Threat scene construction method and device, electronic equipment and storage medium

Abstract

The invention discloses a threat scene construction method and device, electronic equipment and a computer readable storage medium, and the method comprises the steps: responding to an access request for a target threat scene, and querying target scene attribute information and target component configuration information corresponding to the target threat scene in a database; wherein the database is used for storing scene attribute information and component configuration information of a threat scene; according to the target scene attribute information, calling a corresponding target scene template to render a page frame of the target threat scene; according to a component type defined in the target component configuration information, calling a corresponding target component template to render the target scene component; retrieving target data from the data source according to a data filtering condition defined in the target component configuration information; and displaying the target data at a corresponding position of the rendered target scene component. The construction efficiency of the threat scene is improved, and then the threat response efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a method and apparatus for constructing threat scenarios, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Currently, in the field of cybersecurity threat analysis and mitigation, users typically need to frequently switch between multiple independent functional pages to view scattered data such as alert lists, asset information, and vulnerability details, and then manually correlate and analyze them before they can judge and handle specific types of threats. This operating mode suffers from frequent page jumps, low data integration, and lengthy operation paths, resulting in low threat analysis efficiency and a poor user experience.

[0003] Therefore, how to improve the efficiency of threat scenario construction and thus enhance threat response efficiency is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, electronic device, and computer-readable storage medium for constructing threat scenarios, thereby improving the efficiency of threat scenario construction and thus enhancing threat response efficiency.

[0005] To achieve the above objectives, this application provides a method for constructing threat scenarios, including:

[0006] In response to an access request for a target threat scenario, the system queries the database for target scenario attribute information and target component configuration information corresponding to the target threat scenario; wherein, the database is used to store the scenario attribute information and component configuration information of the threat scenario;

[0007] The page frame of the target threat scenario is rendered by calling the corresponding target scenario template based on the target scenario attribute information;

[0008] The target scene component is rendered by calling the corresponding target component template according to the component type defined in the target component configuration information;

[0009] Target data is retrieved from the data source according to the data filtering conditions defined in the target component configuration information;

[0010] The target data is displayed at the corresponding position of the rendered target scene component.

[0011] Optionally, it also includes:

[0012] Receive a rule package; wherein the rule package defines configuration information for at least one threat scenario, the configuration information including scenario attribute information and component configuration information for at least one scenario component;

[0013] The rule package is parsed, and the parsed scene attribute information and component configuration information are stored in the database.

[0014] Optionally, the scene attribute information includes scene type, which includes attack perspective and victim perspective;

[0015] Accordingly, the step of rendering the page frame of the target threat scene by calling the corresponding target scene template based on the target scene attribute information includes:

[0016] Based on the scene type in the target scene attribute information, either an attack perspective template or a victim perspective template is selected to render the page frame of the target threat scene.

[0017] Optionally, the target component configuration information includes: overall component operation configuration, module configuration of at least one sub-module, and module operation configuration;

[0018] The step of rendering the target scene component by calling the corresponding target component template according to the component type defined in the target component configuration information includes:

[0019] The corresponding target component template is determined based on the component type defined in the target component configuration information;

[0020] Using the target component template, render a component-level operation interface on the target scene component according to the overall operation configuration of the component; render at least one corresponding sub-module within the target scene component according to the module configuration; and render a module-level operation interface on the corresponding sub-module according to the module operation configuration.

[0021] Optionally, retrieving target data from the data source according to the data filtering conditions defined in the target component configuration information includes:

[0022] Generate a corresponding data query statement based on the data filtering conditions defined in the target component configuration information;

[0023] The data query statement is executed based on the retrieval period defined in the target scene attribute information to retrieve target data from the data source.

[0024] Optionally, after retrieving the target data from the data source, the process may also include:

[0025] The target data is statistically and aggregated, and the processed target data is converted into a preset format;

[0026] Accordingly, the target data is displayed at the corresponding position in the rendered target scene component, including:

[0027] Display the target data in the preset format at the corresponding position in the rendered target scene component.

[0028] Optionally, after displaying the target data at the corresponding position of the rendered target scene component, the method further includes:

[0029] In response to an export command for the target threat scenario or the target scenario component, an export file is generated and output based on the target data, the target scenario attribute information, and the target component configuration information.

[0030] To achieve the above objectives, this application provides a threat scenario construction apparatus, comprising:

[0031] The query module is used to respond to an access request for a target threat scenario by querying the database for target scenario attribute information and target component configuration information corresponding to the target threat scenario; wherein, the database is used to store the scenario attribute information and component configuration information of the threat scenario;

[0032] The first rendering module is used to render the page frame of the target threat scene by calling the corresponding target scene template according to the target scene attribute information;

[0033] The second rendering module is used to render the target scene component by calling the corresponding target component template according to the component type defined in the target component configuration information;

[0034] The retrieval module is used to retrieve target data from the data source according to the data filtering conditions defined in the target component configuration information;

[0035] The display module is used to display the target data in the corresponding position of the rendered target scene component.

[0036] To achieve the above objectives, this application provides an electronic device, comprising:

[0037] Memory, used to store computer programs;

[0038] A processor is used to implement the steps of the threat scenario construction method described above when executing the computer program.

[0039] To achieve the above objectives, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the threat scenario construction method described above.

[0040] The threat scenario construction method provided in this application firstly achieves standardized description and rapid invocation of threat scenarios through pre-stored scenario attributes and component configuration information in the database; secondly, it calls the corresponding scenario template for page framework rendering based on scenario attributes, ensuring the consistency and standardization of scenario display; thirdly, it calls the corresponding component template for rendering based on the component type defined in the component configuration, enabling flexible combination and reuse of various functional modules; finally, it retrieves target data from the data source according to the data filtering conditions configured in the component and displays it centrally in the rendered component. This process allows users to complete a comprehensive analysis and handling of a specific threat type within an integrated page without needing to jump between pages, thus significantly improving operational efficiency and user experience. This application also discloses a threat scenario construction device, an electronic device, and a computer-readable storage medium, which can achieve the same technical effects.

[0041] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. The drawings are used to provide a further understanding of this disclosure and constitute a part of the specification. They are used together with the following detailed description to explain this disclosure, but do not constitute a limitation of this disclosure. In the drawings:

[0043] Figure 1 This is a flowchart illustrating a threat scenario construction method according to an exemplary embodiment;

[0044] Figure 2 This application provides an overall timing diagram of one application embodiment.

[0045] Figure 3 A flowchart illustrating the specific implementation steps in one application embodiment provided in this application;

[0046] Figure 4 A flowchart illustrating a scenario in one application embodiment provided in this application;

[0047] Figure 5 A flowchart of data retrieval in one application embodiment provided in this application;

[0048] Figure 6 This is a structural diagram illustrating a threat scenario construction apparatus according to an exemplary embodiment;

[0049] Figure 7 This is a structural diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0050] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0051] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0052] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] This application discloses a threat scenario construction method, which improves the efficiency of threat scenario construction and thus enhances threat response efficiency.

[0054] See Figure 1 A flowchart illustrating a threat scenario construction method according to an exemplary embodiment, such as... Figure 1 As shown, it includes:

[0055] S101: In response to an access request for a target threat scenario, query the database for target scenario attribute information and target component configuration information corresponding to the target threat scenario; wherein, the database is used to store scenario attribute information and component configuration information of the threat scenario;

[0056] The target threat scenario refers to the specific security threat analysis scenario that the user is currently requesting access to, such as a phishing email analysis scenario or a DDoS (Distributed Denial of Service) attack attribution scenario. Scenario attribute information is a collection of information describing the overall characteristics of the threat scenario, including scenario name, scenario type, icon, description, and retrieval period. Component configuration information defines the specific parameters of each visual component in the scenario, including component type, data filtering conditions, and operation button configurations. The database is a data storage system built using relational or non-relational database technology, used to persistently store the configuration information of all threat scenarios.

[0057] In this step, when a user selects a threat scenario for access on the web interface, the system generates an access request for that scenario. Based on the scenario identifier carried in the request, the system queries the scenario configuration table in the database for the corresponding scenario attribute information, and simultaneously queries the component configuration table for detailed configuration information of all components under that scenario. The query process can be implemented using Structured Query Language (SQL) or the corresponding database query interface to ensure fast and accurate retrieval of scenario configuration data.

[0058] As can be seen, this step can quickly obtain complete configuration information of the threat scenario, laying the foundation for subsequent page rendering and data acquisition, and improving system response speed and configuration flexibility.

[0059] As a feasible implementation method, this embodiment further includes: receiving a rule package; wherein the rule package defines configuration information for at least one threat scenario, the configuration information including scenario attribute information and component configuration information for at least one scenario component; parsing the rule package, and storing the parsed scenario attribute information and component configuration information in the database.

[0060] The rule package is a structured file containing threat scenario configuration information, which can use highly readable data formats such as YAML, JSON (JavaScript Object Notation), or XML (eXtensible Markup Language). The configuration information uses a standardized data structure definition, including scenario-level attribute information and detailed configuration at the component level. Scenario attribute information includes core fields such as scenario unique identifier (ID), name, icon, scenario type, and template type. Component configuration information includes component unique identifier (id), name, type, and detailed configuration parameters (config).

[0061] In practice, the system receives the rule package file provided by the user through a file upload interface. The parsing process includes reading the file content, verifying the integrity and standardization of the data structure, and extracting scene attribute information and configuration information for each component. After parsing, this configuration information is stored in the corresponding data tables in the database according to a predefined data model, establishing the association between the scene and the components.

[0062] As can be seen, this implementation method enables flexible definition and rapid deployment of threat scenarios through the standardized configuration mechanism of rule packages. It supports security analysts in customizing threat scenarios according to actual needs, and can extend new analysis scenarios without modifying system code, thereby improving the system's adaptability and scalability.

[0063] S102: Render the page frame of the target threat scene by calling the corresponding target scene template according to the target scene attribute information;

[0064] The scenario template is a predefined page layout and style framework used to determine the overall structure and visual style of the threat scenario page. Page frame rendering refers to generating the basic HTML (Hypertext Markup Language) structure and CSS (Cascading Style Sheets) styles of the page based on the template, establishing the skeletal layout of the page. The target scenario template is a specific template selected according to the scenario type, which can include two types: attacker perspective templates and victim perspective templates.

[0065] In this step, based on the target scene attribute information obtained from the database, especially the `template_type` field value, a corresponding scene template is selected from the template library for rendering. In practice, a template library containing attack perspective templates and victim perspective templates can be maintained. Once the scene type is determined, the corresponding template file is loaded, and the template engine replaces the variables in the template with the actual scene data to generate a complete page framework.

[0066] As can be seen, this step, through a templated page rendering mechanism, ensures the consistency and professionalism of the display interface for different threat scenarios, while providing the most suitable visualization layout based on the differences in analysis perspectives, thereby enhancing the pertinence and effectiveness of security analysis.

[0067] As a feasible implementation method, the scene attribute information includes a scene type, which includes an attack perspective and a victim perspective; correspondingly, the step of calling the corresponding target scene template to render the page frame of the target threat scene according to the target scene attribute information includes: selecting an attack perspective template or a victim perspective template to render the page frame of the target threat scene according to the scene type in the target scene attribute information.

[0068] The ATTACK template, representing the attacker's perspective, is specifically designed for analyzing threat scenarios from the attacker's point of view, emphasizing the presentation of the attack process, techniques, and effects. The VICTIM template, representing the victim's perspective, is designed from the defender's point of view, focusing on the security status, scope of impact, and mitigation measures. The `template_type` field is a key field in the scenario attribute information, used to identify the appropriate analysis perspective for that scenario.

[0069] In practice, template selection decisions are made based on the `template_type` field value in the scene attribute information. Two predefined template selection rules are used: when the `template_type` field value is ATTACK, the attack perspective template is selected; when the field value is VICTIM, the victim perspective template is selected. Template files are stored in a dedicated template directory and are loaded and instantiated by the front-end rendering engine.

[0070] As can be seen, this implementation method, by distinguishing between the attack perspective and the victim perspective, enables the presentation of threat scenarios to better match different analysis needs and roles. The attack perspective is suitable for the red team to analyze attack methods, while the victim perspective is suitable for the blue team to evaluate defense effectiveness, thus improving the relevance and efficiency of the analysis.

[0071] S103: Render the target scene component by calling the corresponding target component template according to the component type defined in the target component configuration information;

[0072] Component templates are predefined component display structures and interaction logic used to standardize the visual presentation and functional behavior of components. Component rendering refers to the process of generating specific component instances based on component templates and configuration information and inserting them into the page framework. Target component templates are specific templates selected based on component types, including various types such as list components, chart components, and topology components.

[0073] In this step, the corresponding target component template is selected from the component template library based on the `type` field defined in the target component configuration information. In practice, a component template registry can be maintained to map component types to their corresponding template files. After determining the target component template, the component configuration information is passed as a parameter to the front-end rendering engine to execute the template rendering logic, generating the component's HTML structure, CSS styles, and JavaScript interaction logic. Component types include table components, chart components, topology components, and timeline components, each with its specific data display format and user interaction method. For example, table components are suitable for displaying structured event data, chart components are suitable for data trend visualization, and topology components are suitable for displaying network asset relationships.

[0074] As can be seen, this step achieves standardized development and unified management of components through component template rendering, ensuring the consistency of the display effect of similar components in different threat scenarios, while improving the efficiency of component development and maintenance, and supporting rapid iteration and functional expansion of components.

[0075] As a feasible implementation, the target component configuration information includes: overall component operation configuration, module configuration of at least one sub-module, and module operation configuration; the step of calling the corresponding target component template to render the target scene component according to the component type defined in the target component configuration information includes: determining the corresponding target component template according to the component type defined in the target component configuration information; using the target component template to render a component-level operation interface on the target scene component according to the overall component operation configuration, rendering at least one corresponding sub-module within the target scene component according to the module configuration, and rendering a module-level operation interface on the corresponding sub-module according to the module operation configuration.

[0076] The component-level overall operation configuration defines the operations and functions that take effect at the component level, configured through the `config.operate` field, such as component data export, global refresh, and full-screen display. The module configuration defines the layout and attributes of the component's sub-modules, configured through the `config.module` array, including module name, type, and data filtering conditions. The module operation configuration defines the interactive functions provided at the sub-module level, configured through the `config.module[].operate` field, such as data filtering, details viewing, and correlation analysis.

[0077] In practice, the target component template is first determined based on the component type, and then rendered level by level according to the three-layer configuration structure. Specifically, the component template parses the overall operation configuration of the component and renders the operation button area at the top or bottom of the component container; based on the module configuration information, corresponding sub-module containers are created within the component container and their layout styles are set; finally, based on the module operation configuration, the corresponding operation interface elements and event bindings are rendered within each sub-module.

[0078] As can be seen, this implementation method achieves refined management of component functions through layered configuration and rendering mechanisms, enabling components to have both unified overall operation and flexible combination of internal modules and functions according to actual needs, thereby improving the configurability and user experience of components and supporting the construction of complex analysis scenarios.

[0079] S104: Retrieve target data from the data source according to the data filtering conditions defined in the target component configuration information;

[0080] Data filtering conditions are a set of rules used to filter specific data from a data source. They are defined through the `config.module[].filter` field and include field conditions, logical relationships, comparison operators, etc. The data source refers to the system or service that stores security-related data, such as a Security Information and Event Management (SIEM) system, a log management platform, or a threat intelligence platform. Target data refers to the set of data that meets the filtering conditions and is relevant to the current threat scenario.

[0081] In this step, a query request for a specific data source is constructed based on the data filtering conditions defined in the target component's configuration information. In practice, the backend service parses the filter conditions in the component configuration, converts them into query language or API (Application Programming Interface) parameters supported by the data source, and then sends the query request to the data source and retrieves the returned results. Data filtering conditions can include various filtering dimensions such as time range, IP (Internet Protocol) address range, event type, and severity level. These conditions are combined using logical operators such as AND and OR to form complex query logic.

[0082] As can be seen, this step, through a configurable data filtering mechanism, enables components to accurately acquire data related to threat scenarios, avoids unnecessary data transmission and processing, improves system performance and the targeting of data analysis, and supports fine-grained data retrieval needs.

[0083] As a feasible implementation method, retrieving target data from the data source according to the data filtering conditions defined in the target component configuration information includes: generating a corresponding data query statement according to the data filtering conditions defined in the target component configuration information; and executing the data query statement based on the retrieval period defined in the target scene attribute information to retrieve target data from the data source.

[0084] The data query statement is the command text that requests data from the data source. Depending on the data source type, it may use different query languages ​​such as SQL, Lucene query syntax, or PromQL. The retrieval period is the time range parameter for the data query, defined through the cycle field in the scene attribute information, such as today, this week, this month, or a custom time range.

[0085] In practice, the data filtering conditions in the component configuration are first parsed and converted into a query statement format supported by the target data source. This conversion process includes steps such as field name mapping, syntax adjustment, and parameter escaping. Then, the time range parameter is injected into the query statement, based on the retrieval period defined in the target scenario's attribute information, forming a complete executable query. During query execution, the system establishes a connection with the data source, sends a query request, and receives the returned results.

[0086] As can be seen, this implementation method lowers the technical threshold for manually writing query statements by automating query statement generation and execution, ensuring the standardization and correctness of query statements. At the same time, it ensures the time consistency of data analysis through unified retrieval cycle management, and improves the accuracy and comparability of query results.

[0087] As a preferred embodiment, after retrieving target data from the data source, the method further includes: performing statistical and aggregation processing on the target data, and converting the processed target data into a preset format;

[0088] Statistical processing involves performing mathematical calculations and summarizing the retrieved raw data, such as counting, summing, averaging, and percentiles. Aggregation processing involves grouping and merging data according to specific dimensions, such as aggregating by time interval, by IP address, or by event type. The default format is a standardized data format defined internally by the system, typically in JSON format, containing fixed field names and data structures.

[0089] In practice, after obtaining raw data from the data source, the data is first calculated according to the statistical requirements defined in the component configuration. Then, the data is grouped according to the specified aggregation dimensions. Finally, the processed data is converted into a unified JSON format within the system. Statistical and aggregation processing can be implemented at the database level using SQL's GROUP BY and aggregate functions, or at the application level using a dedicated data processing engine.

[0090] As can be seen, this implementation method converts heterogeneous data from different data sources into a standard format through a unified data processing flow, which facilitates subsequent component display and data analysis. At the same time, statistical aggregation processing reduces the amount of data transmission, thereby improving system performance and data analysis efficiency.

[0091] S105: Display the target data at the corresponding position of the rendered target scene component.

[0092] Data visualization refers to the process of visually presenting the processed target data within a rendered component interface. The corresponding location refers to the predefined data display area in the component template, such as the data row area of ​​a table, the drawing area of ​​a chart, the item area of ​​a list, and the node connection area of ​​a topology graph.

[0093] In this step, the preprocessed target data is passed to the rendered component instance, and the component populates the corresponding display area with the data according to its own display logic. In practice, the component associates the data model with the view element through a data binding mechanism, and automatically refreshes the display content when the data is updated. The form of data display depends entirely on the component type; the system selects the corresponding data renderer based on the `type` field in the component configuration.

[0094] As can be seen, this step, through the separation and binding mechanism of data and view, enables dynamic updating and real-time display of data, allowing threat scenarios to reflect the latest security status, providing timely and effective information support for security analysis, and helping analysts quickly understand the security situation and make decisions.

[0095] As a preferred embodiment, displaying the target data at the corresponding position of the rendered target scene component includes: displaying target data in a preset format at the corresponding position of the rendered target scene component.

[0096] In practice, the target data, after being converted to a preset format, will be displayed in the corresponding position of the rendered target scene component.

[0097] As a feasible implementation method, after displaying the target data at the corresponding position of the rendered target scene component, the method further includes: in response to an export instruction for the target threat scene or the target scene component, generating and outputting an export file based on the target data, the target scene attribute information and the target component configuration information.

[0098] The export command is a user-initiated request to output the current threat scenario content as an external file, which can be triggered via the export button or menu item on the interface. The exported file is a document containing complete information about the threat scenario, and the format can be PDF, Word, HTML, etc., depending on the user's selection.

[0099] In practice, the system monitors export operations on the user interface. Upon receiving an export command, it collects the currently displayed target data, target scenario attribute information, and target component configuration information. It then organizes the content structure according to a predefined document template, generates an export file in the appropriate format, and provides a download link. The export file typically includes basic information about the threat scenario, screenshots or data tables of each component, key findings, and analytical conclusions.

[0100] As can be seen, this implementation method, through the one-click export function, makes it convenient for users to archive, share or report the analysis results, which improves the usability and dissemination efficiency of threat scenario analysis results, enhances the system's practicality and user experience, and supports the standardization of security work and knowledge accumulation.

[0101] The threat scenario construction method provided in this application firstly achieves standardized description and rapid invocation of threat scenarios through pre-stored scenario attributes and component configuration information in the database; secondly, it calls the corresponding scenario template for page framework rendering based on scenario attributes, ensuring the consistency and standardization of scenario display; thirdly, it calls the corresponding component template for rendering based on the component type defined in the component configuration, enabling flexible combination and reuse of various functional modules; finally, it retrieves target data from the data source according to the data filtering conditions configured in the component and displays it centrally in the rendered components. This process allows users to complete a comprehensive analysis and handling of a certain threat type within an integrated page without jumping between pages, thereby significantly improving operational efficiency and user experience.

[0102] The following describes an application embodiment provided by this application, and the overall timing diagram is as follows: Figure 2As shown, the user imports a YAML configuration file into the parser. The parser first parses the YAML content to extract the scene and component configuration parameters, and then verifies the completeness and validity of required fields such as scene ID and name. After successful verification, the parsed data is persistently stored in the database: this includes writing basic scene attributes to the scene table, writing detailed component configurations to the component table, and establishing the association between scenes and components. After the database update is complete, a notification that the configuration has been updated is sent to the front end. Upon receiving this signal, the front end will reload the latest scene configuration information from the database and update the user interface accordingly.

[0103] The specific implementation steps are as follows: Figure 3 As shown, it includes the following steps:

[0104] Step 1: Import the rule package: First, configure the scene information in the rule package and use a fixed scene component data structure.

[0105] Taking a YAML file as an example, the data structure is as follows: scene: '1': # Scene ID (unique) id: xxxx # Scene Name name: xxxx # Icon icon: xxxx # Scene Type type: xxxx # Scene template type, attack perspective or victim perspective (attack perspective: ATTACK, victim perspective: VICTIM) template_type: ATTACK # Scene Description description: xxxx # Scene Tags tags: xxxx # Scene Homepage Statistics Configuration config: '{ "stats": [ { "name": "externalAttacker", "title": "External Attacker", "icon": "externalAttacker"}, { "name": "internalAttacker", "title": "Internal Attacker", "icon": "internalAttacker"} ]}' # Scene Title title: xxxx # Scenario Market Description market_desc: xxxx # Scene retrieval cycle cycle: today # Should the exported report be displayed? show_export_report: 1 # Scene component configuration component: '1': # Component ID (unique) 'id': xxxx # Component Name 'name': xxxx # Component type (fixed value) 'type': xxxx # Component Description 'desc': xxxx # Component Configuration 'config': '{ # Component Operations "operate":{ # Should the export list be displayed? "showExportList": 1, }, #Modules under Components "module":[ { # Module Name "name": "External attacker", # Module type (fixed value) "type": "external", # Recommendations for handling "suggest":"xxxx", # Module Operations "operate":{ # Should batch bans be displayed? "showBatchBan":1, # Should I show the option to ban all accounts with one click? "showBanAll":1 } # Filtering conditions "filter": "field1 == \"value1\" AND field2 ==\ "value2\"" } ] }'

[0106] Step 2, Scene Rule Parsing: Parse the content configured in the template, extracting the scene and component configuration information and storing it in the database. The outermost layer of the template contains scene-related configurations, which can be parsed to obtain information such as scene name, icon, retrieval cycle, and whether certain operation buttons are displayed. Under the component, component configuration information can be parsed, mainly including the modules involved in the component, the display of operation buttons controlling the outer layer of the component, and module information, including module name, handling suggestions, module operations, and filtering conditions for querying model data.

[0107] Step 3, Scene Demonstration: such as Figure 4 As shown, the front-end uses a scene rendering engine to select the appropriate scene template for rendering based on whether the scene is from an attack perspective or a victim's perspective. The rendering engine determines which visual template to use based on the `template_type` field in the scene configuration and displays basic scene information on the interface, such as name, icon, and description. The scene homepage displays metric names and statistics based on the `cycle` query period and the statistical metrics configured in the `config`. On the scene details page, the `showz_export_report` field controls whether to display the export report button.

[0108] Step 4: Component Display: The backend encapsulates each scene configuration component based on the scene ID (Identifier), and further encapsulates component information according to the component type. Each component has a unique type value. The frontend selects the corresponding component template for rendering based on the component type. The component configuration information is mainly in the `component` field, which includes:

[0109] (1) Overall component operation configuration: controls the display of operation buttons at the component level, such as whether to display the export list;

[0110] (2) Module configuration: Configure the internal sub-modules of the component, including module name, module type, query filter conditions, etc.;

[0111] (3) Module operation configuration: The content of the operate field controls which operation buttons the module needs to display.

[0112] Step 5, Data Retrieval: (e.g.) Figure 5As shown, the corresponding component is retrieved by scene ID, and the filter conditions configured in the component are converted into corresponding SQL statements or ElasticSearch query statements. The target data is queried in combination with the retrieval period configured in the scene, and the query results are statistically analyzed and aggregated. Finally, the results are returned to the front-end page in a unified format for display.

[0113] Step 6: Results Display: The data retrieved based on the filter criteria will be displayed visually. For example:

[0114] (1) List display: The query results are displayed in a table format, and the data can be searched according to conditions and processed.

[0115] (2) Statistical charts: Display the query results in chart format;

[0116] (3) Export function: Export report or export list data;

[0117] (4) Component operation: Display the corresponding operation function according to the content of the operate field configured in the component.

[0118] As can be seen, this embodiment improves development efficiency, reduces repetitive work by using component development, increases component reusability, and accelerates scenario construction. This embodiment supports rapid scenario customization; adding a new scenario only requires configuring the scenario and component parameters in the rule package, and the web page can display the new scenario simply by importing the rule package, without requiring platform modifications or upgrades. This embodiment improves user experience; all relevant data for a specific threat type can be viewed through a scenario without needing to navigate back and forth on the page, and the scenario integrates handling strategies, facilitating user actions to handle alarms. This embodiment reduces cost investment, shortens the scenario development cycle, and reduces maintenance workload.

[0119] The following describes a threat scenario construction apparatus provided in an embodiment of this application. The threat scenario construction apparatus described below and the threat scenario construction method described above can be referred to each other.

[0120] See Figure 6 A structural diagram of a threat scenario construction apparatus is shown according to an exemplary embodiment, such as... Figure 6 As shown, it includes:

[0121] The query module 100 is used to query the target scenario attribute information and target component configuration information corresponding to the target threat scenario in the database in response to the access request for the target threat scenario; wherein, the database is used to store the scenario attribute information and component configuration information of the threat scenario;

[0122] The first rendering module 200 is used to render the page frame of the target threat scene by calling the corresponding target scene template according to the target scene attribute information;

[0123] The second rendering module 300 is used to render the target scene component by calling the corresponding target component template according to the component type defined in the target component configuration information;

[0124] The retrieval module 400 is used to retrieve target data from the data source according to the data filtering conditions defined in the target component configuration information;

[0125] The display module 500 is used to display the target data at the corresponding position of the rendered target scene component.

[0126] The threat scenario construction apparatus provided in this application firstly achieves standardized description and rapid invocation of threat scenarios through pre-stored scenario attributes and component configuration information in the database; secondly, it calls the corresponding scenario template for page framework rendering based on the scenario attributes, ensuring the consistency and standardization of scenario display; thirdly, it calls the corresponding component template for rendering based on the component type defined in the component configuration, enabling flexible combination and reuse of various functional modules; finally, it retrieves target data from the data source according to the data filtering conditions configured in the component and displays it centrally in the rendered components. This process allows users to complete a comprehensive analysis and handling of a certain threat type within an integrated page without jumping between pages, thereby significantly improving operational efficiency and user experience.

[0127] Based on the above embodiments, as a preferred embodiment, it further includes:

[0128] A receiving module is used to receive a rule package; wherein the rule package defines configuration information for at least one threat scenario, and the configuration information includes scenario attribute information and component configuration information for at least one scenario component;

[0129] The storage module is used to parse the rule package and store the parsed scene attribute information and component configuration information in the database.

[0130] Based on the above embodiments, as a preferred embodiment, the scene attribute information includes scene type, and the scene type includes attack perspective and victim perspective;

[0131] Accordingly, the first rendering module 200 is specifically used to: select an attack perspective template or a victim perspective template based on the scene type in the target scene attribute information to render the page frame of the target threat scene.

[0132] Based on the above embodiments, as a preferred implementation, the target component configuration information includes: overall component operation configuration, module configuration of at least one sub-module, and module operation configuration;

[0133] The second rendering module 300 is specifically used for: determining the corresponding target component template according to the component type defined in the target component configuration information; using the target component template to render a component-level operation interface on the target scene component according to the overall operation configuration of the component; rendering at least one corresponding sub-module within the target scene component according to the module configuration; and rendering a module-level operation interface on the corresponding sub-module according to the module operation configuration.

[0134] Based on the above embodiments, as a preferred implementation, the retrieval module 400 is specifically used to: generate a corresponding data query statement according to the data filtering conditions defined in the target component configuration information; and execute the data query statement based on the retrieval period defined in the target scene attribute information to retrieve target data from the data source.

[0135] Based on the above embodiments, as a preferred embodiment, it further includes:

[0136] The conversion module is used to perform statistical and aggregation processing on the target data and convert the processed target data into a preset format.

[0137] Accordingly, the display module 500 is specifically used to: display target data in a preset format at the corresponding position of the rendered target scene component.

[0138] Based on the above embodiments, as a preferred embodiment, it further includes:

[0139] The export module is used to generate and output an export file based on the target data, the target scenario attribute information, and the target component configuration information in response to an export command for the target threat scenario or the target scenario component.

[0140] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0141] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide an electronic device. Figure 7 This is a structural diagram of an electronic device according to an exemplary embodiment, such as... Figure 7 As shown, the electronic device includes:

[0142] Communication interface 1 enables information exchange with other devices, such as network devices;

[0143] Processor 2 is connected to communication interface 1 to enable information exchange with other devices and, when running a computer program, executes the threat scenario construction method provided by one or more of the above-mentioned technical solutions. The computer program is stored in memory 3.

[0144] Of course, in practical applications, the various components in an electronic device are coupled together through bus system 4. It can be understood that bus system 4 is used to achieve communication and connection between these components. In addition to the data bus, bus system 4 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 7 The general will label all buses as Bus System 4.

[0145] The memory 3 in this embodiment is used to store various types of data to support the operation of the electronic device. Examples of such data include any computer program used to operate on the electronic device.

[0146] It is understood that memory 3 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 3 described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0147] The methods disclosed in the embodiments of this application can be applied to processor 2, or implemented by processor 2. Processor 2 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 2 or by instructions in the form of software. The processor 2 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 2 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 3. Processor 2 reads the program in memory 3 and completes the steps of the aforementioned method in combination with its hardware.

[0148] When processor 2 executes the program, it implements the corresponding processes in the various methods of the embodiments of this application. For the sake of brevity, these will not be described in detail here.

[0149] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 3 that stores a computer program, which can be executed by a processor 2 to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0150] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0151] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0152] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for constructing threat scenarios, characterized in that, include: In response to an access request for a target threat scenario, the system queries the database for target scenario attribute information and target component configuration information corresponding to the target threat scenario; wherein, the database is used to store the scenario attribute information and component configuration information of the threat scenario; The page frame of the target threat scenario is rendered by calling the corresponding target scenario template based on the target scenario attribute information; The target scene component is rendered by calling the corresponding target component template according to the component type defined in the target component configuration information; Target data is retrieved from the data source according to the data filtering conditions defined in the target component configuration information; The target data is displayed at the corresponding position of the rendered target scene component.

2. The threat scenario construction method according to claim 1, characterized in that, Also includes: Receive a rule package; wherein the rule package defines configuration information for at least one threat scenario, the configuration information including scenario attribute information and component configuration information for at least one scenario component; The rule package is parsed, and the parsed scene attribute information and component configuration information are stored in the database.

3. The threat scenario construction method according to claim 2, characterized in that, The scene attribute information includes the scene type, which includes attack perspective and victim perspective. Accordingly, the step of rendering the page frame of the target threat scene by calling the corresponding target scene template based on the target scene attribute information includes: Based on the scene type in the target scene attribute information, either an attack perspective template or a victim perspective template is selected to render the page frame of the target threat scene.

4. The threat scenario construction method according to claim 1, characterized in that, The target component configuration information includes: overall component operation configuration, module configuration of at least one sub-module, and module operation configuration; The step of rendering the target scene component by calling the corresponding target component template according to the component type defined in the target component configuration information includes: The corresponding target component template is determined based on the component type defined in the target component configuration information; Using the target component template, render a component-level operation interface on the target scene component according to the overall operation configuration of the component; render at least one corresponding sub-module within the target scene component according to the module configuration; and render a module-level operation interface on the corresponding sub-module according to the module operation configuration.

5. The threat scenario construction method according to claim 1, characterized in that, The step of retrieving target data from the data source according to the data filtering conditions defined in the target component configuration information includes: Generate a corresponding data query statement based on the data filtering conditions defined in the target component configuration information; The data query statement is executed based on the retrieval period defined in the target scene attribute information to retrieve target data from the data source.

6. The threat scenario construction method according to claim 5, characterized in that, After retrieving the target data from the data source, the process also includes: The target data is statistically and aggregated, and the processed target data is converted into a preset format; Accordingly, the target data is displayed at the corresponding position in the rendered target scene component, including: Display the target data in the preset format at the corresponding position in the rendered target scene component.

7. The threat scenario construction method according to claim 1, characterized in that, After displaying the target data at the corresponding position in the rendered target scene component, the method further includes: In response to an export command for the target threat scenario or the target scenario component, an export file is generated and output based on the target data, the target scenario attribute information, and the target component configuration information.

8. A threat scenario construction device, characterized in that, include: The query module is used to respond to an access request for a target threat scenario by querying the database for target scenario attribute information and target component configuration information corresponding to the target threat scenario; wherein, the database is used to store the scenario attribute information and component configuration information of the threat scenario; The first rendering module is used to render the page frame of the target threat scene by calling the corresponding target scene template according to the target scene attribute information; The second rendering module is used to render the target scene component by calling the corresponding target component template according to the component type defined in the target component configuration information; The retrieval module is used to retrieve target data from the data source according to the data filtering conditions defined in the target component configuration information; The display module is used to display the target data in the corresponding position of the rendered target scene component.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the threat scenario construction method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the threat scenario construction method as described in any one of claims 1 to 7.

Images