Drill script generation method, device, program product, and electronic device

Abstract

The application discloses a generation method and device of a rehearsal script, a program product and electronic equipment, and relates to the field of financial technology and other related technical fields. The method comprises the following steps: generating a target knowledge graph based on L standard documents, wherein L is a positive integer, a node in the target knowledge graph is used for representing an entity related to a security rehearsal of a network attack event by a financial institution, and an edge in the target knowledge graph is used for representing an association relationship between entities related to the security rehearsal; generating target rehearsal data based on the target knowledge graph, wherein the target rehearsal data is used for representing a rehearsal process of the security rehearsal by the financial institution; and generating a target rehearsal script based on the target rehearsal data and a preset script template, wherein the target rehearsal script is used for representing rehearsal measures executed by the financial institution based on the network attack event. The application solves the technical problem of low efficiency of the security rehearsal of the network attack event by the financial institution in the prior art.

Description

Technical Field

[0001] This application relates to the fields of financial technology and other related technologies, and more specifically, to a method, apparatus, program product, and electronic device for generating exercise scripts. Background Technology

[0002] When financial institutions conduct cyberattack emergency drills, the emergency scenarios require technical personnel to manually input drill information such as attack type, response steps, and division of responsibilities based on the content of static templates. This places high demands on the technical personnel's expertise. Existing drill systems for managing drill scenarios can only simply store the drill scenarios, lacking automation capabilities. Furthermore, the drill scenarios targeted by the management platforms provided by security vendors differ significantly from actual drill scenarios, and they cannot access the financial institution's private regulatory documents, resulting in insufficient scalability and low drill efficiency.

[0003] There is currently no effective solution to the problem of low efficiency in security drills conducted by financial institutions in the face of cyberattacks. Summary of the Invention

[0004] This application provides a method, apparatus, program product, and electronic device for generating exercise scripts, to at least solve the technical problem of low efficiency in security exercises conducted by financial institutions in the face of cyberattacks in the prior art.

[0005] According to one aspect of this application, a method for generating exercise scripts is provided, comprising: generating a target knowledge graph based on L specification documents, where L is a positive integer, the nodes in the target knowledge graph representing entities involved in security exercises conducted by a financial institution in response to a cyberattack event, and the edges in the target knowledge graph representing the relationships between entities involved in the security exercises; generating target exercise data based on the target knowledge graph, wherein the target exercise data represents the exercise process of a financial institution conducting security exercises; and generating a target exercise script based on the target exercise data and a preset script template, wherein the target exercise script represents the exercise measures executed by the financial institution based on a cyberattack event.

[0006] Optionally, generating a target knowledge graph based on L specification documents includes: performing structuring processing on each of the L specification documents to obtain L structured documents, wherein the structuring processing is used to convert the text data in each specification document into structured data in the structured documents; performing entity recognition on the L structured documents to obtain M entities, wherein M is a positive integer, and the M entities include at least the regulatory department, response time limit, responsible department, and preset security rules involved in the security exercise; extracting relations from the L structured documents to obtain the association relationships between the M entities; and generating a target knowledge graph based on the M entities and the association relationships between the M entities.

[0007] Optionally, each of the L specification documents undergoes structuring processing to obtain L structured documents, including: if the i-th specification document in the L specification documents is in table format, parsing the table in the i-th specification document to obtain the triples corresponding to the i-th specification document, and generating the structured document corresponding to the i-th specification document based on the triples corresponding to the i-th specification document, wherein the triples are used to represent the application object and response time limit requirements of each preset security rule recorded in the i-th specification document; if the i-th specification document in the L specification documents is in slide format, parsing the slides in the i-th specification document to obtain the slide titles corresponding to the i-th specification document, and generating the structured document corresponding to the i-th specification document based on the slide titles corresponding to the i-th specification document, wherein the structured data in the structured document is at least one of the following: semantic tags, original document paragraphs, and paragraph positions.

[0008] Optionally, generating target training data based on the target knowledge graph includes: parsing user-uploaded training documents to obtain initial training data for network attack events, wherein the training documents are used to record the initial training process of the security exercise; verifying the initial training data through the target knowledge graph to obtain an audit report, wherein the audit report includes at least the process defects existing in the initial training process, the corresponding correction suggestions for the process defects, and the preset security rules involved in the security exercise; and updating the initial training data based on the audit report to obtain the target training data.

[0009] Optionally, the initial training data is validated using the target knowledge graph. The validation operation includes at least one of the following: a first validation operation, used to detect whether the initial training process corresponding to the initial training data violates preset security rules using the target knowledge graph; a second validation operation, used to detect whether there are process conflicts in the initial training process corresponding to the initial training data using the target knowledge graph; and a third validation operation, used to detect the completeness of the initial training process corresponding to the initial training data using the target knowledge graph.

[0010] Optionally, generating a target training script based on the target training data and preset script templates includes: matching the target training data in a preset template library to obtain P preset script templates corresponding to the target training data, where P is a positive integer, and each preset script template is used to determine the training actions, training roles, training time, and preset safety rules corresponding to different stages of the training process; filling the keywords in the target training data into the P preset script templates to obtain the target training script.

[0011] Optionally, after generating the target exercise script based on the target exercise data and the preset script template, the method for generating the exercise script further includes: generating notification information based on the target exercise script and the preset security rules involved in the security exercise, wherein the notification information includes at least the download address of the target exercise script and the viewing link of the preset security rules; after the financial institution receives the notification information, it executes the target exercise script to obtain the execution record of the target exercise script; and updates the target knowledge graph based on the execution record of the target exercise script.

[0012] According to another aspect of this application, an apparatus for generating exercise scripts is also provided, comprising: a graph generation unit, configured to generate a target knowledge graph based on L specification documents, wherein L is a positive integer, the nodes in the target knowledge graph are used to represent entities involved in security exercises conducted by financial institutions in response to cyberattack events, and the edges in the target knowledge graph are used to represent the relationships between entities involved in the security exercises; a data generation unit, configured to generate target exercise data based on the target knowledge graph, wherein the target exercise data is used to represent the exercise process of security exercises conducted by financial institutions; and a script generation unit, configured to generate a target exercise script based on the target exercise data and a preset script template, wherein the target exercise script is used to represent the exercise measures executed by financial institutions based on cyberattack events.

[0013] According to another aspect of this application, a computer program product is also provided, which stores a computer program, wherein a method for generating a training script that controls the computer program product to execute any of the above-mentioned items is provided when the computer program is running.

[0014] According to another aspect of this application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for generating the exercise script of any of the above.

[0015] In this application, a target knowledge graph is first generated based on L specification documents, where L is a positive integer. Nodes in the target knowledge graph represent entities involved in security drills conducted by financial institutions in response to cyberattacks, and edges represent the relationships between entities involved in the security drills. Next, target drill data is generated based on the target knowledge graph, representing the drill process of financial institutions conducting security drills. Then, a target drill script is generated based on the target drill data and a preset script template, representing the drill measures executed by financial institutions based on cyberattacks.

[0016] As described above, this application converts the content of the specification document into a structured target knowledge graph. Through the target knowledge graph, the entity information and relationships between entities required for security drills corresponding to network attack events can be automatically captured and understood. Subsequently, this application generates structured data for specific drill processes based on the target knowledge graph, and then automatically outputs customized drill scripts by combining preset script templates. The drill script generation strategy in this application not only reduces the reliance on the professional knowledge of technical personnel in financial institutions, but also automates the generation of drill scripts, thereby improving the speed at which financial institutions conduct security drills.

[0017] Therefore, this application adopts a method of automatically generating target training data based on a pre-built target knowledge graph, achieving the goal of automatically acquiring training data that meets the actual training needs of financial institutions. Based on the nodes and edges in the target knowledge graph, this application can accurately represent the relationship between entities in the security training scenario corresponding to the network attack event. Subsequently, this application automatically fills in the preset script template based on the target training data to obtain the target training script, avoiding the step of requiring technicians to manually fill in the static template in the prior art. This achieves the technical effect of improving the generation efficiency of the target training script corresponding to the security exercise, and thus solves the technical problem of low efficiency in the security exercises conducted by financial institutions in the face of network attack events in the prior art. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for generating exercise scripts, according to an embodiment of this application.

[0020] Figure 2This is a flowchart of an optional method for generating a practice script according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of an optional exercise script generation device according to an embodiment of this application;

[0022] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It should also be noted that all information and data (including but not limited to information used for display and analysis) involved in this application are authorized by the user or fully authorized by all parties. For example, if there is an interface between this system and the relevant user or organization, before obtaining the relevant information, it is necessary to send a request to the aforementioned user or organization through the interface, and obtain the relevant information only after receiving consent from the aforementioned user or organization.

[0026] Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of relevant information and data involved in this application all comply with the relevant laws, regulations, and standards of the relevant regions, and necessary security measures have been taken. They do not violate public order and good morals. In addition, this application provides corresponding operation entry points for users to choose to agree to authorization or refuse authorization. If the user chooses to refuse authorization, the corresponding expert decision-making process will be initiated.

[0027] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0028] Cyberattacks in the financial industry refer to attacks against the information systems of financial institutions such as banks, securities firms, and insurance companies. These attacks include, but are not limited to, ransomware attacks, DDoS (Distributed Denial of Service) attacks, APT (Advanced Persistent Threat) attacks, internal data breaches, and API (Application Programming Interface) abuse, which can cause business disruptions, financial losses, or the leakage of customer information.

[0029] Emergency drill choreography: refers to a standardized drill process that financial institutions systematically design and execute in order to test their response capabilities to cyberattacks, based on regulatory standards and internal contingency plans. This process includes scenario building, script writing, role assignment, time simulation, and notification dissemination.

[0030] Multimodal document parsing refers to the system's technical capability to extract structured content from various heterogeneous file formats, including text recognition, table restoration, heading hierarchy analysis, and understanding of text-image relationships, without relying on manual re-recording.

[0031] Financial Emergency Knowledge Graph (FEKG): This refers to the target knowledge graph in the following embodiments, which is a dedicated semantic network in the financial field. Nodes in the financial emergency knowledge graph are used to represent at least regulatory provisions, attack types, response actions, responsible parties, time limits, and compliance indicators. Edges in the financial emergency knowledge graph represent semantic relationships (such as "Provision A mandates action B"), which are used to support compliance verification.

[0032] Human-machine collaborative review mechanism: This refers to a closed-loop process in which the target exercise script content is automatically generated by the generation system, then handed over to the administrator for manual review, modification, and feedback. The generation system regenerates the target exercise script based on the user feedback data to ensure that the final script output meets organizational standards and regulatory requirements, thus avoiding "black box decision-making".

[0033] The present invention will now be described in detail with reference to various embodiments.

[0034] Example 1

[0035] According to an embodiment of this application, an embodiment of a method for generating a training script is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0036] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 This is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for generating exercise scripts, according to an embodiment of this application. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0037] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0038] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the exercise script generation method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the exercise script generation method described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0039] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0040] The display can be configured as a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0041] Under the aforementioned operating environment, this application provides a training script generation system (hereinafter referred to as the generation system) for executing the training script generation method of this application. Figure 2 This is a flowchart of an optional method for generating a practice script according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0042] Step S201: Generate a target knowledge graph based on L specification documents, where L is a positive integer. Nodes in the target knowledge graph are used to represent entities involved in security drills conducted by financial institutions to address network attack events, and edges in the target knowledge graph are used to represent the relationships between entities involved in the security drills.

[0043] Optionally, L specification documents refer to guidance documents from financial regulatory agencies, industry standards, and emergency response guidelines.

[0044] Optionally, a target knowledge graph is a semantic network for the financial industry. Nodes in the target knowledge graph represent entities, such as regulatory terms, attack types, response actions, responsible parties, time limits, and compliance indicators. Edges represent logical relationships between entities. For example, when regulatory authorities require financial institutions to report attack situations, the target knowledge graph transforms the originally unstructured document content into a machine-readable form, facilitating subsequent intelligent analysis and application.

[0045] Optionally, "entity" here specifically refers to an object that plays a specific role or has specific attributes in a security exercise, including but not limited to regulatory provisions, attack types, response actions, responsible parties, time limits, and compliance indicators.

[0046] Optionally, the generation system performs structuring processing on each of the L specification documents, converting the text data in each specification document into structured data in the structured document, resulting in L structured documents. Then, the generation system performs entity recognition and relation extraction on the L structured documents. Subsequently, a target knowledge graph is generated based on the obtained M entities and the relationships between the M entities.

[0047] Optionally, the generation system can achieve the following by converting the specification document into the target knowledge graph:

[0048] (1) Structured storage: It can transform unstructured standard documents with complex and diverse data formats into document formats with unified and structured data formats, thereby improving the speed of subsequent data extraction and processing in standard documents.

[0049] (2) Establishment of semantic association: The establishment of target knowledge graph helps the generation system to identify and understand the logical association between different entities, such as the relationship between the time limit stipulated by one supervision clause and the responsibility allocation of another supervision clause.

[0050] Step S202: Generate target exercise data based on the target knowledge graph, wherein the target exercise data is used to characterize the exercise process of financial institutions conducting security exercises.

[0051] Optionally, target drill data refers to a set of data automatically generated based on a target knowledge graph, used to describe the specific procedures of emergency drills.

[0052] Optionally, the drill process refers to the sequence of steps a financial institution takes from discovering a cyberattack to completing a security emergency response.

[0053] Optionally, the generation system first parses the exercise documents uploaded by the user to obtain initial exercise data of the network attack event. Then, it performs a verification operation on the initial exercise data through the target knowledge graph to obtain a review report. The review report includes at least the process defects existing in the initial exercise process, the corresponding correction suggestions for the process defects, and the preset security rules involved in the security exercise. The verification operation is used to detect whether the initial exercise process corresponding to the initial exercise data violates the preset security rules, whether there are process conflicts, and to detect the completeness of the initial exercise process corresponding to the initial exercise data. Then, the generation system updates the initial exercise data based on the review report to obtain the target exercise data.

[0054] Optionally, the generation system automatically generates target exercise data based on the target knowledge graph. This eliminates the reliance on the manual experience and input of financial institution technicians for target exercise data generation. Instead, it uses intelligent parsing of the target knowledge graph to automatically generate target exercise data, thus saving time and manpower costs. Furthermore, the target exercise data generated by the system clearly depicts each process step of the emergency exercise, ensuring the detail and standardization of the exercise process. In addition, since the target knowledge graph contains data such as supervision clauses from L regulatory documents, the final generated exercise data is compliant, avoiding discrepancies between the exercise content and the actual exercise requirements of financial institutions.

[0055] Step S203: Generate a target exercise script based on the target exercise data and a preset script template. The target exercise script is used to characterize the exercise measures that financial institutions will implement based on cyberattack events.

[0056] Optionally, the preset script template refers to the standard format framework designed by financial institutions for pre-designed emergency drills. The template contains a fixed structure and variable positions. The generation system automatically fills the target drill data into the preset script template, thereby quickly obtaining the target drill script.

[0057] Optionally, the target exercise script refers to the specific action plan that a financial institution uses to conduct security exercises in response to a cyberattack incident.

[0058] Optionally, the generation system first matches the target training data in a preset template library to obtain P preset script templates corresponding to the target training data. Each preset script template is used to determine the training actions, training roles, training time, and preset safety rules corresponding to different stages of the training process. Then, the generation system fills the keywords in the target training data into each preset script template to obtain the target training script.

[0059] Optionally, the generation system utilizes a combination of templates and data. Based on target exercise data and preset script templates, it can quickly generate target exercise scripts applicable to corresponding network attack events, accelerating the preparation process for security exercises by financial institutions. The setting of preset script templates ensures the uniformity of the basic structure and format of the final generated target exercise scripts. The addition of target exercise data enables the customization of security exercise scenarios, meeting the needs of different financial institutions for security exercises targeting different network attack events.

[0060] As described above, this application converts the content of the specification document into a structured target knowledge graph. Through the target knowledge graph, the entity information and relationships between entities required for security drills corresponding to network attack events can be automatically captured and understood. Subsequently, this application generates structured data for specific drill processes based on the target knowledge graph, and then automatically outputs customized drill scripts by combining preset script templates. The drill script generation strategy in this application not only reduces the reliance on the professional knowledge of technical personnel in financial institutions, but also automates the generation of drill scripts, thereby improving the speed at which financial institutions conduct security drills.

[0061] Therefore, this application adopts a method of automatically generating target training data based on a pre-built target knowledge graph, achieving the goal of automatically acquiring training data that meets the actual training needs of financial institutions. Based on the nodes and edges in the target knowledge graph, this application can accurately represent the relationship between entities in the security training scenario corresponding to the network attack event. Subsequently, this application automatically fills in the preset script template based on the target training data to obtain the target training script, avoiding the step of requiring technicians to manually fill in the static template in the prior art. This achieves the technical effect of improving the generation efficiency of the target training script corresponding to the security exercise, and thus solves the technical problem of low efficiency in the security exercises conducted by financial institutions in the face of network attack events in the prior art.

[0062] In one optional embodiment, the generation system first performs structuring processing on each of the L specification documents to obtain L structured documents. The structuring processing is used to convert the text data in each specification document into structured data in the structured documents. Then, the generation system performs entity recognition on the L structured documents to obtain M entities, where M is a positive integer. The M entities include at least the regulatory department, response time limit, responsible department, and preset security rules involved in the security exercise. Then, the generation system extracts relationships from the L structured documents to obtain the association relationships between the M entities. Subsequently, the generation system generates a target knowledge graph based on the M entities and the association relationships between the M entities.

[0063] Optionally, structured processing refers to the process of converting unstructured text data in a standardized document into structured data. For example, extracting key information such as "regulatory department" and "response time limit" from a text description and converting it into a data structure in table or JSON (JavaScript Object Notation, a lightweight data exchange format) format to facilitate subsequent calculation, analysis and information retrieval.

[0064] Optionally, the generation system performs structured processing on each of the L specification documents, which can achieve the following:

[0065] (1) Improve data processing speed and accuracy: Through structured processing, the generation system can quickly and accurately identify and extract entity information in the standard document, laying the foundation for subsequent analysis of the relationship between entities.

[0066] (2) Compatible with multi-source heterogeneous documents: L standard documents are allowed to come from different regulatory agencies or financial departments with different document formats. The structured processing can convert standard documents with different original formats into a unified and operable structured form, so that the generation system ignores the differences in the original document formats.

[0067] Optionally, the generation system performs entity recognition on L structured documents to obtain entities corresponding to regulatory departments, response time limits, responsible departments, and preset security rules involved in the security exercise. This provides a data foundation for the construction of nodes in the target knowledge graph. Furthermore, the generation system performs entity recognition based on dimensions such as regulatory departments, response time limits, responsible departments, and preset security rules involved in the security exercise, which improves the richness of the identified entity types. This enables the subsequently constructed target knowledge graph to locate multiple related steps closely related to the emergency exercise, avoiding omissions of exercise scenarios.

[0068] Optionally, the generation system extracts relationships from L structured documents, enabling it to perform compliance checks based on edge information in the target knowledge graph. For example, it checks whether the emergency response steps corresponding to a network attack event comply with the regulatory requirements of relevant oversight clauses, thereby improving the reliability and accuracy of the final generated target exercise script.

[0069] In summary, the generation system generates a target knowledge graph based on M entities and the relationships between them, resulting in a comprehensive and standardized compliance detection framework. This framework enables the generation system to generate compliance target exercise data based on the target knowledge graph, ensuring the accuracy, completeness, and compliance of the exercise content, and improving the financial institution's response capabilities and management level in the face of cyberattacks.

[0070] In one optional embodiment, if the i-th specification document among the L specification documents is in table format, the generation system parses the table in the i-th specification document to obtain the triples corresponding to the i-th specification document, and generates a structured document corresponding to the i-th specification document based on the triples corresponding to the i-th specification document. The triples are used to characterize the application object and response time limit requirements of each preset security rule recorded in the i-th specification document. If the i-th specification document among the L specification documents is in slide format, the system parses the slides in the i-th specification document to obtain the slide titles corresponding to the i-th specification document, and generates a structured document corresponding to the i-th specification document based on the slide titles corresponding to the i-th specification document. The structured data in the structured document includes at least one of the following: semantic tags, original document paragraphs, and paragraph positions.

[0071] Optionally, table-formatted specification documents are automatically recognized as "supervision clauses - applicable objects - time limit requirements" triples; titles and key points in slide-formatted specification documents are automatically mapped as knowledge nodes.

[0072] Optionally, if the i-th specification document among the L specification documents is in table format, the generation system parses the table content in the i-th specification document, converting the table content into triplet form, thereby obtaining the triplet corresponding to the i-th specification document, which facilitates the generation system to quickly process the data of the specification documents.

[0073] Optionally, after generating the triples, the generation system will create a new document in which the information has been reorganized into a structured format, such as JSON or XML (eXtensible Markup Language), to facilitate the analysis and storage of subsequent document data.

[0074] Optionally, if the i-th specification document among the L specification documents is in slide format, the generation system performs slide parsing, that is, identifies key information such as titles and main points in the slides, thereby quickly capturing the data theme in the specification document.

[0075] Optionally, the final structured document includes, in addition to the tabular data in triplet form and the transformed data of the slide titles, semantic tags extracted from the original specification document, the original paragraphs of the document, and the paragraph positions of the original paragraphs in the original document, thereby enhancing the depth and breadth of the generation system's understanding of the specification document.

[0076] In summary, regardless of whether the standard document is in table format or slide format, the generation system can convert it into a structured document, thereby improving the efficiency of subsequent data processing in the standard document and accelerating the preparation process for emergency drills.

[0077] In one optional embodiment, the generation system first parses the exercise document uploaded by the user to obtain initial exercise data of the network attack event. The exercise document is used to record the initial exercise process of the security exercise. Then, the generation system performs a verification operation on the initial exercise data through the target knowledge graph to obtain a review report. The review report includes at least the process defects existing in the initial exercise process, the corresponding correction suggestions for the process defects, and the preset security rules involved in the security exercise. Then, the generation system updates the initial exercise data based on the review report to obtain the target exercise data.

[0078] Optionally, the exercise document refers to a document uploaded by a financial institution user that describes the design of an emergency exercise for a specific cyberattack event. It can be a text report, flowchart, or any other form of written material, and its content covers the basic process of the exercise, the division of roles, and the expected actions.

[0079] Optionally, initial exercise data refers to the preliminary exercise information extracted by the generation system through parsing exercise documents, which includes key elements such as exercise scenarios, participants, timelines, and response steps. However, the data at this stage has not yet undergone compliance review and may contain situations that do not meet regulatory requirements or have incomplete logic.

[0080] Optionally, the generation system parses the exercise documents uploaded by users to obtain initial exercise data of network attack events. This enables the rapid acquisition of substantive information about the exercise process from user-defined exercise documents, reducing the time spent on manual reading and understanding of documents. Regardless of the document format uploaded by the user, the generation system can parse the document based on the file format and convert it into a unified initial exercise data format, which facilitates subsequent intelligent processing and analysis.

[0081] Optionally, the verification operation is at least used to detect whether the initial exercise process corresponding to the initial exercise data violates preset security rules, whether there are process conflicts in the initial exercise process corresponding to the initial exercise data, and the completeness of the initial exercise process corresponding to the initial exercise data through the target knowledge graph.

[0082] Optionally, the generation system verifies the initial exercise data using the target knowledge graph to ensure that the design of the exercise process strictly complies with the relevant regulations for emergency response to cyberattacks in the financial industry, thus avoiding risks caused by violations of the exercise plan. By generating a review report, the generation system can automatically point out logical contradictions and possible omissions in the exercise process, helping users to make timely corrections and improve the completeness and rationality of the exercise plan.

[0083] Optionally, the generation system updates the initial exercise data based on the review report to obtain the target exercise data, forming a closed-loop process from document upload, parsing to verification feedback and data update. This ensures the accuracy of each exercise design, thereby improving the effectiveness and quality of security exercises. After the target exercise data is updated, it not only eliminates potential compliance risks but also increases the depth and breadth of the exercise by refining and expanding the process, making the exercise closer to real exercise needs and strengthening the emergency response capabilities of financial institutions.

[0084] In one alternative embodiment, the verification operation includes at least one of the following:

[0085] The first verification operation is used to detect whether the initial exercise process corresponding to the initial exercise data violates the preset security rules through the target knowledge graph.

[0086] The second verification operation is used to detect whether there are process conflicts in the initial exercise process corresponding to the initial exercise data through the target knowledge graph.

[0087] The third verification operation is used to detect the completeness of the initial exercise process corresponding to the initial exercise data through the target knowledge graph.

[0088] Optionally, by performing the first verification operation, the generation system can automatically identify and block any operations that violate regulatory requirements by comparing the initial drill process with preset security rules, ensuring that the drill content complies with the latest financial industry standards and preventing security errors during actual drills or responses to real attack events.

[0089] Optionally, by performing a second verification operation, the generation system can help financial institutions identify process conflicts, optimize the design of exercise plans, and ensure the logical coordination and feasibility between emergency response measures. This avoids chaotic and invalid operations during exercise execution, and the exercise process after conflict elimination is executed more smoothly, thereby improving the overall efficiency of the exercise and the financial institution's actual protection capabilities against cyberattacks.

[0090] Optionally, the generation system can measure the coverage of the exercise process by performing a third verification operation, so that the exercise design includes all necessary response steps and participants. By assessing the completeness of the process, it can prevent omissions in the exercise, such as unconsidered attack scenarios, unspecified responsible persons, or unset response times, and ensure that the exercise covers all potential risk points as much as possible.

[0091] In summary, by implementing the three verification operations described above, the generation system can improve the compliance, logical continuity, and operational feasibility of the final exercise plan, thereby providing financial institutions with a more comprehensive and efficient means of preparing for cyberattack emergency drills. The aforementioned intelligent exercise planning process can not only accelerate the speed of exercise preparation but also improve the quality of the exercise, enabling financial institutions to respond in an orderly and compliant manner when facing real cybersecurity threats, thereby reducing the impact and losses of attacks.

[0092] In one optional embodiment, the generation system first matches the target training data in a preset template library to obtain P preset script templates corresponding to the target training data, where P is a positive integer. Each preset script template is used to determine the training actions, training roles, training time, and preset safety rules corresponding to different stages of the training process. Then, the generation system fills the keywords in the target training data into the P preset script templates to obtain the target training script.

[0093] Optionally, the generation system can intelligently match the target exercise data in a preset template library, automatically selecting the most suitable script template for the current exercise data. This saves time on manual selection and creation of new templates. After obtaining P preset script templates corresponding to the target exercise data, the system can quickly generate a complete and content-rich emergency exercise script by simply filling in the key information from the exercise data into the corresponding template. The existence of preset script templates simplifies the script creation process and improves the generation speed of the target exercise script.

[0094] Optionally, the generation system fills the keywords from the target exercise data into P preset script templates to obtain the target exercise script. The keyword filling technology enables rapid script customization, and can quickly generate matching emergency exercise scripts even in the face of network attack events of different types or complexities, improving the speed and flexibility of emergency response. Through automated filling, errors or omissions caused by manual filling are reduced, improving the accuracy and reliability of the generated exercise script. During the filling process, the system will also make appropriate fine-tuning and optimization of the template content according to the characteristics of the target exercise data, so that the script fits the actual exercise scenario and enhances the practicality of the final target exercise script.

[0095] In summary, through the above steps, the system not only simplifies the creation process of emergency drill scripts, but also, through template matching and keyword filling, ensures that the accuracy and reliability of the final generated target drill scripts comply with the latest financial industry standards, providing financial institutions with a standardized solution for creating emergency drill scripts.

[0096] In one optional embodiment, the generation system first generates notification information based on the target exercise script and the preset security rules involved in the security exercise. The notification information includes at least the download address of the target exercise script and the viewing link of the preset security rules. After the financial institution receives the notification information, the generation system executes the target exercise script to obtain the execution record of the target exercise script. Then, the generation system updates the target knowledge graph based on the execution record of the target exercise script.

[0097] Optionally, the notification information is generated by the system to notify relevant personnel of financial institutions to begin the exercise. The content includes at least the download address of the target exercise script and the link to view the preset security rules, so as to remind participants to fully understand the exercise details and compliance requirements before the exercise.

[0098] Optionally, the generation system generates notification information based on the target exercise script and the preset security rules involved in the security exercise, which simplifies the exercise initiation process. Participants in the security exercise can quickly obtain all the information required for the exercise through the script download address and rule viewing link in the notification information. In particular, by embedding the link to the preset security rules into the notification information, the generation system helps to improve the compliance awareness and responsiveness of the entire organization, making the exercise process comply with regulatory requirements.

[0099] Optionally, after receiving the notification information, the financial institution executes the target exercise script and obtains the execution record of the target exercise script, which can achieve the following functions:

[0100] (1) Traceability of the exercise process: The automatically collected execution records provide an immutable chain of evidence for the exercise, which facilitates post-event auditing and accountability, and meets the financial industry's requirements for the traceability of exercise records.

[0101] (2) Performance data collection: Execution records can capture key performance indicators in the exercise, such as response time and success rate, providing data support for analyzing the exercise effect and identifying potential improvement points.

[0102] (3) Facilitate compliance verification: By comparing the actual execution process with the preset script, the execution record helps to discover possible compliance differences in the exercise, providing a basis for subsequent updates to the target knowledge graph.

[0103] Optionally, the generation system updates the target knowledge graph based on the execution records of the target exercise script, forming a knowledge accumulation and iteration process. The results of each exercise are used as input for updating the knowledge graph, enabling the target knowledge graph to continuously evolve and accumulate the emergency experience and lessons unique to financial institutions. The exercise scripts generated subsequently will be more accurate and practical.

[0104] As described above, this application converts the content of the specification document into a structured target knowledge graph. Through the target knowledge graph, the entity information and relationships between entities required for security drills corresponding to network attack events can be automatically captured and understood. Subsequently, this application generates structured data for specific drill processes based on the target knowledge graph, and then automatically outputs customized drill scripts by combining preset script templates. The drill script generation strategy in this application not only reduces the reliance on the professional knowledge of technical personnel in financial institutions, but also automates the generation of drill scripts, thereby improving the speed at which financial institutions conduct security drills.

[0105] Therefore, this application adopts a method of automatically generating target training data based on a pre-built target knowledge graph, achieving the goal of automatically acquiring training data that meets the actual training needs of financial institutions. Based on the nodes and edges in the target knowledge graph, this application can accurately represent the relationship between entities in the security training scenario corresponding to the network attack event. Subsequently, this application automatically fills in the preset script template based on the target training data to obtain the target training script, avoiding the step of requiring technicians to manually fill in the static template in the prior art. This achieves the technical effect of improving the generation efficiency of the target training script corresponding to the security exercise, and thus solves the technical problem of low efficiency in the security exercises conducted by financial institutions in the face of network attack events in the prior art.

[0106] In one optional embodiment, a system for orchestrating emergency drills for cyberattack incidents in the financial industry is provided. This system includes: a multimodal document parsing module, a financial emergency knowledge graph construction module, an intelligent scenario generation and review module, a dynamic scenario optimization and storage module, an automatic drill script generation module, a script human-machine collaborative review module, and a drill feedback and knowledge feedback module. This ultimately forms a closed-loop evolution of the system's knowledge base. The specific functions of each module are described below:

[0107] (1) Multimodal document parsing module:

[0108] Input: Financial regulatory documents in different document formats (i.e., L standard documents);

[0109] Processing: Use preset tools to extract text and structure from financial regulatory documents, for example:

[0110] Financial regulatory documents in the form of worksheets are automatically identified as a triplet of "policy clause - applicable objects - time limit requirements";

[0111] In PowerPoint-formatted financial regulatory documents, titles and key points are automatically mapped to knowledge nodes.

[0112] Output: A structured document object containing the original text, paragraph numbers, and semantic tags.

[0113] (2) Financial Emergency Knowledge Graph (FEKG) Construction Module:

[0114] Based on the parsing results from the multimodal document parsing module, perform the following operations:

[0115] Entity identification: Extracting entities such as "regulatory agencies", "responsible time limits", "responsible departments", and "penalty clauses";

[0116] Relationship extraction: Establish entity relationships such as [Clause 5.2] → Requirement → [Response Action: Report to Branch];

[0117] Conflict detection: Automatically detects whether there are contradictions in the descriptions of the same matter in different financial regulatory documents (such as "2 hours" and "4 hours").

[0118] Storage: Supports semantic retrieval (such as "find all reporting requests involving 'payment system'").

[0119] (3) Intelligent Scene Generation and Review Module:

[0120] Input Method 1: Upload a drill document including an emergency description text;

[0121] Input Method 2: Users can manually enter emergency description text in the text box (e.g., "A branch's core database has been encrypted by ransomware").

[0122] Review logic: as shown in List 1 below:

[0123] Table 1

[0124]

[0125] Output: A structured review report, including a list of issues, cited clauses, and suggested revisions.

[0126] (4) Dynamic Scene Optimization and Storage Module:

[0127] Users can revise the entered emergency description text based on the review report (e.g., add: "Database recovery should be initiated within 2 hours") and regenerate a more semantically complete emergency description text.

[0128] The generated emergency description text content supports the following features:

[0129] Reviewability: Each sentence is automatically marked with its source;

[0130] Traceability: Version number, modifier, and timestamp are all recorded;

[0131] Reusability: Supports searching by "institutional level", "attack type", and "regulatory version";

[0132] Storage format: Compatible with financial industry knowledge graph standards.

[0133] (5) Automatic exercise script generation module:

[0134] Input: Approved emergency description text;

[0135] Script generation logic:

[0136] Map emergency description text to financial script templates (i.e., preset script templates, which include five dimensions of information: stage, action, role, time, and compliance basis).

[0137] Here is an example of a financial script template:

[0138] {

[0139] "step":"5",

[0140] "phase":"T+0",

[0141] "action":"Isolate the infected host",

[0142] "responsible":"Security Operations Group A",

[0143] "reference": "Article 7.3 of the 'Security Operation and Maintenance Procedures for Financial Information Systems'"

[0144] }

[0145] Output: Structured exercise script;

[0146] Users can annotate and modify the structured exercise script, such as "add public opinion group intervention at T+15". The system will automatically use the annotation as a new prompt and regenerate a new structured exercise script. The system supports up to 5 rounds of iterative optimization.

[0147] (6) Intelligent generation module for exercise notifications:

[0148] Input: The approved structured exercise script;

[0149] Processing steps: Key information is automatically extracted from the structured exercise script and populated into a standardized notification template. An example of the final financial emergency exercise notification information is shown below:

[0150] [Financial Emergency Drill Notice]:

[0151] Exercise ID: EXE-2025-017;

[0152] Exercise Theme: Emergency Drill for Ransomware Attack on Core Payment System;

[0153] Time: April 15, 2025, 14:00–16:00;

[0154] Scenario based on: ESC-2025-017 (compliant version V3);

[0155] Key actions:

[0156] T+0: Isolate the database server (in accordance with Security Regulations 7.3);

[0157] T+30: Report to the People's Bank of China branch with encryption (in accordance with 5.2 of the Reporting Procedures);

[0158] Attachments: Exercise Script (Download) | Compliance Basis (View).

[0159] Optionally, financial emergency drill notifications can be pushed to multiple channels with one click, and the receipt status can be automatically recorded after sending. "Drill notification delivery certificate" can be exported.

[0160] (7) Exercise Feedback and Knowledge Feedback Module:

[0161] After the exercise was conducted, feedback data was collected through questionnaires, logs, and manual debriefing.

[0162] Generate system analysis and exercise feedback data, and automatically obtain the following statistics:

[0163] 1) Five frequently occurring issues (such as "70% of teams have not started log auditing");

[0164] 2) Knowledge base improvement suggestions (e.g., "It is suggested to add a 'Log audit start' trigger condition to FEKG");

[0165] The system automatically uses the above output as new training samples to incrementally update the node and edge relationships in the FEKG graph, thus forming a positive closed loop of "exercise → feedback → knowledge base correction → graph correction → guidance for the next exercise".

[0166] Example 2

[0167] This application embodiment can also provide a training script generation device. It should be noted that the training script generation device of this application embodiment can be used to execute the training script generation method provided in this application embodiment. The training script generation device provided in this application embodiment will be described below.

[0168] According to an embodiment of this application, an apparatus for implementing the above-described method for generating exercise scripts is also provided. Figure 3 This is a schematic diagram of an optional exercise script generation device according to an embodiment of this application, such as... Figure 3 As shown, the device includes: a map generation unit 301, a data generation unit 302, and a script generation unit 303.

[0169] Optionally, the graph generation unit 301 is used to generate a target knowledge graph based on L specification documents, where L is a positive integer. The nodes in the target knowledge graph are used to represent the entities involved in the security drills conducted by the financial institution in response to network attack events, and the edges in the target knowledge graph are used to represent the relationships between the entities involved in the security drills. The data generation unit 302 is used to generate target drill data based on the target knowledge graph, where the target drill data is used to represent the drill process of the financial institution conducting security drills. The script generation unit 303 is used to generate a target drill script based on the target drill data and a preset script template, where the target drill script is used to represent the drill measures executed by the financial institution based on network attack events.

[0170] In one optional embodiment, the map generation unit 301 includes: a structured processing subunit, an entity recognition subunit, a relation extraction subunit, and a map generation subunit.

[0171] Optionally, the structured processing subunit is used to perform structured processing on each of the L specification documents to obtain L structured documents, wherein the structured processing is used to convert the text data in each specification document into structured data in the structured documents; the entity recognition subunit is used to perform entity recognition on the L structured documents to obtain M entities, wherein M is a positive integer, and the M entities include at least the regulatory department, response time limit, responsible department, and preset security rules involved in the security exercise; the relation extraction subunit is used to extract relations from the L structured documents to obtain the association relationships between the M entities; and the graph generation subunit is used to generate a target knowledge graph based on the M entities and the association relationships between the M entities.

[0172] In one optional embodiment, the structured processing subunit includes a table parsing module and a slide parsing module.

[0173] Optionally, the table parsing module is used to parse the table in the i-th specification document when the i-th specification document is in table format among the L specification documents, to obtain the triples corresponding to the i-th specification document, and to generate a structured document corresponding to the i-th specification document based on the triples corresponding to the i-th specification document. The triples are used to represent the application object and response time limit requirements of each preset security rule recorded in the i-th specification document. The slide parsing module is used to parse the slides in the i-th specification document when the i-th specification document is in slide format among the L specification documents, to obtain the slide titles corresponding to the i-th specification document, and to generate a structured document corresponding to the i-th specification document based on the slide titles corresponding to the i-th specification document. The structured data in the structured document is at least one of the following: semantic tags, original document paragraphs, and paragraph positions.

[0174] In one optional embodiment, the data generation unit 302 includes: a document parsing subunit, a verification subunit, and an update subunit.

[0175] Optionally, the document parsing subunit is used to parse the exercise document uploaded by the user to obtain the initial exercise data of the network attack event, wherein the exercise document is used to record the initial exercise process of the security exercise; the verification subunit is used to verify the initial exercise data through the target knowledge graph to obtain a review report, wherein the review report includes at least the process defects existing in the initial exercise process, the corresponding correction suggestions for the process defects, and the preset security rules involved in the security exercise; the update subunit is used to update the initial exercise data based on the review report to obtain the target exercise data.

[0176] In one optional embodiment, the verification operation in the verification subunit includes at least one of the following:

[0177] The first verification operation is used to detect whether the initial exercise process corresponding to the initial exercise data violates the preset security rules through the target knowledge graph.

[0178] The second verification operation is used to detect whether there are process conflicts in the initial exercise process corresponding to the initial exercise data through the target knowledge graph.

[0179] The third verification operation is used to detect the completeness of the initial exercise process corresponding to the initial exercise data through the target knowledge graph.

[0180] In an optional embodiment, the script generation unit 303 includes a template matching subunit and a template filling subunit.

[0181] Optionally, the template matching subunit is used to match the target training data in a preset template library to obtain P preset script templates corresponding to the target training data, where P is a positive integer. Each preset script template is used to determine the training actions, training roles, training time, and preset safety rules corresponding to different stages of the training process. The template filling subunit is used to fill the keywords in the target training data into the P preset script templates to obtain the target training script.

[0182] In one optional embodiment, the exercise script generation device further includes: an information generation unit, a script execution unit, and a map update unit.

[0183] Optionally, the information generation unit is used to generate notification information based on the target exercise script and the preset security rules involved in the security exercise, wherein the notification information includes at least the download address of the target exercise script and the viewing link of the preset security rules; the script execution unit is used to execute the target exercise script after the financial institution receives the notification information to obtain the execution record of the target exercise script; and the graph update unit is used to update the target knowledge graph based on the execution record of the target exercise script.

[0184] As described above, this application converts the content of the specification document into a structured target knowledge graph. Through the target knowledge graph, the entity information and relationships between entities required for security drills corresponding to network attack events can be automatically captured and understood. Subsequently, this application generates structured data for specific drill processes based on the target knowledge graph, and then automatically outputs customized drill scripts by combining preset script templates. The drill script generation strategy in this application not only reduces the reliance on the professional knowledge of technical personnel in financial institutions, but also automates the generation of drill scripts, thereby improving the speed at which financial institutions conduct security drills.

[0185] Therefore, this application adopts a method of automatically generating target training data based on a pre-built target knowledge graph, achieving the goal of automatically acquiring training data that meets the actual training needs of financial institutions. Based on the nodes and edges in the target knowledge graph, this application can accurately represent the relationship between entities in the security training scenario corresponding to the network attack event. Subsequently, this application automatically fills in the preset script template based on the target training data to obtain the target training script, avoiding the step of requiring technicians to manually fill in the static template in the prior art. This achieves the technical effect of improving the generation efficiency of the target training script corresponding to the security exercise, and thus solves the technical problem of low efficiency in the security exercises conducted by financial institutions in the face of network attack events in the prior art.

[0186] It should be noted that the map generation unit 301, data generation unit 302, and script generation unit 303 mentioned above correspond to steps S201 to S203 in the method embodiment. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of the device and run in the computer terminal 10 provided in the embodiment.

[0187] Example 3

[0188] Embodiments of this application can also provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application, such as... Figure 4 As shown, the electronic device includes: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0189] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and devices in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the above-mentioned method for generating exercise scripts.

[0190] The memory may include high-speed random access memory (RAM), and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, which can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks (LANs), mobile communication networks, and combinations thereof.

[0191] The processor can access information and applications stored in memory via a transmission device to execute the following steps: Generate a target knowledge graph based on L specification documents, where L is a positive integer; nodes in the target knowledge graph represent entities involved in security drills conducted by the financial institution in response to cyberattacks; edges in the target knowledge graph represent the relationships between entities involved in the security drills; generate target drill data based on the target knowledge graph, where the target drill data represents the drill process conducted by the financial institution in response to cyberattacks; generate a target drill script based on the target drill data and a preset script template, where the target drill script represents the drill measures executed by the financial institution based on cyberattacks.

[0192] The processor can access information and applications stored in memory via a transmission device to perform the following steps: performing structured processing on each of the L specification documents to obtain L structured documents, wherein the structured processing converts text data in each specification document into structured data in the structured documents; performing entity recognition on the L structured documents to obtain M entities, where M is a positive integer, and the M entities include at least the regulatory department, response time limit, responsible department, and preset security rules involved in the security exercise; extracting relationships from the L structured documents to obtain the association relationships between the M entities; and generating a target knowledge graph based on the M entities and the association relationships between them.

[0193] The processor can invoke information and applications stored in memory via a transmission device to perform the following steps: If the i-th specification document among L specification documents is in table format, parse the table in the i-th specification document to obtain the triples corresponding to the i-th specification document; generate a structured document corresponding to the i-th specification document based on the triples corresponding to the i-th specification document, wherein the triples are used to characterize the application object and response time limit requirements of each preset security rule recorded in the i-th specification document; If the i-th specification document among L specification documents is in slide format, parse the slides in the i-th specification document to obtain the slide titles corresponding to the i-th specification document; generate a structured document corresponding to the i-th specification document based on the slide titles corresponding to the i-th specification document, wherein the structured data in the structured document is at least one of the following: semantic tags, original document paragraphs, and paragraph positions.

[0194] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: parse the exercise document uploaded by the user to obtain initial exercise data for the network attack event, wherein the exercise document is used to record the initial exercise process of the security exercise; verify the initial exercise data through the target knowledge graph to obtain an audit report, wherein the audit report includes at least the process defects existing in the initial exercise process, the corresponding correction suggestions for the process defects, and the preset security rules involved in the security exercise; update the initial exercise data based on the audit report to obtain the target exercise data.

[0195] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: a first verification operation, used to detect whether the initial exercise process corresponding to the initial exercise data violates the preset security rules through the target knowledge graph; a second verification operation, used to detect whether there is a process conflict in the initial exercise process corresponding to the initial exercise data through the target knowledge graph; and a third verification operation, used to detect the completeness of the initial exercise process corresponding to the initial exercise data through the target knowledge graph.

[0196] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: matching the target training data in the preset template library to obtain P preset script templates corresponding to the target training data, where P is a positive integer, and each preset script template is used to determine the training actions, training roles, training time and preset safety rules corresponding to different stages of the training process; filling the keywords in the target training data into the P preset script templates to obtain the target training script.

[0197] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: generating notification information based on the target exercise script and the preset security rules involved in the security exercise, wherein the notification information includes at least the download address of the target exercise script and the viewing link of the preset security rules; after the financial institution receives the notification information, it executes the target exercise script to obtain the execution record of the target exercise script; and updates the target knowledge graph based on the execution record of the target exercise script.

[0198] This application provides a scheme for generating exercise scripts. It converts the content of a specification document into a structured target knowledge graph. This target knowledge graph automatically captures and understands the entity information and relationships between entities required for security exercise scenarios corresponding to network attack events. Subsequently, based on the target knowledge graph, this application generates structured data for specific exercise procedures. Combined with preset script templates, it automatically outputs customized exercise scripts. This exercise script generation strategy not only reduces reliance on the professional knowledge of technical personnel in financial institutions but also automates exercise script generation, thereby improving the speed at which financial institutions conduct security exercises.

[0199] Therefore, this application adopts a method of automatically generating target training data based on a pre-built target knowledge graph, achieving the goal of automatically acquiring training data that meets the actual training needs of financial institutions. Based on the nodes and edges in the target knowledge graph, this application can accurately represent the relationship between entities in the security training scenario corresponding to the network attack event. Subsequently, this application automatically fills in the preset script template based on the target training data to obtain the target training script, avoiding the step of requiring technicians to manually fill in the static template in the prior art. This achieves the technical effect of improving the generation efficiency of the target training script corresponding to the security exercise, and thus solves the technical problem of low efficiency in the security exercises conducted by financial institutions in the face of network attack events in the prior art.

[0200] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, PDAs, mobile internet devices, PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0201] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0202] Example 4

[0203] Embodiments of this application may also provide a storage medium.

[0204] Optionally, in this embodiment of the application, the storage medium can be used to store the program code executed by the method for generating the exercise script provided in the above method embodiment.

[0205] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0206] This application also provides a computer program product that, when executed on a data processing device, is adapted to perform the steps of a method for generating a training script.

[0207] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0208] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0209] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0210] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0211] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0212] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0213] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for generating a practice script, characterized in that, include: A target knowledge graph is generated based on L specification documents, where L is a positive integer. The nodes in the target knowledge graph are used to represent the entities involved in the security drills conducted by financial institutions for network attack events, and the edges in the target knowledge graph are used to represent the relationships between the entities involved in the security drills. Target training data is generated based on the target knowledge graph, wherein the target training data is used to characterize the training process of the financial institution conducting the security exercise; A target exercise script is generated based on the target exercise data and a preset script template. The target exercise script is used to characterize the exercise measures executed by the financial institution based on the network attack event.

2. The method for generating exercise scripts according to claim 1, characterized in that, Generate a target knowledge graph based on L canonical documents, including: Each of the L specification documents is subjected to structuring processing to obtain L structured documents, wherein the structuring processing is used to convert the text data in each specification document into structured data in the structured documents; Entity recognition is performed on the L structured documents to obtain M entities, where M is a positive integer. The M entities include at least the regulatory department, response time limit, responsible department, and preset security rules involved in the security exercise. Relationships are extracted from the L structured documents to obtain the association relationships between the M entities; The target knowledge graph is generated based on the M entities and the relationships between them.

3. The method for generating exercise scripts according to claim 2, characterized in that, Each of the L specification documents is processed into a structured document to obtain L structured documents, including: If the i-th specification document among the L specification documents is in table format, the table in the i-th specification document is parsed to obtain the triple corresponding to the i-th specification document. Based on the triple corresponding to the i-th specification document, a structured document corresponding to the i-th specification document is generated. The triple is used to characterize the application object and response time limit requirements of each preset security rule recorded in the i-th specification document. If the i-th specification document among the L specification documents is in slide format, the slides in the i-th specification document are parsed to obtain the slide titles corresponding to the i-th specification document. Based on the slide titles corresponding to the i-th specification document, a structured document corresponding to the i-th specification document is generated, wherein the structured data in the structured document is at least one of the following: Semantic tags, original text paragraphs, and paragraph positions.

4. The method for generating exercise scripts according to claim 1, characterized in that, Target training data is generated based on the target knowledge graph, including: The exercise documents uploaded by the user are parsed to obtain the initial exercise data of the network attack event, wherein the exercise documents are used to record the initial exercise process of the security exercise; The initial training data is verified using the target knowledge graph to obtain a review report, which includes at least the process defects existing in the initial training process, the correction suggestions corresponding to the process defects, and the preset security rules involved in the security exercise. The initial training data is updated based on the review report to obtain the target training data.

5. The method for generating exercise scripts according to claim 4, characterized in that, The initial training data is validated using the target knowledge graph, wherein the validation operation includes at least one of the following: The first verification operation is used to detect whether the initial exercise process corresponding to the initial exercise data violates preset security rules through the target knowledge graph. The second verification operation is used to detect whether there is a process conflict in the initial exercise process corresponding to the initial exercise data through the target knowledge graph. The third verification operation is used to detect the completeness of the initial exercise process corresponding to the initial exercise data through the target knowledge graph.

6. The method for generating exercise scripts according to claim 1, characterized in that, Generate a target training script based on the target training data and the preset script template, including: Based on the target training data, a matching process is performed in a preset template library to obtain P preset script templates corresponding to the target training data, where P is a positive integer. Each preset script template is used to determine the training actions, training roles, training time, and preset safety rules corresponding to different stages of the training process. The keywords in the target training data are filled into the P preset script templates to obtain the target training script.

7. The method for generating exercise scripts according to claim 1, characterized in that, After generating the target training script based on the target training data and the preset script template, the method for generating the training script further includes: A notification message is generated based on the target exercise script and the preset security rules involved in the security exercise, wherein the notification message includes at least the download address of the target exercise script and the viewing link of the preset security rules; After receiving the notification information, the financial institution executes the target exercise script and obtains the execution record of the target exercise script; The target knowledge graph is updated based on the execution records of the target training script.

8. A device for generating exercise scripts, characterized in that, include: The graph generation unit is used to generate a target knowledge graph based on L specification documents, where L is a positive integer. The nodes in the target knowledge graph are used to represent the entities involved in the security drills conducted by financial institutions for network attack events, and the edges in the target knowledge graph are used to represent the relationships between the entities involved in the security drills. A data generation unit is used to generate target exercise data based on the target knowledge graph, wherein the target exercise data is used to characterize the exercise process of the financial institution conducting the security exercise; The script generation unit is used to generate a target exercise script based on the target exercise data and a preset script template, wherein the target exercise script is used to characterize the exercise measures executed by the financial institution based on the network attack event.

9. A computer program product, characterized in that, The computer program product includes a computer program, wherein, when the computer program is executed, it controls the computer program product to perform the exercise script generation method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method for generating exercise scripts according to any one of claims 1 to 7.

Images