Network security event handling method capable of being automatically executed

Abstract

The invention discloses a network security event handling method capable of being automatically executed, which belongs to the field of network security, and comprises the following steps: S1, a process semantic modeling step; according to the method, strict modeling is carried out on the process and the script through LTL and formal semantics, ambiguity is eliminated, automatic verification is carried out through a Z3 solver, the correctness and safety of disposal logic are fundamentally guaranteed, intelligent arrangement recommendation is carried out by introducing GNN, performance optimization is carried out by introducing CPA, and the method has the advantages of being high in practicability and easy to popularize. The design burden of the user is obviously reduced, and the execution efficiency of the disposal process is improved. According to the method, the flow has certain dynamic adjustment capability through the SCM-based causal graph model, the uncertainty in the disposal process can be dealt with, and the robustness of the system in a complex attack scene is improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and more specifically, to an automated method for handling cybersecurity incidents. Background Technology

[0002] As cyberattacks become increasingly complex and large-scale, traditional methods relying on security experts to manually analyze, decide on, and handle security incidents are no longer sufficient to meet the demands of real-time response. While existing Security Orchestration, Automation, and Response (SOAR) platforms have achieved some degree of process automation, the following technical bottlenecks still exist: 1. Inaccurate process definition: Existing processes are mostly described using natural language or simple flowcharts, lacking precise mathematical semantics, which may lead to ambiguity in process logic and make it difficult to automate verification and optimization.

[0003] 2. Low level of orchestration intelligence: Visual orchestration interfaces are usually just graphical representations of code, lacking a deep understanding of process logic and intelligent auxiliary design capabilities, and cannot automatically recommend or optimize processing steps based on context.

[0004] 3. Insufficient reliability of scripts and policies: Automation scripts and policies are usually written by domain experts and lack formal verification methods. They may contain risks such as logical errors, loops that cannot terminate, or security policy conflicts, which affect the reliability and security of the process.

[0005] Therefore, there is an urgent need for a cybersecurity incident handling method that can ensure logical rigor, support intelligent orchestration, and automatically verify execution security. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides an automatically executable method for handling network security incidents, solving the problems mentioned in the background section. To achieve the above objectives, this invention provides the following technical solution: an automatically executable method for handling network security incidents, comprising the following steps: S1, Process Semantic Modeling Steps: Establish an ontological model of the network security incident handling process, defining handling actions, security states, and their relationships; introduce security atomic propositions into Linear Temporal Logic (LTL) to formally describe the security states, and use LTL formulas to define the temporal constraints between handling actions; construct a causal graph for incident handling based on a Structural Causal Model (SCM), where nodes represent handling actions or security states, and directed edges represent the causal relationships between them. The causal graph is used to dynamically adjust subsequent handling paths based on real-time feedback during process execution. S2, Visual Orchestration and Optimization Steps: Provide a visual orchestration interface to receive the disposal nodes and initial connection relationships added by the user through drag-and-drop; use a graph neural network (GNN) to learn the topology of the current flowchart and the user's operation history to generate an embedding vector of the graph structure, and recommend disposal nodes to be added and / or the optimal connection paths between nodes based on this vector; after the flowchart orchestration is completed, perform topology analysis on the directed acyclic graph of the flowchart based on the critical path analysis (CPA) algorithm to identify critical paths, and optimize the overall flowchart topology by adjusting the execution order or parallelization strategy of nodes on non-critical paths to minimize the estimated execution latency; S3, Script Generation and Formal Verification Steps: Based on the orchestrated process, generate an automated processing script that conforms to a predefined Domain-Specific Language (DSL) specification; assign formal compositional semantics based on the category theory Monad structure to define the compositional rules of the basic processing strategy; perform symbolic execution on the generated DSL script, converting the program state and branch conditions into symbolic constraints; use the Z3 solver to solve the symbolic constraints to verify that the execution of the script necessarily converges to the termination state and that its execution result satisfies the preset security properties.

[0007] Furthermore, in the process semantic modeling step, the security atomic proposition is a Boolean assertion that can be automatically determined by the machine, and its specific propositions include, but are not limited to: asset discovery completed, threat confirmed, isolation action executed, backup and recovery completed.

[0008] Furthermore, the dynamic adjustment of the SCM-based causal graph specifically includes: A1, During the process execution, continuously monitor observation data representing the safety status; A2, compare the observed data with the expected state derived based on SCM, and trigger the causal reasoning mechanism when the deviation exceeds a preset threshold; A3. Based on the cause-effect graph, locate the node that is most likely the root cause of the deviation; A4. Based on the root cause node, select and activate a new handling sub-process from the predefined backup causal path library to replace the currently determined invalid handling sub-process.

[0009] Furthermore, in the visualization orchestration and optimization step, the specific implementation of the GNN-assisted design is as follows: B1. Construct a recommendation model based on a graph autoencoder, which uses the flowchart spectrum marked as optimal in the historical orchestration data, as well as node types and edge relationships, as the training set. B2, Input the incomplete flowchart currently edited by the user into the trained recommendation model; B3, the recommendation model outputs one or more node types with high confidence and their connection probabilities with existing nodes in the graph, and recommends the connection relationship with the highest probability as the optimal connection path to the user.

[0010] Furthermore, in the script generation and formal verification steps, the formal verification of the DSL script further includes: C1, using Hall logic to define preconditions and postconditions for critical operations in DSL scripts; C2 transforms the script verification problem into the proof obligation of Hall logic triples; C3. Using the Z3 solver, verify whether the final postconditions can be guaranteed to be met after executing the entire script, provided that all preconditions for the operations are satisfied.

[0011] The advantages of this application are: (1) This application uses LTL and formal semantics to rigorously model the process and script, eliminating ambiguity, and uses the Z3 solver for automated verification, which fundamentally ensures the correctness and security of the processing logic.

[0012] (2) This application introduces GNN for intelligent orchestration recommendation and CPA for performance optimization, which significantly reduces the user's design burden and improves the execution efficiency of the processing flow.

[0013] (3) This application enables the process to have a certain dynamic adjustment capability through the cause-effect graph model based on SCM, which can cope with the uncertainty in the handling process and improve the robustness of the system in complex attack scenarios. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the embodiments of the present application. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application.

[0015] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The present application will now be described in detail with reference to the embodiments.

[0016] This embodiment provides an automatically executable method for handling network security incidents, including the following steps: S1, Semantic Modeling Steps: Establish an ontological model of the network security incident handling process, defining handling actions, security states, and their relationships; introduce security atomic propositions into Linear Temporal Logic (LTL) to formally describe security states, and use LTL formulas to define temporal constraints between handling actions; construct a causal graph for incident handling based on a Structural Causal Model (SCM), where nodes represent handling actions or security states, directed edges represent causal relationships between them, and the causal graph is used to dynamically adjust subsequent handling paths based on real-time feedback during process execution; In the process semantic modeling step, security atomic propositions are Boolean assertions that can be automatically determined by machines. Specific propositions include, but are not limited to: asset discovery completed, threat confirmed, isolation action executed, backup and recovery completed; The dynamic adjustment of the cause-effect graph based on SCM specifically includes: A1, During the process execution, continuously monitor observation data representing the safety status; A2 compares the observed data with the expected state derived from SCM. When the deviation exceeds a preset threshold, the causal inference mechanism is triggered. A3. Based on the cause-effect graph, locate the node that is most likely the root cause of the deviation; A4. Based on the root cause node, select and activate a new handling subprocess from the predefined backup causal path library to replace the currently determined invalid handling subprocess.

[0017] S2, Visual Orchestration and Optimization Steps: Provide a visual orchestration interface to receive disposal nodes and preliminary connection relationships added by the user through drag-and-drop; use a graph neural network (GNN) to learn the topology of the current flowchart and the user's operation history to generate an embedding vector of the graph structure, and recommend disposal nodes to be added and / or the optimal connection paths between nodes based on this vector; after the flowchart orchestration is completed, perform topology analysis on the directed acyclic graph of the flowchart based on the critical path analysis (CPA) algorithm to identify critical paths, and optimize the overall flowchart topology by adjusting the execution order or parallelization strategy of nodes on non-critical paths to minimize the estimated execution latency.

[0018] The specific implementation method of GNN-assisted design is as follows: B1. Construct a recommendation model based on a graph autoencoder, which uses the flowchart spectrum marked as optimal in the historical orchestration data, as well as node types and edge relationships, as the training set. B2, inputs the incomplete flowchart currently being edited by the user into the trained recommendation model; B3, the recommendation model outputs one or more node types with high confidence and their connection probabilities with existing nodes in the graph, and recommends the connection relationship with the highest probability as the optimal connection path to the user.

[0019] S3, Script Generation and Formal Verification Steps: Based on the orchestrated workflow, generate an automated processing script that conforms to the predefined Domain-Specific Language (DSL) specification; assign formal compositional semantics to the DSL based on the category theory Monad structure to define the compositional rules of the basic processing strategy; perform symbolic execution on the generated DSL script, transforming the program state and branch conditions into symbolic constraints; use the Z3 solver to solve the symbolic constraints to verify that the script execution necessarily converges to the termination state and that its execution result satisfies the preset security properties.

[0020] Formal verification of DSL scripts further includes: C1, using Hall logic to define preconditions and postconditions for critical operations in DSL scripts; C2 transforms the script verification problem into the proof obligation of Hall logic triples; C3 uses the Z3 solver to verify whether the final postconditions can be guaranteed to be met after executing the entire script, provided that all preconditions for the operations are satisfied.

[0021] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An automatically executable method for handling network security incidents, characterized in that, Includes the following steps: S1, Process Semantic Modeling Steps: Establish an ontological model of the network security incident handling process, and define the handling actions, security status and their relationships; In linear sequential logic (LTL), a safe atom proposition is introduced to formally describe the safe state, and the timing constraints between dispositions are defined using LTL formulas. A causal graph for event handling is constructed based on the structural causal model (SCM), where nodes represent handling actions or safety states, and directed edges represent causal relationships between them. The causal graph is used to dynamically adjust subsequent handling paths based on real-time feedback during process execution. S2, Visual orchestration and optimization steps: Provides a visual orchestration interface that receives processing nodes and initial connection relationships added by users through drag and drop; The graph neural network (GNN) is used to learn the topology of the current flowchart and the user's operation history, generate the embedding vector of the graph structure, and recommend the processing node to be added and / or the optimal connection path between the nodes based on this vector. After the process orchestration is completed, the directed acyclic graph of the process is analyzed based on the Critical Path Analysis (CPA) algorithm to identify the critical path. The overall process topology is optimized by adjusting the execution order of nodes on non-critical paths or by parallelization strategies to minimize the estimated execution delay. S3, Script Generation and Formal Verification Steps: Based on the orchestrated process, generate an automated processing script that conforms to a predefined Domain-Specific Language (DSL) specification; assign formal compositional semantics based on the category theory Monad structure to define the compositional rules of the basic processing strategy; perform symbolic execution on the generated DSL script, converting the program state and branch conditions into symbolic constraints; use the Z3 solver to solve the symbolic constraints to verify that the execution of the script necessarily converges to the termination state and that its execution result satisfies the preset security properties.

2. The method according to claim 1, characterized in that, In the process semantic modeling step, the security atomic proposition is a Boolean assertion that can be automatically determined by the machine. Specific propositions include, but are not limited to: asset discovery completed, threat confirmed, isolation action executed, backup and recovery completed.

3. The automatically executable network security incident handling method according to claim 1, characterized in that, The dynamic adjustment of the cause-effect graph based on SCM specifically includes: A1, During the process execution, continuously monitor observation data representing the safety status; A2, compare the observed data with the expected state derived based on SCM, and trigger the causal reasoning mechanism when the deviation exceeds a preset threshold; A3. Based on the cause-effect graph, locate the node that is most likely the root cause of the deviation; A4. Based on the root cause node, select and activate a new handling sub-process from the predefined backup causal path library to replace the currently determined invalid handling sub-process.

4. The automatically executable network security incident handling method according to claim 1, characterized in that, In the visualization orchestration and optimization step, the specific implementation of the GNN-assisted design is as follows: B1. Construct a recommendation model based on a graph autoencoder, which uses the flowchart spectrum marked as optimal in the historical orchestration data, as well as node types and edge relationships, as the training set. B2, Input the incomplete flowchart currently edited by the user into the trained recommendation model; B3, the recommendation model outputs one or more node types with high confidence and their connection probabilities with existing nodes in the graph, and recommends the connection relationship with the highest probability as the optimal connection path to the user.

5. The automatically executable network security incident handling method according to claim 1, characterized in that, In the script generation and formal verification steps, the formal verification of the DSL script further includes: C1, using Hall logic to define preconditions and postconditions for critical operations in DSL scripts; C2 transforms the script verification problem into the proof obligation of Hall logic triples; C3. Using the Z3 solver, verify whether the final postconditions can be guaranteed to be met after executing the entire script, provided that all preconditions for the operations are satisfied.

6. The method according to any one of claims 1 to 5, characterized in that, During process execution, the method compiles the verified DSL script into executable code and calls the corresponding security device API to drive the security device to perform specific handling actions according to the process.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1 to 6.