Automated threat detection and response method and system based on zero trust architecture

Abstract

The application discloses an automatic threat detection and response method and system based on a zero-trust architecture, relates to the technical field of network security, and discloses the automatic threat detection and response method and system based on the zero-trust architecture, which acquires multi-source security data, performs standardization processing, constructs a behavior baseline and an anomaly detection model, executes risk quantification, decides a response strategy, monitors execution effects and feeds back an optimization model, solves the problems of narrow detection dimension, rigid response and lack of feedback mechanism in the prior art, can effectively cope with highly dynamic network attacks, realizes closed-loop optimization and improves the security protection capability of the zero-trust architecture.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to an automated threat detection and response method and system based on a zero-trust architecture. Background Technology

[0002] In the actual deployment of zero-trust network security architecture, automated threat detection and response mechanisms are a core component to ensure the secure operation of the system. Currently, the industry's commonly used technical solutions mainly rely on static security rule bases or single-type data analysis models to perform abnormal behavior identification tasks. While these methods can be effective in handling structured and known attack patterns, their inherent shortcomings become particularly prominent when facing highly dynamic and multi-stage modern cyberattacks. Specifically, rule-based detection mechanisms are limited by the coverage of the rule base and cannot effectively deal with unknown attack variants; while solutions based on isolated machine learning models often focus only on the analysis of a single data source, such as network traffic characteristics or user login behavior, resulting in overly narrow detection dimensions and an inability to comprehensively capture the correlations between user, device, and network behaviors. This fragmented analysis approach severely limits the system's ability to perceive the context, making it unable to accurately identify complex threats formed by the interweaving of multiple attack vectors, such as the multi-stage penetration behavior commonly found in advanced persistent threats.

[0003] Furthermore, in existing technologies, threat detection and response execution are typically designed as independent modules, lacking real-time data interaction and dynamic policy adjustment capabilities. After detection results are generated, response operations often rely on predefined, fixed procedures, failing to adapt to the real-time evolution of threats. Simultaneously, the system lacks an effective feedback mechanism, failing to utilize historical response data for continuous optimization of detection models and decision-making logic, leading to response delays and policy rigidity when dealing with new types of attacks. This fragmented architectural design results in significant adaptability deficiencies in the overall security protection system within complex network environments, making it difficult to meet the dynamic verification and continuous monitoring requirements of a zero-trust architecture.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide an automated threat detection and response method and system based on a zero-trust architecture, which aims to improve the security protection capabilities of the zero-trust architecture.

[0006] To achieve the above objectives, this application proposes an automated threat detection and response method based on a zero-trust architecture, the method comprising: Acquire multi-source security data and perform standardization processing on the multi-source security data to obtain a standardized security data stream; The standardized security data stream is subjected to behavioral baseline modeling to obtain a behavioral baseline model, and anomaly detection processing is performed to obtain an anomaly detection model. Preliminary threat detection result data is obtained based on the behavioral baseline model and the anomaly detection model. The preliminary threat detection results are subjected to risk quantification and priority ranking to obtain quantitative threat risk assessment results. Based on the quantitative threat risk assessment results, response strategy decision processing is performed through a pre-trained response strategy decision model to obtain response execution instruction data; Execute automated response operations based on the response execution instruction data, monitor the response execution effect, and obtain response effect feedback data; The response effect feedback data is fed back to the behavior baseline model, the anomaly detection model, and the pre-trained response strategy decision model for model optimization and update.

[0007] In one embodiment, the steps of performing behavioral baseline modeling on the standardized security data stream to obtain a behavioral baseline model, and performing anomaly detection processing to obtain an anomaly detection model, and obtaining preliminary threat detection result data based on the behavioral baseline model and the anomaly detection model, include: Extract user behavior feature data, device behavior feature data, and network behavior feature data from the standardized security data stream; A dynamic behavior baseline model is constructed based on historical normal data. The dynamic behavior baseline model includes user behavior baseline data, device behavior baseline data, and network behavior baseline data. The user behavior feature data is compared with the user behavior baseline data in a first comparison process to obtain user behavior deviation data; the device behavior feature data is compared with the device behavior baseline data in a second comparison process to obtain device behavior deviation data; the network behavior feature data is compared with the network behavior baseline data in a third comparison process to obtain network behavior deviation data. Based on the user behavior deviation data, the device behavior deviation data, and the network behavior deviation data, a comprehensive anomaly analysis is performed using an anomaly detection model to obtain the preliminary threat detection result data.

[0008] In one embodiment, the step of obtaining the preliminary threat detection result data by performing comprehensive anomaly analysis processing through an anomaly detection model based on the user behavior deviation data, the device behavior deviation data, and the network behavior deviation data includes: The user behavior deviation data, the device behavior deviation data, and the network behavior deviation data are fused in multiple dimensions to obtain fused deviation data. The fusion deviation data is subjected to threshold judgment processing. When the fusion deviation data exceeds the preset abnormal threshold data, abnormal marker data is generated. Based on the anomaly marker data, extract the corresponding threat feature data from the standardized security data stream; The threat feature data is matched and compared with the pre-trained threat feature matching model to obtain the preliminary threat detection result data.

[0009] In one embodiment, the step of performing risk quantification and priority ranking processing on the preliminary threat detection result data to obtain quantified threat risk assessment result data includes: The preliminary threat detection results are processed to assess the threat severity, resulting in a threat severity score. The preliminary threat detection results are processed to assess threat confidence, resulting in threat confidence score data. Obtain the current environmental context data, perform environmental sensitivity assessment processing on the current environmental context data, and obtain environmental sensitivity score data; The threat severity score data, the threat confidence score data, and the environmental sensitivity score data are weighted and comprehensively calculated to obtain the comprehensive risk score data. The comprehensive risk score data is sorted to obtain the quantitative threat risk assessment result data.

[0010] In one embodiment, the step of performing threat severity assessment processing on the preliminary threat detection result data to obtain threat severity score data includes: From the preliminary threat detection results, extract attack type data, affected resource data, potential impact range data, and attack duration data; Based on the pre-trained threat type severity assessment model, determine the basic severity score data corresponding to the attack type data; Based on the affected resource data, the potential impact range data, and the attack duration data, calculate the impact degree correction coefficient; The threat severity score data is obtained by multiplying the basic severity score data with the impact correction coefficient.

[0011] In one embodiment, the step of obtaining response execution instruction data by performing response strategy decision processing through a pre-trained response strategy decision model based on the quantitative threat risk assessment result data includes: The quantitative threat risk assessment results are input into the pre-trained response strategy decision model to obtain security status description data. Based on the security status description data and historical response effect data, a pre-trained strategy selection model is used to select the optimal response strategy data. Based on the preferred response strategy data and the currently available resource data, the response execution instruction data is generated through a pre-trained action generation model.

[0012] In one embodiment, the step of obtaining preferred response strategy data by performing response strategy selection processing through a pre-trained strategy selection model based on the security status description data and historical response effect data includes: Extract threat type feature data, risk level feature data, affected resource feature data, and attack time feature data from the security status description data; Retrieve historical case data from the historical response effect data that are similar to the threat type feature data, the risk level feature data, the affected resource feature data, and the attack time feature data; The retrieved historical case data is processed for effect analysis to extract the actual effect data of each response strategy; Based on the actual effect data, the optimal response strategy data is obtained by performing strategy selection processing through a pre-trained strategy optimization model.

[0013] In one embodiment, the steps of executing an automated response operation based on the response execution instruction data and monitoring the response execution effect to obtain response effect feedback data include: The response execution instruction data is distributed to at least one response execution unit to obtain distribution confirmation data; Each of the response execution units performs a specific response operation based on the received response execution instruction data, and obtains operation execution status data; After executing the response operation, monitor the changes in threat situation to obtain threat situation change monitoring data; Monitor the impact on business systems to obtain business impact assessment data, and monitor system resource consumption to obtain resource consumption statistics. The threat situation change monitoring data, the business impact assessment data, and the resource consumption statistics are integrated and processed to obtain the response effect feedback data.

[0014] In one embodiment, the step of feeding back the response effect feedback data to the behavior baseline model, the anomaly detection model, and the pre-trained response strategy decision model for model optimization and update includes: The response feedback data is analyzed and processed to obtain model optimization parameters; The model optimization parameters are divided into detection model optimization parameters and decision model optimization parameters; The optimization parameters of the detection model are input into the behavior baseline model and the anomaly detection model. The parameters of the behavior baseline model and the anomaly detection model are adjusted to obtain the updated behavior baseline model and the updated anomaly detection model. The optimization parameters of the decision model are input into the pre-trained response strategy decision model to update the decision weight parameters and strategy selection rule parameters of the response strategy decision model, thereby obtaining the updated pre-trained response strategy decision model.

[0015] Furthermore, to achieve the above objectives, this application also proposes an automated threat detection and response system based on a zero-trust architecture. The automated threat detection and response system based on a zero-trust architecture includes: a memory, a processor, and an automated threat detection and response program based on a zero-trust architecture stored in the memory and executable on the processor. The automated threat detection and response program based on a zero-trust architecture is configured to implement the steps of the automated threat detection and response method based on a zero-trust architecture.

[0016] The automated threat detection and response method and system based on zero-trust architecture proposed in this application solves the problems of narrow detection dimensions, rigid response and lack of feedback mechanism in the prior art by acquiring multi-source security data, performing standardized processing, building behavioral baselines and anomaly detection models, performing risk quantification, deciding on response strategies, monitoring the execution effect and providing feedback to optimize the model. It can effectively cope with highly dynamic network attacks, achieve closed-loop optimization and improve the security protection capability of zero-trust architecture. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating an embodiment of the automated threat detection and response method based on a zero-trust architecture according to this application. Figure 2 This is a schematic diagram of an embodiment of the automated threat detection and response system based on a zero-trust architecture according to this application.

[0020] Explanation of icon numbers: 10. Memory; 20. Processor.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] The technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of this application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0023] It should be understood that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0024] In existing technologies, threat detection and response methods in zero-trust network security architectures typically employ rule-based behavioral analysis or single machine learning models. When facing complex and ever-changing network attacks, these methods suffer from limitations such as limited detection dimensions, weak context awareness, and difficulty in accurately identifying and assessing complex threats. Furthermore, the detection and response processes are fragmented, lacking a dynamic adjustment and self-optimization closed-loop intelligent decision-making mechanism, resulting in delayed system response and insufficient adaptability.

[0025] Based on this, embodiments of this application provide an automated threat detection and response method based on a zero-trust architecture, referring to... Figure 1 The automated threat detection and response method based on zero-trust architecture includes steps S100 to S600, wherein: Step S100: Obtain multi-source security data and perform standardization processing on the multi-source security data to obtain a standardized security data stream; Step S200: Perform behavioral baseline modeling on the standardized security data stream to obtain a behavioral baseline model, and perform anomaly detection processing to obtain an anomaly detection model. Based on the behavioral baseline model and the anomaly detection model, obtain preliminary threat detection result data. Step S300: Perform risk quantification and priority sorting on the preliminary threat detection result data to obtain quantitative threat risk assessment result data; Step S400: Based on the quantitative threat risk assessment result data, the response strategy decision processing is performed through the pre-trained response strategy decision model to obtain response execution instruction data; Step S500: Execute automated response operations according to the response execution instruction data, monitor the response execution effect, and obtain response effect feedback data; Step S600: Feedback the response effect data to the behavior baseline model, the anomaly detection model, and the pre-trained response strategy decision model for model optimization and update.

[0026] In this embodiment, multi-source security data refers to various security-related information collected from different security devices, systems, or applications, such as log data, network traffic data, terminal behavior data, and identity authentication data. This data provides the foundation for a comprehensive understanding of the system's security posture. Standardized security data streams refer to a collection of security data that has undergone unified format conversion, cleaning, and deduplication. Through standardization, security data from different sources and in different formats can be analyzed and processed uniformly, improving data utilization efficiency. A behavioral baseline model is a reference model describing the normal behavior patterns of a system, user, or device, established by learning and modeling historical normal behavior data. This model is used to identify deviations from normal behavior patterns. An anomaly detection model is a model used to identify behaviors or events that deviate from the behavioral baseline model. This model analyzes data characteristics to determine whether there are potential threats or abnormal activities. A pre-trained response strategy decision model is a model trained on a large number of historical threat events and response cases. This model can intelligently select or generate appropriate security response strategies based on the current threat posture and risk assessment results.

[0027] In this embodiment, the acquisition of multi-source security data can be achieved by the data acquisition module through a configuration interface or proxy program. For example, it can receive log data by configuring a Syslog server or capture network traffic through a network probe. Subsequently, the acquired multi-source security data is standardized. For example, logs of different formats can be uniformly converted into JSON format using preset parsing rules, or common metadata fields can be extracted from network traffic data of different protocols. This results in a standardized security data stream with a unified format, facilitating subsequent analysis and processing.

[0028] Furthermore, behavioral baseline modeling is performed on this standardized security data stream. For example, statistical methods can be used to analyze historical data, calculate the average and standard deviation of various indicators, and form a static behavioral baseline model. Simultaneously, simple rule-based matching can be used for anomaly detection; for instance, when an indicator exceeds a preset fixed threshold, it is marked as an anomaly. Based on this behavioral baseline model and anomaly detection model, events that deviate from normal patterns can be preliminarily identified, thus obtaining preliminary threat detection results.

[0029] Based on this, the preliminary threat detection results are processed for risk quantification and priority ranking. For example, a fixed risk value can be preset for each detected anomaly type, and the data can be simply ranked according to this risk value. In this way, a preliminary risk assessment can be performed on the initially detected threats, obtaining quantitative threat risk assessment results to facilitate subsequent decision-making.

[0030] In this embodiment, the response strategy decision is then processed based on the quantitative threat risk assessment results using a pre-trained response strategy decision model. For example, this model could be a rule-based expert system that searches a predefined response rule base based on the input risk assessment results and matches the corresponding response action. This generates specific response execution instruction data, such as instructions like "isolate the host" or "block the IP."

[0031] In this embodiment, automated response operations are executed based on the response execution instruction data. For example, the instruction can be directly sent to execution devices such as firewalls, intrusion prevention systems, or endpoint security agents, which then execute the corresponding security operations according to the instruction. After the response operation is executed, the effectiveness of the response execution needs to be monitored. For example, the logs of the relevant systems can be manually checked to confirm whether the instruction was executed and whether the system status has changed. In this way, response effectiveness feedback data can be obtained.

[0032] In this embodiment, the response feedback data is finally fed back to the behavioral baseline model, the anomaly detection model, and the pre-trained response strategy decision model for model optimization and updates. For example, the feedback data can be manually analyzed, and the model parameters or rules can be adjusted based on the analysis results. Through this iterative process, the model can adapt to new threat environments, improving the accuracy of detection and response.

[0033] In this embodiment, by integrating and standardizing multi-source security data, a behavioral baseline and anomaly detection model are constructed, enabling a more comprehensive understanding of the system's security posture. By quantifying the risks and prioritizing the initial threat detection results, accurate threat assessment is achieved. Furthermore, automated responses are implemented based on a pre-trained response strategy decision model, and the model is optimized and updated based on response feedback. This effectively solves the problems of single detection dimensions, delayed response, and lack of adaptive closed-loop mechanisms in traditional solutions, improving the automation level and adaptability of threat detection and response under a zero-trust architecture.

[0034] In one feasible implementation, the steps of performing behavioral baseline modeling on the standardized security data stream to obtain a behavioral baseline model, and performing anomaly detection processing to obtain an anomaly detection model, and obtaining preliminary threat detection result data based on the behavioral baseline model and the anomaly detection model include: extracting user behavior feature data, device behavior feature data, and network behavior feature data from the standardized security data stream; constructing a dynamic behavioral baseline model based on historical normal data, the dynamic behavioral baseline model including user behavior baseline data, device behavior baseline data, and network behavior baseline data; performing a first comparison processing between the user behavior feature data and the user behavior baseline data to obtain user behavior deviation data; performing a second comparison processing between the device behavior feature data and the device behavior baseline data to obtain device behavior deviation data; performing a third comparison processing between the network behavior feature data and the network behavior baseline data to obtain network behavior deviation data; and performing comprehensive anomaly analysis processing through the anomaly detection model based on the user behavior deviation data, the device behavior deviation data, and the network behavior deviation data to obtain the preliminary threat detection result data.

[0035] In this embodiment, extracting user behavior feature data, device behavior feature data, and network behavior feature data from the standardized security data stream is the foundation for achieving fine-grained threat detection. User behavior feature data can cover user login time, location, accessed resources, operation frequency, and permission usage; device behavior feature data can include device type, operating system version, patch status, network connection status, running processes, and resource utilization; network behavior feature data can involve traffic patterns, protocol usage, connection targets, data transmission volume, and packet characteristics. This feature data can be parsed and extracted from the standardized security data stream in real-time or near real-time using various sensors, log collectors, and traffic analysis tools deployed at the network, terminal, and application layers. For example, user behavior features can be obtained by analyzing authentication logs and application access logs; device behavior features can be obtained through terminal agent and asset management system logs; and network behavior features can be obtained through firewall logs, intrusion detection system / intrusion prevention system logs, and traffic mirroring data.

[0036] Based on this, a dynamic behavior baseline model is constructed using historical normal data. This dynamic behavior baseline model includes user behavior baseline data, device behavior baseline data, and network behavior baseline data. The dynamic behavior baseline model serves as a reference standard for identifying abnormal behavior; it is built by continuously learning and adapting to historical "normal" behavior patterns. Its dynamism is reflected in the baseline model's ability to adaptively adjust to changes in time, environment, and the evolution of user, device, and network behavior patterns. This model can be constructed using various machine learning algorithms. For example, statistical analysis methods (such as mean, variance, and percentiles) can be used to describe the normal range of behavior; time series analysis models (such as ARIMA and exponential smoothing) can be used to predict future normal behavior; clustering algorithms (such as K-means and DBSCAN) or neural networks (such as Long Short-Term Memory networks (LSTM) and autoencoders) can be used to learn complex normal behavior patterns. The system continuously collects normal behavior data over a period of time and periodically updates the baseline model to ensure it accurately reflects the normal state in the current environment. User behavior baseline data describes the typical operating patterns and habits of a specific user or user group; device behavior baseline data describes the typical operating status and resource usage patterns of a specific device or device group; and network behavior baseline data describes the typical traffic patterns and communication behaviors of a specific network area or the entire network.

[0037] Further, the user behavior feature data is compared with the user behavior baseline data in a first comparison process to obtain user behavior deviation data; the device behavior feature data is compared with the device behavior baseline data in a second comparison process to obtain device behavior deviation data; and the network behavior feature data is compared with the network behavior baseline data in a third comparison process to obtain network behavior deviation data. This series of comparison processes is the core of anomaly detection, aiming to quantify the degree of difference between real-time or near-real-time behavior features and the established normal behavior baseline. The comparison processes can employ various mathematical and statistical methods, such as calculating Euclidean distance, Mahalanobis distance, or cosine similarity to measure the degree of deviation between feature data and baseline data; for statistically based baselines, the standard deviation multiple of the current value from the baseline mean can be calculated; for time-series based baselines, the next value can be predicted and compared with the actual value to calculate the prediction error. The first, second, and third comparison processes can be executed in parallel, independently calculating the deviation data for each of the three dimensions: user, device, and network, providing a quantitative basis for subsequent comprehensive analysis.

[0038] Based on this, using the user behavior deviation data, device behavior deviation data, and network behavior deviation data, a comprehensive anomaly analysis is performed through an anomaly detection model to obtain the preliminary threat detection results. This step aims to integrate deviation data from different dimensions for comprehensive anomaly judgment to generate preliminary threat detection results. Comprehensive anomaly analysis can discover complex anomalies that are difficult to detect from a single dimension. For example, a user's behavior deviation may be low, but combined with slight deviations in their device and network behaviors, they may all point to a potential threat. The anomaly detection model can employ various techniques, such as rule-based expert systems, statistical anomaly detection methods (e.g., Z-score, IQR), machine learning algorithms (e.g., Isolation Forest, One-Class SVM, Autoencoder), or deep learning models. The model receives user behavior deviation data, device behavior deviation data, and network behavior deviation data as input, and uses internal logic or a trained model to determine whether these deviations constitute an anomaly event, outputting preliminary threat detection results data, such as anomaly score, anomaly type, or anomaly event ID.

[0039] In this embodiment, through the above technical solution, this application refines the traditional behavioral baseline modeling and anomaly detection process into the independent extraction, baseline construction, and deviation comparison of user, device, and network behavioral characteristics. This multi-dimensional, fine-grained analysis method can more accurately capture subtle or compound anomalies in user, device, and network behavior in a zero-trust environment, effectively avoiding the blind spots of single-dimensional detection. By conducting comprehensive anomaly analysis on user behavior deviation data, device behavior deviation data, and network behavior deviation data, this application can more comprehensively and accurately identify potential threat activities, thereby improving the accuracy and reliability of preliminary threat detection results data and providing a solid foundation for subsequent risk quantification and response decisions.

[0040] In one feasible implementation, the step of obtaining the preliminary threat detection result data by performing comprehensive anomaly analysis processing through an anomaly detection model based on the user behavior deviation data, the device behavior deviation data, and the network behavior deviation data includes: performing multi-dimensional fusion processing on the user behavior deviation data, the device behavior deviation data, and the network behavior deviation data to obtain fused deviation data; performing threshold judgment processing on the fused deviation data, and generating anomaly marker data when the fused deviation data exceeds a preset anomaly threshold data; extracting corresponding threat feature data from the standardized security data stream based on the anomaly marker data; and performing matching and comparison processing between the threat feature data and a pre-trained threat feature matching model to obtain the preliminary threat detection result data.

[0041] In this embodiment, the user behavior deviation data, device behavior deviation data, and network behavior deviation data are fused from multiple dimensions to obtain fused deviation data. This multi-dimensional fusion process aims to integrate behavioral deviation information from different dimensions into a unified and more representative indicator. Specifically, weighted summation, machine learning models (such as neural networks and support vector machines), or statistical methods (such as principal component analysis) can be used to comprehensively calculate these deviation data, thereby fully reflecting the degree of anomaly in the current system behavior and capturing the potential correlation between different behavioral dimensions, avoiding the limitations of single-dimensional analysis.

[0042] In this embodiment, the fusion deviation data undergoes threshold judgment processing. When the fusion deviation data exceeds a preset anomaly threshold, anomaly marker data is generated. The purpose of this step is to quantitatively evaluate the degree of anomaly after fusion and distinguish the anomalies that truly require attention. The preset anomaly threshold can be a fixed value or a threshold dynamically adjusted based on historical data, statistical analysis, or machine learning algorithms to adapt to dynamic changes in system behavior. When the fusion deviation data exceeds this threshold, it indicates that the system behavior has deviated from the normal baseline and requires further in-depth analysis. At this point, anomaly marker data is generated as a trigger signal for subsequent processing.

[0043] In this embodiment, threat feature data is extracted from the standardized security data stream based on the anomaly marker data. The anomaly marker data, acting as an indicator, guides the system to accurately trace back to the original standardized security data stream, pinpointing the specific time period of the abnormal behavior, the users involved, devices, or network connections, and other contextual information. By defining a series of extraction rules or utilizing pattern matching techniques, specific features directly related to the abnormal behavior can be filtered from this raw data, such as suspicious process startup, abnormal network connections, file access patterns, and failed login attempts. These features are key to identifying specific threat types.

[0044] In this embodiment, the threat feature data is finally matched and compared with the pre-trained threat feature matching model to obtain the preliminary threat detection result data. The pre-trained threat feature matching model is a model trained on a large number of known threat samples, which contains knowledge of various known attack patterns, malware signatures, vulnerability exploitation characteristics, etc. By inputting the extracted threat feature data into this model, the model can quickly and accurately compare it with known threat patterns, thereby identifying the specific threat type, attack method, or potential attack intent, and outputting preliminary threat detection result data.

[0045] In this embodiment, through the above-described technical solution, this application effectively solves the problems of difficulty in accurately integrating multi-source deviation data and accurately extracting threat features. Multi-dimensional fusion processing enables the system to more comprehensively and accurately assess the overall abnormal state, avoiding misjudgments or missed detections that may result from single-dimensional analysis. The threshold judgment mechanism ensures that only anomalies reaching a certain severity are marked, effectively filtering background noise and slight fluctuations, and improving the signal-to-noise ratio of detection. More importantly, the accurate extraction of threat features based on anomaly-marked data provides high-quality, highly relevant input for subsequent threat feature matching, enabling the pre-trained threat feature matching model to more efficiently and accurately identify specific threat types. This improves the accuracy and reliability of the initial threat detection results, laying a solid foundation for subsequent risk quantification and response decisions. This refined anomaly analysis and threat feature extraction mechanism allows the system to provide more targeted and actionable threat detection results when facing complex and ever-changing zero-trust environment threats.

[0046] In one feasible implementation, the step of performing risk quantification and priority ranking processing on the preliminary threat detection result data to obtain quantified threat risk assessment result data includes: performing threat severity assessment processing on the preliminary threat detection result data to obtain threat severity score data; performing threat confidence assessment processing on the preliminary threat detection result data to obtain threat confidence score data; acquiring current environmental context data, performing environmental sensitivity assessment processing on the current environmental context data to obtain environmental sensitivity score data; performing weighted comprehensive calculation processing on the threat severity score data, the threat confidence score data, and the environmental sensitivity score data to obtain comprehensive risk score data; and ranking the comprehensive risk score data to obtain the quantified threat risk assessment result data.

[0047] In this embodiment, the initial threat detection results are processed for threat severity assessment, aiming to quantify the potential harm caused by the detected threats. This typically involves analyzing factors such as the type of threat, the target of the attack, and the extent of potential business disruption or data breaches. For example, a ransomware attack targeting a core database is far more severe than a phishing email attempt targeting a non-critical employee workstation. This assessment can be achieved through a predefined threat knowledge base, expert system rules, or machine learning models. The threat knowledge base can contain known attack types and their corresponding default severity levels. Expert system rules can dynamically adjust the severity based on the importance of the affected assets, the stage of the attack, etc. Machine learning models can predict the severity of the current threat by learning the characteristics of historical threat events and their actual impact.

[0048] In this embodiment, the preliminary threat detection results are processed to assess threat confidence, aiming to quantify the reliability or accuracy of the detection results. Since threat detection models may produce false positives, assessing the confidence level of the detection results is crucial. High confidence means that the threat is more likely to exist, while low confidence may require further manual verification or more cautious response measures. Confidence can be determined based on the output probability of the detection model, the consistency of multiple detectors, or a comparison with historical false positive rates. For example, if multiple independent anomaly detection algorithms report the same behavioral anomaly, their confidence level will be higher. Furthermore, factors such as the quality of the data source and data integrity can also be considered in the assessment.

[0049] In this embodiment, in addition, current environmental context data is acquired and subjected to environmental sensitivity assessment to quantify the vulnerability or importance of the current environment to a specific threat. Environmental context data refers to various information related to the environment in which the current threat event occurs, such as the criticality of the affected system, user permissions, network area, peak business hours, and compliance requirements. A low-severity threat occurring on a critical business system may have a much higher environmental sensitivity than a high-severity threat occurring in a test environment. Environmental context data can be obtained by integrating enterprise asset management systems, identity and access management systems, network topology management systems, and business process management systems. Environmental sensitivity assessment can be performed using a pre-defined rule base, for example, marking production environments, core databases, and privileged user accounts as highly sensitive. Alternatively, machine learning models can be used to learn the amplification or mitigation effects of different environmental factors on the threat impact in historical events.

[0050] Based on this, the threat severity score data, threat confidence score data, and environmental sensitivity score data are weighted and comprehensively calculated to generate a single, comprehensive numerical value that fully reflects the threat risk. This comprehensive score can more accurately reflect the actual degree of harm and urgency of the threat, providing a unified basis for subsequent response decisions. It can be calculated using weighted summation, multi-factor product, or machine learning methods based on decision trees / neural networks.

[0051] In this embodiment, the comprehensive risk score data is sorted to prioritize all detected threats based on this data. By sorting, security operations teams or automated response systems can clearly identify the threats that require the most immediate attention and action, thereby optimizing resource allocation and ensuring timely and effective responses to high-risk threats. The most direct approach is to sort the comprehensive risk score data in descending order, with the highest-scoring threat having the highest priority. Alternatively, threats can be categorized according to preset risk level thresholds. For example, threats with comprehensive risk scores above a certain threshold can be marked as "high-risk," those below another threshold as "medium-risk," and so on.

[0052] In this embodiment, through the above technical solution, this application can comprehensively quantify the potential harm of threats, the reliability of detection results, and the importance of the threat's environment from multiple dimensions. Furthermore, these multi-dimensional scoring data are weighted and comprehensively calculated to generate unified comprehensive risk score data, which is then sorted to obtain refined quantitative threat risk assessment results. This enables the system to clearly identify truly high-risk threats, avoid investing excessive resources in low-risk or false alarm threats, and improve the accuracy of subsequent response strategy decisions and the efficiency of automated response operations. Compared to responding based solely on preliminary detection results, this solution ensures that limited security resources are prioritized for the most critical and urgent threats, thereby effectively reducing false alarm rates, minimizing interference with normal business operations, and maximizing the overall effectiveness of threat response.

[0053] In one feasible implementation, the step of performing threat severity assessment processing on the preliminary threat detection result data to obtain threat severity score data includes: extracting attack type data, affected resource data, potential impact range data, and attack duration data from the preliminary threat detection result data; determining the basic severity score data corresponding to the attack type data according to a pre-trained threat type severity assessment model; calculating the impact degree correction coefficient based on the affected resource data, the potential impact range data, and the attack duration data; and multiplying the basic severity score data with the impact degree correction coefficient to obtain the threat severity score data.

[0054] In this embodiment, extracting attack type data, affected resource data, potential impact scope data, and attack duration data from the initial threat detection results aims to obtain detailed contextual information about the threat event from the initial threat detection results data. Attack type data indicates the nature of the threat, such as whether it is a malware attack, phishing attack, denial-of-service attack, or unauthorized access attempt. This data can be obtained by classifying detected anomalous behavior patterns, matching them with known threat signatures, or from a threat intelligence platform. Affected resource data clarifies which systems, services, data, or user accounts are affected by the threat, which can be determined by analyzing logs, asset management system records, or network topology information. Potential impact scope data assesses the breadth of the threat's potential impact, such as the number of potentially affected users, the criticality of business processes, or the sensitivity of data breaches; this typically requires inference based on the asset's criticality level, user permissions, and data classification tags. Attack duration data records the start and end times of the threat event and whether it is still ongoing; this can be obtained through event log timestamps or real-time monitoring data. By extracting this multi-dimensional data, a comprehensive and detailed input is provided for subsequent threat severity assessment.

[0055] In this embodiment, a basic severity score is determined based on a pre-trained threat type severity assessment model to identify attack type data. The purpose of this step is to establish a standardized, pre-defined severity baseline for different types of attacks. The pre-trained threat type severity assessment model is a trained model that can be a rule-based expert system, a machine learning classifier, or a simple lookup table. This model learns from a large amount of historical threat event data, industry security standards, and the experience of security experts to map various known attack types to corresponding initial severity scores. For example, a DDoS attack might be assigned a high basic severity score, while a low-level port scan might receive a lower score. This basic score reflects the inherent harm of this type of attack under normal circumstances, laying the foundation for subsequent refined assessments.

[0056] Based on this, an impact severity correction coefficient is calculated using data on affected resources, potential impact scope, and attack duration. This step aims to dynamically adjust the base severity score according to the specific context of the current threat event. The impact severity correction coefficient is a multiplier or weighting factor used to adjust the base severity score. Its calculation comprehensively considers the sensitivity or criticality of the affected resources (e.g., the impact on core databases differs from that on non-critical test servers), the breadth of the potential impact scope (e.g., the impact on a single user differs from that on the entire organization), and the duration of the attack (e.g., the impact of a short-lived attack differs from that of a long-lasting, persistent attack). For example, if the affected resource is a core business system, or the potential impact scope involves a large amount of sensitive data, or the attack duration is long, the calculated correction coefficient will be increased accordingly to reflect the amplified actual harm of the threat. This coefficient can be calculated using various methods such as weighted summation, fuzzy logic, or machine learning-based regression models to ensure that the correction coefficient accurately reflects the impact level in a specific scenario.

[0057] In this embodiment, the basic severity score data is multiplied by an impact correction coefficient to obtain the threat severity score data. This step combines the inherent severity of the attack type with the specific contextual impact of the current event to arrive at a final, comprehensive threat severity score. By multiplying the basic severity score data with the calculated impact correction coefficient, general threat type risk and specific environmental risk can be effectively integrated. For example, if a medium-severity attack type (basic score) occurs on a highly sensitive core system (high correction coefficient), the final threat severity score will be higher. Conversely, if a high-severity attack type occurs in a non-critical test environment (low correction coefficient), the final score may be appropriately lowered. This multiplication calculation method ensures that the final threat severity score data considers both the nature of the threat itself and fully reflects its actual potential harm in a specific environment, thus providing a more accurate and dynamic risk assessment result.

[0058] In this embodiment, through the above technical solution, this application can extract multi-dimensional, fine-grained threat features from preliminary threat detection results data, including attack type data, affected resource data, potential impact range data, and attack duration data. Based on this, combined with the basic severity score data determined by a pre-trained threat type severity assessment model, and calculating the impact correction coefficient according to the specific affected resources, potential impact range, and attack duration, a comprehensive threat severity score is finally obtained through product calculation. This assessment method overcomes the limitations of traditional methods where threat severity assessment is too simplistic or lacks contextual awareness, enabling the threat severity score to more accurately reflect the actual potential harm of the current threat to a specific environment. This not only improves the accuracy of risk quantification but also provides a more reliable basis for subsequent response strategy decisions, thereby ensuring the accuracy and effectiveness of automated response operations and avoiding resource waste or insufficient response.

[0059] In one feasible implementation, the step of obtaining response execution instruction data by performing response strategy decision processing through a pre-trained response strategy decision model based on the quantitative threat risk assessment result data includes: inputting the quantitative threat risk assessment result data into the pre-trained response strategy decision model to obtain security status description data; performing response strategy selection processing through a pre-trained strategy selection model based on the security status description data and historical response effect data to obtain preferred response strategy data; and generating the response execution instruction data through a pre-trained action generation model based on the preferred response strategy data and currently available resource data.

[0060] In this embodiment, the quantified threat risk assessment result data is data that has undergone risk quantification and prioritization, containing comprehensive information such as threat severity, confidence level, and environmental sensitivity. This quantified threat risk assessment result data is input into a pre-trained response strategy decision model, which parses and transforms it to generate a structured, machine-understandable security state description. This security state description data is an abstraction and summary of key information such as the current threat situation, affected assets, and potential impacts, providing a foundation for subsequent strategy selection and action generation. For example, the model's internal feature engineering module can parse the input data, extract key features, and map them to a predefined threat state space, forming a vector or textual description.

[0061] Building upon this foundation, security status description data reflects the current threat context, while historical response performance data records past response strategies adopted for similar threats or security states and their corresponding actual effects, such as whether the threat was successfully mitigated or whether side effects occurred. The pre-trained strategy selection model, trained on extensive historical data, intelligently selects the most suitable strategy from a predefined library of response strategies based on the current security status description data and historical response performance data. This model can be implemented using reinforcement learning, supervised learning (such as classification models), or expert system rules, aiming to maximize the effectiveness of the response and minimize negative impacts. Optimal response strategy data represents the model's output, considered the optimal response plan, and may include strategy type (such as isolation, blocking, and remediation) and target object.

[0062] Furthermore, the preferred response strategy data specifies the high-level response measures to be taken. The currently available resource data provides information on the system resources required to execute these strategies, such as the current status, load, and permissions of network devices (firewalls, intrusion detection / prevention systems), endpoint devices, and security tools (endpoint detection and response, security information and event management systems). The pre-trained action generation model transforms the abstract preferred response strategy into concrete, executable low-level operational instructions. This model considers currently available resources, ensuring that the generated instructions are feasible and do not cause resource conflicts or system overload. For example, if the preferred strategy is "isolate infected hosts," the action generation model will generate specific application programming interface calls or command-line instructions based on available resources (such as network access control lists, firewall rules). The response execution instruction data is the final output set of instructions that can be directly executed by the automated response system.

[0063] In this embodiment, through the above technical solution, this application can transform abstract quantitative threat risk assessment results into structured security status description data, providing clear input for subsequent decision-making. Based on this, combined with historical response performance data, the pre-trained strategy selection model can intelligently select the optimal strategy best suited to the current threat situation from a variety of possible response strategies, effectively avoiding blind or suboptimal responses. Furthermore, by combining the optimal strategy with currently available resource data through a pre-trained action generation model, specific and executable response execution instructions can be generated, ensuring the accuracy and feasibility of response operations. This improves the intelligence, accuracy, and efficiency of automated threat response, reducing the need for manual intervention and the potential risk of misoperation.

[0064] In one feasible implementation, the step of selecting preferred response strategy data by using a pre-trained strategy selection model based on the security status description data and historical response effect data includes: extracting threat type feature data, risk level feature data, affected resource feature data, and attack time feature data from the security status description data; retrieving historical case data similar to the threat type feature data, risk level feature data, affected resource feature data, and attack time feature data from the historical response effect data; performing effect analysis processing on the retrieved historical case data to extract the actual effect data of each response strategy; and performing strategy selection processing by using a pre-trained strategy selection model based on the actual effect data to obtain the preferred response strategy data.

[0065] In this embodiment, threat type feature data, risk level feature data, affected resource feature data, and attack time feature data are extracted from the security status description data. Security status description data typically contains a large amount of information; to make more accurate policy selections, it is necessary to identify and extract the key features most directly related to threat response decisions. Threat type feature data can indicate the nature of the attack, such as whether it is a malware attack, a denial-of-service attack, or an insider threat; risk level feature data reflects the potential harm of the current threat, which is usually derived from quantitative threat risk assessment results; affected resource feature data clarifies which systems, data, or users are affected by the threat; and attack time feature data provides information on the timing and duration of the threat. These feature data can be parsed and extracted from the raw security status description data using predefined rules, pattern matching, or machine learning methods. For example, regular expressions can be used to identify threat types from logs, or detailed information about affected resources can be obtained by querying an asset management database.

[0066] Based on this, historical case data similar to threat type characteristics, risk level characteristics, affected resource characteristics, and attack time characteristics are retrieved from historical response effect data. Historical response effect data represents the system's accumulated experience in handling past threat events, containing detailed processes and final effects of each response. By comparing the current threat's characteristic data with those of historical cases, the system can identify response measures taken in similar situations and their effects. Similarity retrieval can employ various techniques, such as distance calculations based on feature vectors (e.g., Euclidean distance, cosine similarity) or rule-based fuzzy matching. For example, if the current threat is a high-risk SQL injection attack targeting a database server, the system will retrieve all historical high-risk SQL injection attack cases targeting databases.

[0067] In this embodiment, the retrieved historical case data undergoes effect analysis processing to extract the actual effect data of each response strategy. Simply finding similar historical cases is insufficient; it is also necessary to evaluate the actual performance of different response strategies within these cases. Actual effect data may include, but is not limited to, indicators such as threat containment time, business interruption duration, data leakage amount, resource recovery status, false positive rate, and impact on system performance. Effect analysis processing can be a quantitative process, such as assigning a score to the performance of each response strategy in a specific case, or a qualitative assessment, such as labeling it as "successful," "partially successful," or "failed." For example, if in a historical case, after adopting the "isolate infected host" strategy, the threat was completely contained within 5 minutes with minimal business impact, then the actual effect data of this strategy would be evaluated as high.

[0068] In this embodiment, based on actual effect data, a pre-trained strategy optimization model is used to select the optimal response strategy data. The pre-trained strategy optimization model is an intelligent decision-making model trained on a large amount of historical data. Its goal is to recommend the most suitable response strategy based on the characteristics of the current threat and the actual effects of historical strategies. This model can be implemented using techniques such as reinforcement learning, decision trees, and neural networks. It takes the characteristic data of the current threat and the actual effect data of each strategy extracted from similar historical cases as input, and outputs one or more response strategies considered "optimal" through its internal decision logic or learned weights. For example, the model might determine from historical data that, under the current threat type and risk level, "blocking malicious IPs" has a higher success rate and lower side effects than "resetting user passwords," and thus recommend the former.

[0069] In this embodiment, through the above technical solution, this application can effectively solve the problem of how to accurately select the optimal response strategy from massive historical data in a complex security environment. By extracting key threat type feature data, risk level feature data, affected resource feature data, and attack time feature data from security status description data, the system can focus on the core elements of the threat and avoid interference from irrelevant information. Subsequently, by intelligently searching for historical case data similar to these feature data, the system can make full use of past practical experience. Furthermore, by performing effect analysis on the retrieved historical cases and extracting the actual effect data of each response strategy, the system can quantitatively evaluate the advantages and disadvantages of different strategies, thereby providing solid data support for decision-making. Finally, based on these actual effect data, the system performs strategy selection processing through a pre-trained strategy optimization model, ensuring that the selected optimal response strategy data is a historically validated and the most effective and efficient solution for the current threat situation. This improves the intelligence level and response efficiency of automated threat detection and response methods, reduces the risk of misjudgment and misoperation, and makes security protection under the zero-trust architecture more accurate and adaptive, thereby effectively curbing the spread and impact of threats.

[0070] In one feasible implementation, the steps of executing automated response operations based on the response execution instruction data and monitoring the response execution effect to obtain response effect feedback data include: distributing the response execution instruction data to at least one response execution unit to obtain distribution confirmation data; each response execution unit executing a specific response operation based on the received response execution instruction data to obtain operation execution status data; after executing the response operation, monitoring changes in threat situation to obtain threat situation change monitoring data; monitoring the impact on business systems to obtain business impact assessment data, and monitoring system resource consumption to obtain resource consumption statistics; and comprehensively integrating the threat situation change monitoring data, the business impact assessment data, and the resource consumption statistics to obtain the response effect feedback data.

[0071] In this embodiment, the response execution instruction data refers to specific operational instructions generated by the system based on threat assessment results and policy decisions, such as isolating infected devices, blocking malicious connections, and modifying access permissions. Distribution refers to the secure and reliable transmission of these instructions to the entity responsible for execution. The response execution unit can be a network firewall, intrusion prevention system (IPS), endpoint security agent, identity and access management (IAM) system, security information and event management (SIEM) platform, etc. Distribution confirmation data ensures that the instructions have been successfully delivered and acknowledged by the recipient, providing a prerequisite for subsequent operations. Specifically, distribution can be achieved in various ways, such as pushing instructions to the API interfaces of each response execution unit through encrypted communication channels (e.g., TLS / SSL); or publishing instructions through message queue systems (e.g., Kafka, RabbitMQ), which are then subscribed to and consumed by each response execution unit; or remotely calling via command-line interface (CLI) or dedicated security protocols (e.g., SCAP). Distribution confirmation data can be a success status code returned by the recipient, an acknowledgment message (ACK), or an instruction reception event recorded in a log system.

[0072] In this embodiment, upon receiving response execution instruction data, each response execution unit performs corresponding security operations based on the instruction content. These operations may include, but are not limited to: adding or modifying access control rules on the firewall to block malicious traffic; initiating isolation procedures or deleting malicious files on the terminal device; disabling or restricting the permissions of threatened accounts in the identity management system; or triggering a preset automated workflow in the Security Orchestration Automation and Response (SOAR) platform. Operation execution status data is used to record the execution status of these specific operations, such as whether the operation was successfully completed, the execution progress, and any errors or anomalies encountered. During execution, each response execution unit generates and collects operation logs, status codes, error reports, and other information in real time. For example, the firewall records the rule's effective status after successfully applying a rule; the terminal security agent reports the deletion result after completing file deletion. This detailed execution information is summarized and used as operation execution status data for subsequent monitoring and evaluation.

[0073] In this embodiment, after or during the execution of a response operation, the system continuously observes and analyzes security threat activities within the system and network to assess the direct impact of the response operation on the threat environment, thereby obtaining threat situation change monitoring data. This data reflects changes in key indicators such as threat activity, attack sources, attack targets, and attack methods before and after the response. Specifically, this can be achieved by continuously collecting and analyzing security logs, alerts, and event data from intrusion detection systems (IDS), intrusion prevention systems (IPS), security information and event management (SIEM) systems, endpoint detection and response (EDR) systems, and network traffic analysis tools. Threat situation change monitoring data is generated by comparing threat-related data before and after the response operation, for example, observing whether connection attempts from specific malicious IPs decrease, whether the propagation of specific malicious files stops, and whether the number of abnormal behavior alerts decreases.

[0074] In this embodiment, while resolving security threats, automated response operations may also have collateral impacts on normal business operations and system resources. Therefore, this application also monitors the impact on business systems to obtain business impact assessment data and monitors system resource consumption to obtain resource consumption statistics. Business impact assessment data is used to measure the degree of impact of response operations on business continuity, service availability, system performance, user experience, and data integrity. System resource consumption statistics are used to assess the computing resources (such as CPU, memory), storage resources (such as disk I / O), and network resources (such as bandwidth) consumed by the response operation itself. Business impact assessment can be obtained by integrating application performance management (APM) tools, business monitoring systems, or by collecting business logs and user feedback. For example, monitoring key business service KPIs such as response time, error rate, transaction success rate, and user concurrency. System resource consumption statistics can be obtained through operating system built-in performance monitoring tools, cloud platform monitoring services (such as AWS CloudWatch, Azure Monitor), or third-party infrastructure monitoring tools, for example, real-time monitoring of CPU utilization, memory usage, network bandwidth usage, and disk read / write speed.

[0075] In this embodiment, the threat situation change monitoring data, the business impact assessment data, and the resource consumption statistics are comprehensively integrated to obtain the response effect feedback data. Comprehensive integration processing refers to the unified collection, cleaning, standardization, correlation, and analysis of monitoring data from multiple sources to form a comprehensive, objective, and structured response effect feedback data. This feedback data not only includes the effectiveness of threat mitigation but also covers the potential impact of response operations on business and resources, providing a comprehensive perspective for subsequent decision-making and optimization. Specifically, this can be accomplished through a central data processing platform or a Security Information and Event Management (SIEM) system. This platform first parses and standardizes monitoring data in different formats, and then performs data fusion based on correlation identifiers such as timestamps and event IDs. Next, it analyzes the integrated data using preset rules or machine learning algorithms, for example, calculating indicators such as threat mitigation rate, business impact score, and resource consumption efficiency, ultimately generating a response effect report or structured data containing these key indicators as the response effect feedback data.

[0076] In this embodiment, by employing the aforementioned technical solution, this application addresses the problem of ensuring effective instruction execution and comprehensive effect evaluation. It ensures accurate execution of response operations by distributing response execution instruction data to specific response execution units and acquiring operation execution status data in real time. Simultaneously, by monitoring threat landscape changes, business system impacts, and system resource consumption from multiple dimensions, the actual effectiveness of response operations can be comprehensively and objectively evaluated. This comprehensive feedback mechanism not only verifies the effectiveness of automated response but, more importantly, allows the generated response effect feedback data to be precisely used for subsequent model optimization and updates, thus forming a closed-loop, adaptive threat detection and response system. This enables the system to continuously learn and improve based on actual response effects, enhancing the accuracy of future threat detection and the effectiveness of response strategies, avoiding blind execution and inefficient responses, and improving the overall security protection capabilities under a zero-trust architecture.

[0077] In one feasible implementation, the step of feeding back the response effect feedback data to the behavioral baseline model, the anomaly detection model, and the pre-trained response strategy decision model for model optimization and update processing includes: analyzing and processing the response effect feedback data to obtain model optimization parameters; dividing the model optimization parameters into detection model optimization parameters and decision model optimization parameters; inputting the detection model optimization parameters into the behavioral baseline model and the anomaly detection model, adjusting the behavioral baseline model parameters and the anomaly detection model parameters to obtain updated behavioral baseline models and updated anomaly detection models; and inputting the decision model optimization parameters into the pre-trained response strategy decision model to update the decision weight parameters and strategy selection rule parameters of the response strategy decision model to obtain updated pre-trained response strategy decision models.

[0078] In this embodiment, the response effect feedback data is comprehensive data obtained by monitoring changes in the threat landscape, the impact on business systems, and system resource consumption after the system executes automated response operations. Analyzing and processing this feedback data aims to evaluate the effectiveness, efficiency, and potential side effects of the response operations. Various techniques can be employed for analysis and processing. For example, statistical analysis methods can be used to identify the correlation between response operations and changes in the threat landscape; machine learning algorithms (such as regression analysis and classification algorithms) can be used to predict the potential effects of different response strategies on system security and business operations; or the success of the response can be evaluated based on preset rules and expert knowledge. This analysis quantifies the performance of the response operations and extracts key information to guide model improvement; this information constitutes the model optimization parameters. These parameters can include model weight adjustment suggestions, threshold update suggestions, feature importance assessment results, or new training samples.

[0079] Based on this, model optimization parameters are divided into detection model optimization parameters and decision model optimization parameters. This division is based on the type of model and the optimization objective. Detection models (behavioral baseline models and anomaly detection models) mainly focus on threat identification and judgment. Their optimization parameters should focus on improving detection accuracy, reducing false positive and false negative rates, and adapting to new normal and abnormal behavior patterns. Decision models (pre-trained response strategy decision models) mainly focus on how to formulate the optimal response strategy based on detection results and risk assessment. Their optimization parameters should focus on improving the effectiveness, efficiency, and resource utilization of the response strategy, and reducing the negative impact on business systems. This distinction ensures that different types of models receive targeted optimization guidance, avoiding the negative impact of general parameters on specific models, thereby improving the efficiency and effectiveness of the overall optimization process.

[0080] In this embodiment, the optimization parameters of the detection model are input into the behavioral baseline model and the anomaly detection model. The parameters of both models are adjusted to obtain updated behavioral baseline and anomaly detection models. The input and adjustment process of the detection model optimization parameters aims to improve the accuracy and adaptability of threat detection. For the behavioral baseline model, optimization parameters may include new normal behavior pattern samples, weight adjustments to existing baseline features, or suggestions for baseline update frequency. For example, when the system identifies new legitimate user behavior patterns, these patterns can be used as new training data input to update the user behavior baseline data, enabling it to more accurately reflect current normal system behavior. For the anomaly detection model, optimization parameters may include threshold adjustments to the anomaly detection algorithm, feature selection optimization, or the introduction of new anomaly pattern recognition rules. For example, when a new attack pattern is discovered, relevant threat feature data can be used to train or fine-tune the anomaly detection model, enabling it to identify previously unknown threats. Through these adjustments, the behavioral baseline model can more accurately depict the "normal" state, while the anomaly detection model can more sensitively capture "abnormal" behavior, thereby improving the accuracy of the initial threat detection results.

[0081] In this embodiment, the optimization parameters of the decision model are input into the pre-trained response strategy decision model to update the decision weight parameters and strategy selection rule parameters of the response strategy decision model, resulting in an updated pre-trained response strategy decision model. The input and updating of the decision model optimization parameters aim to improve the effectiveness and adaptability of the response strategy. These parameters may include assessments of the success rate of different response strategies, cost-effectiveness analyses of specific response actions, or suggestions for optimal response paths under different threat scenarios. For example, if feedback data shows that a certain response strategy is ineffective or has significant side effects under a specific threat type, the decision model optimization parameters will instruct the pre-trained response strategy decision model to reduce the decision weight parameter of that strategy or adjust its selection priority under specific conditions. Conversely, if a certain response strategy performs well, its decision weight parameters or strategy selection rule parameters will be increased. Furthermore, updating the strategy selection rule parameters may include introducing new decision logic, adjusting the priority of existing rules, or optimizing strategy selection conditions based on new environmental context data. Through these updates, the pre-trained response strategy decision model can more intelligently select and generate response execution instruction data, ensuring that the most appropriate and effective automated response operations are taken under different threat scenarios.

[0082] In this embodiment, through the above technical solution, this application can perform refined analysis of response effect feedback data and transform it into targeted model optimization parameters. By clearly distinguishing these optimization parameters into detection model optimization parameters and decision model optimization parameters, and applying them respectively to the behavioral baseline model, anomaly detection model, and pre-trained response strategy decision model, precise optimization of different functional modules is achieved. This divide-and-conquer optimization strategy avoids model conflicts or inefficient updates that may result from general optimization parameters, ensuring that the behavioral baseline model and anomaly detection model can more accurately adapt to constantly changing normal behavior patterns and new threat patterns, thereby improving the accuracy and real-time performance of threat detection. Simultaneously, the pre-trained response strategy decision model can dynamically adjust its decision weight parameters and strategy selection rule parameters based on more accurate feedback information, enabling the system to select and execute automated response operations more intelligently and effectively, improving the adaptability and effectiveness of the response strategy. Ultimately, this allows the entire zero-trust architecture-based automated threat detection and response method to continuously learn and improve itself, maintaining efficient and accurate threat response capabilities in dynamic and complex cybersecurity environments.

[0083] In the embodiments of this application, the automated threat detection and response method based on zero-trust architecture solves the problems of narrow detection dimensions, rigid response and lack of feedback mechanism in the prior art by acquiring multi-source security data, performing standardization processing, constructing behavioral baselines and anomaly detection models, performing risk quantification, deciding on response strategies, monitoring the execution effect and providing feedback to optimize the model. It can effectively cope with highly dynamic network attacks, achieve closed-loop optimization and improve the security protection capability of zero-trust architecture.

[0084] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the automated threat detection and response method based on the zero-trust architecture of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0085] This application also provides an automated threat detection and response system based on a zero-trust architecture, see reference. Figure 2 The automated threat detection and response system based on zero-trust architecture includes: a memory 10, a processor 20, and an automated threat detection and response program based on zero-trust architecture stored on the memory 10 and executable on the processor 20. The automated threat detection and response program based on zero-trust architecture is configured to implement the steps of the automated threat detection and response method based on zero-trust architecture.

[0086] The automated threat detection and response system based on zero-trust architecture provided in this application, employing the automated threat detection and response method based on zero-trust architecture described in the above embodiments, can enhance the security protection capabilities of the zero-trust architecture. Compared with the prior art, the beneficial effects of the automated threat detection and response system based on zero-trust architecture provided in this application are the same as those of the automated threat detection and response method based on zero-trust architecture provided in the above embodiments, and other technical features of the automated threat detection and response system based on zero-trust architecture are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0087] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0088] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any equivalent structural transformations made under the technical concept of this application using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included within the scope of patent protection of this application.

Claims

1. An automated threat detection and response method based on a zero-trust architecture, characterized in that, The method includes: Acquire multi-source security data and perform standardization processing on the multi-source security data to obtain a standardized security data stream; The standardized security data stream is subjected to behavioral baseline modeling to obtain a behavioral baseline model, and anomaly detection processing is performed to obtain an anomaly detection model. Preliminary threat detection result data is obtained based on the behavioral baseline model and the anomaly detection model. The preliminary threat detection results are subjected to risk quantification and priority ranking to obtain quantitative threat risk assessment results. Based on the quantitative threat risk assessment results, response strategy decision processing is performed through a pre-trained response strategy decision model to obtain response execution instruction data; Execute automated response operations based on the response execution instruction data, monitor the response execution effect, and obtain response effect feedback data; The response effect feedback data is fed back to the behavior baseline model, the anomaly detection model, and the pre-trained response strategy decision model for model optimization and update.

2. The automated threat detection and response method based on zero-trust architecture as described in claim 1, characterized in that, The steps of performing behavioral baseline modeling on the standardized security data stream to obtain a behavioral baseline model, and performing anomaly detection processing to obtain an anomaly detection model, and obtaining preliminary threat detection result data based on the behavioral baseline model and the anomaly detection model include: Extract user behavior feature data, device behavior feature data, and network behavior feature data from the standardized security data stream; A dynamic behavior baseline model is constructed based on historical normal data. The dynamic behavior baseline model includes user behavior baseline data, device behavior baseline data, and network behavior baseline data. The user behavior feature data is compared with the user behavior baseline data in a first comparison process to obtain user behavior deviation data; the device behavior feature data is compared with the device behavior baseline data in a second comparison process to obtain device behavior deviation data; the network behavior feature data is compared with the network behavior baseline data in a third comparison process to obtain network behavior deviation data. Based on the user behavior deviation data, the device behavior deviation data, and the network behavior deviation data, a comprehensive anomaly analysis is performed using an anomaly detection model to obtain the preliminary threat detection result data.

3. The automated threat detection and response method based on zero-trust architecture as described in claim 2, characterized in that, The steps for obtaining the preliminary threat detection results data by performing comprehensive anomaly analysis and processing through an anomaly detection model based on the user behavior deviation data, the device behavior deviation data, and the network behavior deviation data include: The user behavior deviation data, the device behavior deviation data, and the network behavior deviation data are fused in multiple dimensions to obtain fused deviation data. The fusion deviation data is subjected to threshold judgment processing. When the fusion deviation data exceeds the preset abnormal threshold data, abnormal marker data is generated. Based on the anomaly marker data, extract the corresponding threat feature data from the standardized security data stream; The threat feature data is matched and compared with the pre-trained threat feature matching model to obtain the preliminary threat detection result data.

4. The automated threat detection and response method based on zero-trust architecture as described in claim 1, characterized in that, The steps for performing risk quantification and priority ranking on the preliminary threat detection results to obtain quantified threat risk assessment results include: The preliminary threat detection results are processed to assess the threat severity, resulting in a threat severity score. The preliminary threat detection results are processed to assess threat confidence, resulting in threat confidence score data. Obtain the current environmental context data, perform environmental sensitivity assessment processing on the current environmental context data, and obtain environmental sensitivity score data; The threat severity score data, the threat confidence score data, and the environmental sensitivity score data are weighted and comprehensively calculated to obtain the comprehensive risk score data. The comprehensive risk score data is sorted to obtain the quantitative threat risk assessment result data.

5. The automated threat detection and response method based on zero-trust architecture as described in claim 4, characterized in that, The steps for performing threat severity assessment on the preliminary threat detection results data to obtain threat severity score data include: From the preliminary threat detection results, extract attack type data, affected resource data, potential impact range data, and attack duration data; Based on the pre-trained threat type severity assessment model, determine the basic severity score data corresponding to the attack type data; Based on the affected resource data, the potential impact range data, and the attack duration data, calculate the impact degree correction coefficient; The threat severity score data is obtained by multiplying the basic severity score data with the impact correction coefficient.

6. The automated threat detection and response method based on zero-trust architecture as described in claim 1, characterized in that, Based on the quantitative threat risk assessment results, the steps for obtaining response execution instruction data through pre-trained response strategy decision-making models to perform response strategy decision-making include: The quantitative threat risk assessment results are input into the pre-trained response strategy decision model to obtain security status description data. Based on the security status description data and historical response effect data, a pre-trained strategy selection model is used to select the optimal response strategy data. Based on the preferred response strategy data and the currently available resource data, the response execution instruction data is generated through a pre-trained action generation model.

7. The automated threat detection and response method based on zero-trust architecture as described in claim 6, characterized in that, Based on the security status description data and historical response effect data, the steps of obtaining optimal response strategy data by performing response strategy selection processing through a pre-trained strategy selection model include: Extract threat type feature data, risk level feature data, affected resource feature data, and attack time feature data from the security status description data; Retrieve historical case data from the historical response effect data that are similar to the threat type feature data, the risk level feature data, the affected resource feature data, and the attack time feature data; The retrieved historical case data is processed for effect analysis to extract the actual effect data of each response strategy; Based on the actual effect data, the optimal response strategy data is obtained by performing strategy selection processing through a pre-trained strategy optimization model.

8. The automated threat detection and response method based on zero-trust architecture as described in claim 1, characterized in that, The steps of executing automated response operations based on the response execution instruction data, monitoring the response execution effect, and obtaining response effect feedback data include: The response execution instruction data is distributed to at least one response execution unit to obtain distribution confirmation data; Each of the response execution units performs a specific response operation based on the received response execution instruction data, and obtains operation execution status data; After executing the response operation, monitor the changes in threat situation to obtain threat situation change monitoring data; Monitor the impact on business systems to obtain business impact assessment data, and monitor system resource consumption to obtain resource consumption statistics. The threat situation change monitoring data, the business impact assessment data, and the resource consumption statistics are integrated and processed to obtain the response effect feedback data.

9. The automated threat detection and response method based on zero-trust architecture as described in claim 1, characterized in that, The steps of feeding back the response effect feedback data to the behavior baseline model, the anomaly detection model, and the pre-trained response strategy decision model for model optimization and update include: The response feedback data is analyzed and processed to obtain model optimization parameters; The model optimization parameters are divided into detection model optimization parameters and decision model optimization parameters; The optimization parameters of the detection model are input into the behavior baseline model and the anomaly detection model. The parameters of the behavior baseline model and the anomaly detection model are adjusted to obtain the updated behavior baseline model and the updated anomaly detection model. The optimization parameters of the decision model are input into the pre-trained response strategy decision model to update the decision weight parameters and strategy selection rule parameters of the response strategy decision model, thereby obtaining the updated pre-trained response strategy decision model.

10. An automated threat detection and response system based on a zero-trust architecture, characterized in that, The zero-trust architecture-based automated threat detection and response system includes: a memory, a processor, and a zero-trust architecture-based automated threat detection and response program stored in the memory and executable on the processor, wherein the zero-trust architecture-based automated threat detection and response program is configured to implement the steps of the zero-trust architecture-based automated threat detection and response method as described in any one of claims 1 to 9.

Images