelligent management method applied to network information security, which comprises the following steps: Step one: collect at least two types of telemetry on the host side, network side and identity side, and preliminarily determine according to the majority rule of event confidence, severity and evidence integrity; when all three are in the high range, output the isolation preliminary action, when any two are in the high range, output the speed limit preliminary action, and the rest output the observation preliminary action; in a short time window, verify the effectiveness of the preliminary action according to session termination, abnormal restoration and mis-disposal count, and form a case snapshot containing event identification and initial disposal result; The embodiment realizes data acquisition and preliminary treatment through the following process: the security platform acquires original event information from multiple source heterogeneous security data sources through a distributed data acquisition engine, including but not limited to continuously acquiring security event data from host side security monitoring tools such as terminal intrusion prevention systems, host firewalls, antivirus software, network side monitoring systems such as network traffic sampling, intrusion detection systems, application firewalls, and identity side logs such as single sign-on platforms, authentication and authorization systems, and access control logs; each type of data source provides a different perspective of events: host side data includes process creation, system call, file access, etc., which can reflect abnormal behavior inside the terminal; network side data includes connection establishment, traffic pattern, protocol analysis, etc., which can capture behaviors such as horizontal movement and data export; identity side logs include login failure, permission change, session duration, etc., which can be used to detect account theft, unauthorized access, etc.; for ease of subsequent correlation, the system maps these events into entity, behavior, and time triples through a unified identification model, and constructs an event graph in combination with the asset dependency graph of the enterprise, where each node type includes a host node, a service node, and an account node, and each edge represents a dependency relationship or a communication link edge type including but not limited to network connection edges, service call edges, container deployment edges, and permission granting edges; the goal of this step is to form a graph that can reflect the real dependency relationship, supporting subsequent blast radius and control policy analysis; It should be noted that the asset dependency graph represents the calling relationship and trust relationship between applications, services, containers, hosts, network devices, and accounts; the specific implementation includes: collecting the topology relationship in the configuration management database CMDB, such as the deployment relationship between services and servers, the API calling relationship between services; using the configuration files of network routing and switching devices to establish data paths, such as the connection between the border router and the internal network segment; analyzing historical traffic and using the traffic matrix to count the actual calling frequency between services to complete the missing connections in the CMDB; mapping the association between users and services and between roles and permissions in combination with the allocation relationship of the identity system; The constructed asset dependency graph will be stored as a graph database to support subsequent query and graph algorithm operations; for each security event in the event graph, the following three types of risk factors are evaluated using majority rules: first, collect historical security event data for the past 6-12 months, including event characteristics, disposal actions, and final verification results to confirm whether it is a real attack or a false alarm; establish an event feature matrix including event confidence , severity , and evidence completeness original assessment value and event context information; using a logistic regression detection model to analyze historical event data to finally verify the result; wherein the true attack = 1, false alarm = 0 as the dependent variable, and the evaluation value of the three risk factors as the independent variable; the form of the logistic regression detection model is: ; wherein p is the probability that the event is a true attack, , , is the regression coefficient of each factor; the weight of each risk factor is calculated according to the relative size of the regression coefficient: , , ; wherein the weight is recalibrated once a quarter to ensure that it reflects the latest threat environment and detection capability; According to the weight of each risk factor obtained above and the corresponding risk factor, a comprehensive disposal score is calculated by linear weighting, according to the following formula: ; wherein the quantification process of each risk factor is as follows: Event confidence Quantification, based on the historical performance of the detection model for Bayesian calibration; for each detection model, a confusion matrix is maintained to record the number of true positives, false positives, true negatives, and false negatives; when the detection model outputs a probability p, the calibrated confidence is: ; wherein TPR is the true positive rate and FPR is the false positive rate; when multiple models are fused, the Bayesian average method is used to consider the historical accuracy rate and correlation of each model; Severity Quantification, calculated by the product of asset criticality score and behavior threat score; asset criticality score is determined based on business impact analysis, considering three core dimensions including data sensitivity, service dependency and recovery time objective; behavior threat score is based on the technical score of MITREATT&CK framework, combined with industry threat intelligence data for dynamic adjustment; wherein when any of the above core dimensions is met, it is a core asset node, and the marking result is embodied as asset criticality score, and the asset criticality score of the core asset is significantly higher than that of the ordinary node, such as 0.3-0.5 for ordinary node score and 0.8-1.0 for core node; Evidence completeness Quantification, using an evidence weight model to assign a basic weight to each type of evidence and adjust it according to the evidence quality; the initial value of the network side evidence basic weight can be set to 0.4, the initial value of the host side evidence basic weight can be set to 0.35, and the initial value of the identity side evidence basic weight can be set to 0.25; evidence quality is evaluated through three dimensions of integrity, timeliness and reliability, and finally weighted to obtain evidence completeness; Based on the comparison of the comprehensive disposal score R and the corresponding action trigger threshold; ​When , execute the isolation action; the action parameter of the isolation action is: isolation duration Based on the linear adjustment of the difference between R and the action trigger threshold, the formula is: If the calculation result exceeds , take If , take ; When , execute the speed limit action; the action parameter of the speed limit action is: speed limit ratio Based on the relative position of R in the interval, the formula is: ; wherein, the result is forced to be within the range of ; When , execute the observation action, and the corresponding action parameter is: if , adopt the basic observation frequency ; If , adopt the enhanced observation frequency ; The action trigger threshold is determined based on the comprehensive disposition score threshold of ROC analysis, specifically: determine the action trigger threshold by receiver operating characteristic curve analysis: Use historical event data, including comprehensive disposition score R and final verification label; calculate the true positive rate and false positive rate under different thresholds, and draw the ROC curve; select the threshold that maximizes (sensitivity + specificity - 1) as the high action trigger threshold ; select the highest threshold with a false positive rate of less than 5% as the low action trigger threshold ; For two time points before and after executing the disposition action, including the baseline time point before disposition and the evaluation time point after disposition , with a default interval of 10 minutes, which can be configured, define the following core evaluation indicators: The ratio of the number of abnormal sessions after disposition to the total number of sessions before disposition, i.e. abnormal session ratio ; wherein, is the total number of sessions at , and is the number of abnormal sessions at ; The ratio of the number of abnormal calls after disposition to the total number of calls before disposition, i.e. abnormal call ratio ; wherein, is the total number of calls at , and is the number of abnormal calls at ; The difference between the high-risk alarm number after the treatment and the high-risk alarm number before the treatment, that is, the newly added high-risk alarm number ; wherein, is the high-risk alarm number at the moment, is the high-risk alarm number at the moment; Based on the above obtained core indicators, an effect score function is constructed to quantify the effectiveness of the treatment action: through the indicator function, when the abnormal session ratio is lower than the success condition trigger threshold , the newly added high-risk alarm is not increased, each is counted +1 point when the success condition is met, and when the abnormal session ratio is higher than the failure condition trigger threshold , the newly added high-risk alarm is increased, each is counted -1 point when the failure condition is met, and the final score S is the difference between the success condition score and the failure condition score, that is, the final score ; Based on the above scoring function, when , that is, the score reaches the minimum score of the success classification, it is determined that the treatment action is effective, and the parameters such as the threshold value and the execution timing of the treatment strategy are automatically recorded and included in the optimal strategy library for subsequent rapid response to similar threats; when , that is, the score is lower than the highest score of the failure classification, it is determined that the treatment action is ineffective, a secondary treatment process is triggered, and it is marked that the treatment strategy needs to be optimized and adjusted; when , that is, the score is between the two, the effect is uncertain, a prolonged observation window is started, such as extending the evaluation period from 10 minutes to 30 minutes, and the indicator data is continuously collected and the score is recalculated until the success or failure condition is met, and then the corresponding operation is performed; wherein, is the minimum score of the success classification, used to distinguish between success and uncertainty; is the highest score of the failure classification, used to distinguish between failure and uncertainty; Step 2: Based on the case snapshot, the affected node number, the key link number, and the predicted delay are simulated using the asset and dependency topology to obtain the level of cascading influence; the three alternative actions are compared according to the threat escalation probability first, and the lower one is preferred; if they are parallel, the mis-treatment rate is compared, and the lower one is preferred; if they are still parallel, the action that will not trigger high cascading influence is preferred, and the level of escalation, maintenance or degradation is output accordingly; Based on the asset dependency graph, the source node that triggers the security event recorded in the case snapshot is taken as the starting point, such as the malicious IP associated host and the infected terminal detected in step 1, the breadth-first search (BFS) algorithm is used, and along the dependency relationship and the current active session connection between nodes, the node set that may be attacked and affected is speculated within the time window consistent with the evaluation window in step 1 ; At the same time, from the node set ​​The core asset nodes marked by business impact analysis, such as databases storing sensitive data and payment service nodes supporting core business, form a key node subset ; For events associated with treatment strategies marked for optimization adjustment, all nodes within 2 layers of the source node are included in the priority range to avoid missing the spread range due to ineffective original treatment; The explosion radius value H is used to quantify the range of collateral damage that may be caused by an attack. Combined with the core asset node marking rules, the explosion radius value H formula is as follows: ; Wherein, is the total number of nodes affected, i.e. through the breadth-first search algorithm with the attack source node in the case snapshot as the starting point, along the dependency relationship and active session connection of the asset dependency graph to infer the node set The number of elements in ; is the number of key nodes affected, i.e. the set of core asset nodes marked by business impact analysis selected from the node set The number of elements in ; ; The constant factor 2 is used to reflect the priority of core asset protection emphasized in step one, which is equivalent to equating the impact weight of 1 key node to 2 ordinary nodes; Two variable thresholds are determined by historical event statistics, including high impact threshold and medium impact threshold ; Wherein, the high impact threshold takes the top 30% quantile of the maximum historical explosion radius value If the historical data contains events associated with treatment strategies that need to be optimized and adjusted, their actual spread range needs to be weighted by 1.2 times before being included in the statistics to avoid similar bias; The medium impact threshold takes the middle 30% quantile of the maximum historical explosion radius value, i.e. the difference between the top 60% quantile and the top 30% quantile; The explosion radius level division result obtained by comparing the explosion radius value H with the above variable thresholds is as follows: When , the corresponding explosion radius level is high; When , the corresponding explosion radius level is medium; When , the corresponding explosion radius level is low; The decision tree model is used to predict the probability of attack diffusion under different treatment actions. The input features of the model directly reuse the quantified parameters in step one, ensuring data homogeneity and feature effectiveness. The core features are event confidence , severity , evidence completeness , and comprehensive treatment score R; The auxiliary features are the recorded abnormal session ratio , the number of new high-risk alarms , the type of preliminary treatment action , and the invalid treatment label that needs to be optimized and adjusted. It should be noted that the model training data uses the historical event data accumulated in step one, and additional event information corresponding to the treatment strategy that needs to be optimized and adjusted is supplemented, including the cause analysis of the original invalid treatment, such as misjudgment node range, insufficient strength, and the label is determined by manual review, i.e. attack occurs in the evaluation window or data leakage, which is marked as upgrade = 1, otherwise, it is not upgraded = 0; The training process optimizes the tree depth through 5-fold cross-validation and the default maximum depth is 5, and the minimum sample size is 10 by default to avoid overfitting. The model output is the threat upgrade probability of three alternative actions, including the observed threat upgrade probability , the speed-limited threat upgrade probability , and the isolated threat upgrade probability ; The threat upgrade probability refers to the conditional probability that the security event expands in scope or intensifies in the subsequent evaluation window after performing a certain preliminary treatment action. Specifically, the threat upgrade is defined as: in the evaluation time window after treatment, the attack occurs horizontally to new nodes or data leakage occurs. The mis-treatment rate refers to the proportion of normal business operations that are misjudged as abnormal after taking treatment actions. Based on the historical treatment records stored in step one, the corresponding business interruption records, misjudgment counts, and mis-treatment cases marked by the effect score S, such as records of business interruption caused by mis-speed limiting; The conditional probability table is combined with the decision tree model to correct the mis-treatment rate of the three actions, including the observed mis-treatment rate , the speed-limited mis-treatment rate , and the isolated mis-treatment rate . ; The optimal treatment action is filtered according to the priority In addition, priority correction rules have been added for events associated with marked handling strategies that require optimization and adjustment: The first priority is to compare the probability of threat escalation, and then select the option based on the probability of threat escalation. Minimal action required; if the difference is less than the threshold. In cases of parallel events, proceed to the next priority level; where the threshold is... Default value is 0.05, but it is configurable. The second priority is to compare the false positive rate and select the false positive rate. The least demanding action; if there are multiple priorities, proceed to the third priority level. The third priority is to determine whether the action will trigger a high cascading impact. Prioritize actions that will not cause the explosion radius level to rise to a high level, such as the core asset node concentration area marked in step one, to avoid isolation actions causing large-scale business interruption; where 'a' represents the corresponding action identifier. Combined with initial treatment actions The best course of action at present Determine the level of action and associate it with the action strategies that need to be optimized or adjusted: If the optimal action is The force was greater than the initial treatment action. If the initial step is speed limiting, the preferred approach is isolation. If the optimal action is and initial handling actions If the intensity is consistent, the corresponding response level is maintained; Optimal handling action The intensity was lower than the initial treatment action. If the initial step is isolation, the preferred approach is speed limiting. Set binary switch This is used to dynamically adjust the intensity of the response. when At that time, the optimal action will be taken. The intensity of the response will be automatically reduced by one level, such as from isolation to speed limit, and from speed limit to observation, to avoid large-scale interruption of core business due to strong measures.

[0018] Step 3: When the handling level is determined to be escalation, a minimum cut candidate set is generated on the dependency graph from source to target. Based on the impact of candidate controls on the probability of threat escalation and the false alarm rate during the replay or shadow stage, candidate controls are categorized to determine priority and intensity mapping: high corresponds to isolation, medium corresponds to rate limiting, and low corresponds to shadow. When the level is determined to be degraded, controls in the existing control set are categorized according to their improvement on performance and false alarm rate and their impact on the probability of threat escalation, and are respectively executed to be offline, downgraded, or maintained. When the cascading impact is high, the intensity is automatically reduced by one level. This step is triggered only when the handling level is determined to be upgraded or downgraded in step two. It relies on the asset dependency graph constructed in step one to ensure the targeting and feasibility of the control node selection. The source node is defined as the attack source node determined in step two, such as a compromised host or a terminal associated with a malicious IP. The target node is defined as the core asset node marked in step one, such as a database storing sensitive data or a core business service node. The node marking results of the previous steps are directly reused. From the asset dependency graph, select edges with policy delivery capabilities, such as firewall policies corresponding to network connection edges, API gateway policies corresponding to service call edges, and network policies corresponding to container deployment edges, and exclude physical links that cannot be controlled by system orchestration to ensure that candidate control edges are actually operable. The Edmonds-Karp algorithm is used to solve for the maximum flow from the source node to the target node. Based on the maximum flow minimum cut theorem, the minimum cut set is obtained, which is the set of control edges that cut off all paths from the source node to the target node after deletion, and has the fewest number of control edges. This set is denoted as the minimum cut candidate set. ;in, Represents the candidate set of minimum cuts The control edge identifiers in the minimum cut candidate set are the basic elements constituting the minimum cut candidate set, representing the specific control objects that can be used to cut off attack paths; n represents the number of control edges in the minimum cut candidate set, i.e., the minimum cut candidate set. The total number of control edges included reflects the scale of control edges required to cut off the attack path; this minimum cut candidate set is directly used as the operation object for subsequent upgrade or downgrade scenarios to ensure optimal control efficiency. Based on the obtained minimum cut candidate set K, quantize each control edge in the minimum cut candidate set K. The added value is denoted as the increase index. The acquisition logic is as follows: The decision tree model trained in step two is invoked, and only records data that does not affect business operations are recorded using shadow mode. The following calculations are performed separately: Control edge disabled Time: Probability of Threat Escalation Mishandling rate ; Enable control edge Execute the optimal handling action in time. Threat escalation probability ), mishandling rate The threat improvement value is obtained by calculating the difference between the parameters obtained in the two different states. A positive value indicates that the control edge is enabled. Post-threat reduction; mishandling increase A positive value indicates that the control edge is enabled. The number of subsequent mishandling increases; The determination threshold is dynamically configured based on historical security event data statistics, i.e., the upgrade improvement threshold is upgraded , and the 70% quantile of the average decrease in threat upgrade probability in historical successful handling events is taken as the default value 0.2, i.e., a decrease of 20 percentage points is required; The false handling tolerance threshold , the maximum increase in the false handling rate acceptable by the business is taken as the default value 0.05; When and , the increase index is high; it indicates that the optimal handling action is executed , the effect is optimal, and it is preferred; When but , the increase index is medium; it indicates that the optimal handling action is executed , the effect is suboptimal, and it is less preferred; When , the increase index is low; it indicates that the optimal handling action is executed , the effect is not as expected, and it is excluded; The minimum cut candidate set is sorted in descending order of the increase index , and the control edges with high increase indexes are preferred ; if the number is insufficient, the control edges with medium increase indexes are supplemented to meet the link coverage requirement of the asset dependency graph in step one, i.e., to cut all paths from source nodes to target nodes and thus obtain the optimal control positions for the upgrade scenario; For the determined downgrade scenario, based on the existing control set , i.e., the deployed control positions, the control edge identifier is , the subscript e represents the element of the existing control set , i.e. , and m is the total number of control edges included in the existing control set, which quantifies the necessity of removing each control edge in the existing control set is recorded as the removal index , and its acquisition method is similar to that of the increase index : The trained decision tree model is called to calculate the threat upgrade probability, false handling rate, and threat upgrade probability when the control edge is removed is enabled ; the threat upgrade probability, false handling rate, and threat upgrade probability when the control edge is removed are calculated; the parameters obtained in the two different states are subtracted to obtain the threat increase , and its positive value indicates that the control edge is removed Post-threat increase; and mishandling improvement value A positive value indicates the removal of the control edge. Post-incident handling is reduced; The above-mentioned threshold is configured in conjunction with the business impact analysis results from step one, i.e., the risk tolerance threshold. : The maximum acceptable increase in the probability of threat escalation after removal, default 0.05; Mishandling Improvement Threshold This refers to the minimum required decrease in the mishandling rate after removal, with a default value of 0.1. Gear determination when and At that time, remove the index "High" indicates that the risk is controllable and mishandling has been significantly improved after removal, making it a priority for removal. when but At that time, remove the index "Medium" indicates that the risk is controllable, the improvement is suboptimal, and it is the second best option. when At that time, remove the index A value of low indicates a significant increase in threat after removal, thus excluding the target; the existing control set is adjusted according to the removal index. Sort by highest to lowest, prioritizing removal index. For high control edges, the secondary removal index is used. The control edges are defined in the middle, thus obtaining the optimal control position for the degraded scenario; It should be noted that the removal index Methods of obtaining and increasing the index The framework complements each other; it fully covers the assessment needs of control nodes for both upgrades and downgrades.

[0019] Step 4: Execute the operation according to the optimized control strategy, verify the effectiveness through shadow mode and gradient execution, and feed back the control parameters and effect data to the previous steps after execution to calibrate the evaluation model and judgment threshold, forming a closed-loop management of the entire process. After the optimal control position is output, this step is automatically triggered, and the optimal handling action determined in step two is reused synchronously. HighBlast and the target control position of screening, while calling the abnormal judgment standard set in step one and the observation period defined in step two, to ensure that the execution standard is consistent with the previous logic; for the upgrade scenario, first start the 10-minute shadow mode at the target position, only record the action hit data without affecting the business, verify the effectiveness of the position link coverage; no exception, execute the action by 5% to 25% to 100% gradient, if it is an isolation action, gradually expand the traffic interception range, if it is a speed limit action, determine the baseline value according to the speed limit proportion formula in step one, and then gradually increase the volume, observe for 10 minutes at each stage, and immediately back off and mark the position for reevaluation as soon as the false break standard is triggered; For the downgrade scenario, the offline action first converts the target control to observation mode, observes for 2 business cycles, and if there is no threat escalation and no business exception, it is completely deleted, otherwise the original control is restored and marked as offline; the downgrade action is to reduce the control strength to the optimal handling action according to the shadow verification to canary volume flow process , the execution standard remains the same as the upgrade scenario; After execution is completed, start the closed-loop feedback, and incorporate the effective control position and parameters into the optimal strategy library in step one to calibrate the weight of the comprehensive handling R; map the position and effect samples to the decision tree model in step two to improve the probability prediction accuracy; according to the deviation between the removal index or the increase index gear and the actual effect, optimize the judgment threshold in step three, and finally form a complete closed loop to ensure the dynamic iteration and continuous adaptation of the entire scheme.

[0020] Please refer to Figure 2 , the application discloses an intelligent management system applied to network information security, comprising: comprising the following modules: a data acquisition module, used for acquiring security event data and executing a preliminary handling action, and generating a case snapshot; a collateral impact assessment module, used for calculating an explosion radius value and an explosion radius level based on the security event data and an asset dependency graph; a handling level determination module, used for predicting a threat escalation probability and a false handling rate, determining an optimal handling action and a handling level; a control quantification module, used for generating a minimum cut candidate set, a control priority and strength in different grades, and verifying the effectiveness through a shadow mode and gradient execution; a control execution module, used for feeding back control parameters and effect data to the previous module for model and threshold calibration.

[0021] The above formulas are dimensionless values, and the formulas are obtained by software simulation of a large amount of data to obtain a formula of the latest real situation, and the preset parameters in the formula are set by a person skilled in the art according to the actual situation.

[0022] The above-described embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, the above-described embodiments can be implemented in whole or in part in the form of a computer program product.

[0023] Those skilled in the art can realize that the modules and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and the constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0024] In addition, each functional module in each embodiment of the present application can be integrated in one processing module, or each module can exist physically alone, or two or more modules can be integrated in one module.

[0025] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0026] Finally, the above is merely preferred embodiments of the present application, and is not intended to limit the present application, and any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. An intelligent management method for network information security, characterized in that, Includes the following steps: Acquire security incident data, and determine preliminary handling actions based on the event confidence, severity, and evidence completeness in the security incident data, generating a case snapshot containing the event identifier and the results of the preliminary handling actions; the preliminary handling actions include isolation, rate limiting, and observation; Based on case snapshots and pre-built asset dependency graphs, an explosion radius value is calculated. This explosion radius value is used to quantify the scope of collateral impact of a security incident, and the explosion radius level is determined based on historical data. The asset dependency graph represents the nodes in the network and the dependencies between them. The decision tree model is used to predict the threat escalation probability and mishandling rate of different initial response actions. The threat escalation probability and mishandling rate are compared and combined with the explosion radius level to determine the optimal response action through priority screening. Based on the comparison of the strength of the optimal response action and the initial response action, the response level is output, which includes escalation, maintenance, or de-escalation. Based on the level of action, when upgrading, a minimum cut candidate set is generated and the control priority and intensity are determined in stages. When downgrading, the existing control set is processed in stages. When the explosion radius level is high, the control intensity is automatically reduced. The operation is executed according to the optimized control strategy. The effectiveness is verified by shadow mode and gradient execution. After execution, the control parameters and effect data are fed back to the previous steps for calibration.

2. The intelligent management method for network information security according to claim 1, characterized in that, The preliminary action determination includes: calculating a comprehensive action score based on linear weighting of event confidence, severity, and evidence completeness, and comparing the comprehensive action score with an action trigger threshold. When the comprehensive action score is greater than or equal to the high action trigger threshold, isolation action is performed; when the comprehensive action score is between the low action trigger threshold and the high action trigger threshold, rate limiting action is performed; and when the comprehensive action score is less than the low action trigger threshold, observation action is performed.

3. The intelligent management method for network information security according to claim 2, characterized in that, Event confidence Bayesian calibration is performed based on the historical performance of the detection model, using the following calibration formula: Where TPR is the true positive rate, FPR is the false positive rate, and p is the initial probability output by the detection model; The severity is calculated by multiplying the asset criticality score and the behavioral threat score. The evidence completeness score uses an evidence weighting model to assign a basic weight to each type of evidence and adjust it according to the quality of the evidence. The asset criticality score is determined based on data sensitivity, service dependence, and recovery time target.

4. The intelligent management method for network information security according to claim 1, characterized in that... include: The explosion radius is calculated using the specific formula. Achieve; where H is the explosion radius value, The total number of affected nodes is the set of nodes inferred by a breadth-first search algorithm, starting from the attack source node in the case snapshot and following the dependencies and active session connections in the asset dependency graph. Number of elements ; The number of critical nodes affected, i.e., the set of nodes. The set of core asset nodes selected and marked by business impact analysis. Number of elements Core asset nodes include database nodes that store sensitive data and service nodes that support core business operations.

5. The intelligent management method for network information security according to claim 1, characterized in that, Determining the blast radius level based on historical data includes: statistically analyzing the actual blast radius values ​​of various historical security incidents; and determining the high-impact threshold. Influence threshold The blast radius is classified according to the following rules: when When the explosion radius is high, the corresponding explosion radius level is high. when When the explosion radius is at that time, its corresponding explosion radius level is medium. when When the explosion radius is low, the corresponding explosion radius level is low.

6. The intelligent management method for network information security according to claim 1, characterized in that, When using decision tree models to predict threat escalation probability and mishandling rate, the input features of the decision tree model include core features and auxiliary features. The core features are event confidence, severity, evidence completeness, and overall handling score. The auxiliary feature is the ratio of abnormal sessions recorded in the case snapshot. New high-risk alerts Initial handling actions Types and invalidation markers for actions requiring optimization and adjustment; model training data uses historical security event data, supplemented with full information on invalidation events; model parameters are optimized through cross-validation during training; model outputs are the threat escalation probability and mishandling rate for three actions: observation, rate limiting, and isolation; the mishandling rate is calculated based on historical handling records and corrected using a conditional probability table combined with a decision tree model; where the threat escalation probability refers to the conditional probability that, after performing a certain initial handling action, the scope of harm of the security event will expand or its impact will intensify within the subsequent assessment window.

7. The intelligent management method for network information security according to claim 1, characterized in that, The optimal response action is determined through priority screening, including: First priority: comparing the threat escalation probability of each initial response action and selecting the action with the lowest probability of escalation; if the difference in threat escalation probability between different actions is less than a preset threshold... The process proceeds to the second priority level. In the second priority level, the error rates of each initial response action are compared, and the response action with the lowest error rate is selected. If there are still ties, the process proceeds to the third priority level. In the third priority level, it is determined whether the response action will trigger a high cascading effect, and the response action that will not cause the explosion radius level to rise to a high level is selected first. Simultaneously set a binary switch When the explosion radius level is high At this point, the optimal response level will be automatically reduced by one level, i.e., isolation will be reduced to speed limit, and speed limit will be reduced to observation. When the explosion radius level is medium or low... Maintain the strength of the selected optimal treatment actions.

8. The intelligent management method for network information security according to claim 1, characterized in that, Generating the minimum cut candidate set involves: defining the source node as the attack source node in the case snapshot, and defining the target node as the core asset node marked by business impact analysis in the asset dependency graph; using the attack source node and the core asset node as the start and end points, solving the maximum flow from the source node to the target node using the asset dependency graph; and obtaining the minimum cut set according to the maximum flow minimum cut theorem, which is the set of control edges that cut off all paths from the source node to the target node after deletion, and has the fewest number of edges. This set is denoted as the minimum cut candidate set. ;in, Represents the candidate set of minimum cuts The control edge identifiers in the minimum cut candidate set are the basic elements constituting the minimum cut candidate set, representing the specific control objects that can be used to cut off attack paths; n represents the number of control edges in the minimum cut candidate set, i.e., the minimum cut candidate set. The total number of control edges included.

9. The intelligent management method for network information security according to claim 1, characterized in that, Determining control priorities and intensity by tiering includes: for scenarios with an escalation level of action, calculating the increase exponent for each control edge in the minimum cut candidate set. The threat improvement value is categorized based on the threat improvement value and the increase in mishandling; the threat improvement value This refers to enabling the control edge. After executing the optimal handling action, compared to when the control edge is not enabled, the decrease in the probability of threat escalation is measured; a positive value indicates a reduction in threat. The increase in mishandling... This refers to enabling the control edge. After executing the optimal handling action, the increase in the false handling rate compared to when the control edge is not enabled is calculated. A positive value indicates an increase in false handling. The tiering logic is as follows: when and At that time, increase the index For high; when but At that time, increase the index For the middle; when At that time, increase the index For low; prioritize control edges with higher exponents; among them, and These are the mishandling tolerance threshold and the escalation and improvement threshold, respectively. For scenarios where the handling level is downgraded, calculate the existing control set. In the middle, its control edge is identified as Removal index for each control edge Threat amplification is categorized based on threat increase and mishandling improvement value; where m is the total number of control edges in the existing control set; the threat increase... This refers to simulating the removal of control edges. Afterwards, compared to when the control edge was enabled, the increase in the probability of threat escalation is positive, indicating an increase in threat; the mishandling improvement value This refers to simulating the removal of control edges. Afterwards, compared to when this control edge is enabled, the decrease in the false processing rate is represented by a positive value, indicating a reduction in false processing; the tiering logic is as follows: when... and At that time, remove the index For high; when but At that time, remove the index For the middle; when At that time, remove the index For low values; prioritize removing control edges with high exponents; among them, Risk tolerance threshold , Improve thresholds to prevent mishandling; The control intensity is mapped as follows: when the increase or removal index is high, it corresponds to isolation action; when the increase or removal index is medium, it corresponds to speed limiting action; and when the increase or removal index is low, it corresponds to shadow mode or hold.

10. An intelligent management system for network information security, used to implement the intelligent management method for network information security as described in any one of claims 1-9, characterized in that, It includes the following modules: a data acquisition module, used to acquire security incident data and perform preliminary handling actions, and generate case snapshots; The cascading impact assessment module is used to calculate the blast radius value and blast radius level based on the security incident data and asset dependency map; The response level determination module is used to predict the probability of threat escalation and the false alarm rate, and to determine the optimal response action and response level. The control quantization module is used to generate the minimum cut candidate set, control the priority and intensity in different levels, and verify the effectiveness through shadow mode and gradient execution. The control execution module is used to feed back control parameters and effect data to the preceding module for model and threshold calibration.

Images