Security response script recommendation method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a security response script recommendation method and device, equipment, a storage medium and a computer program product which are applied to the technical field of artificial intelligence. In the method, an alarm text used for describing a target alarm event is acquired; determining a first action matrix of the alarm text according to the alarm text; the first action matrix is used for representing the processing actions for the target alarm event and the logic relation between the processing actions for the target alarm event. In a preset script library, determining a plurality of first safety response scripts matched with the first action matrix; and obtaining a plurality of first safety response scripts matched with the first action matrix, and recommending the plurality of first safety response scripts to the safety personnel as recommended safety response scripts for processing the target alarm event. The security response script suitable for processing the target alarm event can be determined according to the first action matrix, so that the target alarm event is accurately processed, and the cost of selecting the security response script is reduced.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, and storage medium for recommending safe response scenarios. Background Technology

[0002] Security Orchestration Automation and Response (SOAR) is a key technology in the field of cybersecurity. SOAR technology can combine cybersecurity policies with operational procedures to automate the response to network threat events or network attack events, thereby improving the efficiency of handling network security alerts.

[0003] By leveraging SOAR technology to combine cybersecurity strategies with operational procedures, a security response playbook can be created. A playbook outlines the operational flow of security operations, primarily comprising three phases: triggering conditions, analysis and investigation, and response and handling. Based on playbooks, automated response processing can be implemented for cybersecurity alerts and events.

[0004] Because network security policies and operational procedures are diverse, combining them results in a large number of different Playbooks. Different Playbooks may include different operational processes and are applicable to handling different network security alerts. When processing alerts, it is necessary to select the appropriate Playbook from a large pool of Playbooks. Currently, there is a lack of methods for determining the appropriate Playbook for each alert, leading to low efficiency and poor effectiveness in handling network security alerts. Summary of the Invention

[0005] In view of this, this application provides a security response script recommendation method, apparatus, device, storage medium, and computer program product, which can automatically determine the security response script suitable for alarm events. Using the recommended security response script can improve the efficiency and effectiveness of handling alarm events.

[0006] Firstly, this application provides a method for recommending security response scripts. The method involves: obtaining alarm text describing a target alarm event; determining a first action matrix based on the alarm text; the first action matrix representing the handling actions for the target alarm event and the logical relationships between these actions; a pre-built script library containing multiple security response scripts for handling alarm events; and determining at least one first security response script that matches the first action matrix from the script library. Finally, recommending the determined at least one first security response script.

[0007] The first action matrix is ​​obtained by mapping the features of the target alarm event to the feature space of the security response script, thus reflecting the characteristics of the target alarm event from the perspective of the security response script. Based on the first action matrix, a relatively suitable first security response script is selected from the established security response scripts, resulting in high accuracy in the selected script. Furthermore, the first action matrix reflects the characteristics of the target alarm event from the perspective of suitable handling actions and the logical relationships between these actions. Based on the first action matrix, the reasons for selecting the first security response script can be clearly explained from the perspective of handling actions and their logical relationships, making the recommended first security response script highly interpretable. Recommending a first security response script based on the first action matrix is ​​highly efficient, reducing the cost of selecting a security response script.

[0008] In one possible implementation, a pre-trained security response script recommendation model is used to process the alarm text, resulting in a first action matrix fed back by the model. Utilizing the security response script recommendation model allows for efficient processing of large volumes of alarm text, improving the efficiency of generating the first action matrix and shortening the time required to respond to target alarm events.

[0009] In one possible implementation, the similarity between the first action matrix and the action matrices of security response scripts included in the script library is considered. Based on the similarity and preset conditions, a first security response script is determined. This allows selecting a security response script from the script library with a high degree of similarity to the first action matrix as the first security response script, improving the effectiveness and accuracy of recommending the first security response script to security personnel and enhancing the effectiveness of handling target alarm events based on the first security response script.

[0010] In one possible implementation, if no security response script in the script library meets the preset similarity criteria, a second security response script is generated based on the first action matrix. This allows for the creation of new security response scripts suitable for handling target alarm events when existing scripts cannot be matched, thus automating the generation of new scripts suitable for handling target alarm events, improving the efficiency of security response script generation, and providing targeted and personalized new security response scripts.

[0011] In one possible implementation, an initial security response script is generated based on a first action matrix. A script configuration instruction, including script configuration information, is obtained. The initial security response script is configured based on the script configuration information to obtain a second security response script. Users can then further configure and generate usable second security response scripts based on the initial script. This improves the efficiency of users editing security response scripts, reduces the editing cost of creating usable security response scripts, and lowers the difficulty of creating security response scripts.

[0012] In one possible implementation, the generated second security response script is stored in a script library. The second security response script can then be selected from the script library to handle the alarm event.

[0013] In one possible implementation, the security response script recommendation model employs a Deep Security Response Script Network (DAPN). DAPN includes an embedding layer, a positional encoding layer, a feature extraction layer, and an action matrix construction layer. The embedding layer processes the alert text to obtain a first word vector. The positional encoding layer, based on the first word vector and its corresponding text position vector, obtains a second word vector. The feature extraction layer extracts features from the second word vector to obtain alert features. The action matrix construction layer maps the alert features to the script feature space to obtain a first action matrix. DAPN combines the advantages of the Transformer model and CNN, enabling efficient feature extraction. The extracted features are more comprehensive and accurate, which is beneficial for determining the security response script for handling the target alert event based on the first action matrix.

[0014] In one possible implementation, the security response script is represented using a directed graph. The directed graph consists of multiple nodes and at least one edge connecting them, with each node representing a processing action included in the security response script. Each edge represents the logical relationship between the processing actions included in the security response script. This structured representation of the security response script using a directed graph facilitates the generation of an action matrix that characterizes the script.

[0015] Secondly, this application provides a security response script recommendation device, the device comprising:

[0016] The acquisition module is used to acquire the alarm text that describes the target alarm event;

[0017] The matrix determination module is used to determine a first action matrix of the alarm text based on the alarm text. The first action matrix is ​​used to characterize the processing action for the target alarm event and the logical relationship between the processing actions for the target alarm event.

[0018] The script determination module is used to obtain the N first security response scripts that match the first action matrix in a preset script library. The script library includes M security response scripts, and the security response scripts are used to handle alarm events. N is a positive integer greater than or equal to 1, and M is greater than N.

[0019] The recommendation module is used to recommend the N first security response scripts for handling the target alarm event.

[0020] In one possible implementation, the matrix determination module is specifically used for:

[0021] Based on the security response script recommendation model, the first action matrix of the alarm text is determined according to the alarm text.

[0022] In one possible implementation, the script determination module is specifically used for:

[0023] Determine the similarity between the first action matrix and the action matrix of each security response script. The action matrix of each security response script is used to characterize the processing actions included in each security response script and the logical relationship between the processing actions included in each security response script. If there are N first security response scripts in the script library whose similarity satisfies the preset condition, obtain the N first security response scripts from the script library.

[0024] In one possible implementation, the device further includes:

[0025] The generation module is used to generate a second safe response script based on the first action matrix when there is no safe response script in the script library that meets the preset similarity condition.

[0026] In one possible implementation, the generation module is configured to generate a second security response script based on the first action matrix, including:

[0027] The generation module is used to generate an initial security response script based on the first action matrix; obtain a script configuration instruction, the script configuration instruction including script configuration information; and configure the initial security response script according to the script configuration information to obtain a second security response script.

[0028] In one possible implementation, the device further includes:

[0029] A storage module is used to store the second security response script into the script library.

[0030] In one possible implementation, the security response script recommendation model employs a Deep Security Response Script Network (DAPN). The DAPN includes an embedding layer, a position encoding layer, a feature extraction layer, and an action matrix construction layer. The embedding layer processes the alarm text to obtain a first word vector. The position encoding layer obtains a second word vector based on the first word vector and the text position vector corresponding to the first word vector. The feature extraction layer extracts features from the second word vector to obtain alarm features. The action matrix construction layer maps the alarm features to the script feature space to obtain the first action matrix.

[0031] In one possible implementation, the security response script is represented by a directed graph, which includes multiple nodes and at least one edge connecting the multiple nodes. Each node represents a processing action included in the security response script, and each edge represents a logical relationship between the processing actions included in the security response script.

[0032] Thirdly, this application provides a computing device, which includes a processor and a memory. The memory stores instructions, and when the computing device is running, the processor executes the instructions stored in the memory to cause the computing device to perform the operation steps of the method described in the first aspect or any possible implementation thereof. It should be noted that the memory can be integrated into the processor or can be independent of the processor. Each computing device may also include a bus. The processor is connected to the memory via the bus. The memory may include readable storage and random access memory.

[0033] Fourthly, this application provides a computing device cluster, which includes at least one computing device, each computing device including a processor and a memory. The memory is used to store instructions. When the computing device cluster is running, the processor in each computing device executes the instructions stored in the memory to cause the computing device cluster to perform the operation steps of the method in the first aspect or any possible implementation of the first aspect. It should be noted that the memory can be integrated into the processor or can be independent of the processor. Each computing device may also include a bus. The processor is connected to the memory via the bus. The memory may include readable storage memory and random access memory.

[0034] Fifthly, this application provides a chip system including a processor and a power supply circuit, the power supply circuit being used to supply power to the processor, and the processor being used for the operation steps of the method in the first aspect or any possible implementation of the first aspect.

[0035] In a sixth aspect, this application provides a computer-readable storage medium storing instructions that, when executed on a computing device cluster (which includes at least one computing device), cause the computing device cluster to perform the operational steps of the method described in the first aspect or any implementation thereof.

[0036] In a seventh aspect, this application provides a computer program product containing instructions that, when run on a computing device cluster (which includes at least one computing device), causes the computing device cluster to perform the operational steps of the method described in the first aspect or any implementation thereof.

[0037] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0038] Figure 1 This is a schematic diagram illustrating an application scenario of a security response script recommendation method provided in an embodiment of this application.

[0039] Figure 2 A flowchart illustrating a security response script recommendation method provided in this application embodiment;

[0040] Figure 3 This is a schematic diagram of the structure of a DAPN provided in an embodiment of this application;

[0041] Figure 4 A schematic diagram of a security response script provided for an embodiment of this application;

[0042] Figure 5 A flowchart illustrating another security response script recommendation method provided in this application embodiment;

[0043] Figure 6 A schematic diagram of a security response script recommendation device provided in this application embodiment;

[0044] Figure 7 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0045] Figure 8 This is a schematic diagram of the structure of a computing device cluster provided in an embodiment of this application;

[0046] Figure 9 This is a schematic diagram of another computing device cluster provided in an embodiment of this application. Detailed Implementation

[0047] The solutions in the embodiments provided in this application will now be described with reference to the accompanying drawings.

[0048] The terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application.

[0049] For ease of understanding, the following is a brief introduction to some of the technical terms used in the embodiments of this application:

[0050] A cyber threat incident refers to an event that poses a risk to the security and integrity of a network system. A cyberattack incident refers to a malicious event that exploits network or system vulnerabilities with the aim of gaining unauthorized access, data, or services. Both cyber threats and cyberattacks can affect the security of network systems, potentially leading to network paralysis, data breaches, and data tampering, resulting in significant losses.

[0051] SOAR (Security Response Script) technology combines the security functions of different systems or components within a single system according to a specific logical relationship to complete a particular security operation process and procedure. SOAR technology aims to help enterprise and organizational security teams respond quickly and efficiently to cyber threats, achieving efficient and automated response and handling of security incidents. In security orchestration, playbooks and workflows are two crucial elements. Playbooks can also be called security response playbooks.

[0052] Playbooks play a crucial role in security orchestration systems. They transform complex security operational processes and procedures into machine-understandable workflows. Playbook workflows primarily include trigger condition processes, analysis and judgment processes, and response and handling processes, enabling the detection, judgment, and processing of alarm events. Playbooks clearly express the logic of security protection and guide the invocation and coordination of various security resources. With high flexibility and scalability, playbooks can be easily adjusted and upgraded according to new security threats or business needs, ensuring that security measures can adapt to changes in the environment in a timely manner.

[0053] A process is a collaborative work model that integrates the tools, technologies, procedures, and human resources required for security operations and maintenance. A process consists of a series of interconnected modules. Processes can be activated by external events; for example, the generation of a new task can automatically initiate a process for automatically reviewing that task. Users can customize the specific operations of each step through a visual editing interface.

[0054] A process is the response method triggered by a Playbook; it is responsible for translating the instructions and procedures in the Playbook into specific operations and execution steps. Based on Playbooks and processes, automated security operations and maintenance are achieved, reducing the costs of manual orchestration and operation. Automated response technology primarily enables rapid, automated responses to detected network security alerts, effectively shortening response time and improving efficiency. SOAR-based technology can effectively detect potential network threats or existing network attacks based on alerts, and quickly respond to these threats and attacks, effectively reducing network system security risks.

[0055] Different security policies and procedural operational procedures can be combined to generate various Playbooks. Different Playbooks not only include different types of workflows but also apply to handling different alarm events. When faced with an alarm event, security personnel need to select the appropriate Playbook to handle it, enabling the Playbook to automate appropriate operational actions to resolve the alarm event.

[0056] However, alarm events contain complex information, making it difficult to manually select suitable Playbooks. Currently, recommendation algorithms are commonly used to determine Playbooks. Two commonly used recommendation algorithms are introduced below.

[0057] The first type: content-based collaborative filtering recommendation algorithm.

[0058] The principle of content-based collaborative filtering recommendation algorithms is to use the Playbooks used by historical alert events with a high degree of similarity to the current alert event as the Playbooks to be used for the current alert event. Specifically, based on the information of historical alert events and the Playbooks used to process those historical alert events, a preference relationship between alert events and Playbooks is constructed. After obtaining the current alert event, based on the information of the current alert event, historical alert events that are highly similar to the current alert event are identified, and the Playbooks preferred by these similar historical alert events are recommended.

[0059] The second type: recommendation algorithms based on multi-layer deep network structures.

[0060] The principle of recommendation algorithms based on multi-layer deep network structures is to extract features from alarm event data and determine the severity of alarm events and the priority of security response scripts based on these features. These algorithms can be trained using historical alarm event data and historical alarm event handling behavior data.

[0061] The two recommendation algorithms mentioned above rely heavily on historical alarm event processing behavior data. When the amount of historical alarm event processing behavior data is small, or when all security policies for selecting Playbooks have changed, the effectiveness of the Playbooks determined by the recommendation algorithms is insufficient, and the interpretability of the recommended Playbooks is weak, which affects the processing effect of using Playbooks to handle alarm events and fails to meet the needs of maintaining network security.

[0062] In view of this, embodiments of this application provide a security response script recommendation method. The method includes: obtaining alarm text describing a target alarm event, wherein the alarm text includes relevant information about the target alarm event; determining a first action matrix based on the alarm text, wherein the first action matrix characterizes the handling actions for the target alarm event and the logical relationships between these actions; the first action matrix is ​​obtained by mapping the features of the target alarm event to the feature space of the security response script, thus reflecting the characteristics of the target alarm event from the perspective of the security response script; then, determining multiple first security response scripts matching the first action matrix from a pre-set script library; obtaining the multiple first security response scripts matching the first action matrix, and recommending the determined multiple first security response scripts as recommended security response scripts for handling the target alarm event. The first action matrix enables the determination of suitable security response scripts for handling the target alarm event, facilitating accurate handling of the target alarm event. The first security response scripts recommended based on the first action matrix have high interpretability, enabling automated and personalized recommendation of security response scripts to security personnel, reducing the cost of selecting security response scripts.

[0063] In one possible application scenario, see Figure 1 As shown, Figure 1 This is a schematic diagram illustrating an application scenario of a security response script recommendation method provided in this application embodiment. This security response script recommendation method can be applied to a security response script recommendation system. The security response script recommendation system can be a standalone system or a system integrated into a security operations and maintenance system. The security response script recommendation system can run on a cloud server or on a local terminal device. This application embodiment does not impose any limitations on this.

[0064] The security response play recommendation system obtains the alert text. The alert text describes the target alert event. For example, the alert text includes multiple fields and their corresponding values. Each field value represents one dimension of information about the target alert event. The security response play recommendation system processes the alert text to obtain a first action matrix. The first action matrix represents the actions to be taken for the target alert event and the logical relationships between these actions. For example, see... Figure 1 As shown, a pre-trained security response script recommendation model is invoked. The alarm text is used as input data to the model. The model processes the alarm text to obtain a first action matrix. This first action matrix is ​​then used to determine the appropriate security response script for handling the target alarm event.

[0065] Specifically, the security response script recommendation system pre-acquires multiple security response scripts. The system can obtain multiple security response scripts from a pre-built script library. Features are extracted from each security response script to obtain an action matrix corresponding to each script. The action matrix represents the processing actions included in the corresponding security response script and the logical relationships between these actions.

[0066] From multiple security response scripts in the script library, the security response script that matches the first action matrix is ​​selected as the first security response script for handling the target alarm event. This first security response script is then recommended to security personnel, i.e., users of the recommendation system.

[0067] In another possible implementation, if no safe response script that meets the preset conditions exists in the script library, a second safe response script is generated based on the first action matrix.

[0068] This allows for the extraction of features from alarm texts and mapping these features to the feature space of a security response script, resulting in a first action matrix that represents the actions required to handle the target alarm event and the logical relationships between these actions. Using this first action matrix, the suitability of the security response script for handling the target alarm event is determined, thereby improving the effectiveness and efficiency of the event handling process.

[0069] Next, various non-limiting specific implementations of the security response script recommendation method will be described in detail.

[0070] See Figure 2 As shown in the figure, this figure is a flowchart illustrating a security response script recommendation method provided in an embodiment of this application, including steps S201-S204.

[0071] S201: Obtain the alarm text used to describe the target alarm event.

[0072] An alert event is a network threat or attack event detected during network operation that affects network security. A target alert event is an alert event that requires processing using a security response playbook. Target alert events are described using alert text. Alert text can be extracted from network operation logs or generated by operations personnel based on the target alert event; this embodiment does not limit this. Alert text may include fields and their corresponding field values. The fields included in the alert text correspond to information dimensions of the target alert event. The field values ​​corresponding to the fields include information about the target alert event for that information dimension. The information dimensions of the target alert event included in the alert text can be determined based on the Playbook's recommendations and the analysis requirements of the target alert event. As an example, the information dimensions of the target alert event corresponding to the fields included in the alert text may include alert name (title), alert type (type), alert level (severity), alert time (time), alert remediation (remediation), and alert description (description).

[0073] This application does not limit the method of obtaining alarm text. As one example, the alarm text is automatically generated by the security response script recommendation system by detecting target alarm events that occur during network operation. As another example, the alarm text is generated by other network security management systems detecting target alarm events and sent to the security response script recommendation system.

[0074] S202: Determine the first action matrix of the alarm text based on the alarm text.

[0075] The first action matrix is ​​used to characterize the actions taken to handle a target alarm event and the logical relationships between these actions. The first action matrix represents the characteristics of the target alarm event in the script feature space. This allows for the determination of suitable security response scripts for handling target alarm events, enabling the recommendation of appropriate scripts to security personnel.

[0076] In one possible implementation, a security response playbook recommendation model is invoked to process the alert text and obtain a first action matrix. The security response playbook recommendation model is a pre-built model for recommending playbooks. This model is used to generate the first action matrix based on the input alert text.

[0077] As an example, the security response playbook recommendation model is based on the Deep Alert-Playbook Network (DAPN). See also Figure 3 As shown in the figure, this figure is a schematic diagram of the structure of a DAPN provided in an embodiment of this application.

[0078] DAPN consists of an embedding layer, a position encoding layer, a feature layer, and a playbook rebuilding layer.

[0079] In some possible implementations, the alert text is preprocessed before being input into the security response play recommendation model. Preprocessing includes word segmentation and encoding of the alert text, converting the text data into text vectors, and obtaining a text vector sequence for processing by the security response play recommendation model.

[0080] The embedding layer processes the alarm text to obtain the first word vector. It converts the preprocessed text vector sequence of the alarm text into first word vectors, resulting in a first word vector sequence. Text vectors are typically high-dimensional and sparse, lacking contextual information. The embedding layer utilizes word embedding techniques to transform the text vectors into low-dimensional and dense first word vectors, enabling other layers of the DAPN to process these vectors, improving computational and memory efficiency. Furthermore, the embedding layer effectively understands the contextual information of the text vectors, accurately representing the alarm text semantically to obtain the first word vectors. This results in first word vectors containing richer semantic and contextual information, which is beneficial for the feature extraction layer to comprehensively understand the target alarm event and accurately extract its features.

[0081] In some possible implementations, DAPN also includes a Linear Projection Layer. The Linear Projection Layer transforms the channel dimensions of the first word vector, ensuring that the transformed channel dimensions meet the processing requirements of the feature extraction layer. This helps the feature extraction layer extract useful feature information more effectively from the word vectors. The channel dimensions of the transformed first word vector can be set according to the processing needs of the feature extraction layer. As an example, the channel dimensions of the transformed first word vector are powers of 2. Vectors with powers of 2 have better memory alignment, faster read and write speeds, and improve the performance of the model processing the vectors.

[0082] The positional encoding layer is used to obtain the second word vector based on the first word vector and its corresponding text position vector. Each first word vector has a corresponding text position vector. The text position vector represents the position of the first word vector in the word vector sequence generated using the alarm text, which includes all the first word vectors. The text position vector is encoded based on the position index of the first word vector in the word vector sequence. For example, for the first first word vector in the word vector sequence, the text position index is 1. Encoding 1 yields the text position vector of the first word vector. Based on the text position vector, the feature extraction layer can better understand the arrangement order of word vectors in the word vector sequence, thereby better understanding the semantic information and structural features of the word vectors. The positional encoding layer adds the corresponding text position vector to each first word vector to obtain the second word vector.

[0083] The feature extraction layer extracts features from the second word vectors to obtain alarm features. Alarm features represent the information of an alarm event within the feature space of the alarm event information. The feature extraction layer can use the encoder of a Transformer model to extract features from the second word vectors. The encoder of the Transformer model has a self-attention mechanism. Based on the self-attention mechanism, the weights of alarm features can be dynamically adjusted. Based on the importance of different alarm features, the weights and focus of attention are adaptively adjusted, allowing DAPN to focus on and extract more important alarm features. Multi-head attention in the self-attention mechanism further enhances the expressive power of the feature extraction layer. Different attention heads can extract alarm features with more dimensions, resulting in alarm features that include rich information about the target alarm event, reducing the length of the alarm features, and facilitating the generation of an effective first action matrix.

[0084] In some possible implementations, alarm characteristics are reshaping. Specifically, alarm characteristics are transformed and reorganized to facilitate information transfer between different layers of the network.

[0085] The action matrix construction layer maps alarm features to the script feature space, obtaining the first action matrix. The alarm features extracted by the feature extraction layer belong to the feature space of the alarm event information. The action matrix construction layer maps alarm features from the feature space of the alarm event information to the script feature space, obtaining the first action matrix representing the target alarm event handling actions and the logical relationships between these actions. The action matrix construction layer includes convolutional layers, activation function layers, and pooling layers. The convolutional layers, activation function layers, and pooling layers can employ a Convolutional Neural Network (CNN) structure. The alarm features extracted by each convolutional kernel reflect information in a certain dimension of the alarm event, such as alarm type, alarm level, alarm time, etc. The activation function layer uses a non-linear activation function, such as ReLU or Sigmoid. Mapping alarm features from the feature space of the alarm event information to the script feature space is a non-linear process; using a non-linear activation function enhances the expressive power of the security response script recommendation model. The pooling layer extracts the most important features from the features obtained after processing by the convolutional layer and activation function layer, and generates the first action matrix, which reflects the correlation and relationship between the alarm features and the first action matrix.

[0086] DAPN combines the advantages of Transformer models and CNNs to achieve efficient feature extraction. The extracted features are more comprehensive and accurate, which helps to determine and recommend security response scripts to security personnel for handling target alarm events based on the first action matrix.

[0087] The security response script recommendation model built on a deep security response script network can be trained in a supervised manner. One possible implementation is to train the model using training data that includes training alert texts and their corresponding labels. The labels corresponding to the training alert texts are action matrices for security response scripts applicable to handling the training alert events described by the training alert texts. The model parameters are then determined by training the security response script recommendation model using the training data. The training data can be based on historical alert event processing behavior data or manually constructed training data tailored to the model training requirements.

[0088] The security response script recommendation model can efficiently process a large number of alarm texts, shorten the time to respond to alarm events, and automatically recommend accurate security response scripts to security personnel based on the first action matrix, reducing the cost of selecting security response scripts and improving the efficiency of handling alarm events.

[0089] In another possible implementation, a correspondence between alarm texts and action matrices is pre-established. After obtaining the alarm text, the action matrix corresponding to the alarm text is determined as the first action matrix based on the alarm text and the correspondence between the alarm text and the action matrix.

[0090] S203: Retrieve N first security response scripts that match the first action matrix from the script library. The script library is a pre-built database that stores security response scripts. In some possible implementations, pre-built security response scripts are retrieved and written into the script library.

[0091] From the security response scripts included in the script library, determine the first security response script that matches the first action matrix. The number of first security response scripts can be one or more. The number of first security response scripts is less than the number of security response scripts included in the script library. For example, the number of first security response scripts is N. The number of security response scripts included in the script library is M. N is a positive integer greater than or equal to 1 and less than or equal to M. M is a positive integer.

[0092] The embodiments of this application do not limit the implementation of determining the first security response script that matches the first action matrix.

[0093] In one possible implementation, features of the security response scripts included in the script library are extracted to obtain the action matrix corresponding to the security response script. The action matrix corresponding to the security response script is used to characterize the processing actions included in the security response script and the logical relationships between the processing actions included in the security response script.

[0094] In one possible implementation, the security response script is represented by a directed graph. The directed graph includes multiple nodes and at least one edge connecting the nodes. Each node represents a processing action. Each edge represents the logical relationship between processing actions. Processing actions can be set according to the needs of handling alarm events. The logical relationship between processing actions can be determined according to the alarm event handling process. This application embodiment does not limit the specific types of processing actions or the specific types of logical relationships between processing actions.

[0095] As an example, see Figure 4 As shown in the figure, this is a schematic diagram of a security response script provided in an embodiment of this application. The security response script includes processing actions such as start, generate alarm type, generate affected asset information, generate process information, review, one-click host isolation, alarm closure, and end. The logical relationship between the processing actions is sequential execution, that is, after one processing action is completed, the next processing action is executed in sequence.

[0096] Security response scripts are represented using a directed graph, employing a structured approach to facilitate the generation of action matrices that characterize the scripts. The action matrix corresponding to a security response script is the reachability matrix of the directed graph of that script. This action matrix reflects the processing actions included in the security response script and the processing logic between these actions. There is a one-to-one correspondence between security response scripts and action matrices, and they can be converted to each other.

[0097] This application does not limit the method of converting security response scripts represented in the form of directed graphs into action matrices. As examples, depth-first search (DFS), breadth-first search (BFS), or Warshall's algorithm can be used. As another example, an action matrix transformation model is pre-built. The action matrix transformation model is used to convert security response scripts represented in the form of directed graphs into action matrices. The action matrix transformation model can be trained using training data including training security response scripts and corresponding training action matrices.

[0098] Convert the security response scripts included in the script library into corresponding action matrices to obtain the action matrix of the security response script.

[0099] Determine the similarity between the first action matrix and the action matrix of the safety response script.

[0100] The embodiments of this application do not limit the method of calculating similarity. For example, the similarity can be obtained by calculating the cosine similarity or Euclidean distance between the first action matrix and the action matrix of the security response script.

[0101] The security response script that meets a preset similarity condition is selected as the first security response script. For example, the preset condition is the highest similarity. Another example is that the similarity is greater than a similarity threshold. This ensures that the action matrix of the first security response script is highly similar to the first action matrix, thus determining a more suitable first security response script for handling target alarm events.

[0102] Obtain a confirmed first security response scenario.

[0103] S204: Recommend N first security response scenarios for handling target alarm events.

[0104] It should be noted that multiple first-response scripts can be written into a recommended script set. This recommended script set can be fed back to the user, i.e., the security personnel, so that the user can select a security response script from the multiple first-response scripts included in the recommended script set to handle the target alarm event. The recommended script set can be displayed in list form.

[0105] Based on the first action matrix, a relatively suitable first security response script is selected from the established security response scripts. The selected first security response script has high accuracy. Furthermore, based on the first action matrix, the reasons for selecting the first security response script can be clearly explained. Specifically, the reasons for recommending the first security response script can be explained from the perspective of the appropriate handling actions for the target alarm event and the logical relationship between the handling actions, making the recommendation of the first security response script highly explainable.

[0106] In another possible implementation, if there is no safe response script in the script library that meets the preset similarity conditions, a second safe response script is generated based on the first action matrix.

[0107] See Figure 5 As shown in the figure, this figure is a flowchart of another security response script recommendation method provided in the embodiment of this application. In addition to the above-mentioned S201-S204, it also includes S205 and S206.

[0108] S205: If there is no safe response script in the script library that meets the preset similarity conditions, generate a second safe response script based on the first action matrix.

[0109] This application provides two possible implementations for generating a second security response script based on a first action matrix.

[0110] The first method involves converting the first action matrix into a second safety response script.

[0111] The first action matrix is ​​used as the reachability matrix of the directed graph of the second security response script. The first action matrix is ​​then transformed into a directed graph form to obtain the newly generated second security response script. The second security response script obtained using the first action matrix includes the processing actions represented by the first action matrix and the logical relationships between these actions.

[0112] Furthermore, the second security response script also needs to be reviewed. In response to obtaining the second security response script, a review process for the script is triggered. This review process can be performed manually or automatically according to pre-set script review rules; this embodiment does not limit this. After review, if the feasibility and practicality of the second security response script are determined to meet the needs of handling target alarm events, the second security response script can be used to handle target alarm events.

[0113] This allows for the creation of new security response scripts suitable for handling target alert events, even when existing matching scripts are unavailable. It enables the rapid generation of targeted and practical security response scripts, automating the creation of personalized scripts for specific target alert events, thus improving the efficiency and effectiveness of handling these events and achieving precise responses.

[0114] The second approach: Based on the first action matrix, assist in generating a second security response script.

[0115] Additionally, in some possible implementation scenarios, an initial security response script is generated based on the first action matrix. For example, the first action matrix can be converted into a directed graph to obtain a second security response script.

[0116] The initial security response script cannot be used directly to handle alarm events. Users can configure the initial security response script to quickly edit usable security response scripts.

[0117] The system obtains a script configuration instruction triggered by the user. The script configuration instruction includes script configuration information. This script configuration information is used to further configure the initial security response script to obtain a usable second security response script. This application embodiment does not limit the type of information included in the script configuration information. As an example, the script configuration information includes one or more of the following: newly added processing actions, replaced processing actions, processing actions to be deleted, logical relationships between newly added processing actions, logical relationships between replaced processing actions, and logical relationships between processing actions to be deleted. Based on the script configuration information, the initial security response script is configured to obtain a second security response script that can be used to handle target alarm events. Furthermore, the second security response script needs to be reviewed. After approval, the second security response script is obtained.

[0118] An initial security response script is generated based on the first action matrix, which allows users to further configure and generate a usable second security response script based on the initial security response script. The initial security response script provides a reference for users to create a second security response script, improves the efficiency of users in editing security response scripts, reduces the editing cost of users in creating usable security response scripts, shortens the time users spend editing security response scripts, and reduces the difficulty of creating security response scripts.

[0119] S206: Store the second security response scenario in the scenario library.

[0120] The second security response script is stored in the script library so that the second security response script can be selected from the script library to handle the target alarm event, thereby realizing the construction of a new security response script.

[0121] This application also provides a security response scenario recommendation device, such as... Figure 6 As shown, it includes:

[0122] The acquisition module 601 is used to acquire the alarm text that describes the target alarm event;

[0123] The matrix determination module 602 is used to determine a first action matrix of the alarm text based on the alarm text. The first action matrix is ​​used to characterize the processing action for the target alarm event and the logical relationship between the processing actions for the target alarm event.

[0124] The script determination module 603 is used to obtain the N first security response scripts that match the first action matrix in a preset script library. The script library includes M security response scripts, and the security response scripts are used to handle alarm events. N is a positive integer greater than or equal to 1, and M is greater than N.

[0125] Recommendation module 604 is used to recommend the N first security response scripts for handling the target alarm event.

[0126] In one possible implementation, the matrix determination module 602 is specifically used for:

[0127] Based on the security response script recommendation model, the first action matrix of the alarm text is determined according to the alarm text.

[0128] In one possible implementation, the script determination module 603 is specifically used for:

[0129] Determine the similarity between the first action matrix and the action matrix of each security response script. The action matrix of each security response script is used to characterize the processing actions included in each security response script and the logical relationship between the processing actions included in each security response script. If there are N first security response scripts in the script library whose similarity satisfies the preset condition, obtain the N first security response scripts from the script library.

[0130] In one possible implementation, the device further includes:

[0131] The generation module 605 is used to generate a second safe response script based on the first action matrix when there is no safe response script in the script library whose similarity meets the preset conditions.

[0132] In one possible implementation, the generation module 605 is configured to generate a second security response script based on the first action matrix, including:

[0133] The generation module 605 is configured to generate an initial security response script based on the first action matrix; obtain a script configuration instruction, the script configuration instruction including script configuration information; and configure the initial security response script based on the script configuration information to obtain a second security response script.

[0134] In one possible implementation, the device further includes:

[0135] Storage module 606 is used to store the second security response script into the script library.

[0136] In one possible implementation, the security response script recommendation model employs a Deep Security Response Script Network (DAPN). The DAPN includes an embedding layer, a position encoding layer, a feature extraction layer, and an action matrix construction layer. The embedding layer processes the alarm text to obtain a first word vector. The position encoding layer obtains a second word vector based on the first word vector and the text position vector corresponding to the first word vector. The feature extraction layer extracts features from the second word vector to obtain alarm features. The action matrix construction layer maps the alarm features to the script feature space to obtain the first action matrix.

[0137] In one possible implementation, the security response script is represented by a directed graph, which includes multiple nodes and at least one edge connecting the multiple nodes. Each node represents a processing action included in the security response script, and each edge represents a logical relationship between the processing actions included in the security response script.

[0138] The acquisition module 601, matrix determination module 602, script determination module 603, recommendation module 604, generation module 605, and storage module 606 can all be implemented in software or hardware. For example, the implementation of the acquisition module 601 will be described below. Similarly, the implementation of the matrix determination module 602, script determination module 603, recommendation module 604, generation module 605, and storage module 606 can refer to the implementation of the acquisition module 601.

[0139] As an example of a software functional unit, module 601 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Further, the aforementioned computing instance may be one or more. For example, module 601 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed within the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed within the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0140] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0141] As an example of a hardware functional unit, the acquisition module 601 may include at least one computing device, such as a server. Alternatively, the acquisition module 601 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0142] The multiple computing devices included in the acquisition module 601 can be distributed in the same region or in different regions. Similarly, the multiple computing devices included in the acquisition module 601 can be distributed in the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices included in the acquisition module 601 can be distributed in the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0143] It should be noted that, in other embodiments, the acquisition module 601 can be used to execute any step in the security response script recommendation method, the matrix determination module 602 can be used to execute any step in the security response script recommendation method, the script determination module 603 can be used to execute any step in the security response script recommendation method, the recommendation module 604 can be used to execute any step in the security response script recommendation method, the generation module 605 can be used to execute any step in the security response script recommendation method, and the storage module 606 can be used to execute any step in the security response script recommendation method. The steps implemented by the acquisition module 601, matrix determination module 602, script determination module 603, recommendation module 604, generation module 605, and storage module 606 can be specified as needed. By implementing different steps in the security response script recommendation method through the acquisition module 601, matrix determination module 602, script determination module 603, recommendation module 604, generation module 605, and storage module 606, all functions of the security response script recommendation device can be realized.

[0144] This application also provides a computing device 700. For example... Figure 7 As shown, the computing device 700 includes a bus 702, a processor 704, a memory 706, and a communication interface 708. The processor 704, the memory 706, and the communication interface 708 communicate with each other via the bus 702. The computing device 700 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 700.

[0145] The 702 bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 7The bus 702 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 702 may include a path for transmitting information between various components of the computing device 700 (e.g., memory 706, processor 704, communication interface 708).

[0146] Processor 704 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0147] The memory 706 may include volatile memory, such as random access memory (RAM). The processor 704 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0148] The memory 706 stores executable program code, which the processor 704 executes to implement the functions of the aforementioned acquisition module 601, matrix determination module 602, script determination module 603, recommendation module 604, generation module 605, and storage module 606, thereby realizing the security response script recommendation method. In other words, the memory 706 stores instructions for executing the security response script recommendation method.

[0149] The communication interface 708 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between the computing device 700 and other devices or communication networks.

[0150] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0151] like Figure 8As shown, the computing device cluster includes at least one computing device 700. The memory 706 of one or more computing devices 700 in the computing device cluster may store the same instructions for executing the security response script recommendation method.

[0152] In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also store partial instructions for executing the security response script recommendation method. In other words, a combination of one or more computing devices 700 can jointly execute the instructions for executing the security response script recommendation method.

[0153] It should be noted that the memory 706 in different computing devices 700 within the computing device cluster can store different instructions, each used to execute a portion of the functions of the security response script recommendation device. That is, the instructions stored in the memory 706 of different computing devices 700 can implement the functions of one or more modules among the acquisition module 601, matrix determination module 602, script determination module 603, recommendation module 604, generation module 605, and storage module 606.

[0154] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 9 One possible implementation is shown. For example... Figure 9 As shown, the two computing devices 700A and 700B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this possible implementation, the memory 706 in computing device 700A stores instructions for executing the functions of the acquisition module 601, the matrix determination module 602, and the script determination module 603. Meanwhile, the memory 706 in computing device 700B stores instructions for executing the functions of the recommendation module 604, the generation module 605, and the storage module 606.

[0155] Figure 9 The connection method between the computing device clusters shown can be such that, considering the security response script recommendation method provided in this application requires a large amount of data processing and storage, the functions implemented by the recommendation module 604, the generation module 605, and the storage module 606 are delegated to the computing device 700B for execution.

[0156] It should be understood that Figure 9 The functions of the computing device 700A shown can also be performed by multiple computing devices 700. Similarly, the functions of the computing device 700B can also be performed by multiple computing devices 700.

[0157] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to execute a security response script recommendation method.

[0158] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct a computing device to execute a security response script recommendation method.

[0159] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for recommending security response scenarios, characterized in that, The method includes: Retrieve the alarm text used to describe the target alarm event; Based on the alarm text, a first action matrix of the alarm text is determined, wherein the first action matrix is ​​used to characterize the processing action for the target alarm event and the logical relationship between the processing actions for the target alarm event; If there are N first security response scripts that match the first action matrix in the pre-set script library, the N first security response scripts are obtained from the script library, wherein the script library includes M security response scripts, the security response scripts are used to handle alarm events, N is a positive integer greater than or equal to 1, and M is greater than N; The N first security response scenarios are recommended for handling the target alarm events.

2. The method according to claim 1, characterized in that, The step of determining the first action matrix of the alarm text based on the alarm text includes: Based on the security response script recommendation model, the first action matrix of the alarm text is determined according to the alarm text.

3. The method according to claim 1, characterized in that, When there are N first safety response scripts matching the first action matrix in a pre-set script library, retrieving the N first safety response scripts from the script library includes: Determine the similarity between the first action matrix and the action matrix of each security response script, wherein the action matrix of each security response script is used to characterize the processing actions included in each security response script and the logical relationship between the processing actions included in each security response script. If there are N first security response scripts in the script library that meet the preset similarity conditions, then the N first security response scripts are obtained from the script library.

4. The method according to claim 3, characterized in that, The method further includes: If no security response script that meets the preset condition in the script library exists, a second security response script for handling the target alarm event is generated based on the first action matrix.

5. The method according to claim 4, characterized in that, The step of generating a second security response script for handling the target alarm event based on the first action matrix includes: Based on the first action matrix, generate an initial security response script; Obtain script configuration instructions, wherein the script configuration instructions include script configuration information; Configure the initial security response script according to the script configuration information to obtain the second security response script.

6. The method according to claim 4, characterized in that, After generating a second security response script for handling the target alarm event based on the first action matrix, the process includes: The second security response script is stored in the script library.

7. The method according to claim 2, characterized in that, The security response script recommendation model adopts the Deep Security Response Script Network (DAPN). The DAPN includes an embedding layer, a position encoding layer, a feature extraction layer, and an action matrix construction layer. The embedding layer processes the alarm text to obtain a first word vector. The position encoding layer obtains a second word vector based on the first word vector and the text position vector corresponding to the first word vector. The feature extraction layer extracts features from the second word vector to obtain alarm features. The action matrix construction layer maps the alarm features to the script feature space to obtain the first action matrix.

8. The method according to any one of claims 1-7, characterized in that, The security response script is represented by a directed graph, which includes multiple nodes and at least one edge connecting the multiple nodes. Each node represents a processing action included in the security response script, and each edge represents the logical relationship between the processing actions included in the security response script.

9. A security response script recommendation device, characterized in that, The device includes: The acquisition module is used to acquire the alarm text that describes the target alarm event; The matrix determination module is used to determine a first action matrix of the alarm text based on the alarm text. The first action matrix is ​​used to characterize the processing action for the target alarm event and the logical relationship between the processing actions for the target alarm event. The script determination module is used to obtain the N first security response scripts that match the first action matrix in a preset script library. The script library includes M security response scripts, and the security response scripts are used to handle alarm events. N is a positive integer greater than or equal to 1, and M is greater than N. The recommendation module is used to recommend the N first security response scripts for handling the target alarm event.

10. The apparatus according to claim 9, characterized in that, The matrix determination module is specifically used for: Based on the security response script recommendation model, the first action matrix of the alarm text is determined according to the alarm text.

11. The apparatus according to claim 9, characterized in that, The script determination module is specifically used for: Determine the similarity between the first action matrix and the action matrix of each security response script. The action matrix of each security response script is used to characterize the processing actions included in each security response script and the logical relationships between the processing actions included in each security response script. If there are N first security response scripts in the script library that meet the preset similarity conditions, then the N first security response scripts are obtained from the script library.

12. The apparatus according to claim 11, characterized in that, The device further includes: The generation module is used to generate a second safe response script based on the first action matrix when there is no safe response script in the script library that meets the preset similarity condition.

13. The apparatus according to claim 12, characterized in that, The generation module is used to generate a second security response script based on the first action matrix, including: The generation module is used to generate an initial security response script based on the first action matrix; obtain a script configuration instruction, the script configuration instruction including script configuration information; and configure the initial security response script according to the script configuration information to obtain a second security response script.

14. The apparatus according to claim 12, characterized in that, The device further includes: A storage module is used to store the second security response script into the script library.

15. The apparatus according to claim 10, characterized in that, The security response script recommendation model adopts the Deep Security Response Script Network (DAPN). The DAPN includes an embedding layer, a position encoding layer, a feature extraction layer, and an action matrix construction layer. The embedding layer processes the alarm text to obtain a first word vector. The position encoding layer obtains a second word vector based on the first word vector and the text position vector corresponding to the first word vector. The feature extraction layer extracts features from the second word vector to obtain alarm features. The action matrix construction layer maps the alarm features to the script feature space to obtain the first action matrix.

16. The apparatus according to any one of claims 9-15, characterized in that, The security response script is represented by a directed graph, which includes multiple nodes and at least one edge connecting the multiple nodes. Each node represents a processing action included in the security response script, and each edge represents the logical relationship between the processing actions included in the security response script.

17. A computing device, characterized in that, The computing device includes a processor and memory; The processor is configured to execute instructions stored in the memory to cause the computing device to perform the operational steps of the method as described in any one of claims 1 to 8.

18. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the operational steps of the method as described in any one of claims 1 to 8.

19. A computer program product containing instructions, characterized in that, When the instruction is executed by the computing device cluster, the computing device cluster causes the computing device cluster to perform the operation steps of the method as described in any one of claims 1 to 8.

20. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a cluster of computing devices, perform the operational steps of the method as described in any one of claims 1 to 8.

Images