A method, device, equipment and medium for diagnosing a security programming link

Abstract

This invention provides a diagnostic method, apparatus, device, and medium for secure orchestration links. The method includes: in response to a trigger operation of an auxiliary configuration control for a target component node, acquiring output information of the preceding component node, component information of the target component node, and diagnostic information, wherein the diagnostic information is used to characterize configuration errors of the target component node; determining first prompt information based on a pre-trained first diagnostic model and the component information and diagnostic information of the target component node; determining candidate configuration files for the target component node based on a pre-trained second diagnostic model and the first prompt information and the output information of the preceding component node; and displaying the candidate configuration files to update the configuration information of the target component node using the candidate configuration files. This invention can improve the diagnostic efficiency of component nodes and improve the accuracy of secure orchestration links.

Description

Technical Field

[0001] This invention relates to the field of fault diagnosis, and in particular to a method, apparatus, device and medium for diagnosing secure orchestration links. Technical Background The core significance of automatically generating security orchestration links (playbooks) lies in completely transforming the traditional operational model that relies on manual coding by experts, upgrading security operations from a "workshop" to a "smart factory." Through parameter mapping, it can greatly reduce the barrier to entry, enabling frontline analysts to directly describe response needs in natural language, thereby turning expert knowledge into reusable automated assets and significantly improving the scale and speed of threat response.

[0002] However, the automatic generation of scripts faces significant challenges. The output must possess extremely high accuracy, logical rigor, and executability, requiring users to have a deep understanding of complex attack contexts, the interface specifications of heterogeneous security products, and the logical dependencies between actions. Currently, script construction still heavily relies on manual input and configuration of various parameters. This method is not only inefficient and error-prone, but also incurrs extremely high costs for troubleshooting and correction after errors occur. Summary of the Invention

[0003] This invention provides a diagnostic method, apparatus, device, and medium for secure orchestration links. Through the technical solutions of the embodiments of this invention, rapid diagnosis and correction of component nodes of secure orchestration links can be achieved, thereby improving the update efficiency of secure orchestration links.

[0004] In a first aspect, embodiments of the present invention provide a diagnostic method for a secure orchestration link, the secure orchestration link including multiple component nodes, each component node representing a security task executed in response to a security issue, and each component node being associated with an auxiliary configuration control; the method includes: In response to a trigger operation of the auxiliary configuration control for the target component node, the output information of the preceding component node of the target component node, the component information of the target component node, and diagnostic information are obtained, wherein the diagnostic information is used to characterize the configuration error of the target component node; Based on the pre-trained first diagnostic model, the first prompt information is determined according to the component information and diagnostic information of the target component node; Based on the pre-trained second diagnostic model, the candidate configuration file of the target component node is determined according to the first prompt information and the output information of the preceding component node; The candidate configuration file is displayed so that the configuration information of the target component node can be updated using the candidate configuration file.

[0005] Secondly, embodiments of the present invention provide a diagnostic device for a secure orchestration link, the secure orchestration link including multiple component nodes, each component node representing a security task executed in response to a security issue, the component nodes being associated with an auxiliary configuration control, the device comprising: The acquisition module is used to acquire, in response to the triggering operation of the auxiliary configuration control for the target component node, the output information of the preceding component node of the target component node, the component information of the target component node and diagnostic information, wherein the diagnostic information is used to characterize the configuration error of the target component node; The first diagnostic module is used to determine the first prompt information based on the component information and diagnostic information of the target component node, according to the pre-trained first diagnostic model. The second diagnostic module is used to determine the candidate configuration file of the target component node based on the first prompt information and the output information of the preceding component node, according to the pre-trained second diagnostic model. An update module is used to display the candidate configuration files so as to update the configuration information of the target component node using the candidate configuration files.

[0006] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the diagnostic method for the secure orchestration link as described in any one of the embodiments of the present invention.

[0007] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to execute and implement the diagnostic method for the secure orchestration link as described in any one of the embodiments of the present invention.

[0008] This invention provides a diagnostic method, apparatus, device, and medium for secure orchestration links. The method includes: responding to a trigger operation of the auxiliary configuration control for a target component node, acquiring output information of the preceding component node of the target component node, component information of the target component node, and diagnostic information, wherein the diagnostic information is used to characterize configuration errors of the target component node; determining first prompt information based on a pre-trained first diagnostic model, according to the component information and diagnostic information of the target component node; determining candidate configuration files for the target component node based on a pre-trained second diagnostic model, according to the first prompt information and the output information of the preceding component node; and displaying the candidate configuration files to update the configuration information of the target component node using the candidate configuration files. Specifically, the first prompt information explicitly includes the specific errors or non-compliance reasons in the current configuration of the target component node. Based on the analysis of the rule conflicts, missing parameters, and format mismatches described in the first prompt information, corresponding candidate configuration files can be generated through large language model inference. The candidate configuration files contain corrected target configuration information that conforms to parameter configuration standards. The system can automatically use the content in the candidate configuration files to complete the update and overwrite of the current configuration of the target component node. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 A flowchart illustrating a diagnostic method for a secure orchestration link provided in Embodiment 1 of the present invention; Figure 2 A flowchart illustrating a diagnostic method for a secure orchestration link provided in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of a diagnostic device for a secure orchestration link provided in Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0011] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0012] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0013] It should be noted that the collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0014] Example 1 Figure 1 This is a flowchart of a diagnostic method for a secure orchestration link provided in Embodiment 1 of the present invention. The method is specifically applicable to the situation of modifying the content of component nodes of a secure orchestration link. The method can be executed by a diagnostic device for a secure orchestration link, which can be composed of software and / or hardware and configured in a computer or server.

[0015] like Figure 1 As shown, it includes: Step 110: In response to the triggering operation of the auxiliary configuration control for the target component node, obtain the output information of the predecessor component node of the target component node, the component information of the target component node, and the diagnostic information, wherein the diagnostic information is used to characterize the configuration error of the target component node.

[0016] Specifically, a security orchestration link comprises multiple component nodes, each representing a security task executed in response to a security issue, and each component node is associated with an auxiliary configuration control. Specifically, a security orchestration link is an automated process composed of multiple component nodes connected in a logical sequence, used to respond to security issues and execute a series of security tasks, representing an automated workflow for security operations, such as a complete chain from alarm analysis to response. Component nodes are the basic building blocks in the security orchestration link, representing specific security tasks executed in response to security issues. Security tasks are the specific operations or functions represented by the component nodes, used to resolve or mitigate security issues, representing automated response actions, such as isolating hosts, blacklisting IPs, or sending alarms such as log queries, threat blocking, or email notifications. Security issues are events or threats that require processing by the security system, used to trigger the execution of the security orchestration link, representing the objects of security operations, such as network attacks, data breaches, or malware infections. Auxiliary configuration controls are user interface elements used to respond to user actions to trigger configuration assistance functions, representing interactive entry points associated with component nodes, such as buttons or icons. Furthermore, when a security issue arises, security tasks will be executed according to the sequence of the security orchestration chain to handle and respond to the security issue. The security orchestration chain can be a SOAR (Security Orchestration, Automation, and Response Playbook) playbook.

[0017] Specifically, the target component node is a component node in the security orchestration chain, which can be a component node where user configuration information is inaccurate or incorrect. The preceding component node is a component node in the security orchestration chain that precedes the target component node. Each component node has specific input and output information to ensure the sequential execution of each component node in the security orchestration chain, thereby responding to security issues. Component information consists of the target component node's attributes or metadata, used to describe the component's type, function, interface, and other characteristics, representing the component's static configuration, such as API endpoints or parameter formats. Diagnostic information is data used to identify configuration information problems in the target component node, representing the specific type or location of configuration errors, and assisting in error correction, such as missing fields or type mismatches.

[0018] Optionally, the process may include the following steps prior to step 110: Based on the link connection relationship of the security orchestration link, obtain the output information of each front-end component node; obtain the component identifier and current configuration information of the target component node; based on the component identifier, obtain the attributes and parameter configuration standards of the target component node from the preset component database, and construct the component information from the attributes and parameter configuration standards of the target component node; determine the diagnostic information of the target component node based on the component information and current configuration information of the target component node.

[0019] The link connection relationship refers to the logical connection relationship between component nodes in the security orchestration link. It is used to define the execution order and data flow of component nodes, and to represent the structural topology of the automated process, such as sequential connection, branching, or looping. Output information refers to the data results generated after the execution of the preceding component node, used as input for subsequent component nodes, representing the status or output content of the task execution, such as threat intelligence query results or event details, such as IP address and event time. Current configuration information refers to the parameter values ​​currently set for the target component node. The preset component database is a database that stores component node attributes and parameter configuration standards, used to provide reference standards for component configuration. Parameter configuration standards are the correct configuration specifications or templates for component node parameters, used to guide parameter settings to ensure executability, and to represent compliance requirements for configuration, such as field type, value range, or required fields.

[0020] Specifically, the component identifier and current configuration information of the target component node can be queried through its configuration file. Then, the obtained current configuration information is compared and analyzed with the parameter configuration standards extracted from the component database to assess the degree of compliance of the current configuration with the standards. For example, it checks whether required parameters are set, whether the data type and format of parameter values ​​are correct, and whether the values ​​are within the specified constraints. Simultaneously, by combining the output information of the preceding component nodes obtained from the link connection relationship, it verifies whether the current configuration of the target component node can correctly process these input data, such as whether the configuration mapping relationship is correct and whether the required input fields are complete. Finally, by combining the results of the configuration compliance check and context input adaptability verification, diagnostic information for the target component node is generated. The diagnostic information clearly identifies whether the configuration is correct, whether there are errors or warnings, and provides specific correction suggestions or compliance status descriptions.

[0021] Specifically, the current configuration information of the target component node is compared with the attribute and parameter configuration standards of the target component node, the cause of the error is determined based on the comparison result, and the cause of the error is used as the diagnostic information of the target component node.

[0022] Step 120: Based on the pre-trained first diagnostic model, determine the first prompt information according to the component information and diagnostic information of the target component node.

[0023] Specifically, the first diagnostic model is a prompt word generation model. Its function is to generate structured prompt word text based on the component information and diagnostic information of the target component node. The first prompt information aims to help the second diagnostic model more accurately understand the diagnostic context and configuration requirements, thereby providing effective guidance for generating candidate configuration files for the target component node. Furthermore, the first diagnostic model can contain multiple sub-models, which perform independent or correlated analysis on the component information and diagnostic information respectively, and generate corresponding component prompt words and diagnostic prompt words. Finally, these parts are assembled and integrated into a complete first prompt information.

[0024] Step 130: Based on the pre-trained second diagnostic model, determine the candidate configuration file of the target component node according to the first prompt information and the output information of the preceding component node.

[0025] The second diagnostic model includes a file template for the configuration file corresponding to the target component node.

[0026] Specifically, the second diagnostic model will perform comprehensive reasoning based on the configuration intent and specifications conveyed by the first prompt information and the actual data content output by the front-end node, and finally output candidate configuration files that can be directly used to configure the target component node.

[0027] Step 140: Display the candidate configuration file to update the configuration information of the target component node using the candidate configuration file.

[0028] Specifically, the candidate configuration file is displayed on the visualization page associated with the target component node; in response to the user's confirmation modification operation for the target component node, the current configuration information of the target node is updated based on the configuration information in the candidate configuration file.

[0029] Specifically, the current configuration information of the target component node and the configuration information corresponding to the candidate configuration file can be displayed simultaneously on the visualization page associated with the target component node. If the user confirms the adoption of the configuration information of the candidate configuration file, the current configuration information of the target component node will be updated based on the configuration information in the candidate configuration file.

[0030] This invention provides a diagnostic method for secure orchestration links. The method includes: responding to a trigger operation of the auxiliary configuration control for a target component node, acquiring output information of the preceding component node of the target component node, component information of the target component node, and diagnostic information, wherein the diagnostic information characterizes configuration errors of the target component node; determining first prompt information based on a pre-trained first diagnostic model, according to the component information and diagnostic information of the target component node; determining candidate configuration files for the target component node based on a pre-trained second diagnostic model, according to the first prompt information and the output information of the preceding component node; and displaying the candidate configuration files to update the configuration information of the target component node using the candidate configuration files. Specifically, the first prompt information explicitly includes the specific errors or non-compliance reasons in the current configuration of the target component node. Based on the analysis of rule conflicts, missing parameters, and format mismatches described in the first prompt information, corresponding candidate configuration files can be generated through large language model inference. The candidate configuration files contain corrected target configuration information that conforms to parameter configuration standards. The system can automatically use the content in the candidate configuration files to update and overwrite the current configuration of the target component node, improving the configuration efficiency of the component node.

[0031] Example 2 Figure 2 This is a flowchart of a diagnostic method for a secure orchestration link provided in Embodiment 2 of the present invention. The method specifically defines the method for generating the first prompt information and the candidate configuration file.

[0032] like Figure 2 As shown, it includes: Step 210: In response to the triggering operation of the auxiliary configuration control for the target component node, obtain the output information of the predecessor component node of the target component node, the component information of the target component node and the diagnostic information, wherein the diagnostic information is used to characterize the configuration error of the target component node.

[0033] Step 220: Using the first sub-model, based on the missing fields of the first structured template, extract keywords from the component information, and fill the extracted keywords into the first structured template to obtain component configuration prompts.

[0034] Specifically, the first sub-model is a sub-module or component in the pre-trained first diagnostic model, used to extract and fill keywords into component information based on a first structured template. The first structured template is a pre-defined text structure framework used to define the format and content fields of component configuration prompts, representing a standardized template for component configuration prompts, such as a template containing fields like "component type" and "parameter requirements". Component configuration prompts are structured prompts generated by the first sub-model based on component information, used to describe the configuration requirements of the target component node, representing the component's basic attributes and parameter standards, such as the text "Component type: Firewall, Action: Block, Parameter: IP address".

[0035] Step 230: Using the second sub-model, based on the missing fields of the second structured template, extract keywords from the diagnostic information, and fill the extracted keywords into the second structured template to obtain error description prompts.

[0036] Specifically, the second sub-model is a sub-module or component within the pre-trained first diagnostic model. It is used to extract and fill in keywords from diagnostic information based on a second structured template. The second structured template is a pre-defined text structure framework used to define the format and content fields of error description prompts, representing a standardized template for error description prompts, such as a template containing fields like "error type," "error location," and "suggested correction." The error description prompts are structured prompts generated by the second sub-model based on diagnostic information, used to describe configuration errors in target component nodes, representing the nature and details of the error, such as the text "Error type: field missing, error field: port number, suggestion: supplement port parameters."

[0037] Step 240: Output the prompt information containing the component configuration prompt and error description prompt through the first diagnostic model.

[0038] Specifically, the first diagnostic model can output a prompt message composed of component configuration prompts and error description prompts.

[0039] Step 250: Obtain the task information of the target component node.

[0040] The task information is a detailed description of the security task associated with the target component node, representing the intent and requirements of the task, such as the task name "Block Malicious IP" or the task description "Block IP access based on threat intelligence".

[0041] Step 260: Generate a second prompt message based on the arrangement purpose, prompt information and output information of the preceding component node.

[0042] Specifically, the second prompt information can be obtained by filling and combining the arrangement purpose, prompt information and output information of the preceding component nodes based on the preset second prompt information template.

[0043] Step 270: Input the second prompt information into the second diagnostic model. The second diagnostic model determines the target configuration information and modification suggestions of the target component node based on the output information of the front-end component node, combined with the prompt information and the arrangement purpose.

[0044] Specifically, the essence of a security script is a data-driven automated process, where the output information of the preceding component nodes is the direct input for subsequent task execution. The second diagnostic model, by parsing the orchestration purpose (defining task objectives), component configuration prompts (defining parameter specifications), and error description prompts (locating existing problems), can accurately understand which data from the preceding outputs should be filled into the configuration fields of the target component nodes, and in what format, thus achieving automated mapping from "data results" to "execution parameters."

[0045] Step 280: Obtain the candidate configuration file output by the second diagnostic model, which includes the target configuration information and modification suggestions.

[0046] Specifically, the configuration template of the target component node is obtained; the target configuration information and modification suggestions of the target component node are filled into the corresponding position of the configuration template to obtain the candidate configuration file.

[0047] Step 290: Display the candidate configuration file to update the configuration information of the target component node using the candidate configuration file.

[0048] For example, in SOAR script arrangement, each component node is associated with an auxiliary configuration control (such as an "AI Assist" button) as the trigger entry point for the intelligent configuration function. When the user triggers this control, the system synchronously obtains the component information of the target component node (including component metadata such as name, type, action, and parameter definitions), current configuration information (such as filled parameter values), diagnostic information (such as missing required fields or format errors), and the output information (structured JSON data) of the preceding component node. A pre-trained first diagnostic model generates component configuration prompts and error description prompts based on the component information and diagnostic information. The configuration prompts and error description prompts, combined with the arrangement purpose (such as script name and node intent) and the output information of the preceding node, construct a second prompt message, which is then input into the second diagnostic model. Based on the output information of the preceding component node, the second diagnostic model infers and determines the target configuration information and modification suggestions for the target component node, outputting candidate configuration files. Finally, the front end displays the candidate configuration files, highlights auto-filled items, and provides optimization suggestions. Users can update the configuration information of the target component node with a single click.

[0049] This invention triggers an intelligent configuration process through an auxiliary configuration control. Its core advantage lies in the deep integration of SOAR runtime context and pre-trained model capabilities, achieving a fundamental shift from "manual parameter filling" to "intelligent deduction." Compared to existing technologies, this invention has significant advantages: First, by combining orchestration purpose, component information, diagnostic information, and the output information of preceding component nodes, the second diagnostic model can perform precise context-aware reasoning, generating highly targeted target configuration information and modification suggestions, rather than generalized recommendations. Second, directly using diagnostic information to drive the correction of configuration information ensures the accuracy and executability of candidate configuration files. Third, through the structured collaboration between the first and second diagnostic models, raw information is transformed into standardized component configuration prompts and error description prompts, ultimately outputting standardized candidate configuration files. This supports one-click application of updated configuration information, forming a complete closed loop from problem diagnosis to intelligent repair, significantly reducing the configuration threshold of the secure orchestration chain, improving script construction efficiency, and building the platform's differentiated competitiveness.

[0050] Example 3 Figure 3 This is a schematic diagram of a diagnostic device for a secure orchestration link provided in Embodiment 3 of the present invention. Figure 3 As shown, the security orchestration link includes multiple component nodes, each representing a security task executed in response to a security issue, and each component node is associated with an auxiliary configuration control; the device includes: The acquisition module 310 is used to acquire, in response to the triggering operation of the auxiliary configuration control for the target component node, the output information of the preceding component node of the target component node, the component information of the target component node and diagnostic information, wherein the diagnostic information is used to characterize the configuration error of the target component node; The first diagnostic module 320 is used to determine the first prompt information based on the component information and diagnostic information of the target component node, according to the pre-trained first diagnostic model. The second diagnostic module 330 is used to determine the candidate configuration file of the target component node based on the first prompt information and the output information of the preceding component node, according to the pre-trained second diagnostic model. The update module 340 is used to display the candidate configuration file so as to update the configuration information of the target component node using the candidate configuration file.

[0051] This invention provides a diagnostic device for secure orchestration links. The device, in response to a trigger operation of the auxiliary configuration control for a target component node, acquires the output information of the preceding component node, the component information of the target component node, and diagnostic information, wherein the diagnostic information characterizes configuration errors in the target component node. Based on a pre-trained first diagnostic model, it determines a first prompt message according to the component information and diagnostic information of the target component node. Based on a pre-trained second diagnostic model, it determines candidate configuration files for the target component node according to the first prompt message and the output information of the preceding component node. The device then displays the candidate configuration files to update the configuration information of the target component node. Specifically, the first prompt message explicitly includes the specific errors or non-compliance reasons in the current configuration of the target component node. Based on the analysis of rule conflicts, missing parameters, and format mismatches described in the first prompt message, a corresponding candidate configuration file can be generated through large language model inference. The candidate configuration file contains corrected target configuration information that conforms to parameter configuration standards. The system can automatically use the content in the candidate configuration files to update and overwrite the current configuration of the target component node, improving the configuration efficiency of the component node.

[0052] Optionally, the acquisition module 310 includes: The acquisition unit is used to acquire the output information of each front-end component node according to the link connection relationship of the security orchestration link; and to acquire the component identifier and current configuration information of the target component node. The component information determination unit is used to obtain the attributes and parameter configuration standards of the target component node from a preset component database according to the component identifier, and the component information is constituted by the attributes and parameter configuration standards of the target component node. The diagnostic information determination unit is used to determine the diagnostic information of the target component node based on the component information and the current configuration information of the target component node.

[0053] Optionally, the diagnostic information determination unit is specifically used to: compare the current configuration information of the target component node with the attribute and parameter configuration standards of the target component node, determine the cause of the error based on the comparison result, and use the cause of the error as the diagnostic information of the target component node.

[0054] The first diagnostic module 320 includes: The first reasoning unit is used to extract keywords from the component information based on the missing fields of the first structured template using the first sub-model, and fill the extracted keywords into the first structured template to obtain component configuration prompt words; The second reasoning unit is used to extract keywords from the diagnostic information based on the missing fields of the second structured template using the second sub-model, and fill the extracted keywords into the second structured template to obtain error description prompt words; The combination unit is used to output the prompt information containing the component configuration prompt words and error description prompt words through the first diagnostic model.

[0055] Optionally, the first diagnostic module 330 includes: The acquisition unit is used to acquire the task information of the target component node; The combination unit is used to generate a second prompt message based on the arrangement purpose, prompt information and output information of the preceding component node; The reasoning unit is used to input the second prompt information into the second diagnostic model, and the second diagnostic model determines the target configuration information and modification suggestions of the target component node based on the output information of the preceding component node, combined with the prompt information and the arrangement purpose. The generation unit is used to obtain the candidate configuration file output by the second diagnostic model, which includes the target configuration information and modification suggestions.

[0056] Optional, the generation unit includes: Obtain a sub-unit, used to obtain the configuration template of the target component node; The fill sub-unit is used to fill the target configuration information and modification suggestions of the target component node into the corresponding position of the configuration template to obtain the candidate configuration file.

[0057] Optional, the update modules include: The display unit is used to display the candidate configuration file in the visualization page associated with the target component node; The update unit is used to update the current configuration information of the target node based on the configuration information in the candidate configuration file in response to the user's confirmation modification operation for the target component node.

[0058] The diagnostic device for secure orchestration links described in this invention has all the working mechanisms and beneficial effects of the diagnostic method for secure orchestration links described in the embodiments of this invention, which will not be repeated here.

[0059] Example 4 Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0060] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0061] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0062] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as diagnostic methods for secure orchestration links.

[0063] In some embodiments, the diagnostic method for secure orchestration links may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the diagnostic method for secure orchestration links described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the diagnostic method for secure orchestration links by any other suitable means (e.g., by means of firmware).

[0064] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0065] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0066] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0067] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0068] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0069] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0070] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0071] This disclosure also provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements the diagnostic method for secure orchestration links as provided in any embodiment of this application.

[0072] In implementing a computer program product, computer program code for performing the operations of the embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0073] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A diagnostic method for secure orchestration links, characterized in that, The security orchestration chain includes multiple component nodes, each representing a security task executed in response to a security issue. These component nodes are associated with auxiliary configuration controls. The method includes: In response to a trigger operation of the auxiliary configuration control for the target component node, the output information of the preceding component node of the target component node, the component information of the target component node, and diagnostic information are obtained, wherein the diagnostic information is used to characterize the configuration error of the target component node; Based on the pre-trained first diagnostic model, the first prompt information is determined according to the component information and diagnostic information of the target component node; Based on the pre-trained second diagnostic model, the candidate configuration file of the target component node is determined according to the first prompt information and the output information of the preceding component node; The candidate configuration file is displayed so that the configuration information of the target component node can be updated using the candidate configuration file.

2. The method according to claim 1, characterized in that, Before obtaining the output information of the preceding component node of the target component node, the component information of the target component node, and the diagnostic information, the method further includes: Based on the link connection relationship of the security orchestration link, obtain the output information of each front-end component node; Obtain the component identifier and current configuration information of the target component node; Based on the component identifier, the attributes and parameter configuration standards of the target component node are obtained from the preset component database, and the component information is constituted by the attributes and parameter configuration standards of the target component node. Based on the component information and current configuration information of the target component node, the diagnostic information of the target component node is determined.

3. The method according to claim 2, characterized in that, The step of determining the diagnostic information of the target component node based on the component information and current configuration information of the target component node includes: The current configuration information of the target component node is compared with the attribute and parameter configuration standards of the target component node. The cause of the error is determined based on the comparison result, and the cause of the error is used as the diagnostic information of the target component node.

4. The method according to claim 1, characterized in that, The first diagnostic model includes a first sub-model and a second sub-model; The pre-trained first diagnostic model determines the prompt information based on the component information and diagnostic information of the target component node, including: Using the first sub-model, based on the missing fields of the first structured template, keywords are extracted from the component information, and the extracted keywords are filled into the first structured template to obtain component configuration prompt words; Using the second sub-model, based on the missing fields of the second structured template, keywords are extracted from the diagnostic information, and the extracted keywords are filled into the second structured template to obtain error description prompts; The first diagnostic model outputs a prompt message containing the component configuration prompts and error description prompts.

5. The method according to claim 1, characterized in that, The pre-trained second diagnostic model determines the candidate configuration file of the target component node based on the first prompt information and the output information of the preceding component node, including: Obtain the task information of the target component node; Based on the arrangement purpose, prompt information, and output information of the preceding component nodes, a second prompt message is generated; The second prompt information is input into the second diagnostic model, and the second diagnostic model determines the target configuration information and modification suggestions of the target component node based on the output information of the front component node, combined with the prompt information and the arrangement purpose. Obtain the candidate configuration file output by the second diagnostic model, which includes the target configuration information and modification suggestions.

6. The method according to claim 5, characterized in that, The step of generating candidate configuration files based on the target configuration information and modification suggestions of the target component nodes includes: Obtain the configuration template of the target component node; Fill the target configuration information and modification suggestions of the target component node into the corresponding position of the configuration template to obtain the candidate configuration file.

7. The method according to claim 1, characterized in that, The step of displaying the candidate configuration file to update the configuration information of the target component node using the candidate configuration file includes: The candidate configuration file is displayed on the visualization page associated with the target component node; In response to the user's confirmation modification operation for the target component node, the current configuration information of the target node is updated based on the configuration information in the candidate configuration file.

8. A diagnostic device for a secure orchestration link, characterized in that, The security orchestration link includes multiple component nodes, each representing a security task executed in response to a security issue. These component nodes are associated with auxiliary configuration controls. The device includes: The acquisition module is used to acquire, in response to the triggering operation of the auxiliary configuration control for the target component node, the output information of the preceding component node of the target component node, the component information of the target component node and diagnostic information, wherein the diagnostic information is used to characterize the configuration error of the target component node; The first diagnostic module is used to determine the first prompt information based on the component information and diagnostic information of the target component node, according to the pre-trained first diagnostic model. The second diagnostic module is used to determine the candidate configuration file of the target component node based on the first prompt information and the output information of the preceding component node, according to the pre-trained second diagnostic model. An update module is used to display the candidate configuration files so as to update the configuration information of the target component node using the candidate configuration files.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, which enables the at least one processor to perform the diagnostic method for the secure orchestration link according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the diagnostic method for the secure orchestration link as described in any one of claims 1-7.

Images