Security event response system and method based on intelligent analysis

Abstract

The invention discloses a security event response system and method based on intelligent analysis, and relates to the technical field of network security, an asset business load integrated digital model is constructed, a cross-domain attack surface is identified based on cross-environment asset interaction data in the integrated digital model, and basic data support for subsequent simulation and reasoning is formed; based on the obtained asset, business and cross-domain attack surface data, an attack framework and a dynamic attacker portrait are fused to construct a causal knowledge graph, the causal relationship of unknown attacks is complemented through transfer learning and an unsupervised algorithm, and the causal knowledge graph is updated according to the dynamic change of the environment; according to the method, the conversion of the security event from passive tracing to active prediction is realized, high-risk threats are identified in advance through cross-domain attack path simulation and risk quantification, and the defense initiative is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a security incident response system and method based on intelligent analysis. Background Technology

[0002] With the development of technologies such as cloud computing and containerization, IT environments are gradually evolving towards a hybrid architecture where public clouds, private clouds, and on-premises data centers coexist. Cross-domain asset interactions are becoming increasingly frequent, the cross-domain attack surface is expanding significantly, and the complexity and concealment of security threats are constantly increasing. Traditional security incident response methods are mostly based on post-incident tracing, relying on fixed rules to match known attacks, which is insufficient to deal with new and unknown threats. At the same time, they lack effective simulation and risk assessment of cross-domain attack paths, and response strategy formulation often ignores the impact on business load, which can easily lead to business continuity damage. In addition, existing solutions lack closed-loop learning mechanisms, cannot continuously optimize models and strategies based on response results, have weak cross-domain collaborative defense capabilities, and are unable to meet the security protection needs of hybrid IT environments. Summary of the Invention

[0003] To address the shortcomings of the existing technology, this invention provides a security incident response system and method based on intelligent analysis. The technical solution adopted is as follows: The security incident response method based on intelligent analysis includes the following steps: Step 1: Construct an integrated digital model of asset business load, and then identify cross-domain attack surfaces based on cross-environment asset interaction data in the integrated digital model to form the basic data support for subsequent simulation and inference. Step 2: Based on the asset, business, and cross-domain attack surface data obtained in Step 1, a causal knowledge graph is constructed by integrating the attack framework and dynamic attacker profile. The causal relationship of unknown attacks is supplemented by transfer learning and unsupervised algorithms, and the causal knowledge graph is updated according to the dynamic changes in the environment. Step 3: Based on the cross-domain attack surface data from Step 1 and the causal knowledge graph from Step 2, combined with the multi-source attack origin and attacker profile, simulate cross-domain attack paths and perform multi-dimensional risk quantification to screen high-risk paths. Step 4: Map the multi-source security events to the causal knowledge graph of Step 2, locate the root cause of the attack through bidirectional causal reasoning, and predict the cross-domain impact range of the attack by combining the cross-domain asset dependency relationship of Step 1. Step 5: For the high-risk paths in Step 3 or the attack impact predicted in Step 4, generate cross-environment response plans, and dynamically execute the response strategies after combining real-time business load assessment, the game model between the defender and the attacker, and reinforcement learning optimization schemes.

[0004] Optionally, step 6 is also included, which involves conducting automated internal feedback based on the response execution results of step 5, and combining it with expert external feedback experience to achieve iterative optimization and knowledge accumulation of the integrated digital model of step 1, the causal knowledge graph of step 2, and the response strategy of step 5.

[0005] Optionally, step 1 includes the following sub-steps: Step 11: Integrate active scanning tools, passive traffic analysis tools, cloud service APIs and container platform interfaces to collect information on devices, systems, microservices, users and datasets from public clouds, private clouds and local data centers, and generate a unified asset list with unique identifiers. Step 12: Link the vulnerability scan results, system configuration parameters, real-time asset operating status, and unified asset list in three ways to mark the asset's availability level. Step 13: Define key business services and sub-processes, map the asset dependencies and data flows supporting the business, and dynamically adjust the business criticality weight of assets based on real-time business load data. Step 14: Based on the cross-environment asset dependency relationship obtained in Step 13, analyze the asset interaction links between different environments, mark unauthorized cross-domain potential attack entry points, including cloud API interfaces and cross-environment shared accounts, and complete the cross-domain attack surface identification.

[0006] Optionally, the specific process of constructing and updating the causal knowledge graph in step 2 includes: Step 21: Import the tactical points of the MITRE ATT&CK attack framework as attack nodes, associate them with dynamic attacker profiles that include attack preferences, common techniques, and cross-domain attack habits, and label each attack node with profile adaptation weights. Step 22: Based on the asset data from Step 1, construct a four-level causal chain of vulnerability exploitation access acquisition, asset control, and business impact, and label the confidence level of each causal relationship. Step 23: Use the CNN-LSTM transfer learning model to transfer the causal patterns of known attacks to unknown scenarios; Step 24: Detect abnormal traffic and process data using the isolated forest unsupervised algorithm, identify potential attack nodes, calculate the association probability with existing graph nodes, automatically complete the causal chain of unknown attacks, and mark the state to be verified. Step 25: Real-time synchronization of asset status changes, vulnerability remediation status, and external threat intelligence updates; dynamic adjustment of the confidence level of node status and causal relationships in the graph.

[0007] Optionally, the specific process of cross-domain attack path simulation and risk quantification in step 3 includes: Step 31: Integrate external threat intelligence, internal security alerts, and the cross-domain attack surface hypothesis identified in Step 1 to generate a set of attack origins; Step 32: Based on the attacker's profile preferences, perform a heuristic traversal on the causal knowledge graph from Step 2, prioritize simulating attack paths that match the profile characteristics, and simulate the cross-environment propagation process of the attack between public cloud, private cloud, and local data center. Step 33: Calculate the risk value of each attack path by combining four dimensions: difficulty of exploitation, complexity of steps, business impact, and probability of cross-domain propagation. Sort the paths in descending order of risk value to generate a Top-N list of high-risk attack paths.

[0008] Optionally, the specific process of bidirectional causal reasoning and cross-domain impact prediction in step 4 includes: Step 41: Standardize SIEM alerts, cloud security center alerts, and user behavior logs, and map them to the nodes corresponding to the causal knowledge graph in Step 2. Step 42: Starting from the event mapping node, combine the real-time asset status and the current attacker profile to trace the root cause of the attack back along the causal chain. Step 43: Based on the cross-domain asset dependency relationship in Step 1, deduce the next action of the attack and the scope of cross-environment spread along the causal chain. Step 44: For abnormal events associated with nodes to be verified, predict the potential impact based on the causal chain completed in step 23.

[0009] Optionally, the specific process of generating and dynamically executing cross-environment response solutions in step 5 includes: Step 51: For the high-risk simulation path in step 3 and the attack events confirmed in step 4, generate a cross-environment collaborative response plan and a single-environment alternative plan. Step 52: Based on the current service QoS metrics and real-time load data, quantify the service loss of each response strategy; Step 53: Construct a game model between the defender and the attacker to simulate the attacker's evasion behavior; use the maximization of attack containment rate and the minimization of business loss as reward functions, and iteratively optimize the strategy parameters through a reinforcement learning framework to select the optimal response scheme; Step 54: Execute the optimal response command through the SOAR platform and monitor the changes in the attack status in real time; if the attacker adjusts his behavior, immediately trigger the strategy iteration update.

[0010] Optionally, the specific process of system iterative optimization and knowledge accumulation in step 6 includes: Step 61: Record the response execution results of Step 5, and adjust the risk scoring model parameters of Step 33, the reinforcement learning reward function of Step 53, and the confidence of the graph causal relationship of Step 2 in real time to complete the automated inner loop feedback optimization. Step 62: The security expert records the high-risk path in Step 3 and the response effect in Step 5, enters the experience rules, corrects the attacker profile and the causal relationship of the graph, and completes the expert's outer loop experience correction. Step 63: Based on the dual-loop feedback data, optimize the attack path simulation algorithm in step 32 and the response strategy generation logic in step 51; store the optimized rules and model parameters in the knowledge base.

[0011] Optionally, the reinforcement learning framework uses TensorFlowAgents. The SOAR platform interfaces with cloud security components, network devices, and server management tools through standardized interfaces to achieve automated execution of response commands.

[0012] A security incident response system based on intelligent analysis is used to implement a security incident response method based on intelligent analysis. The system includes: The integrated modeling module is used to build an integrated digital model of asset business load, identify cross-domain attack surfaces based on cross-environment asset interaction data and output corresponding data; The causal graph construction module receives the output data from the modeling module, integrates the attack framework and dynamic attacker profile to construct a causal knowledge graph, and completes the unknown attack causal relationships and updates them dynamically through transfer learning and unsupervised algorithms. The attack simulation and risk quantification module calls upon the cross-domain attack surface data and causal knowledge graph to filter and output high-risk paths. The causal reasoning module maps multi-source security events to the graph, locates the root cause of the attack through bidirectional causal reasoning, and predicts the scope of impact by combining cross-domain asset dependencies. The response strategy module generates cross-environment response schemes for the high-risk paths or anticipated attack impacts. After optimization by combining business load assessment, attack and defense game model and reinforcement learning, the optimal response command is dynamically executed through the interface. The dual-loop learning and knowledge accumulation module receives the response execution results, optimizes the model, graph, and response strategy through automated inner loop feedback and expert outer loop experience correction, and stores the accumulated and optimized rules and parameters.

[0013] In summary, the present invention has at least one of the following beneficial technical effects: This invention provides a security incident response system and method based on intelligent analysis, enabling a shift from passive tracing to proactive prediction of security incidents. By simulating cross-domain attack paths and quantifying risks, it can identify high-risk threats in advance and enhance proactive defense.

[0014] By leveraging transfer learning and unsupervised algorithms to complete the causal relationships of unknown attacks, we can overcome the limitations of traditional rule-based reliance, expand the scope of threat coverage, and enhance our ability to respond to new types of attacks.

[0015] By combining business load assessment, attack and defense game model and reinforcement learning to optimize response strategies, attacks can be effectively contained while reducing the impact on normal business operations, thus balancing security protection and business continuity.

[0016] It supports cross-environment collaborative response and two-way causal reasoning, accurately locates the root cause of attacks and predicts the scope of impact, and solves the problem of isolated cross-domain defense in hybrid IT environments.

[0017] The dual-loop learning mechanism enables continuous iterative optimization of the model, graph, and response strategy, thereby continuously improving the system's adaptive protection capabilities and adapting to dynamically changing security environments. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the security incident response method based on intelligent analysis of the present invention; Detailed Implementation

[0019] The present invention will be further described in detail below with reference to the accompanying drawings.

[0020] This invention discloses a security incident response system and method based on intelligent analysis.

[0021] Reference Figure 1 Example 1, a security incident response method based on intelligent analysis, includes the following steps: Step 1: Construct an integrated digital model of asset business load, and then identify cross-domain attack surfaces based on cross-environment asset interaction data in the integrated digital model to form the basic data support for subsequent simulation and inference. Step 2: Based on the asset, business, and cross-domain attack surface data obtained in Step 1, a causal knowledge graph is constructed by integrating the attack framework and dynamic attacker profile. The causal relationship of unknown attacks is supplemented by transfer learning and unsupervised algorithms, and the causal knowledge graph is updated according to the dynamic changes in the environment. Step 3: Based on the cross-domain attack surface data from Step 1 and the causal knowledge graph from Step 2, combined with the multi-source attack origin and attacker profile, simulate cross-domain attack paths and perform multi-dimensional risk quantification to screen high-risk paths. Step 4: Map the multi-source security events to the causal knowledge graph of Step 2, locate the root cause of the attack through bidirectional causal reasoning, and predict the cross-domain impact range of the attack by combining the cross-domain asset dependency relationship of Step 1. Step 5: For the high-risk paths in Step 3 or the attack impact predicted in Step 4, generate cross-environment response plans, and dynamically execute the response strategies after combining real-time business load assessment, the game model between the defender and the attacker, and reinforcement learning optimization schemes.

[0022] Example 2 also includes step 6, which involves conducting automated inner loop feedback based on the response execution results of step 5, and combining it with expert outer loop experience for correction, thereby realizing iterative optimization and knowledge accumulation of the integrated digital model of step 1, the causal knowledge graph of step 2, and the response strategy of step 5.

[0023] Example 3, step 1 includes the following sub-steps: Step 11: Integrate active scanning tools, passive traffic analysis tools, cloud service APIs and container platform interfaces to collect information on devices, systems, microservices, users and datasets from public clouds, private clouds and local data centers, and generate a unified asset list with unique identifiers. Step 12: Link the vulnerability scan results, system configuration parameters, real-time asset operating status, and unified asset list in three ways to mark the asset's availability level. Step 13: Define key business services and sub-processes, map the asset dependencies and data flows supporting the business, and dynamically adjust the business criticality weight of assets based on real-time business load data. Step 14: Based on the cross-environment asset dependency relationship obtained in Step 13, analyze the asset interaction links between different environments, mark unauthorized cross-domain potential attack entry points, including cloud API interfaces and cross-environment shared accounts, and complete the cross-domain attack surface identification.

[0024] By adopting the above technical solutions and integrating multi-source collection methods such as active scanning, passive traffic analysis, cloud service APIs, and container platform interfaces, the system comprehensively covers asset information from public clouds, private clouds, and local data centers, generating a unified asset list to solve the problem of asset data silos. It also links vulnerabilities, configurations, and operational status with assets, marking availability levels to provide a clear view of asset risk status. Furthermore, by defining business services and sub-processes, it maps asset dependencies and data flows, dynamically adjusting the critical weights of asset business operations based on real-time load, highlighting the protection priority of core business assets. Finally, based on cross-environment asset dependency analysis and interaction links, it marks potential attack entry points such as unauthorized cloud API interfaces and cross-environment shared accounts, accurately locating cross-domain attack surfaces and providing comprehensive and accurate basic data support for subsequent simulation and inference.

[0025] Based on asset, business, and attack surface data output from integrated modeling, this system integrates tactical and technical points of the attack framework with dynamic attacker profiles to link attack behaviors, assets, and business impacts into a structured causal network. It constructs a four-level causal chain of "vulnerability exploitation – privilege acquisition – asset control – business impact" and labels its confidence level to clarify the correlation strength of each attack stage. A CNN-LSTM transfer learning model is used to transfer the causal patterns of known attacks to unknown scenarios, breaking through the dependence of traditional rules on known threats. Simultaneously, an isolated forest unsupervised algorithm detects abnormal data and identifies potential attack nodes, automatically completing the causal chain of unknown attacks. The system dynamically adjusts the graph node status and causal relationship confidence level in conjunction with asset status changes, vulnerability remediation, and threat intelligence updates to ensure the graph reflects the environmental security situation in real time.

[0026] Leveraging cross-domain attack surface data and causal knowledge graphs, a set of attack origins is constructed by integrating multiple attack origins (external threat intelligence, internal alerts, and attack surface hypotheses). Based on attacker profile preferences, a heuristic graph traversal is performed to simulate the attacker's behavioral logic in a hybrid environment, prioritizing the exploration of attack paths that match the profile characteristics. Simultaneously, the cross-domain propagation process of attacks in different environments is simulated. A risk scoring model is constructed from four dimensions: exploitation difficulty, step complexity, business impact, and cross-domain propagation probability. Each simulated path is quantitatively evaluated, and high-risk paths are sorted by risk value to achieve early threat identification and priority ranking.

[0027] After standardizing multi-source security events (SIEM alerts, cloud security alarms, user logs), they are mapped to a causal knowledge graph to establish the association between events and graph nodes. Starting from the event mapping nodes, the causal chain is traced backward by combining the real-time asset status and attacker profiles to locate the root cause of the attack and avoid responding only to superficial phenomena. The causal chain is extrapolated forward based on cross-domain asset dependencies to predict the next action of the attack and the scope of cross-environment spread. The potential impact of abnormal events of associated "unverified" nodes is predicted by combining the completed causal chain, realizing in-depth analysis and situation prediction of attacks.

[0028] For high-risk paths or confirmed attack events, cross-environment collaborative response schemes and single-environment alternative schemes are generated to meet the collaborative defense needs of hybrid environments. Business losses from response strategies are quantified based on business QoS indicators and real-time load data to balance security protection and business continuity. An attack-defense game model is constructed to simulate attacker evasion behaviors (such as switching C2 servers or changing attack paths), aiming to maximize attack containment rate and minimize business losses. Strategy parameters are iteratively optimized using a reinforcement learning framework to select the optimal response scheme. The optimal strategy is executed through the SOAR platform, and the attack status is monitored in real time. If an adjustment to attacker behavior is detected, dynamic strategy iteration is triggered to ensure the effectiveness and real-time nature of the response.

[0029] Record response execution results (containment effect, business loss, false positive rate), and adjust risk scoring model parameters, reinforcement learning reward function, and graph causal relationship confidence through automated internal feedback to achieve system autonomous optimization; combine expert external feedback experience to review high-risk paths, response effects, and causal nodes to be verified, and input empirical rules to correct attacker profiles and graph relationships to compensate for the limitations of machine learning; optimize attack path simulation algorithms and response strategy generation logic based on dual-loop feedback data, and store and accumulate the optimized rules and parameters in the knowledge base to support deployment in new environments, forming a continuous evolution mechanism of "practice-feedback-optimization-accumulation".

[0030] Example 4, the specific process of constructing and updating the causal knowledge graph in step 2 includes: Step 21: Import the tactical points of the MITRE ATT&CK attack framework as attack nodes, associate them with dynamic attacker profiles that include attack preferences, common techniques, and cross-domain attack habits, and label each attack node with profile adaptation weights. Step 22: Based on the asset data from Step 1, construct a four-level causal chain of vulnerability exploitation access acquisition, asset control, and business impact, and label the confidence level of each causal relationship. Step 23: Use the CNN-LSTM transfer learning model to transfer the causal patterns of known attacks to unknown scenarios; Step 24: Detect abnormal traffic and process data using the isolated forest unsupervised algorithm, identify potential attack nodes, calculate the association probability with existing graph nodes, automatically complete the causal chain of unknown attacks, and mark the state to be verified. Step 25: Real-time synchronization of asset status changes, vulnerability remediation status, and external threat intelligence updates; dynamic adjustment of the confidence level of node status and causal relationships in the graph.

[0031] By adopting the above technical solution, the tactical points of the MITRE ATT&CK attack framework are imported as basic attack nodes, giving them standardized attack technique descriptions. At the same time, dynamic attacker profiles containing attack preferences, common techniques, and cross-domain habits are associated. By labeling each attack node with profile adaptation weights, the graph not only contains the attack techniques themselves, but also reflects the degree of preference of different types of attackers for specific techniques, making subsequent graph-based simulations and inferences more consistent with the logic of actual attack behavior.

[0032] Based on the asset data output in step 1, the attack process is broken down into four progressive stages: "vulnerability exploitation - privilege acquisition - asset control - business impact", forming a four-level causal chain. The confidence level of the causal relationship between each stage is marked, and the reliability of the association is quantified to provide a quantifiable basis for subsequent causal reasoning, ensuring the integrity and traceability of the attack chain.

[0033] By employing a CNN-LSTM transfer learning model, common features and correlation patterns are extracted from the causal patterns of known attacks and transferred to unseen attack scenarios (such as new IT architectures or unknown vulnerability scenarios). This breaks through the limitations of traditional graphs that rely on known attack rules, enabling the graph to perform preliminary modeling of causal relationships in emerging attack scenarios.

[0034] The isolated forest unsupervised algorithm is used to detect abnormal traffic, processes and other data to identify potential nodes that may correspond to unknown attacks. The association probability between these potential nodes and existing nodes in the graph is calculated to automatically complete the causal chain of unknown attacks and mark them as unverified. This not only expands the graph's coverage of unknown threats, but also preserves the space for subsequent verification through the unverified marking, ensuring the rigor of the graph.

[0035] Real-time synchronization of asset status changes, vulnerability remediation status, and external threat intelligence updates; dynamic adjustment of the confidence level of node status and causal relationships in the graph to ensure that the graph can reflect the current security situation in real time, providing an accurate basis for subsequent analysis.

[0036] Example 5, the specific process of cross-domain attack path simulation and risk quantification in step 3 includes: Step 31: Integrate external threat intelligence, internal security alerts, and the cross-domain attack surface hypothesis identified in Step 1 to generate a set of attack origins; Step 32: Based on the attacker's profile preferences, perform a heuristic traversal on the causal knowledge graph from Step 2, prioritize simulating attack paths that match the profile characteristics, and simulate the cross-environment propagation process of the attack between public cloud, private cloud, and local data center. Step 33: Calculate the risk value of each attack path by combining four dimensions: difficulty of exploitation, complexity of steps, business impact, and probability of cross-domain propagation. Sort the paths in descending order of risk value to generate a Top-N list of high-risk attack paths.

[0037] By employing the above technical solution and fusing multi-source data to construct an attack origin set, the comprehensiveness and authenticity of attack source coverage are ensured. External threat intelligence can introduce known malicious attack sources globally, internal security alerts can capture suspicious anomalies already appearing in the environment, and the cross-domain attack surface hypothesis identified in step 1 can supplement potential attack entry points that have not triggered alerts (such as unauthorized cross-environment interfaces). The combination of these three forms a complete attack origin set, avoiding the omission of attack sources due to the limitations of a single data source, and providing comprehensive initial input for subsequent simulations.

[0038] Step 32 performs a heuristic traversal based on attacker profile preferences, making the simulated attack path more closely resemble the behavioral logic of real attackers. Different types of attackers have significantly different attack preferences; by prioritizing the simulation of paths that match their characteristics, the realism and targeting of the simulated paths can be improved. Furthermore, considering the characteristics of hybrid IT environments, the simulation demonstrates the cross-environment propagation process of attacks between public clouds, private clouds, and local data centers, fully recreating the diffusion chain after an attack breaks through the boundaries of a single environment, thus overcoming the limitation of traditional simulations that neglect cross-domain propagation.

[0039] Step 33 establishes a multi-dimensional risk assessment system to accurately quantify and prioritize attack path risks. Four core dimensions are selected: exploitation difficulty, step complexity, business impact, and cross-domain propagation probability. These four dimensions comprehensively cover the feasibility, implementation cost, severity, and spread of the attack: exploitation difficulty directly reflects the threshold for attack implementation; step complexity relates to the probability of attack success; business impact determines the core severity of the threat; and cross-domain propagation probability reflects the potential scope of threat spread. By quantifying these four dimensions, a comprehensive risk value for each path is obtained. A Top-N high-risk path list is generated in descending order of risk value, clarifying the priority of defense efforts and enabling subsequent response strategies to focus on core threats, thereby improving the efficiency of defense resource utilization.

[0040] Example 6, the specific process of bidirectional causal reasoning and cross-domain impact prediction in step 4 includes: Step 41: Standardize SIEM alerts, cloud security center alerts, and user behavior logs, and map them to the nodes corresponding to the causal knowledge graph in Step 2. Step 42: Starting from the event mapping node, combine the real-time asset status and the current attacker profile to trace the root cause of the attack back along the causal chain. Step 43: Based on the cross-domain asset dependency relationship in Step 1, deduce the next action of the attack and the scope of cross-environment spread along the causal chain. Step 44: For abnormal events associated with nodes to be verified, predict the potential impact based on the causal chain completed in step 23.

[0041] Example 7, the specific process of generating and dynamically executing the cross-environment response plan in step 5 includes: Step 51: For the high-risk simulation path in step 3 and the attack events confirmed in step 4, generate a cross-environment collaborative response plan and a single-environment alternative plan. Step 52: Based on the current service QoS metrics and real-time load data, quantify the service loss of each response strategy; Step 53: Construct a game model between the defender and the attacker to simulate the attacker's evasion behavior; use the maximization of attack containment rate and the minimization of business loss as reward functions, and iteratively optimize the strategy parameters through a reinforcement learning framework to select the optimal response scheme; Step 54: Execute the optimal response command through the SOAR platform and monitor the changes in the attack status in real time; if the attacker adjusts his behavior, immediately trigger the strategy iteration update.

[0042] Example 8, the specific process of system iterative optimization and knowledge accumulation in step 6 includes: Step 61: Record the response execution results of Step 5, and adjust the risk scoring model parameters of Step 33, the reinforcement learning reward function of Step 53, and the confidence of the graph causal relationship of Step 2 in real time to complete the automated inner loop feedback optimization. Step 62: The security expert records the high-risk path in Step 3 and the response effect in Step 5, enters the experience rules, corrects the attacker profile and the causal relationship of the graph, and completes the expert's outer loop experience correction. Step 63: Based on the dual-loop feedback data, optimize the attack path simulation algorithm in step 32 and the response strategy generation logic in step 51; store the optimized rules and model parameters in the knowledge base.

[0043] Example 9: The reinforcement learning framework uses TensorFlowAgents. The SOAR platform interfaces with cloud security components, network devices, and server management tools through standardized interfaces to achieve automated execution of response commands.

[0044] By adopting the above technical solution, step 41 standardizes SIEM alerts, cloud security center alarms, and user behavior logs to eliminate format differences and descriptive ambiguities in data from different sources, enabling them to be uniformly mapped to the corresponding nodes of the causal knowledge graph. This establishes the association between security events and attack behaviors and asset status in the graph, providing a consistent data foundation for subsequent inference.

[0045] Step 42 starts from the event mapping node, combines the real-time status of assets and the current attacker profile, traces back along the causal chain, breaks through the surface phenomena to reach the root cause of the attack, and avoids incomplete defense caused by only responding to intermediate links.

[0046] Step 43, based on the cross-domain asset dependency relationship in Step 1, deduces forward along the causal chain and combines the progressive logic of attack behavior (such as lateral movement after obtaining permissions) to predict the attacker's next move and the cross-environment spread range between public cloud, private cloud, and local data center, and identify potentially affected core assets and businesses in advance.

[0047] Step 44, for abnormal events associated with “unverified” nodes (corresponding to unknown attacks or unconfirmed causal relationships), combines the causal chain completed by transfer learning in step 23 to infer their possible attack intentions and potential impact range, providing direction for early response to new threats.

[0048] Step 51 generates cross-environment collaborative response schemes (such as linkage strategies that work simultaneously in cloud and local environments) and single-environment alternative schemes for the high-risk simulation paths (potential threats) in Step 3 and the attack events (already occurred threats) confirmed in Step 4. This ensures that there are appropriate response methods in different scenarios and avoids defense vulnerabilities caused by single-environment responses.

[0049] Step 52 quantifies the potential loss of each response strategy to normal business (such as the duration of service interruption caused by the isolation of servers) based on current business QoS indicators (such as response time and transaction success rate) and real-time load data (such as CPU usage and bandwidth usage), providing a quantitative basis for balancing security protection and business continuity.

[0050] Step 53 involves constructing a game model between the defender and the attacker to simulate the attacker's evasion behavior when facing a defense strategy (such as switching attack IPs or choosing alternative paths). With the goals of "maximizing attack containment rate" and "minimizing business losses", a reinforcement learning framework is used to continuously iterate and optimize strategy parameters (such as the strength and timing of response actions) to select the optimal response scheme in the attack-defense game and improve the targeting and effectiveness of the strategy.

[0051] Step 54: The optimal response command is executed automatically through the SOAR platform, and the attack status changes are monitored in real time. If the attacker adjusts his behavior, the strategy is immediately iterated and updated to ensure that the response can dynamically adapt to the changes in the attack and avoid the failure of the static strategy.

[0052] Step 61 records the response execution result of Step 5, converts it into a feedback signal, and adjusts the risk scoring model parameters of Step 33 (such as correcting the weight of business impact), the reinforcement learning reward function of Step 53 (such as adjusting the penalty coefficient of business loss), and the confidence of causal relationships in the causal knowledge graph of Step 2 (such as reducing the confidence of invalid associations) in real time to complete automated inner loop optimization, enabling the system to learn autonomously from practice.

[0053] Step 62 involves security experts reviewing the high-risk paths in Step 3 and the response effects in Step 5 (to determine the rationality of the strategy), inputting domain experience rules, correcting attacker profiles (such as adjusting preference weights) and causal relationships in the causal knowledge graph (such as supplementing associations not recognized by the machine), and using an expert outer loop to compensate for the limitations of machine learning in complex scenarios.

[0054] Step 63 optimizes the attack path simulation algorithm in Step 32 (such as improving the accuracy of cross-domain propagation simulation) and the response strategy generation logic in Step 51 based on the comprehensive data from the dual-loop feedback; the optimized rules and model parameters are stored in the knowledge base to provide reusable experience for deployment in new environments or responses to similar threats, forming a closed-loop evolution mechanism of practice-optimization-accumulation-reuse.

[0055] TensorFlowAgents is used as the reinforcement learning framework. Its ability to model complex decision-making scenarios and its efficient iterative characteristics enable the automated optimization of response policy parameters in step 53. This supports the solution of the objective function of "balancing attack containment rate and business loss", ensuring the efficiency and accuracy of policy optimization.

[0056] The SOAR platform connects with cloud security components (such as firewalls and WAFs), network devices (such as routers and switches), and server management tools (such as endpoint protection software) through standardized interfaces, breaking down protocol barriers between different devices and systems. This enables the automated execution of response commands (such as blocking IPs and isolating hosts) in step 54 across environments, reducing delays caused by manual intervention and improving response speed. At the same time, it obtains execution results and device status in real time through interfaces, providing data support for dynamic policy iteration.

[0057] Example 10: A security incident response system based on intelligent analysis, used to implement a security incident response method based on intelligent analysis. The system includes: The integrated modeling module is used to build an integrated digital model of asset business load, identify cross-domain attack surfaces based on cross-environment asset interaction data and output corresponding data; The causal graph construction module receives the output data from the modeling module, integrates the attack framework and dynamic attacker profile to construct a causal knowledge graph, and completes the unknown attack causal relationships and updates them dynamically through transfer learning and unsupervised algorithms. The attack simulation and risk quantification module calls upon the cross-domain attack surface data and causal knowledge graph to filter and output high-risk paths. The causal reasoning module maps multi-source security events to the graph, locates the root cause of the attack through bidirectional causal reasoning, and predicts the scope of impact by combining cross-domain asset dependencies. The response strategy module generates cross-environment response schemes for the high-risk paths or anticipated attack impacts. After optimization by combining business load assessment, attack and defense game model and reinforcement learning, the optimal response command is dynamically executed through the interface. The dual-loop learning and knowledge accumulation module receives the response execution results, optimizes the model, graph, and response strategy through automated inner loop feedback and expert outer loop experience correction, and stores the accumulated and optimized rules and parameters.

[0058] The following specific embodiments illustrate the implementation principle of the present invention: Taking the hybrid IT environment of a large e-commerce enterprise as an example, the enterprise's IT architecture covers Alibaba Cloud public cloud (deploying order management and user registration services), private cloud (deploying user database and inventory management system), and local data center (deploying payment gateway and core financial system). It needs to address core requirements such as cross-environment attacks, unknown threats, and business continuity assurance. This technical solution is adopted to achieve intelligent response to security incidents. The specific implementation process is as follows: Integrated asset and business load modeling and cross-domain attack surface identification: Integrating Nessus active scanning tool, Zeek passive traffic analysis tool, Alibaba Cloud ECSAPI, AWS EC2API and K8s container platform interfaces, it collects data from 20 order servers and 15 user registration service containers in the public cloud, 8 user database servers and 10 inventory management hosts in the private cloud, 5 payment gateway devices and 3 financial system servers in the local data center, as well as 2000+ employee accounts and 10 types of core business datasets, to generate a unified asset list with unique device IDs and account identifiers.

[0059] The Nessus vulnerability scan results (including CVSS scores for high-risk vulnerabilities such as CVE-2023-23397), system configuration parameters (such as the open port 8080 of the order server and the root account permission configuration of the database), and real-time asset operating status (such as the CPU utilization of the payment gateway and the number of active connections in the database) are triple-linked with the unified asset list to mark the order server as "high availability level" and the financial system server as "low availability level".

[0060] We define three key business services and sub-processes: payment processing, order generation, and user login. We map the asset dependencies and transaction data flows of the payment service to the payment gateway, user database, and financial system. Combined with real-time business load data (such as the peak transaction volume of the payment gateway during Double 11 reaching 5,000 transactions / second and CPU utilization of 85%), we adjust the business criticality weight of the payment gateway from the usual 8 to 10, thereby increasing its protection priority.

[0061] Based on cross-environment asset dependencies, we analyzed the API synchronization link between Alibaba Cloud order server and private cloud user database, and the VPN channel between local payment gateway and private cloud inventory system. We also marked two types of potential cross-domain attack entry points: unauthorized access to Alibaba Cloud OSS API interfaces and cross-environment shared operation and maintenance accounts, thus completing the identification of cross-domain attack surfaces.

[0062] The T1190 phishing email and T1110 password brute-force attacks, which are part of the MITRE ATT&CK attack framework, are used as attack nodes. They are associated with dynamic profiles of APT groups whose attack preferences are "stealth," whose common techniques are "phishing emails + vulnerability exploitation," and whose cross-domain attack habits are "penetrating from the public cloud to the local data center." The T1190 tactical points are labeled with 90% profile adaptation weight.

[0063] Based on the asset data output by the integrated modeling, a four-level causal chain is constructed: "exploiting the CVE-2023-23397 vulnerability - obtaining order server privileges - controlling user registration data - interruption of payment business". The causal chain is labeled with a 90% confidence level.

[0064] Using a CNN-LSTM transfer learning model, the known attack causal pattern of "Web server vulnerability - obtaining server privileges - stealing database data" is transferred to the unknown scenario of "cloud function vulnerability - obtaining cloud storage privileges - stealing order data", thus completing the preliminary modeling of the attack causal relationship in the new cloud environment.

[0065] The isolated forest unsupervised algorithm was used to detect abnormal Python process data of the payment gateway, identify the potential attack nodes corresponding to the process, calculate the 85% correlation probability between the process and the "obtain payment gateway permission" node, automatically complete the unknown attack causal chain of "abnormal process execution - obtaining payment gateway permission - stealing payment data", and mark it as pending verification.

[0066] The status changes of the order server vulnerability patch completion, newly discovered cloud function vulnerability information, and the attack techniques updated by APT groups in external threat intelligence are synchronized in real time. The status of the "Exploiting CVE-2023-23397 vulnerability" node is updated from "vulnerable" to "normal", and the causal relationship confidence corresponding to the new cloud function vulnerability is initialized to 75%.

[0067] By integrating malicious IPs (192.168.1.100) from external threat intelligence, suspicious login alerts from internal SIEM (employee accounts logging into the private cloud database outside of working hours), and the cross-domain attack surface hypothesis of "unauthorized OSSAPI interface being exploited", an attack origin set consisting of three attack origins is generated.

[0068] Based on the covert attack preferences of APT groups, heuristic traversal is performed on the causal knowledge graph to prioritize simulating a low-alarm path of "malicious IP sending phishing emails - employees clicking to implant malware - obtaining order server privileges - penetrating private cloud databases through API synchronization links - accessing local payment gateways". At the same time, the cross-environment propagation process of the attack spreading from Alibaba Cloud public cloud to local data center via VPN tunnel is simulated.

[0069] The risk value of this path was calculated from four dimensions: exploitation difficulty (CVSS score of 7.8 for CVE-2023-23397 vulnerability, profile fit of 90%, quantified as 8.0), step complexity (5 attack steps, quantified as 3.0), business impact (loss of 500,000 yuan per hour due to payment business interruption, quantified as 9.0), and cross-domain propagation probability (80%, quantified as 8.0). The overall risk value was calculated to be 7.5. After sorting the risk values ​​in descending order, it was included in the Top-3 high-risk path list.

[0070] The "Abnormal File Transfer at Payment Gateway" alert from SIEM, the "Unauthorized Access to OSSAPI Interface" alert from Alibaba Cloud Security Center, and the "Login During Non-Work Hours" record in employee behavior logs are standardized. After unifying the field format and attack behavior definition, they are mapped to the corresponding nodes of "Obtaining Payment Gateway Permissions" and "Unauthorized API Access" in the causal knowledge graph.

[0071] Starting from the "abnormal file transfer of payment gateway" mapping node, and combining the real-time operating status of the payment gateway (abnormal process, surge in bandwidth usage) with the APT group profile, the root cause of the attack was determined to be "an employee clicking on a phishing email, which led to the compromise of the order server, and then infiltrating the payment gateway through a cross-domain link".

[0072] Based on cross-environment asset dependencies and extrapolating along the causal chain, it is predicted that the attacker's next step will be to use payment gateway privileges to access the financial system and steal transaction fund data. The cross-environment spread will cover the core financial system of the local data center.

[0073] For events associated with "unverified" abnormal process nodes, combined with the causal chain completed by transfer learning, it is predicted that attackers may inject ransomware through the abnormal process, causing a complete interruption of payment services and affecting the transaction operations of all e-commerce users.

[0074] For high-risk paths and confirmed attack events, a cross-environment collaborative response plan is generated: On the Alibaba Cloud side, the malicious IP 192.168.1.100 is blocked, and the access IP range of the OSS API interface is restricted; on the private cloud side, the compromised database server is isolated; on the local data center side, the external service of the payment gateway is suspended, and the operation and maintenance account password is reset. Simultaneously, a single-environment backup plan is generated: if the collaborative plan fails, the API synchronization link between Alibaba Cloud and the private cloud is shut down.

[0075] Based on current business QoS metrics (payment service response time 1.2 seconds, transaction success rate 99.5%) and real-time load data (payment gateway CPU utilization 70%, transaction concurrency 3000 transactions / second), the business losses of the quantified collaborative response plan are as follows: Suspending the payment gateway service is expected to cause the transaction success rate to drop to 80%, resulting in a loss of 300,000 yuan per hour; the alternative plan of shutting down the API link will cause order synchronization delays, resulting in a loss of 200,000 yuan per hour.

[0076] An attack-defense game model was constructed to simulate the evasion behavior of attackers who might switch to a malicious IP (192.168.1.101) to continue their attacks. Using "maximizing attack containment rate" and "minimizing business loss" as reward functions, the strategy parameters were iteratively optimized through the TensorFlowAgents reinforcement learning framework. Finally, the optimal solution of "blocking the malicious IP first + restricting API access + isolating the database, and not suspending the payment gateway" was selected. The attack containment rate is expected to reach 90%, and the business loss is controlled within 100,000 yuan per hour.

[0077] By executing optimal response commands through the SOAR platform and monitoring the attack status in real time, once the attacker switches to a new malicious IP, the policy is immediately iterated and the firewall rules are automatically expanded to block the new IP, ensuring that the attack does not spread further.

[0078] Record the response execution results: The attack was successfully contained, no financial data was leaked, the actual business loss was 80,000 yuan / hour, and there were no false alarms. This result was converted into a feedback signal, and the weight of the business impact in the risk scoring model was adjusted (from 0.3 to 0.4), the business loss penalty coefficient of the reinforcement learning reward function was optimized (from 1.2 to 1.5), and the confidence level of the causal relationship between "abnormal process - payment gateway compromise" was adjusted from 85% to 92%.

[0079] Security experts reviewed the accuracy of the simulation and response of high-risk paths, entered the rule of thumb "APT groups often use IPs in the 192.168.1.0 / 24 network segment to launch attacks", corrected the attack IP preferences of the attacker profile, and added the causal relationship of "cloud function vulnerability - unauthorized access to OSS interface" to the knowledge graph.

[0080] Based on the dual-loop feedback data, the attack path simulation algorithm was optimized to improve the accuracy of attack path priority ranking for IPs in the 192.168.1.0 / 24 network segment; the response strategy generation logic was optimized to add the response action option of "IP network segment blocking"; the optimized risk scoring parameters, reinforcement learning model parameters, and causal relationship rules were stored in a distributed knowledge base to provide support for the subsequent deployment of e-commerce business in new regions.

[0081] In this embodiment, the security incident response system based on intelligent analysis implements the above method through the following modules: The integrated modeling module integrates Nessus, Zeek tools, and various API interfaces to complete cross-environment asset data collection and unified inventory generation, outputting basic data including asset availability level, business criticality weight, and cross-domain attack surface information.

[0082] The causal graph construction module receives basic data, integrates the MITRE ATT&CK framework with APT organization profiles to construct a causal knowledge graph, completes the causal chain of unknown attacks through CNN-LSTM model and isolated forest algorithm, and dynamically updates the graph content according to environmental changes.

[0083] The attack simulation and risk quantification module calls cross-domain attack surface data and causal knowledge graphs, integrates multi-source attack starting points to complete path simulation, and outputs a list of Top-3 high-risk paths through multi-dimensional risk calculation.

[0084] The causal reasoning module standardizes multi-source security events and maps them to a graph, outputting analysis results on the root cause of the attack and the scope of cross-domain impact through bidirectional reasoning.

[0085] The response strategy module generates response plans for high-risk paths and attack impacts. It combines business load assessment, game theory models, and TensorFlowAgents framework optimizations. Through the standardized interfaces of the SOAR platform, it connects to cloud security components, firewalls, and server management tools to execute response commands and dynamically iterate strategies.

[0086] The dual-loop learning and knowledge accumulation module receives the response execution results, adjusts the model parameters through an automated inner loop, and corrects the rules and profiles by combining them with an expert outer loop. It optimizes the algorithm logic and stores the relevant parameters in the knowledge base to complete the system's iterative evolution.

[0087] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A security incident response method based on intelligent analysis, characterized in that, Includes the following steps: Step 1: Construct an integrated digital model of asset business load, and then identify cross-domain attack surfaces based on cross-environment asset interaction data in the integrated digital model to form the basic data support for subsequent simulation and inference. Step 2: Based on the asset, business, and cross-domain attack surface data obtained in Step 1, a causal knowledge graph is constructed by integrating the attack framework and dynamic attacker profile. The causal relationship of unknown attacks is supplemented by transfer learning and unsupervised algorithms, and the causal knowledge graph is updated according to the dynamic changes in the environment. Step 3: Based on the cross-domain attack surface data from Step 1 and the causal knowledge graph from Step 2, combined with the multi-source attack origin and attacker profile, simulate cross-domain attack paths and perform multi-dimensional risk quantification to screen high-risk paths. Step 4: Map the multi-source security events to the causal knowledge graph of Step 2, locate the root cause of the attack through bidirectional causal reasoning, and predict the cross-domain impact range of the attack by combining the cross-domain asset dependency relationship of Step 1. Step 5: For the high-risk paths in Step 3 or the attack impact predicted in Step 4, generate cross-environment response plans, and dynamically execute the response strategies after combining real-time business load assessment, the game model between the defender and the attacker, and reinforcement learning optimization schemes.

2. The security incident response method based on intelligent analysis according to claim 1, characterized in that, It also includes step 6, which involves conducting automated internal feedback based on the response execution results of step 5, and combining it with expert external feedback experience to achieve iterative optimization and knowledge accumulation of the integrated digital model of step 1, the causal knowledge graph of step 2, and the response strategy of step 5.

3. The security incident response method based on intelligent analysis according to claim 1, characterized in that, Step 1 includes the following sub-steps: Step 11: Integrate active scanning tools, passive traffic analysis tools, cloud service APIs and container platform interfaces to collect information on devices, systems, microservices, users and datasets from public clouds, private clouds and local data centers, and generate a unified asset list with unique identifiers. Step 12: Link the vulnerability scan results, system configuration parameters, real-time asset operating status, and unified asset list in three ways to mark the asset's availability level. Step 13: Define key business services and sub-processes, map the asset dependencies and data flows supporting the business, and dynamically adjust the business criticality weight of assets based on real-time business load data. Step 14: Based on the cross-environment asset dependency relationship obtained in Step 13, analyze the asset interaction links between different environments, mark unauthorized cross-domain potential attack entry points, including cloud API interfaces and cross-environment shared accounts, and complete the cross-domain attack surface identification.

4. The security incident response method based on intelligent analysis according to claim 3, characterized in that, The specific process of constructing and updating the causal knowledge graph in step 2 includes: Step 21: Import the tactical points of the MITRE ATT&CK attack framework as attack nodes, associate them with dynamic attacker profiles that include attack preferences, common techniques, and cross-domain attack habits, and label each attack node with profile adaptation weights. Step 22: Based on the asset data from Step 1, construct a four-level causal chain of vulnerability exploitation access acquisition, asset control, and business impact, and label the confidence level of each causal relationship. Step 23: Use the CNN-LSTM transfer learning model to transfer the causal patterns of known attacks to unknown scenarios; Step 24: Detect abnormal traffic and process data using the isolated forest unsupervised algorithm, identify potential attack nodes, calculate the association probability with existing graph nodes, automatically complete the causal chain of unknown attacks, and mark the state to be verified. Step 25: Real-time synchronization of asset status changes, vulnerability remediation status, and external threat intelligence updates; dynamic adjustment of the confidence level of node status and causal relationships in the graph.

5. The security incident response method based on intelligent analysis according to claim 4, characterized in that, The specific process of cross-domain attack path simulation and risk quantification in step 3 includes: Step 31: Integrate external threat intelligence, internal security alerts, and the cross-domain attack surface hypothesis identified in Step 1 to generate a set of attack origins; Step 32: Based on the attacker's profile preferences, perform a heuristic traversal on the causal knowledge graph from Step 2, prioritize simulating attack paths that match the profile characteristics, and simulate the cross-environment propagation process of the attack between public cloud, private cloud, and local data center. Step 33: Calculate the risk value of each attack path by combining four dimensions: difficulty of exploitation, complexity of steps, business impact, and probability of cross-domain propagation. Sort the paths in descending order of risk value to generate a Top-N list of high-risk attack paths.

6. The security incident response method based on intelligent analysis according to claim 5, characterized in that, The specific process of bidirectional causal reasoning and cross-domain impact prediction in step 4 includes: Step 41: Standardize SIEM alerts, cloud security center alerts, and user behavior logs, and map them to the nodes corresponding to the causal knowledge graph in Step 2. Step 42: Starting from the event mapping node, combine the real-time asset status and the current attacker profile to trace the root cause of the attack back along the causal chain. Step 43: Based on the cross-domain asset dependency relationship in Step 1, deduce the next action of the attack and the scope of cross-environment spread along the causal chain. Step 44: For abnormal events associated with nodes to be verified, predict the potential impact based on the causal chain completed in step 23.

7. The security incident response method based on intelligent analysis according to claim 6, characterized in that, The specific process of generating and dynamically executing cross-environment response solutions in step 5 includes: Step 51: For the high-risk simulation path in step 3 and the attack events confirmed in step 4, generate a cross-environment collaborative response plan and a single-environment alternative plan. Step 52: Based on the current service QoS metrics and real-time load data, quantify the service loss of each response strategy; Step 53: Construct a game model between the defender and the attacker to simulate the attacker's evasion behavior; use the maximization of attack containment rate and the minimization of business loss as reward functions, and iteratively optimize the strategy parameters through a reinforcement learning framework to select the optimal response scheme; Step 54: Execute the optimal response command through the SOAR platform and monitor the changes in the attack status in real time; if the attacker adjusts his behavior, immediately trigger the strategy iteration update.

8. The security incident response method based on intelligent analysis according to claim 7, characterized in that, The specific process of system iterative optimization and knowledge accumulation in step 6 includes: Step 61: Record the response execution results of Step 5, and adjust the risk scoring model parameters of Step 33, the reinforcement learning reward function of Step 53, and the confidence of the graph causal relationship of Step 2 in real time to complete the automated inner loop feedback optimization. Step 62: The security expert records the high-risk path in Step 3 and the response effect in Step 5, enters the experience rules, corrects the attacker profile and the causal relationship of the graph, and completes the expert's outer loop experience correction. Step 63: Based on the dual-loop feedback data, optimize the attack path simulation algorithm in step 32 and the response strategy generation logic in step 51; store the optimized rules and model parameters in the knowledge base.

9. The security incident response method based on intelligent analysis according to claim 8, characterized in that, The reinforcement learning framework uses TensorFlowAgents. The SOAR platform interfaces with cloud security components, network devices, and server management tools through standardized interfaces to achieve automated execution of response commands.

10. A security incident response system based on intelligent analysis, characterized in that: The system for implementing the intelligent analysis-based security incident response method as described in claim 9 includes: The integrated modeling module is used to build an integrated digital model of asset business load, identify cross-domain attack surfaces based on cross-environment asset interaction data and output corresponding data; The causal graph construction module receives the output data from the modeling module, integrates the attack framework and dynamic attacker profile to construct a causal knowledge graph, and completes the unknown attack causal relationships and updates them dynamically through transfer learning and unsupervised algorithms. The attack simulation and risk quantification module calls upon the cross-domain attack surface data and causal knowledge graph to filter and output high-risk paths. The causal reasoning module maps multi-source security events to the graph, locates the root cause of the attack through bidirectional causal reasoning, and predicts the scope of impact by combining cross-domain asset dependencies. The response strategy module generates cross-environment response schemes for the high-risk paths or anticipated attack impacts. After optimization by combining business load assessment, attack and defense game model and reinforcement learning, the optimal response command is dynamically executed through the interface. The dual-loop learning and knowledge accumulation module receives the response execution results, optimizes the model, graph, and response strategy through automated inner loop feedback and expert outer loop experience correction, and stores the accumulated and optimized rules and parameters.

Images