Automatic response system for network security event emergency technology processing
By constructing an automated response system for handling cybersecurity incidents, and utilizing data acquisition and reinforcement learning algorithms to generate dynamic control strategies, the system addresses the problem of low response efficiency in existing systems, achieving efficient and intelligent cybersecurity defense.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NAT COMPUTER NETWORK & INFORMATION SECURITY MANAGEMENT CENT ANHUI BRANCH
- Filing Date
- 2026-02-27
- Publication Date
- 2026-05-19
AI Technical Summary
Existing cybersecurity incident emergency response systems rely on human experience and rule engines, making it difficult to adapt to dynamically changing security threat scenarios. They suffer from low response efficiency and are prone to policy deviations, failing to effectively address unknown threats.
Build an automated response system for emergency technical handling of cybersecurity incidents. Generate dynamic control strategies through data acquisition, preprocessing, and reinforcement learning algorithms, and update model parameters in real time to optimize response efficiency and accuracy.
It achieves efficient and intelligent network security defense in complex security environments, reduces operational risks and human resource costs, and enhances the adaptability of emergency response.
Smart Images
Figure CN122069089A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of emergency response to cybersecurity incidents, specifically relating to an automated response system for emergency technical handling of cybersecurity incidents. Background Technology
[0002] In the field of cybersecurity, the efficient flow and precise handling of incident emergency response systems are crucial for enterprise security operations. With increasingly sophisticated cyberattack methods and a surge in security alerts, enterprises urgently need to achieve rapid response to security incidents and precise control over the effectiveness of their handling in order to reduce security risks and operating costs.
[0003] However, current cybersecurity incident emergency response and control technologies face multiple challenges. Traditional incident emergency response relies on human experience and rule engines, making it difficult to adapt to dynamically changing security threat scenarios. Manual scheduling is not only inefficient but also prone to biases in response strategies due to subjective judgment. For example, when facing new ransomware attacks, manual priority determination may lag behind the speed of threat spread. Furthermore, existing systems have simple policy generation models that can only handle regular alerts with clearly defined rules, failing to address the dynamic control needs of unknown threats such as zero-day vulnerabilities.
[0004] Therefore, there is an urgent need for an efficient, lightweight event emergency response and control method and system that can achieve synergistic optimization of response efficiency and handling accuracy to meet the practical needs of enterprises in complex security environments. Summary of the Invention
[0005] The purpose of this invention is to propose an automated response system for emergency technical handling of network security incidents. This system collects and preprocesses multi-source data, including network device operating status, security alarms, and attack characteristics, to construct a reinforcement learning optimization model that dynamically generates emergency technical handling response control strategies. Simultaneously, the model parameters are dynamically updated based on the execution results. This reduces security operation risks and manpower costs, helping enterprises build an efficient and intelligent network security defense system.
[0006] Therefore, the technical solution adopted by the present invention is as follows:
[0007] The automated response system for handling cybersecurity incidents includes the following modules:
[0008] Data acquisition module: Collects network device operating status data, security alarm data, and attack characteristic parameter data in real time through sensors and log collectors to build an initial event dataset;
[0009] Data preprocessing module: performs missing value imputation, outlier removal, and dynamic normalization on the initial event dataset to generate a standardized event set;
[0010] Regulation strategy generation module: Based on a standardized event set, a reinforcement learning algorithm is used to generate a regulation strategy for emergency response technology handling, with the goal of achieving a weighted comprehensive optimal balance between the efficiency and accuracy of emergency response technology handling.
[0011] Control execution and feedback module: It sends the control strategy to the event emergency technical handling and response system for execution, calculates the event emergency technical handling and response efficiency index and the handling accuracy index in real time, and triggers an update when the combined deviation of the two exceeds the preset threshold.
[0012] Furthermore, the sensors in the data acquisition module include network device status sensors, security alarm sensors, and attack signature sensors;
[0013] The network device operating status data is collected by the network device status sensor; the security alarm data is collected by the security alarm sensor and the log collector; and the attack feature parameter data is collected by the attack feature sensor.
[0014] Furthermore, the missing value filling in the data preprocessing module includes linear interpolation, type mapping filling, and default value filling;
[0015] Based on the time-series characteristics of the network device operating status data, the linear interpolation method is used to fill in missing values;
[0016] The security alarm data is populated using the type mapping described above;
[0017] When a field is missing in the attack feature parameter data, a default value is used to fill it in. The default value is the system preset value.
[0018] Furthermore, the outlier removal employs the 3σ boundary method.
[0019] Furthermore, it is characterized in that,
[0020] The dynamic normalization process includes the following steps:
[0021] Dynamic boundary calculation:
[0022] For each variable in the initial event dataset Define the dynamic boundaries within a 1-hour sliding window:
[0023]
[0024] in, for The dynamic lower bound; for The dynamic upper bound; For time window within Maximum value; For time window within Minimum value; The current time; for In the time window The difference between the maximum and minimum values within the range;
[0025] Dynamic normalization formula:
[0026]
[0027] in, The value after the dynamic normalization process; The value before the dynamic normalization process; for The dynamic lower bound; for The dynamic upper bound; This is the current time.
[0028] Furthermore, the reinforcement learning algorithm in the regulation strategy generation module includes the following steps:
[0029] State space: The state space is constructed based on the standardized event set. , means as follows:
[0030]
[0031] in, This refers to the preprocessed network device operating status data; The security alarm data is the preprocessed data. The attack feature parameter data after preprocessing; This is the current time step;
[0032] Action space The action space represents the control strategy adopted, as shown below:
[0033]
[0034] in, Adjustment amount for priority of emergency technical handling response; The range of values is Furthermore, the highest priority for emergency technical response is 5, and the lowest priority is 1. To handle team allocation adjustments, 0 indicates maintaining the original team, while 1-3 correspond to other preset teams;
[0035] reward function The reward function integrates the emergency response efficiency and accuracy indicators of the incident, and its formula is expressed as follows:
[0036]
[0037] in, The emergency response technical handling efficiency index is calculated using the following formula: , For the target response time, This refers to the actual response time. The calculation formula is as follows: , To account for the number of misjudgments, To account for the number of missed detections, Total number of treatments; The formula for the action penalty item is as follows:
[0038]
[0039] in, Adjustment amount for priority of emergency technical handling response; Adjustments were made to the allocation of personnel to handle the situation;
[0040] The target response time is a system preset value; the actual response time is the time interval automatically collected and defined by the system as the time interval between the creation time of the emergency response and the time of the first action; the number of misjudgments, the number of missed judgments, and the total number of actions required for the accuracy of the action are all collected manually.
[0041] Policy optimization algorithm: The policy network parameters are updated using the near-end policy optimization algorithm, expressed by the following formula:
[0042]
[0043] in, For the current policy network parameters, For the updated policy network parameters; The learning rate; The gradient of the parameters of the policy network; For the current policy network in state Next action The probability of; The policy network was in state before the update. Next action The probability of; The function limits the probability ratio to interval, ; The dominant function;
[0044] Constraint handling: Constraint handling includes priority adjustment constraints and team load constraints;
[0045] The priority adjustment constraint is expressed as follows:
[0046]
[0047] in, Prioritize the emergency technical response to the current event; Adjustment amount for priority of emergency technical handling response;
[0048] The team load constraint:
[0049]
[0050] in, This represents the team's current load rate, with a value ranging from 0 to 1. To account for the increased load resulting from the adjustment, when a team is assigned to handle new incident response technical issues, the increased load will be... , This represents the number of emergency technical response responses for current team incidents.
[0051] Furthermore, the event emergency response efficiency index in the control execution and feedback module... The calculation formula is expressed as follows:
[0052]
[0053] in, For the target response time, This refers to the actual response time.
[0054] The comprehensive deviation , means as follows:
[0055]
[0056] when Exceeding the system's preset threshold When the time comes, an update is triggered;
[0057] The update involves re-executing the regulation strategy generation module and updating the model parameters in the reinforcement learning algorithm using the latest standardized event set.
[0058] Compared with the prior art, the advantages of the present invention are as follows:
[0059] This invention, through the deep integration of reinforcement learning and the system, constructs a closed-loop control system for data acquisition, strategy generation, and feedback optimization, breaking through the limitations of traditional manual scheduling and single-objective optimization.
[0060] This invention achieves adaptive evolution of strategies by dynamically updating model parameters in real time, effectively addressing complex and ever-changing cybersecurity threat scenarios. Attached Figure Description
[0061] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0062] Figure 1 This is a system module diagram of the present invention;
[0063] Figure 2 This is a structural diagram of the data preprocessing module of the present invention;
[0064] Figure 3 This is a structural diagram of the regulation strategy generation module of the present invention. Detailed Implementation
[0065] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present application.
[0066] Example 1: Please refer to Figure 1 As shown, this embodiment is an automated response system for emergency technical handling of network security incidents. The system includes a data acquisition module, a data preprocessing module, a control strategy generation module, and a control execution and feedback module.
[0067] The data acquisition module collects network device operating status data, security alarm data, and attack characteristic parameter data in real time through sensors and log collectors to construct an initial event dataset.
[0068] In this embodiment, the sensors include network device status sensors, security alarm sensors, and attack signature sensors;
[0069] The network device operating status data is collected by network device status sensors; the security alarm data is collected by security alarm sensors and log collectors; the attack characteristic parameter data is collected by attack characteristic sensors.
[0070] The network device status sensor is an SNMP sensor; the SNMP sensor is deployed on the core switch and server, and periodically collects CPU utilization, memory usage and network interface traffic through the SNMP v3 protocol;
[0071] The safety alarm sensors include Suricata IDS and Cisco ASA 5585-X;
[0072] The Suricata IDS is deployed on the mirror port of the core switch and collects high-threat malicious traffic characteristics in real time based on the Eve-ng rule base;
[0073] The characteristics of the malicious traffic include the source / destination IP, port, and attack type of SQL injection and DDoS attacks;
[0074] The Cisco ASA 5585-X firewall threat sensor is deployed at the network boundary to collect abnormal connection blocking events, including timestamps, source / destination IPs, and port numbers.
[0075] The attack signature sensor employs a threat intelligence probe and collects verified malicious IP addresses, domain names, and file hash values.
[0076] The log collector uses the ELK Stack and Zabbix Agent;
[0077] The ELK Stack log collector is used to collect firewall blocking logs and WAF attack logs;
[0078] The Zabbix Agent log collector is installed on the server node to collect server login failure logs.
[0079] The data preprocessing module performs missing value imputation, outlier removal, and dynamic normalization on the initial event dataset to generate a standardized event set, such as... Figure 2 As shown;
[0080] In this embodiment, the initial event dataset includes the network device operating status data, the security alarm data, and the attack characteristic parameter data;
[0081] The missing value filling includes linear interpolation, type mapping filling, and default value filling;
[0082] Based on the time-series characteristics of the network device operating status data, the linear interpolation method is used to fill in missing values; the formula for the linear interpolation method is as follows:
[0083]
[0084] in, For time points Missing values in the network device operating status data to be filled; for Previous valid observation; for The last valid observation;
[0085] The security alarm data is populated using the type mapping, expressed by the following formula:
[0086]
[0087] When the security alarm data is missing, use The alarm type mapping table is filled with missing values; when there is no security alarm data, it is filled with 0; the alarm type mapping table includes, but is not limited to, SQL injection with a default fill value of 9 and remote code execution with a default fill value of 10;
[0088] When a field is missing in the attack feature parameter data, a default value is used to fill it in. The default value is the system preset value.
[0089] The outlier removal method employs the 3σ boundary method.
[0090] The 3σ boundary value method is used to remove outliers from the network device operating status data, the security alarm data, and the attack characteristic parameter data. The calculation method is as follows:
[0091] Step 1: Take the data within a 1-hour sliding window and calculate the mean. and standard deviation ;
[0092] Step 2: Remove excess The range of data points;
[0093] Step 3: Fill in the removed data points using the linear interpolation method described above;
[0094] The dynamic normalization process includes the following steps:
[0095] Dynamic boundary calculation:
[0096] For each variable in the initial event dataset Define the dynamic boundaries within a 1-hour sliding window:
[0097]
[0098] in, for The dynamic lower bound; for The dynamic upper bound; For time window within Maximum value; For time window within Minimum value; The current time; for In the time window The difference between the maximum and minimum values within the range;
[0099] Dynamic normalization formula:
[0100]
[0101] in, The value after the dynamic normalization process; The value before the dynamic normalization process; for The dynamic lower bound; for The dynamic upper bound; This is the current time.
[0102] The control strategy generation module, based on a standardized event set, employs a reinforcement learning algorithm and aims to generate a control strategy for emergency response technology, with the goal of achieving a weighted optimal balance between response efficiency and handling accuracy. Figure 3 As shown;
[0103] In this embodiment,
[0104] The reinforcement learning algorithm includes the following steps:
[0105] State space: The state space is constructed based on the standardized event set. , means as follows:
[0106]
[0107] in, This refers to the preprocessed network device operating status data; The security alarm data is the preprocessed data. The attack feature parameter data after preprocessing; This is the current time step;
[0108] Action space The action space represents the control strategy adopted, as shown below:
[0109]
[0110] in, Adjustment amount for priority of emergency technical handling response; The range of values is Furthermore, the highest priority for emergency technical response is 5, and the lowest priority is 1. To handle team allocation adjustments, 0 indicates maintaining the original team, while 1-3 correspond to other preset teams;
[0111] reward function The reward function integrates the emergency response efficiency and accuracy indicators of the incident, and its formula is expressed as follows:
[0112]
[0113] in, The emergency response technical handling efficiency index is calculated using the following formula: , For the target response time, This refers to the actual response time. The calculation formula is as follows: , To account for the number of misjudgments, To account for the number of missed detections, Total number of treatments; The formula for the action penalty item is as follows:
[0114]
[0115] in, Adjustment amount for priority of emergency technical handling response; Adjustments were made to the allocation of personnel to handle the situation;
[0116] The target response time is a system preset value; the actual response time is the time interval automatically collected and defined by the system as the time interval between the creation time of the emergency response and the time of the first action; the number of misjudgments, the number of missed judgments, and the total number of actions required for the accuracy of the action are all collected manually.
[0117] Policy optimization algorithm: The policy network parameters are updated using the near-end policy optimization algorithm, expressed by the following formula:
[0118]
[0119] in, For the current policy network parameters, For the updated policy network parameters; The learning rate; The gradient of the parameters of the policy network; For the current policy network in state Next action The probability of; The policy network was in state before the update. Next action The probability of; The function limits the probability ratio to interval, ; The dominant function is an existing formula, so it will not be described in this embodiment.
[0120] Constraint handling: Constraint handling includes priority adjustment constraints and team load constraints;
[0121] The priority adjustment constraint is expressed as follows:
[0122]
[0123] in, Prioritize the emergency technical response to the current event; Adjustment amount for priority of emergency technical handling response;
[0124] The team load constraint:
[0125]
[0126] in, This represents the team's current load rate, with a value ranging from 0 to 1. To account for the increased load resulting from the adjustment, when a team is assigned to handle new incident response technical issues, the increased load will be... , This represents the number of emergency technical response responses for current team incidents.
[0127] The control execution and feedback module sends the control strategy to the event emergency technical processing and response system for execution, calculates the event emergency technical processing and response efficiency index and the handling accuracy index in real time, and triggers an update when the combined deviation of the two exceeds a preset threshold.
[0128] In this embodiment, the event emergency response technology handling efficiency index The calculation formula is expressed as follows:
[0129]
[0130] in, For the target response time, This refers to the actual response time.
[0131] The accuracy index of the treatment The calculation formula is expressed as follows:
[0132]
[0133] in, To account for the number of misjudgments, To account for the number of missed detections, Total number of treatments;
[0134] The comprehensive deviation , means as follows:
[0135]
[0136] when Exceeding the system's preset threshold When the time comes, an update is triggered;
[0137] The update involves re-executing the regulation strategy generation module and updating the model parameters in the reinforcement learning algorithm using the latest standardized event set.
[0138] All the above formulas are dimensionless and use only numerical values for calculation. These formulas are derived from a large amount of data and through software simulation, aiming to approximate reality as closely as possible. The preset parameters in the formulas can be adjusted by those skilled in the art according to specific needs.
[0139] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0140] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.
Claims
1. An automated response system for emergency technical handling of network security incidents, characterized in that, include: Data acquisition module: Collects network device operating status data, security alarm data, and attack characteristic parameter data in real time through sensors and log collectors to build an initial event dataset; Data preprocessing module: performs missing value imputation, outlier removal, and dynamic normalization on the initial event dataset to generate a standardized event set; Regulation strategy generation module: Based on a standardized event set, a reinforcement learning algorithm is used to generate a regulation strategy for emergency response technology handling, with the goal of achieving a weighted comprehensive optimal balance between the efficiency and accuracy of emergency response technology handling. Control execution and feedback module: It sends the control strategy to the event emergency technical handling and response system for execution, calculates the event emergency technical handling and response efficiency index and the handling accuracy index in real time, and triggers an update when the combined deviation of the two exceeds the preset threshold.
2. The system according to claim 1, characterized in that, The reinforcement learning algorithm in the regulation strategy generation module includes the following steps: State space: The state space is constructed based on the standardized event set. , means as follows: in, This refers to the preprocessed network device operating status data; The security alarm data is the preprocessed data. The attack feature parameter data after preprocessing; This is the current time step; Action space The action space represents the control strategy adopted, as shown below: in, Adjustment amount for priority of emergency technical handling response; The range of values is Furthermore, the highest priority for emergency technical response is 5, and the lowest priority is 1. To handle team allocation adjustments, 0 indicates maintaining the original team, while 1-3 correspond to other preset teams; reward function The reward function integrates the emergency response efficiency and accuracy indicators of the incident, and its formula is expressed as follows: in, The emergency response technical handling efficiency index is calculated using the following formula: , For the target response time, This refers to the actual response time. The calculation formula is as follows: , To account for the number of misjudgments, To account for the number of missed judgments, Total number of treatments; The formula for the action penalty item is as follows: in, Adjustment amount for priority of emergency technical handling response; Adjustments were made to the allocation of personnel to handle the situation; The target response time is a system preset value; the actual response time is the time interval automatically collected and defined by the system as the time interval between the creation time of the emergency response and the time of the first action; the number of misjudgments, the number of missed judgments, and the total number of actions required for the accuracy of the action are all collected manually. Policy optimization algorithm: The policy network parameters are updated using the near-end policy optimization algorithm, expressed by the following formula: in, For the current policy network parameters, For the updated policy network parameters; The learning rate; The gradient of the parameters of the policy network; For the current policy network in state Next action The probability of; The policy network was in state before the update. Next action The probability of; The function limits the probability ratio to interval, ; The dominant function; Constraint handling: Constraint handling includes priority adjustment constraints and team load constraints; The priority adjustment constraint is expressed as follows: in, Prioritize the emergency technical response to the current event; Adjustment amount for priority of emergency technical handling response; The team load constraint: in, This represents the team's current load rate, with a value ranging from 0 to 1. To account for the increased load resulting from the adjustment, when a team is assigned to handle new incident response technical issues, the increased load will be... , This represents the number of emergency technical response responses for current team incidents.
3. The system according to claim 2, characterized in that, The event emergency response efficiency index in the control execution and feedback module The calculation formula is expressed as follows: in, For the target response time, This refers to the actual response time. The comprehensive deviation , means as follows: when Exceeding the system's preset threshold When the time comes, an update is triggered; The update involves re-executing the regulation strategy generation module and updating the model parameters in the reinforcement learning algorithm using the latest standardized event set.
4. The system according to claim 1, characterized in that, The sensors in the data acquisition module include network device status sensors, security alarm sensors, and attack signature sensors; The network device operating status data is collected by the network device status sensor; the security alarm data is collected by the security alarm sensor and the log collector; and the attack feature parameter data is collected by the attack feature sensor.
5. The system according to claim 1, characterized in that, The missing value filling in the data preprocessing module includes linear interpolation, type mapping filling, and default value filling; Based on the time-series characteristics of the network device operating status data, the linear interpolation method is used to fill in missing values; The security alarm data is populated using the type mapping described above; When a field is missing in the attack feature parameter data, a default value is used to fill it in. The default value is the system preset value.
6. The system according to claim 1, characterized in that, The outlier removal method employs the 3σ boundary method.
7. The system according to claim 1, characterized in that, The dynamic normalization process includes the following steps: Dynamic boundary calculation: For each variable in the initial event dataset Define the dynamic boundaries within a 1-hour sliding window: in, for The dynamic lower bound; for The dynamic upper bound; For time window within Maximum value; For time window within Minimum value; The current time; for In the time window The difference between the maximum and minimum values within the range; Dynamic normalization formula: in, The value after the dynamic normalization process; The value before the dynamic normalization process; for The dynamic lower bound; for The dynamic upper bound; This is the current time.