A system security operation scheme generation method and device

Abstract

This disclosure provides a method and apparatus for generating a system security operation plan. The method includes: determining target security events, alarm information, and operational requirements corresponding to the user's security operation needs; determining parameters to be filled based on the target security events, alarm information, and operational requirements; filling the parameters to be filled into a security operation plan template to generate a target security operation plan corresponding to the security operation needs, and performing security operation operations based on the target security operation plan. This implementation can reduce the difficulty of parameter configuration in automated security operation plans, thereby reducing the deployment and maintenance costs of automated security operation plans; in addition, it can also reduce invalid alarms and improve security operation efficiency through security operation plans.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a method and apparatus for generating a system security operation plan. Background Technology

[0002] Alarm overload is a common problem in current cybersecurity technologies. Due to the massive number of alarms generated by security devices and systems, relevant personnel are often unable to effectively analyze and process all alarms in a short period of time, leading to reduced security operation efficiency.

[0003] To address these issues, automated security operations solutions can automatically identify and classify security events, reducing false alarms and improving response speed. However, the configuration parameters for automated security operations technologies are highly complex, and achieving effective automation requires significant expert knowledge and manual orchestration. This results in high deployment and maintenance costs for automated security operations solutions. Summary of the Invention

[0004] In view of this, the present disclosure provides a method, apparatus, electronic device and storage medium for generating a system security operation scheme, which can reduce the difficulty of parameter configuration in the automated security operation scheme, thereby reducing the deployment and maintenance costs of the automated security operation scheme; in addition, it can also reduce invalid alarms and improve security operation efficiency through the security operation scheme.

[0005] In a first aspect, embodiments of this disclosure provide a method for generating a system security operation plan, comprising:

[0006] Identify the target security events, alarm information, and operational requirements that correspond to the user's security operation needs;

[0007] Based on the target security events, alarm information, and operational requirements, determine the parameters to be filled;

[0008] Fill the parameters to be filled into the security operation plan template to generate a target security operation plan that corresponds to the security operation requirements, and then perform security operation operations based on the target security operation plan.

[0009] Optionally, the target security events corresponding to the user's security operation needs are identified, including:

[0010] Analyze users' security operation requirements to determine the event information contained within those requirements;

[0011] Match security scenarios related to the event information from pre-configured security scenarios, and combine the event information with the security scenarios to obtain the target security event corresponding to the security operation requirements.

[0012] Optionally, based on the target security event, alarm information, and operational requirements, the parameters to be filled are determined, including:

[0013] Based on the target security events, alarm information and operational requirements, determine the parameter types to be filled in;

[0014] Based on the parameter type, the target prompt word corresponding to the parameter type is selected from the preset candidate prompt words, and the parameter to be filled is determined based on the target prompt word, security operation requirements and alarm information.

[0015] Optionally, the parameters to be populated include security recommendations; based on the target security events, alarm information, and operational requirements, the parameters to be populated are determined, including:

[0016] By combining the pre-set configuration information, the pre-set security operation plan template with the target security event, the security environment information under the current event environment can be obtained.

[0017] Based on safety environment information, alarm information, and operational requirements, safety suggestions are generated for the parameters to be filled.

[0018] Optionally, the method further includes:

[0019] Identify the functions to be implemented corresponding to the target security event;

[0020] Based on the functions to be implemented, determine the security operation plan template corresponding to the target security event; the security operation plan template contains the functional nodes corresponding to the functions to be implemented.

[0021] Optionally, before populating the parameters to be filled into the security operations plan template, the following steps are also included:

[0022] Determine whether the parameters to be filled meet the functional node operation information in the safety operation plan template;

[0023] In response to the fact that the parameters to be filled meet the functional node operation information, the data to be filled is populated into the security operation plan template.

[0024] Secondly, this disclosure also provides an apparatus for generating a system security operation plan, comprising:

[0025] The first determination module is used to determine the target security events, alarm information and operation requirements corresponding to the user's security operation needs;

[0026] The second determination module is used to determine the parameters to be filled based on the target security events, alarm information and operation requirements;

[0027] The generation module is used to fill the parameters to be filled into the security operation plan template, generate the target security operation plan corresponding to the security operation requirements, and carry out security operation operations based on the target security operation plan.

[0028] Thirdly, embodiments of this disclosure also provide an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the first aspect or any optional implementation of the first aspect are performed.

[0029] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the first aspect or any optional implementation thereof.

[0030] Fifthly, embodiments of this disclosure also provide a computer program product, including a computer program that, when executed by a processor, implements the methods of any of the above embodiments.

[0031] Any of the above aspects or any implementation of any aspect reduces the difficulty of parameter configuration in automated security operation schemes by accurately matching and automatically filling in the parameters to be filled, thereby effectively reducing the deployment and maintenance costs of automated security operation schemes. First, by analyzing the user's security operation needs, the execution entity of this disclosure embodiment can clearly identify the target security events, alarm information, and operational requirements related to the needs. This information can not only be used to determine the security scenario to provide conditions for subsequent operations, but also, based on this information, further determine the parameters to be filled. The parameters to be filled include configuration items related to specific security events and alarm information, and these configuration items can be preset or closely related to the processing flow of the target security event. By automatically filling the parameters to be filled into the preset security operation scheme template, a specific scheme corresponding to the user's security operation needs can be generated without the user manually configuring every detail, significantly reducing the complexity of human intervention. This not only reduces manual operations in the configuration process, but also eliminates the need for a large number of manual adjustments and maintenance, thereby effectively reducing deployment and maintenance costs. At the same time, the execution entity can automatically generate accurate security operation schemes based on the target security events and alarm information, avoiding unnecessary configuration redundancy, reducing the generation of invalid alarms, and thus improving security operation efficiency.

[0032] The effects of the above-mentioned system security operation plan generation device, electronic equipment and storage medium are described in the description of the above-mentioned system security operation plan generation method, and will not be repeated here. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0034] Figure 1 A flowchart illustrating a method for generating a system security operation scheme according to an embodiment of this disclosure is shown;

[0035] Figure 2 A flowchart illustrating a method for generating a system security operation scheme according to an embodiment of this disclosure is shown.

[0036] Figure 3 A flowchart illustrating the process of determining a security scenario provided in an embodiment of this disclosure is shown;

[0037] Figure 4 A schematic diagram of a preset security operation scheme template provided in an embodiment of this disclosure is shown;

[0038] Figure 5 A schematic diagram of the process for determining security recommendations provided in an embodiment of this disclosure is shown;

[0039] Figure 6 A schematic diagram of the process for generating a security operation scheme provided in an embodiment of this disclosure is shown;

[0040] Figure 7 A schematic diagram of a system security operation scheme generation apparatus provided in an embodiment of this disclosure is shown;

[0041] Figure 8 An exemplary system architecture in which embodiments of this disclosure can be applied is shown;

[0042] Figure 9 A schematic diagram of the structure of a computer system used to implement the embodiments of the present disclosure is shown. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0044] It should be noted that the collection, use, storage, sharing and transfer of user personal information involved in the technical solution of the present invention all comply with the provisions of relevant laws and regulations, and require notification to users and obtaining their consent or authorization. When applicable, user personal information is subjected to de-identification and / or anonymization and / or encryption technical processing.

[0045] The above problems and solutions are the result of the inventor's practice and careful research. The discovery process of the above problems and the solutions proposed for the above problems should be considered as the inventor's contribution to this disclosure.

[0046] The technical solutions of this disclosure will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely to illustrate selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0047] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0048] To facilitate understanding of this embodiment, a method for generating a system security operation scheme disclosed in this disclosure will first be described in detail. The execution entity of the method for generating a system security operation scheme provided in this disclosure is generally a computer device with certain computing capabilities. This computer device may include, for example, a terminal device, a server, or other processing devices. The terminal device may be a user equipment (UE), mobile device, user terminal, terminal, cellular phone, cordless phone, personal digital assistant (PDA), handheld device, computing device, vehicle-mounted device, wearable device, etc. In some possible implementations, the method for generating the system security operation scheme can be implemented by a processor calling computer-readable instructions stored in memory.

[0049] See Figure 1 The diagram shows a flowchart of a method for generating a system security operation scheme according to an embodiment of this disclosure. The method includes steps S101 to S103, wherein:

[0050] S101: Identify the target security events, alarm information, and operational requirements that correspond to the user's security operation needs.

[0051] In the embodiments disclosed herein, such as Figure 2 As shown, users can input security operation requirements in natural language, which can include three types of intents: the target security events they expect to be supported, alarm information, and operational requirements. For example, a user's input security operation requirement could be: "You are a security operations governance expert. There are some logical nodes. Use these nodes in sequence: Threat Intelligence Query Node: Query threat intelligence for a specific scenario; Alarm Query Node: Query security alarm information based on the detection engine and alarm type; Asset Query Node; Data Processing Node: Merge, filter, or aggregate the input data; Send Vulnerability Emergency Response Ticket Node. You need to fill in the parameters according to the remediation suggestions. The parameter name required for the Scan Result Trigger Node is: Task Name; the parameter name required for the Asset Query Node is: Asset Name; the parameter names required for the Send Risk Response Ticket Node are: Event Source, Event Type, Event Name, Event Level, Event Description, Remediation Suggestion, Ticket Issuer, and Suggested Remediation Deadline (days)."

[0052] Continuing the example above, the security operation requirements input by the user include multiple nodes and operation steps, such as the "Asset Query Node," "Threat Intelligence Query Node," and "Send Vulnerability Emergency Response Ticket Node." The tasks and operations involved in these nodes provide instructions to the system, thereby helping to determine the user's intent to handle the target security event. For example, the "Asset Query Node" and "Send Vulnerability Emergency Response Ticket Node" point to possible asset security events and vulnerability management events. Furthermore, the "Alarm Query Node" and "Threat Intelligence Query Node" mentioned in the security operation requirements indicate the need to query alarm information and threat intelligence. These nodes require querying and processing security alarm information during operation. Therefore, relevant alarm information can be extracted from the node names and their descriptions. Operational requirements may include parameters such as "Task Name," "Asset Name," "Event Source," "Event Type," and "Remediation Suggestion." This information represents specific security operation requirements, and corresponding operations can be executed based on triggering conditions. Therefore, by analyzing the nodes and their parameters input by the user, the specific requirements of the operation can be identified, and the remediation operations or processes that need to be performed can be understood.

[0053] It should be noted that the above-mentioned security operation requirements, as well as the target security events, alarm information and operation requirements corresponding to the security operation requirements, are only illustrative examples of one possible implementation method of this disclosure and do not constitute an improper limitation of the present invention. In actual applications, requirements can be made according to actual needs and circumstances. This disclosure does not make specific limitations in this regard, and the implementation of its function shall prevail.

[0054] In this embodiment of the disclosure, the target security event may include event information and a security scenario. Specifically, determining the target security event corresponding to the user's security operation needs includes: parsing the user's security operation needs to determine the event information contained in the security operation needs; matching security scenarios related to the event information from pre-configured security scenarios; and combining the event information and the security scenarios to obtain the target security event corresponding to the security operation needs.

[0055] In specific implementation, such as Figure 3As shown, the execution entity of this disclosure embodiment can pre-configure multiple security scenarios, such as network security incident scenarios, host security incident scenarios, vulnerability baseline scanning scenarios, threat intelligence scenarios, and key network protection scenarios. After receiving user-inputted security operation requirements, natural language processing techniques can be used for word segmentation and named entity recognition to parse event information such as "security vulnerability detection" and "network attack detection." It should be noted that the step of parsing event information can be accomplished using a pre-trained large language model or any other method; this disclosure embodiment does not specifically limit this, as long as the functionality is achieved. Different event information can correspond to different event types, and in this case, keywords or event information can be used to match predefined security scenarios. For example, if the event information includes content or fields such as network attack, port scanning, malicious traffic, or abnormal access, it can be matched to a network security incident scenario. Alternatively, if the event information includes content or fields such as host vulnerability, operating system anomaly, malware, privilege escalation, or unauthorized access, it can be matched to a host security incident scenario. It's important to note that the same event information may correspond to different security scenarios. For example, an alarm event might correspond to a network security event scenario or a host security event scenario. In such cases, event context analysis can be used to determine which security scenario the event information should be matched to. For instance, if the asset involved in the alarm event is a network device, and the event description is abnormal traffic or port scanning, then the alarm event can be matched to a network security event scenario. If the event description is that an unauthorized user accessed a host, and that host is a critical database or server, then the alarm should be matched to a host security event scenario. After determining the event information corresponding to the security operation requirements and the corresponding security scenario, the two can be combined to form a complete target security event.

[0056] Furthermore, due to the complexity of different security scenarios, to avoid repetitive or logically flawed orchestration, each security scenario can specify a certain range of development interface calls. For example, alarm event correlation in host security scenarios can be limited to the categories of "asset query," "security baseline," and "vulnerability analysis," thereby avoiding repetitive or logically flawed orchestration.

[0057] It should be noted that the above-mentioned security scenarios and the correspondence between event information and security scenarios are only illustrative examples of one possible implementation method of this disclosure and do not constitute an improper limitation of the present invention. In actual applications, the settings can be made according to the actual situation. This disclosure does not impose specific limitations on this, and the functionality shall prevail.

[0058] S102: Determine the parameters to be filled based on the target security events, alarm information and operation requirements.

[0059] In this embodiment of the disclosure, the parameters to be filled are determined based on the target security event, alarm information and operation requirements, including: determining the parameter type of the parameter to be filled based on the target security event, alarm information and operation requirements; and selecting the target prompt word corresponding to the parameter type from the preset candidate prompt words based on the parameter type, so as to determine the parameter to be filled based on the target prompt word, security operation requirements and alarm information.

[0060] In specific implementations, the parameter types to be filled can be categorized based on dimensions such as event type, data source, or parameter function. This disclosure does not impose specific limitations on these categories, but rather focuses on achieving the desired functionality. For example, assuming parameter types are categorized by event type, parameters can be divided into alarm information parameters, event description parameters, and operation command parameters based on the form of the security event. For instance, "alarm source" can belong to alarm information parameters, while "processing method" belongs to operation command parameters. Alternatively, parameter types can be categorized by data source, such as system log parameters, network traffic parameters, and device status parameters. For example, "victim IP (Internet Protocol)" is extracted from alarm information, while "attack type" may come from external threat intelligence information. The parameters to be filled can be obtained based on a pre-trained large language model. Specifically, a corresponding prompt word can be set for each parameter type. After determining the parameter type of the parameter to be filled, the target prompt word corresponding to the parameter type of the current parameter to be filled can be selected from multiple pre-configured candidate prompt words. Based on the target prompt word, the user's input security operation requirements and the alarm information they carry are converted into standard format output, thereby determining the parameter to be filled in the standard format.

[0061] In another possible implementation, besides setting corresponding prompts for each parameter type, a set of rules can be defined for each parameter type. These rules can determine the content to be filled based on the characteristics and source of the parameter. For example, if a parameter belongs to the "alarm information" type and its value is "IP address," the system can automatically extract the relevant IP address from the alarm information according to the rules to obtain the parameter to be filled. Alternatively, a context-aware method can be used to dynamically determine the parameter to be filled based on the specific background and context of the current security event. For example, for the "threat target IP" parameter in an alarm message, the system can automatically infer the most relevant IP address by analyzing the context of the event, thereby determining the parameter to be filled. It should be noted that the above methods for determining the parameter to be filled are only illustrative examples of feasible implementation methods in this disclosure and do not constitute an improper limitation of the present invention. In actual applications, settings can be made according to the actual situation. This disclosure does not impose specific limitations on this, but only on achieving its function.

[0062] In this embodiment of the disclosure, the parameters to be populated may include security suggestions. Specifically, the parameters to be populated are determined based on the target security event, alarm information, and operational requirements, including: combining pre-set configuration information, a pre-set security operation plan template, and the target security event to obtain security environment information under the current event environment; and generating security suggestions in the parameters to be populated based on the security environment information, alarm information, and operational requirements.

[0063] In specific implementation, such as Figure 4 As shown, this is a pre-set security operation plan template. The template pre-defines the multiple nodes to be included in the final security operation plan, as well as the dependencies or execution order between these nodes. Multiple security operation plan templates can be used, and different templates can be selected based on different application scenarios. This will be explained in detail in S103, and will not be repeated here. The configuration information may include a unique identifier and version control character corresponding to the current security operation plan template, as well as the identifier of the user who created the template, the name of the template, its function or purpose, etc. Furthermore, it may include the applicable security scenarios for the current security operation plan template, related tags or keywords, etc.

[0064] In specific implementation, such as Figure 5As shown, after determining the security operation plan template and configuration information, it can be combined with the target security event to generate security environment information under the current event context. This security environment information refers to various data and intelligence related to the current security event during the handling of the security event and the defense response. This may include event-related information, such as the security event type and description; network topology and technical infrastructure information, such as network structure and devices, asset lists, and device status; and user behavior permissions, vulnerability information, business environment, and context. After obtaining the security environment information, a pre-trained large language model can be invoked to generate security recommendations corresponding to the current target security event. The generated security recommendations can include security remediation suggestions that meet the user's expected scenario, security event explanations, and security ticket filling.

[0065] S103: Fill the parameters to be filled into the security operation plan template to generate a target security operation plan corresponding to the security operation requirements, and perform security operation operations based on the target security operation plan.

[0066] In this step, as mentioned in S102, the execution entity of this embodiment can be pre-configured with multiple different security operation scheme templates, and different security operation scheme templates can correspond to different target security events. Therefore, after determining the target security event corresponding to the user's security operation needs, the corresponding security operation scheme template can be determined based on the target security event. Specifically, the method further includes: determining the function to be implemented corresponding to the target security event; determining the security operation scheme template corresponding to the target security event based on the function to be implemented; the security operation scheme template contains the functional nodes corresponding to the function to be implemented.

[0067] In practical implementation, after identifying the target security event corresponding to the user's security operation requirements, the corresponding function to be implemented can be determined. After determining the function to be implemented, a template containing the corresponding function node can be found among multiple pre-configured security operation solution templates and used as the template for generating the security operation solution. Alternatively, after determining the function to be implemented, a security operation solution template corresponding to the target security event can be assembled based on the corresponding function node. This disclosure does not specifically limit the implementation in this way; the requirement is that the function can be achieved.

[0068] For example, assuming the target security event is a "ransomware infection," the appropriate functional nodes can be selected based on the target security event, such as "isolate infected terminals," "recover encrypted files," and "notify the administrator." Then, a template with these functional nodes defined can be found in the preset security operation plan templates, and the relevant parameters can be filled in according to the requirements. Finally, this template is selected as the template for generating the security operation plan. Alternatively, when the target security event is a "DDoS attack (Distributed Denial of Service)," the functional requirements involved in the event can be identified, such as "traffic monitoring," "blocking malicious IPs," and "traffic analysis." Then, by analyzing the functional nodes to be implemented, a new security operation plan template can be dynamically assembled based on the definitions and implementation requirements of these functional nodes.

[0069] In this embodiment of the disclosure, before filling the parameter to be filled into the security operation plan template, the method further includes: determining whether the parameter to be filled meets the functional node operation information in the security operation plan template; and in response to the parameter to be filled meeting the functional node operation information, filling the data to be filled into the security operation plan template.

[0070] In specific implementation, such as Figure 6 As shown, before filling the information to be filled into the corresponding functional node, it can be verified whether the node operation information is satisfied. Specifically, it can be checked whether the type of the parameter to be filled is consistent with the type required by the functional node, whether the parameter to be filled conforms to the predetermined format, etc. In addition, for parameters with range restrictions, it can also be checked whether the parameter to be filled is within a reasonable range. It can also be checked the dependency of the parameter to be filled to ensure that it can be used in the correct context. It should be noted that the above verification and judgment methods and judgment contents are only illustrative examples of a possible implementation of this disclosure embodiment and do not constitute an improper limitation of the present invention. In actual applications, they can be set according to the actual situation. For example, the integrity of the parameter to be filled can also be verified. This disclosure embodiment does not specifically limit this, as long as its function can be achieved. In specific implementation, if the parameter to be filled satisfies the functional node operation information, it can be directly filled into the determined security operation scheme template; if it does not satisfy, relevant information can be obtained again to determine new parameters to be filled and then fill them into the security operation scheme template.

[0071] In this embodiment, besides converting the parameters to be filled into a standard format using prompts, the prompts can also be re-bound to node names. For example, the "Victim IP" parameter in the "Receive Alarm Information" node can be automatically generated as "Extract victim IP information from alarm information" using prompts; the "Threat Target" parameter in the "Threat Intelligence Information" node can be generated as "Extract threat target IP" using prompts. This reduces the workload of repeatedly constructing prompts and enables data format filling in different scenarios.

[0072] According to a second aspect of the embodiments of this disclosure, such as Figure 7 As shown, a system security operation scheme generation device 700 is provided, comprising:

[0073] The first determination module 701 is used to determine the target security events, alarm information and operation requirements corresponding to the user's security operation needs;

[0074] The second determining module 702 is used to determine the parameters to be filled based on the target security events, alarm information and operation requirements;

[0075] The generation module 703 is used to fill the parameters to be filled into the security operation plan template, generate the target security operation plan corresponding to the security operation requirements, and perform security operation operations based on the target security operation plan.

[0076] The first determining module 701 is specifically used for:

[0077] Analyze users' security operation requirements to determine the event information contained within those requirements;

[0078] Match security scenarios related to the event information from pre-configured security scenarios, and combine the event information with the security scenarios to obtain the target security event corresponding to the security operation requirements.

[0079] The second determining module 702 is specifically used for:

[0080] Based on the target security events, alarm information and operational requirements, determine the parameter types to be filled in;

[0081] Based on the parameter type, the target prompt word corresponding to the parameter type is selected from the preset candidate prompt words, and the parameter to be filled is determined based on the target prompt word, security operation requirements and alarm information.

[0082] Optionally, the parameters to be filled include safety recommendations; the second determining module 702 is specifically used for:

[0083] By combining the pre-set configuration information, the pre-set security operation plan template with the target security event, the security environment information under the current event environment can be obtained.

[0084] Based on safety environment information, alarm information, and operational requirements, safety suggestions are generated for the parameters to be filled.

[0085] Optionally, the generation module 703 is also used for:

[0086] Identify the functions to be implemented corresponding to the target security event;

[0087] Based on the functions to be implemented, determine the security operation plan template corresponding to the target security event; the security operation plan template contains the functional nodes corresponding to the functions to be implemented.

[0088] Optionally, the generation module 703 is also used for:

[0089] Determine whether the parameters to be filled meet the functional node operation information in the safety operation plan template;

[0090] In response to the fact that the parameters to be filled meet the functional node operation information, the data to be filled is populated into the security operation plan template.

[0091] According to a third aspect of the present disclosure, an electronic device for generating a system security operation scheme is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in the first aspect of the present invention.

[0092] According to a fourth aspect of the present disclosure, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method provided in the first aspect of the present invention.

[0093] According to a fifth aspect of the present invention, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method of any of the above embodiments.

[0094] Figure 8 An exemplary system architecture 800 is shown that can be applied to the method or apparatus for generating a system security operation scheme implemented in this disclosure.

[0095] like Figure 8As shown, system architecture 800 may include terminal devices 801, 802, and 803, a network 804, and a server 805. Network 804 serves as the medium for providing communication links between terminal devices 801, 802, and 803 and server 805. Network 804 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0096] Users can use terminal devices 801, 802, and 803 to interact with server 805 via network 804 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 801, 802, and 803, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0097] Terminal devices 801, 802, and 803 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0098] Server 805 can be a server providing various services, such as a backend management server supporting shopping websites browsed by users using terminal devices 801, 802, and 803 (for example only). The backend management server can process received requests to generate system security operation plans and return the processing results (for example only) to the terminal devices.

[0099] It should be noted that the method for generating the system security operation scheme provided in this embodiment of the invention is generally executed by server 805, and correspondingly, the device for generating the system security operation scheme is generally located in server 805. The method for generating the system security operation scheme provided in this embodiment of the invention can also be executed by terminal devices 801, 802, and 803, and correspondingly, the device for generating the system security operation scheme can be located in terminal devices 801, 802, and 803.

[0100] It should be understood that Figure 8 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0101] The following is for reference. Figure 9 It shows a schematic diagram of the structure of a computer system 900 suitable for implementing a terminal device of the present invention. Figure 9 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0102] like Figure 9As shown, the computer system 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 902 or programs loaded from storage section 908 into random access memory (RAM) 903. The RAM 903 also stores various programs and data required for the operation of the system 900. The CPU 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0103] The following components are connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 910 as needed so that computer programs read from it can be installed into storage section 908 as needed.

[0104] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable medium 911. When the computer program is executed by central processing unit (CPU) 901, it performs the functions defined above in the system of this invention.

[0105] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0106] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0107] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be located in a processor. For example, a processor includes a first determining module, a second determining module, and a generating module. The names of these modules do not necessarily limit the module itself. For example, the first determining module can also be described as "a module for determining target security events, alarm information, and operation requirements corresponding to the user's security operation needs".

[0108] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the device, the device implements the following method: determining target security events, alarm information, and operational requirements corresponding to the user's security operation needs; determining parameters to be filled based on the target security events, alarm information, and operational requirements; filling the parameters to be filled into a security operation scheme template to generate a target security operation scheme corresponding to the security operation needs, and performing security operation operations based on the target security operation scheme.

[0109] Finally, it should be noted that the above embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit it. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this disclosure. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the protection scope of the claims.

Claims

1. A method for generating a system security operation scheme, characterized in that, include: Identify the target security events, alarm information, and operational requirements that correspond to the user's security operation needs; Based on the target security events, alarm information, and operational requirements, determine the parameters to be filled; The parameters to be filled are entered into the security operation plan template to generate a target security operation plan corresponding to the security operation requirements, so as to carry out security operation operations based on the target security operation plan.

2. The method of claim 1, wherein, Identify target security events that correspond to the user's security operation needs, including: The user's security operation requirements are analyzed to determine the event information contained in the security operation requirements; The event information is matched with a security scenario related to the event from a pre-configured security scenario, and the event information is combined with the security scenario to obtain a target security event corresponding to the security operation requirements.

3. The method of claim 1, wherein, Based on the target security events, alarm information, and operational requirements, determine the parameters to be filled, including: Based on the target security events, alarm information and operation requirements, determine the parameter types to be filled in; Based on the parameter type, a target prompt word corresponding to the parameter type is selected from the preset candidate prompt words, so as to determine the parameter to be filled based on the target prompt word, security operation requirements and alarm information.

4. The method of claim 1, wherein, The parameters to be filled include safety recommendations; Based on the target security events, alarm information, and operational requirements, determine the parameters to be filled, including: By combining the pre-set configuration information, the pre-set security operation plan template with the target security event, the security environment information under the current event environment can be obtained. Based on the security environment information, alarm information, and operational requirements, security recommendations are generated for the parameters to be filled.

5. The method of claim 4, wherein, The method further includes: Identify the functions to be implemented corresponding to the target security event; Based on the function to be implemented, a security operation plan template corresponding to the target security event is determined; the security operation plan template contains the functional nodes corresponding to the function to be implemented.

6. The method of claim 5, wherein, Before filling the parameters to be filled into the security operation plan template, the following steps are also included: Determine whether the parameter to be filled meets the functional node operation information in the safety operation plan template; In response to the fact that the parameters to be filled meet the functional node operation information, the data to be filled is populated into the security operation scheme template.

7. A safety operation device characterized by comprising: include: The first determination module is used to determine the target security events, alarm information and operation requirements corresponding to the user's security operation needs; The second determination module is used to determine the parameters to be filled based on the target security events, alarm information and operation requirements; The generation module is used to fill the parameters to be filled into the security operation plan template, generate a target security operation plan corresponding to the security operation requirements, and perform security operation operations based on the target security operation plan.

8. An electronic device, comprising: include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-6.

9. A computer readable medium having stored thereon a computer program, characterized in that When the program is executed by the processor, it implements the method as described in any one of claims 1-6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-6.

Images