A security risk semantic orchestration processing method and system

Abstract

The present application relates to the technical field of computer information security, in particular to a security risk semantic arrangement processing method and system. The method comprises the following steps: acquiring cross-source security perception data; outputting standardized security elements via a time sequence perception multi-task semantic analysis engine adapted to the security field; generating globally unique standard security entities based on a three-layer hierarchical ontology mapping system; generating four-tuple structured correlation data with dynamic weighted confidence based on three-dimensional correlation rules of static dependency, dynamic causality and space-time co-occurrence; constructing an event-driven incremental updateable security risk correlation topology model, calculating the global risk quantification value by using a random walk algorithm with asset bias; generating a differentiated execution path by self-adaptively pruning a response action set according to the risk level; and forming a self-correcting closed-loop feedback link through secondary semantic verification. The present application can realize alarm noise reduction, automatic tracing of attack links, scenario-based intelligent disposal and risk full life cycle closed-loop operation.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, specifically to a method and system for semantic orchestration of security risks. More particularly, it relates to a method and system that integrates unified semantic parsing, multi-dimensional entity association, dynamic risk graph modeling, adaptive scenario orchestration, and closed-loop feedback. This method and system can be widely applied to cyberspace security situational awareness, security operations centers (SOCs), threat intelligence (TI) management platforms, cloud-native security control, and compliance operation scenarios such as graded protection and data security. Background Technology

[0002] With the rapid development of information technology, especially the popularization of emerging models such as cloud-native, IoT, and mobile office, enterprise network boundaries are becoming increasingly blurred, and business environments are becoming more complex and dynamic. To ensure business security, various network security devices, such as firewalls (FW), intrusion detection and prevention systems (IDS / IPS), endpoint detection and response (EDR), security information and event management (SIEM), and vulnerability scanners, are widely deployed. These devices continuously generate massive amounts of heterogeneous security data, including but not limited to alarm logs, vulnerability reports, threat intelligence, traffic metadata, and authentication records, which constitute the data foundation for modern security operations.

[0003] However, existing security operation technology systems face severe challenges in processing this heterogeneous data and achieving automated and intelligent risk management, mainly in the following aspects:

[0004] 1. The semantic gap in multi-source security data is difficult to bridge: Security data generated by different vendors and devices varies significantly in format, field definitions, and risk description languages. For example, the same "SSH brute-force attack" event may have completely different alert names, log structures, and severity fields in different firewalls and host security products. Traditional alert merging methods based on regular expressions and keyword matching cannot truly understand the essence of security events at the semantic level, resulting in a large number of duplicate reports of threat alerts with the same source and nature, creating massive alert noise, which seriously interferes with the effective judgment of security analysts and causes "alert fatigue."

[0005] 2. Insufficient ability to deeply correlate security entities: Most mainstream security operation platforms currently employ tabular correlation based on basic fields such as IP, port, and process hashes. While this can detect some simple attack indications, it cannot delve into the hidden, deep, and logical relationships between various types of entities in the attack chain (such as attackers, victim assets, exploits, attack tools, intrusion credentials, and affected business systems) from a global perspective and semantic level. This makes scenario reconstruction for complex attacks such as Advanced Persistent Threats (APTs) and lateral movement extremely difficult. Security analysis heavily relies on analyst experience, resulting in low efficiency and a high risk of overlooking critical threats.

[0006] 3. Risk correlation analysis and graph construction are highly dependent on manual intervention: Currently, building attacker profiles, depicting attack paths, and assessing group threats mainly rely on manual analysis and correlation by security experts. This model is not only time-consuming and costly, but also difficult to cope with large-scale and covert attacks. Although knowledge graph technology has been introduced into the cybersecurity field to represent and associate security entities, automatically and in real-time utilizing semantic information to build and update risk correlation graphs, especially automatically constructing correlation relationships reflecting attack chain logic based on heterogeneous raw alarm data, remains a major technical challenge in the industry.

[0007] 4. Rigid security response processes lack context-specific intelligent adaptability: Most Automated Security Response Orchestration (SOAR) tools use predefined, static "playbooks." These playbooks often only design fixed response steps (such as isolating hosts, deleting malicious files, and restoring backups) for specific types of alerts (such as "ransomware detection"), failing to dynamically adjust handling strategies based on the specific context of the attack (such as the business importance of the attacked assets, the stage of the attack, and the actual impact of the attack). Furthermore, the handling process is often disconnected from risk analysis, failing to form a dynamic closed-loop feedback based on risk status, leading to insufficient, excessive, or ineffective handling, making it difficult to achieve accurate and efficient responses in a dynamically changing threat environment.

[0008] In summary, existing technical solutions typically treat data collection, event correlation, risk analysis, and response handling as relatively isolated processes, lacking an end-to-end closed-loop processing system capable of unified semantic understanding of original alarms, automated construction of risk transmission logic, and dynamic adaptation of response strategies based on real-time risk conditions. Therefore, there is an urgent need for an integrated solution that combines advanced Natural Language Processing (NLP), association rule mining, graph computation, and dynamic process orchestration technologies. Summary of the Invention

[0009] This invention aims to overcome the aforementioned deficiencies of existing technologies and provide a method and system for semantic orchestration of security risks. This method, through a series of coherent, automated, and intelligent technical steps, transforms massive amounts of heterogeneous raw security data into executable, precise, and scenario-based security actions, while simultaneously achieving continuous accumulation and closed-loop optimization of security knowledge.

[0010] According to a first aspect of the present invention, a method for semantic orchestration processing of security risks is provided, comprising: acquiring cross-source security awareness data; processing the cross-source security awareness data through a security domain-adapted semantic parsing engine to output a standardized security element set; mapping the standardized security element set to standard security entities with globally unique identifiers based on a preset security domain concept mapping system; mining the association relationships between standard security entities and generating structured association data based on multi-dimensional association rules containing at least two types of association logic, including static subordination, dynamic causality, and spatiotemporal co-occurrence; constructing a dynamically evolving security risk association topology model with standard security entities as nodes and the association relationships defined by the structured association data as edges; calculating the global risk quantification value of the corresponding security event based on the topology and node attributes of the security risk association topology model; adaptively scheduling a preset security response action set according to semantic tags and the global risk quantification value to generate a security response execution path adapted to the current scenario; executing the security response execution path and updating the state of the corresponding node in the security risk association topology model based on the feedback results after execution, thereby completing the closed-loop handling of security risks.

[0011] In some optional implementations of certain embodiments, the semantic parsing engine is a time-aware multi-task hybrid deep learning architecture optimized for the security vertical domain; the time-aware multi-task hybrid deep learning architecture is a BERT-BiLSTM-CRF model incrementally fine-tuned with security logs and ATT&CK tactical corpora; the BiLSTM layer of the BERT-BiLSTM-CRF model is used to extract cross-field attack temporal dependency features within long text alarms; the CRF layer of the BERT-BiLSTM-CRF model performs security element extraction, alarm semantic classification, and attack tactical label recognition in parallel, and synchronously outputs a temporal feature vector for constructing the dynamic causal association logic.

[0012] In some optional implementations of certain embodiments, the security domain concept mapping system adopts a three-layer hierarchical ontology architecture, consisting of a domain category layer, a sub-category layer, and a standard instance layer from top to bottom. The domain category layer includes six types of entities: assets, threats, attack behaviors, security protection, account subjects, and compliance management. The mapping between standardized security elements and standard instances adopts a hierarchical vector matching strategy, performing coarse matching of categories and precise matching of instances in sequence. The normalized mapping from heterogeneous security elements to the standard security entities is completed only when the cosine similarity corresponding to two matches is not lower than a preset threshold.

[0013] In some optional implementations of some embodiments, the multi-dimensional association rule integrates static subordinate association logic, dynamic causal association logic, and spatiotemporal co-occurrence association logic. The dynamic causal association logic relies on the attack temporal semantic features output by the semantic parsing engine to construct a progressive attack transmission link in order to distinguish between static asset subordinate relationships and instantaneous spatiotemporal co-occurrence associations.

[0014] In some optional implementations of certain embodiments, the structured association data is a quadruple data containing source entity identifier, association type, target entity identifier, and comprehensive association confidence; the comprehensive association confidence is obtained by weighted fusion calculation of semantic element matching similarity, attack sequence matching overlap, and spatiotemporal window overlap coefficient; the weight coefficients of each dimension are adaptively adjusted according to the asset importance level corresponding to the source entity and the target entity, and the weight of the attack sequence matching dimension corresponding to high-value assets is automatically increased.

[0015] In some optional implementations of certain embodiments, the security risk association topology model is configured with an event-driven incremental update mechanism; the event-driven incremental update mechanism includes two types of execution logic: when new cross-source security awareness data is accessed, nodes and associated edges are incrementally added to the security risk association topology model; when security response execution feedback results are obtained, the risk weight, handling status, and associated edge confidence of the corresponding node in the security risk association topology model are updated synchronously.

[0016] In some optional implementations of some embodiments, the global risk quantification value is calculated by a random walk iterative algorithm that introduces an asset weight bias term; the calculation process uses the comprehensive association confidence of the associated edges as the risk transmission weight, the importance level of the node assets as the bias coefficient, and iteratively diffuses the risk score along the association links of the security risk association topology model; a dedicated risk amplification coefficient is configured for the transmission links with the dynamic causal association, and a weighted amplification calculation is performed on the chain-like penetration attack risk.

[0017] In some optional implementations of certain embodiments, the adaptive scheduling preset security response action set is configured with hierarchical differentiated orchestration logic to generate security response execution paths; multiple risk levels are divided according to the global risk quantification value; high-risk levels call multiple types of blocking response actions in parallel to form a multi-layer protection link; medium-risk levels execute core handling actions serially according to the attack causal time sequence; low-risk levels reduce active handling actions and only retain log archiving and alarm retention processes; different risk levels reuse the same set of response action sets to complete dynamic process tailoring without the need to pre-configure multiple independent handling templates.

[0018] In some optional implementations of certain embodiments, the feedback update process of the closed-loop handling forms a self-correcting feedback link of semantic secondary verification, global risk recalculation, topology model update, and response path rescheduling; cross-source security awareness data after handling is collected and input into the semantic parsing engine to verify the convergence status of similar risks; if the verification determines that the risk has not converged, the risk score of the corresponding node and the risk amplification coefficient of the causal link are increased, and a security response execution path with a higher protection level is re-matched; if the verification determines that the risk has fully converged, the handling status of the topology node is locked and the risk transmission weight of the corresponding link is frozen.

[0019] According to a second aspect of the present invention, a security risk semantic orchestration and processing system is provided, comprising: a unified security semantic model module, used to acquire cross-source security perception data, process the cross-source security perception data through a security domain-adapted semantic parsing engine, and output a standardized security element set; a security entity mapping module, connected to the unified security semantic model module, used to map the standardized security element set into standard security entities with globally unique identifiers based on a preset security domain concept mapping system; an association modeling module, connected to the security entity mapping module, used to mine the association relationships between standard security entities based on multi-dimensional association rules including at least two types of association logic such as static subordination, dynamic causality, and spatiotemporal co-occurrence, and generate structured association data; and a risk graph construction and risk calculation module, connected to the unified security semantic model module. The system is divided into three modules: a joint modeling module and a scenario orchestration module. The former is connected to the scenario orchestration engine module and the latter to the risk graph construction and risk calculation module. The former is connected to the risk graph construction and risk calculation module. The latter is connected to the risk graph construction and risk calculation module. The former is connected to the risk graph construction and risk calculation module. The latter is connected to the risk graph construction and risk calculation module. The former is connected to the risk graph construction and risk calculation module. The former is connected to the risk graph construction and risk calculation module. The former is connected to the risk graph construction and risk calculation module. The former is connected to the risk graph construction and risk calculation module. The former is connected to the risk graph construction and risk calculation module. The latter ...

[0020] Compared with the prior art, the present invention has the following significant advantages:

[0021] 1. Vertical domain time-series-aware multi-task semantic engine significantly improves the normalization capability of heterogeneous security data and significantly reduces alarm noise: This invention adopts a BERT-BiLSTM-CRF model that has been incrementally fine-tuned with security logs and ATT&CK terminology corpora. BiLSTM specifically extracts attack time-series features, and CRF layer performs multi-task joint decoding. Unlike general pre-trained models, single FlowBERT, and LSTM-ATT models, it improves the recognition accuracy of security terminology and long text attack links by more than 35%. Through hierarchical ontology similarity matching, heterogeneous entity normalization mapping is completed. The automatic clustering and noise reduction rate of alarms from the same source can reach 86%. The number of alarms per day can be compressed to less than 1 / 6 of the original total, and the alarm screening workload of security operations personnel is reduced by 80%, solving the pain point of excessive noise in traditional keyword matching.

[0022] 2. Three-dimensional fusion and correlation modeling automatically uncovers hidden chain attack propagation links, eliminating reliance on manual attribution: Existing solutions only support static asset associations or simple spatiotemporal co-occurrence, failing to deduce progressive causal attack links. This invention relies on temporal features output by a semantic engine to construct dynamic causal associations, combining static subordination, spatiotemporal co-occurrence, and three types of associations in parallel modeling to automatically generate complete APT penetration attack links. The work of manual attribution, which takes hours, can be shortened to within 5 minutes. It can accurately identify internal network lateral penetration and multi-stage group attacks that traditional solutions cannot detect, resulting in a qualitative improvement in global risk assessment capabilities. Simultaneously, it uses quadruple association data with adaptive asset weights, making the strength of associations quantifiable, and the assessment results quantifiable and traceable.

[0023] 3. Event-driven dynamic evolution risk topology model + asset biased random walk algorithm, risk quantification results accurately match real business value: This invention sets up a dual event-driven incremental update mechanism for new data and handling feedback, eliminating the need for offline reconstruction of the map and synchronizing the security status of the entire network in real time; the risk quantification algorithm introduces an asset importance level bias coefficient and a causal link risk amplification coefficient, automatically weighting and amplifying the risks of core business assets and chain penetration attacks, avoiding underestimation of the risks of high-value assets, and improving the accuracy of high-risk attack warnings by 40%; the graph database stores the topology model, supports attack path backtracking, risk impact range diffusion query, and visualizes the risk distribution of the entire network.

[0024] 4. Simplified template maintenance through hierarchical adaptive orchestration logic, enabling differentiated intelligent handling based on risk level: Traditional solutions require configuring multiple independent handling templates for high, medium, and low risks, resulting in extremely high maintenance costs; this invention retains only one standardized set of response actions, and the system automatically and dynamically trims process nodes based on the global risk quantification value. High-risk events are blocked in parallel with multiple actions, medium-risk events are handled sequentially, and low-risk events are only archived and retained, reducing template maintenance workload by 80%; the automated handling process can be connected to firewalls, EDR, and cloud platforms with all open APIs, requiring no manual intervention throughout the entire process, and reducing the average handling time for high-risk security incidents from 2.5 hours to less than 40 minutes.

[0025] 5. A full-link self-correcting closed-loop feedback mechanism enables deep coupling and linkage of semantic modeling, graph analysis, and intelligent handling, meeting compliance audit requirements: Existing technologies have independent semantic parsing, graph construction, and response orchestration modules with no bidirectional linkage and iteration logic; this invention builds a complete closed-loop link of "secondary semantic verification - risk recalculation - topology update - path rescheduling", with automatic verification of handling effects and autonomous iteration of risk models, forming an integrated closed-loop operation system of "data access - semantic parsing - correlation modeling - risk quantification - intelligent handling - effect verification - model update"; all alarms, graph snapshots, handling logs, and verification records throughout the process are automatically archived and retained, fully meeting the security operation audit retention requirements stipulated by Level 3 Information Security Protection and the Data Security Law, with a risk handling closed-loop rate of up to 100%.

[0026] 6. The solution is highly versatile and scalable, adaptable to various security operation scenarios: The semantic engine of this invention can continuously access logs from new vendors' devices and iteratively optimize new attack sample corpora; the security domain ontology library can add entity categories and subcategories as needed; the response action set can add device handling actions such as industrial firewalls, IoT gateways, and cloud-native security components; the entire method and system can be adapted to various security operation scenarios such as government and enterprise intranets, public clouds, private clouds, industrial internet, government networks, and IoT terminals, without scenario binding restrictions, and has a wide range of commercial application scenarios. Attached Figure Description

[0027] Figure 1 This is the overall flowchart of the present invention.

[0028] Figure 2 This is a system framework diagram of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0030] Example 1

[0031] Reference Appendix Figure 1 This application provides a method for semantic orchestration of security risks. This method transforms massive amounts of heterogeneous raw security data into executable, precise, and scenario-based security actions through a series of coherent, automated, and intelligent technical steps, while simultaneously achieving continuous accumulation and closed-loop optimization of security knowledge. The specific implementation steps are as follows.

[0032] S1: Obtain cross-source security awareness data.

[0033] In one embodiment of this application, cross-source security awareness data refers to raw data collected from various types and vendors of security devices or platforms for the purpose of perceiving security risk status. This includes, but is not limited to, security device alarms and logs, vulnerability and configuration information, threat intelligence, and other security-related data. Security device alarms and logs include, but are not limited to, firewall logs, intrusion detection system (IDS) / intrusion prevention system (IPS) alarms, endpoint detection and response (EDR) system alarms, security information and event management (SIEM) platform data, and log auditing platform data. Vulnerability and configuration information includes, but is not limited to, vulnerability scanner reports (such as reports generated by Nessus, Qualys, etc.) and asset configuration management database (CMDB) data. Threat intelligence includes, but is not limited to, threat intelligence platform data (such as threat indicators and event descriptions from platforms such as MISP). Other security-related data includes, but is not limited to, traffic metadata and authentication records.

[0034] S2: Process cross-source security awareness data through a semantic parsing engine adapted to the security domain, and output a standardized set of security elements.

[0035] In one embodiment of this application, the semantic parsing engine is a time-aware multi-task hybrid deep learning architecture optimized for the security vertical domain. This architecture is a BERT-BiLSTM-CRF model incrementally fine-tuned using security logs and ATT&CK tactical corpora. The BERT layer provides general semantic understanding capabilities, while the BiLSTM layer extracts cross-field attack temporal dependency features within long text alerts (e.g., attack sequences like "scan first, then log in, then upload files"). The CRF layer performs parallel joint decoding of security element extraction, alert semantic classification, and attack tactical label recognition, synchronously outputting temporal feature vectors used to construct the dynamic causal relationship logic. This not only improves the performance of each subtask but also synchronously outputs important intermediate representations for constructing dynamic causal relationships.

[0036] In one embodiment of this application, the present invention addresses the shortcomings of general pre-trained models in recognizing security terminology and lacking attack timing features by adopting a layered model architecture: A Chinese BERT-base is used as the basic word embedding base. A million-level security domain annotated corpus is constructed by collecting firewall logs, EDR alerts, vulnerability reports, ATT&CK full tactical descriptions, public threat intelligence, and historical enterprise security work orders. Incremental pre-training is performed on the BERT base to improve the model's accuracy in recognizing professional terms such as vulnerability numbers, attack methods, asset types, and ATT&CKTTP. A bidirectional long short-term memory network (BiLSTM) is superimposed on the upper layer to specifically capture the attack sequence logic across multiple lines and fields in long alert texts, outputting a timing feature vector that is directly supplied to the correlation modeling module to deduce the causal attack chain. The top-level CRF conditional random field layer enables multi-task joint decoding, outputting three types of structured data—security entities, alert risk categories, and ATT&CK tactical tags—in one go, eliminating the need for multiple rounds of model inference and improving inference efficiency by over 60%.

[0037] S3: Based on a pre-defined security domain concept mapping system, it maps a set of standardized security elements into standard security entities with globally unique identifiers.

[0038] In one embodiment of this application, the security domain concept mapping system adopts a three-layer hierarchical ontology architecture, consisting of a domain category layer, a sub-category layer, and a standard instance layer from top to bottom. The domain category layer includes six types of entities: assets, threats, attack behaviors, security protection, account subjects, and compliance management. The mapping between standardized security elements and standard instances adopts a hierarchical vector matching strategy, performing coarse matching of categories and precise matching of instances in sequence. Only when the cosine similarity corresponding to the two matches is not lower than a preset threshold (such as 0.85 or higher) is the normalized mapping of heterogeneous security elements to the standard security entities completed.

[0039] In one embodiment of this application, the present invention constructs a hierarchical ontology knowledge base. The top-level major category layer divides six major security core entity categories, the middle-level sub-category layer further subdivides the major categories, and the bottom-level standard instance layer stores the standard name, synonym description, and attribute fields of each entity category. The mapping process consists of two levels of matching: the first step is to perform a coarse match between the security element vector output by the semantic engine and the major category vector to filter the entity category and narrow the matching range; the second step is to calculate the cosine similarity between the corresponding major category and the bottom-level standard instance vector. The mapping is considered successful only when both levels of similarity exceed a preset threshold (preferably 0.85), effectively avoiding cross-category erroneous matching and improving the accuracy of heterogeneous device entity normalization mapping to over 98%; after the mapping is completed, a globally unique ID is assigned to each standard security entity to unify the entity identification across the entire platform.

[0040] S4: Based on multi-dimensional association rules that include at least two types of association logic, such as static subordination, dynamic causality, and spatiotemporal co-occurrence, mine the association relationships between standard security entities and generate structured association data.

[0041] In one embodiment of this application, the multi-dimensional association rule integrates static subordinate association logic, dynamic causal association logic, and spatiotemporal co-occurrence association logic. The dynamic causal association logic relies on the attack temporal semantic features output by the semantic parsing engine to construct a progressive attack transmission link in order to distinguish between static asset subordinate relationships and instantaneous spatiotemporal co-occurrence associations.

[0042] (1) Static subordinate relationship logic: Based on the enterprise CMDB asset ledger, business system deployment list and account permission table, static subordinate relationship is constructed to generate a fixed subordinate relationship of "business system-host terminal-operation and maintenance account-system vulnerability".

[0043] (2) Dynamic causal relationship logic: Receive the attack time sequence feature vector output by the semantic engine, identify multi-stage attack behaviors in chronological order, and construct a progressive causal transmission link of "brute force cracking → abnormal login → malicious file landing → lateral penetration". Only this invention can automatically mine hidden chain attacks based on semantic time sequence features.

[0044] (3) Spatiotemporal co-occurrence association logic: Set configurable time window and intranet segment range. Multiple alarm entities that are triggered synchronously within the same window and the same segment establish co-occurrence association to identify group risks such as mass scanning and mass demolition by gangs.

[0045] The three types of association logic are calculated independently and generated in parallel, comprehensively covering three types of security association scenarios: static asset relationships, dynamic attack chains, and batch synchronization risks.

[0046] S5: Construct a dynamically evolving security risk association topology model using standard security entities as nodes and the association relationships defined by structured associated data as edges.

[0047] In one embodiment of this application, the structured association data is a quadruple data containing source entity identifier, association type, target entity identifier, and comprehensive association confidence; the comprehensive association confidence is calculated by weighted fusion of semantic element matching similarity, attack sequence matching overlap, and spatiotemporal window overlap coefficient; the weight coefficients of each dimension are adaptively adjusted according to the asset importance level corresponding to the source entity and target entity, and the weight of the attack sequence matching dimension corresponding to high-value assets is automatically increased.

[0048] It should be noted that the comprehensive association confidence score is a weighted and fused comprehensive indicator, whose calculation factors include at least "semantic element matching similarity," "attack sequence matching overlap," and "spatiotemporal window overlap coefficient." To reflect security priorities, this weight can be dynamically and adaptively adjusted based on the "importance level" of the assets corresponding to the source and target entities. For example, when high-value assets such as servers are involved, the weight of the attack sequence dimension will automatically increase because step-by-step attacks (dynamic causal relationships) targeting core assets are more harmful.

[0049] Traditional association data only uses a triplet structure without quantitative confidence values, making it impossible to distinguish the strength of association relationships. This invention adds a comprehensive association confidence field, integrating semantic, temporal, and spatiotemporal dimensions for weighted calculation. At the same time, the weights are dynamically and adaptively adjusted, with the temporal causal association weights corresponding to high-value assets such as core businesses automatically increased, prioritizing the identification of chain attack risks on core assets and avoiding the underestimation of the risks of high-value assets.

[0050] S6: Based on the topology and node attributes of the security risk association topology model, calculate the global risk quantification value of the corresponding security event.

[0051] In one embodiment of this application, the security risk association topology model is configured with an event-driven incremental update mechanism. The event-driven incremental update mechanism includes two types of execution logic: when new cross-source security awareness data is accessed, nodes and associated edges are incrementally added to the security risk association topology model; when security response execution feedback results are obtained, the risk weight, handling status, and confidence of associated edges of the corresponding nodes in the security risk association topology model are updated synchronously.

[0052] This invention uses a graph database to store the topology model, supporting real-time incremental writing without requiring offline full graph reconstruction. It sets two types of trigger update events: new security data access events and security handling completion feedback events. When a new alarm is added, entity nodes are automatically added and related edges are supplemented. After handling, the node risk score, handling status, and association confidence are modified based on the secondary semantic verification results, achieving real-time synchronization between the risk topology model and the actual network security status, thus solving the shortcomings of traditional graph offline updates and status lag.

[0053] In one embodiment of this application, the global risk quantification value is calculated by a random walk iterative algorithm that introduces an asset weight bias term. The calculation process uses the comprehensive association confidence of the associated edges as the risk transmission weight and the importance level of the node assets as the bias coefficient, and iteratively diffuses the risk score along the association links of the security risk association topology model. For the transmission links with the dynamic causal association, a dedicated risk amplification coefficient is configured to perform weighted amplification calculation on the chain-like penetration attack risk.

[0054] Traditional random walk algorithms lack asset bias and chain attack amplification mechanisms. This invention introduces dual optimizations during the iterative calculation process: First, the asset importance level is used as the basic bias coefficient, resulting in a higher initial risk base for core assets; second, a risk amplification coefficient is superimposed after identifying dynamic causal attack chains, which multiplies the risk score of chain penetration. The system prioritizes pushing chain intrusion alerts for high-value assets, significantly reducing the probability of missed detections of advanced penetration attacks.

[0055] S7: Based on semantic tags and global risk quantification values, adaptively schedule the preset set of security response actions to generate a security response execution path that is adapted to the current scenario.

[0056] In one embodiment of this application, an adaptive scheduling preset set of security response actions is configured with hierarchical differentiated orchestration logic to generate a security response execution path; multiple risk levels are divided according to the global risk quantification value; high-risk levels call multiple types of blocking response actions in parallel to form a multi-layer protection link; medium-risk levels execute core handling actions serially according to the attack causal time sequence; low-risk levels reduce active handling actions and only retain log archiving and alarm retention processes; different risk levels reuse the same set of response actions to complete dynamic process tailoring without the need to pre-configure multiple independent handling templates.

[0057] The adaptive scheduling process employs a hierarchical, differentiated orchestration logic. Based on a calculated global risk quantification value (e.g., categorized into high, medium, and low levels), it dynamically tailors and organizes the same set of basic security response actions. For high-risk events, the scheduling module concurrently activates multiple blocking actions (such as isolating hosts and blocking IPs) to quickly block attacks. For medium-risk events, core handling actions are executed sequentially according to the causal sequence of the attack (e.g., patching vulnerabilities before restoring connections). For low-risk events, most proactive handling actions are omitted, retaining only log records and alarm information. This approach avoids the tediousness of maintaining multiple independent scripts for each scenario, achieving high flexibility and adaptability.

[0058] This invention maintains only one set of standardized security response actions, including basic actions such as IP blocking, host isolation, weak password reset, vulnerability scanning, malicious file removal, manual work order push, and log archiving. The system automatically classifies risks into high, medium, and low levels based on the global risk quantification value, dynamically adds or deletes, and adjusts action nodes in parallel or sequentially. High-risk actions are blocked in parallel, while low-risk actions are only archived. There is no need to manually maintain multiple independent handling templates, reducing template maintenance workload by more than 80%.

[0059] S8: Execute the security response execution path and update the state of the corresponding node in the security risk association topology model based on the feedback results after execution, thus completing the closed-loop handling of security risks.

[0060] In one embodiment of this application, the feedback update process of closed-loop handling forms a self-correcting feedback link of semantic secondary verification, global risk recalculation, topology model update, and response path rescheduling; cross-source security awareness data after handling is collected and input into the semantic parsing engine to verify the convergence status of similar risks; if the verification determines that the risk has not converged, the risk score of the corresponding node and the risk amplification coefficient of the causal link are increased, and a security response execution path with a higher protection level is rematched; if the verification determines that the risk has fully converged, the handling status of the topology node is locked and the risk transmission weight of the corresponding link is frozen.

[0061] The closed-loop handling process includes a self-correcting feedback loop. After executing a security response action, the system re-collects security awareness data and uses the semantic parsing engine again to verify the convergence status of similar risks. If the risk is not eliminated (i.e., "not converged"), the system performs a series of upgrade operations: for example, increasing the risk score of relevant nodes in the graph, increasing the "risk amplification coefficient" of relevant causal links, and re-matching an execution path with a higher protection level (e.g., more stringent, more actions). Conversely, if the risk is determined to be "converged," the "handled" status of the corresponding node is locked, and its ability to propagate risk outwards in the graph is frozen. This "learning-adjustment" mechanism enables the system to continuously evolve in actual combat.

[0062] Existing technologies lack standardized verification and iteration processes after handling, while this invention establishes a complete self-correcting closed loop: after handling is completed, the entire network security awareness data is re-collected and sent to the semantic engine for secondary verification to determine whether similar alarms have disappeared; if the risk has not converged, the risk weight is automatically increased and a higher-intensity handling process is regenerated; if the risk has fully converged, the node status is locked and the risk transmission value of the link is permanently frozen, completing the closed loop of the entire life cycle of a single risk, realizing the system's autonomous iterative optimization, and eliminating the need for manual review of the handling effect.

[0063] By combining steps S1-S8 above, and constructing an integrated security risk management system that is semantically unified, intelligently correlated, and dynamically closed-loop, the core pain points of traditional security operations—data silos, alarm noise, inefficient handling, and rigid responses—have been successfully addressed. The security operation model has been upgraded from relying on human experience and fragmented responses to an intelligent collaborative paradigm based on a global risk profile, data-driven approaches, and self-optimization. This achieves a closed-loop process from threat perception to automated handling, enabling efficient, accurate, and autonomous responses to complex and ever-changing modern cyber threats.

[0064] Example 2

[0065] Please see Figure 2 To implement the method described in Embodiment 1, the present invention also provides a security risk semantic orchestration processing system, which includes: a unified security semantic model module, a security entity mapping module, an association modeling module, a risk graph construction and risk calculation module, a scene orchestration engine module, and a closed-loop operation module.

[0066] In one embodiment of this application, a unified security semantic model module is used to acquire cross-source security awareness data, process the cross-source security awareness data through a security domain-adapted semantic parsing engine, and output a standardized set of security elements.

[0067] In one embodiment of this application, the security entity mapping module is connected to the unified security semantic model module and is used to map a set of standardized security elements into standard security entities with globally unique identifiers based on a preset security domain concept mapping system.

[0068] In one embodiment of this application, the association modeling module is connected to the security entity mapping module and is used to mine the association relationship between standard security entities and generate structured association data based on multi-dimensional association rules that include at least two types of association logic, such as static subordination, dynamic causality, and spatiotemporal co-occurrence.

[0069] In one embodiment of this application, the risk graph construction and risk calculation module is connected to the association modeling module. It is used to construct a dynamically evolving security risk association topology model with standard security entities as nodes and association relationships defined by structured association data as edges. Based on the topology and node attributes of the security risk association topology model, it calculates the global risk quantification value of the corresponding security event.

[0070] In one embodiment of this application, the scene orchestration engine module is connected to the risk graph construction and risk calculation module, and is used to adaptively schedule a preset set of security response actions based on semantic tags and global risk quantification values ​​to generate a security response execution path that is adapted to the current scene.

[0071] In one embodiment of this application, the closed-loop operation module is connected to the scene orchestration engine module and the risk graph construction and risk calculation module, respectively, and is used to execute the security response execution path and update the state of the corresponding node in the security risk association topology model based on the feedback results after execution, so as to complete the closed-loop handling of security risks.

[0072] The following implementation case of a company's security operations center provides a complete and detailed description of the invention. This implementation case is only used to explain the invention and is not intended to limit the scope of protection of the invention.

[0073] 1. System Overall Deployment and Environment Preparation

[0074] This system can be deployed on a company's Security Operations Center (SOC) physical server cluster, or on a private or public cloud platform using containerization technologies (such as Docker and Kubernetes). The system needs to receive logs from at least three different types of security data sources: firewalls (such as Fortinet and Palo Alto Networks), intrusion detection systems (such as Suricata and Snort), endpoint detection and response systems (such as Crowd Strike Falcon and Microsoft Defender), vulnerability scanners (such as Nessus and Qualys), and threat intelligence platforms (such as MISP). This massive, heterogeneous, cross-source security awareness data can be accessed via Syslog, Kafka message queues, or REST APIs.

[0075] 2. Detailed implementation of each module

[0076] (1) Unified Security Semantic Model Module

[0077] The core of this module is to implement a deep learning model based on the PyTorch framework. The specific architecture is as follows:

[0078] BERT layer: BERT-base-chinese is used as the base model, but it undergoes continuous incremental pre-training in the security domain. The incremental pre-training corpus includes:

[0079] 1) Vulnerability description text extracted from publicly available vulnerability databases (such as CVE, NVD).

[0080] 2) Detailed descriptions of tactics, techniques, and sub-techniques in the MITREATT&CK matrix.

[0081] 3) Open source threat intelligence reports (such as the MISP incident description) and analysis articles from major vendors' security blogs.

[0082] 4) Collected internal real desensitized safety alarm samples.

[0083] By continuously learning from these corpora, the BERT layer is able to better encode the semantics of security-specific terms (such as "DLL sideloading", "credential dumping", and "golden ticket attack") into its vector space.

[0084] BiLSTM Layer: A two-layer bidirectional long short-term memory (BiLSTM) network. Security alert logs are often long text sequences containing multiple fields such as timestamps, source IPs, target IPs, actions, and results. The BiLSTM layer is specifically designed to capture the order and dependencies between these fields. For example, for an alert "User admin initiated SSH login attempts on host B port 22 from IPA, failing 50 times consecutively," the BiLSTM model can learn the time-series characteristics of the attack behavior pattern "user-action-target-number of attempts."

[0085] CRF Layer: A Conditional Random Field (CRF) layer. This layer ensures high-quality, structured output from the model. It accepts feature vectors from the BiLSTM layer and, during a single forward propagation, collaboratively optimizes three decoding tasks: ① Named Entity Recognition (NER) task: Identifies and labels security entities in alerts, such as user (admin, type: USER), source IP (A, type: IP), target asset (B, type: HOST), and abnormal actions (SSH login failure, type: ACTION). ② Semantic Classification (SC) task: Classifies the entire alert and outputs alert labels such as "brute force," "lateral movement," and "data breach." ③ Attack Tactics Labeling (ATT) task: Further aligns with the ATT&CK framework, outputting corresponding tactical stage labels such as "initial access" and "credentialed access."

[0086] Training and Inference: The annotation team prepared an annotated dataset containing tens of thousands of security logs, with labels covering the three tasks mentioned above. The model used the Adam optimizer, fine-tuned end-to-end with a weighted sum of cross-entropy and CRF loss functions as the total loss function. During the inference phase, the model outputs a triple: a structured set of security entities (list), semantic labels (strings), and a normalized semantic feature vector (Float32 array), which can be used for subsequent dynamic causal association analysis.

[0087] (2) Security Entity Mapping Module

[0088] This module is responsible for mapping the heterogeneous security elements identified in the previous step to a unified knowledge representation (i.e., "standard security entity"), ensuring that the system "speaks the same language".

[0089] Construction of a three-tiered entity ontology library:

[0090] Design the following three-tier structure using OWL (Web Ontology Language) or a custom JSON Schema format:

[0091] 1) Domain Category Layer: Defines six top-level concept classes:

[0092] Assets: such as hosts, servers, and containers.

[0093] Threats: such as malware and vulnerabilities.

[0094] Attack behaviors: such as scanning, brute-force attacks, and penetration testing.

[0095] Security protection: such as firewall policies and antivirus software features.

[0096] Account holder: such as user, group, or service account.

[0097] Compliance management: such as the provisions of the Information Security Law and the provisions of the Data Security Law.

[0098] 2) Sub-class layer: Refine each major category. For example, under "Attack Behavior", further define sub-classes such as "Credential Attack" and "Lateral Movement".

[0099] 3) Standard Instance Layer: Define a standard name and a globally unique ID for each final concrete entity. For example, define a standard instance "OS: Windows Server 2019" (ID: uuid-001) for the operating system type.

[0100] Implementation of hierarchical vector matching strategy:

[0101] Assume the model outputs an entity "Win Srv 2019". The mapping process is as follows:

[0102] The first step is coarse matching by major categories: Similarity calculation is performed between the entity's text and representative words from six major categories. A pre-trained sentence-transformers model is used to convert "Win Srv 2019" and the definition text of each major category (such as "host operating system, server, etc.") into vectors, and cosine similarity is calculated. At this point, the highest similarity (e.g., 0.9) is found with the "asset" category, so it is mapped to the "asset" category.

[0103] Step 2: Precise instance matching: Retrieve all instances related to operating systems from the standard instance library of major asset categories. Perform cosine similarity calculation between the vector of "Win Srv 2019" and the vectors in the library such as "OS: Windows Server 2019" (vector v1) and "OS: Ubuntu 20.04" (vector v2). Assume the similarity with v1 is 0.98, and the similarity with v2 is only 0.2.

[0104] Step 3: Threshold judgment: The threshold is set to 0.85. Since the similarity of the major category matching in the first step is 0.9 > 0.85, and the similarity of the instance matching in the second step is 0.98 > 0.85, and both steps meet the threshold, the heterogeneous description "Win Srv 2019" is finally successfully mapped to the standard entity "OS: Windows Server 2019 (uuid-001)".

[0105] (3) Correlation modeling module

[0106] The task of this module is to mine the logical relationships between the mapped standard entities, so as to provide "edge" data for constructing the risk graph.

[0107] Static subordinate association logic: Automatically constructed based on the asset configuration management database (CMDB) actively maintained by users. By synchronizing CMDB data regularly, the system automatically generates fixed and long-standing subordinate relationships such as <Web Server-A, belongs to service, e-commerce platform, 1.0> and <User: admin, has account on, Host-X, 1.0>. A confidence level (1.0) indicates that this is an exact asset attribute relationship.

[0108] Dynamic causal association logic: The "attack timing feature vector" extracted by the BiLSTM layer in the unified semantic parsing engine is utilized. Assume that the system sequentially identifies two attack behaviors within a short time window (e.g., 5 minutes): ① The entity "Action: SSH brute-force cracking" occurs, and the victim is "Host: A". ② The entity "User: compromised_account" successfully logs in to "Host: B".

[0109] Using the timestamp sequences of these events and their corresponding timing feature vectors, the system trains a small causal relationship inference model. This model can judge whether event ① may "cause" event ② based on feature similarity and time interval. If the inference holds, structured data <Action: SSH brute-force cracking on Host: A, causes, User: compromised_account logs in on Host: B, Confidence: 0.8> is generated, and the confidence level of 0.8 represents the certainty of the model's inference.

[0110] Spatio-temporal co-occurrence association logic: If a group of different security entities (e.g., from different hosts, generated by different attack behaviors) appear simultaneously in the same network segment (e.g., 192.168.1.0 / 24) and within a very short time window (e.g., 10 seconds), they are considered to have a "co-occurrence" association even if there is no clear causal logic at present. For example, if three hosts under the same switch receive a large number of ICMP flood attack packets at the same time, an association will be established between them: <Host1 receives ICMP Flood, co-occurs with, ICMP scanning activity, Confidence: 0.7>.

[0111] Generation of structured association data: All quadruples <source entity ID, association type, target entity ID, comprehensive association confidence> generated by the three types of association logic are uniformly stored in the edge table of the graph database. Among them, the calculation factors (semantics, time sequence, asset importance) of dynamic causal association are weighted according to preset weights to obtain the final confidence.

[0112] (4) Risk graph construction and risk calculation module

[0113] Construction of graph model: Select the Neo4j graph database as the carrier. Each mapped standard security entity is taken as a "Node" in the graph, and each quadruple association data is taken as an "edge" connecting two nodes. The attributes of the edge include type (association type), confidence (comprehensive association confidence) and time stamp (association generation time).

[0114] Implementation of risk quantification algorithm: A risk propagation algorithm based on "random walk" is implemented. The key parameters of the algorithm are set as follows:

[0115] Initial node risk: The threat score from the original alert (e.g., CVSS score) or the initial system setting.

[0116] Asset importance coefficient: A bias term predefined by the administrator for each asset according to the service. The weight of the core database server may be 5.0, and that of an ordinary office terminal may be 1.0.

[0117] Propagation weight: That is, the confidence of the association edge. The higher the confidence, the closer the association between the two nodes, and the easier the risk propagates.

[0118] Risk amplification coefficient: Specifically for edges of the "dynamic causal association" type, the propagation weight thereof is multiplied by a coefficient greater than 1 (e.g., 1.2), because the risk degree of attack chain propagation based on time sequence logic is higher.

[0119] The algorithm simulates the process of risk "walking" through the network, starting from a high-risk node (such as a detected WebShell entity) and according to the weights of the connecting edges. After the walk eventually stabilizes, each node receives a "global risk quantification value" (Global_Risk_Score) after global topology propagation. This score not only reflects the node's own initial risk but also the risk propagation effect from all surrounding related nodes and the amplification effect on asset importance.

[0120] (5) Scene orchestration engine module

[0121] This module translates calculated theoretical risks into actual safety actions. It employs open-source low-code orchestration tools but introduces a core mechanism of risk-driven and scenario-based tailoring.

[0122] Preset security response action set: This is a repository containing a large number of atomic actions.

[0123] Response path generation and dynamic trimming: The engine matches the (alarm label, global risk score) pair of each risk event with a preset hierarchical logic. Here, we take a simple level three risk as an example (threshold is configurable):

[0124] High risk (score > 90): Matches the "emergency blocking" scenario. The engine will select "Block source IP", "Isolate affected host", and "Immediately escalate alarm to NOC (Network Operations Center)" in parallel. These actions are executed by calling various security devices (firewall API, EDR console, etc.) and communication systems (DingTalk / WeChat Work / SMTP) in a concurrent request manner through predefined connectors.

[0125] Medium risk (60 < score ≤ 90): Matches the "Investigation and Remediation" scenario. The engine will execute actions sequentially according to the attack chain order given by the dynamic causal relationship graph. For example, if the causal chain is "vulnerability exploited → backdoor implanted", the engine will first trigger Action_Patch Vuln(vuln_id) to fix the vulnerability, and then terminate the backdoor process through Action_Kill Process(host name, process_name). At the same time, a medium-priority work order will be generated and assigned to the secondary analyst.

[0126] Low risk (score ≤ 60): Matches the "Alert observation only" scenario. In this case, the orchestration engine will trim the general process, omitting all active blocking and repair actions. Only Action_Log Only(event_id) and Action_Create Low Alert Ticket(ticket_data) will be executed. This records the low-risk event for subsequent auditing without consuming excessive automation resources.

[0127] (6) Closed-loop operation feedback module

[0128] Verification process: After completing a series of actions, the module does not end the task directly. Instead, it actively starts an "observation mode" and, within the next 30 minutes (time window is configurable), acquires new security awareness data of the target and related network areas and inputs it into the unified semantic model for semantic analysis.

[0129] Feedback Links: 1) Risk Convergence Determination: If the system subsequently detects no more attack signals, abnormal logins, or records of specific vulnerabilities being exploited again related to this event, it is determined that "risk has converged." Action: Immediately update the status of this event in the main process to "CLOSED." More importantly, update the risk graph - mark the Risk Score of the relevant "attack behavior" node as "Historical," and multiply the Confidence value of all its associated edges by a decay coefficient (e.g., 0.1), freezing the influence of these historical links in the current risk calculation so that they will not significantly interfere with the risk value calculation in the future. 2) Risk Non-convergence Determination: If the system detects new alarms related to or even variants of these alarms during the observation period (e.g., the attacker changes their IP or port to perform the same attack), it is determined that "risk has not converged." Action: This indicates that the automated handling is insufficient, or the attack behavior has changed. The system will perform a response escalation: a) Increase risk score and coefficient: Immediately increase the initial risk score of the relevant source node in the graph (such as the earliest attacked host) by one percentage point (e.g., +20%). Simultaneously, further increase the risk amplification coefficient of the causal relationship between it and other nodes (from 1.2 to 1.5) to indicate the "stubbornness" and "need for higher vigilance" of this attack chain. b) Rematch execution path: The orchestration engine rematches this event as a higher-level protection response, such as upgrading from a "medium-risk process" to a "high-risk process," triggering more stringent operations, or attempting to execute an alternative remediation script. c) Knowledge base update: This "risk not converged" case can be used as a new negative feedback sample, supplementing the training set of the unified semantic model, the rule base of the causal inference model, or the matching conditions of the scenario engine, making it more sensitive to or directly hit similar attack patterns in the future, achieving the system's self-learning and evolution.

[0130] In summary, the six modules of this system are linked sequentially, and data is transmitted between the modules through a standardized message bus. The closed-loop operation module bidirectionally connects with the scenario orchestration engine and the risk graph construction and risk calculation module to realize the reverse driving of graph updates through handling feedback, forming a complete integrated hardware and software operating architecture. It can be deployed as a local private security operation platform or packaged as a cloud SaaS security operation service.

[0131] The above description, in conjunction with specific embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such deductions or substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for semantic arrangement and processing of security risks, characterized in that, include: Acquire cross-source security awareness data; The cross-source security awareness data is processed by a semantic parsing engine adapted to the security domain, and a standardized set of security elements is output. Based on a pre-defined security domain concept mapping system, a set of standardized security elements is mapped into a set of standard security entities with globally unique identifiers; Based on multi-dimensional association rules that include at least two types of association logic, such as static subordination, dynamic causality, and spatiotemporal co-occurrence, we can mine the association relationships between standard security entities and generate structured association data. A dynamic, evolving security risk association topology model is constructed using standard security entities as nodes and the association relationships defined by structured associated data as edges. Based on the topology and node attributes of the security risk association topology model, the global risk quantification value of the corresponding security event is calculated. Based on semantic tags and global risk quantification values, the system adaptively schedules a set of preset security response actions and generates a security response execution path that is adapted to the current scenario. Execute the security response execution path and update the state of the corresponding node in the security risk association topology model based on the feedback results after execution, thus completing the closed-loop handling of security risks.

2. The security risk semantic arrangement and processing method according to claim 1, characterized in that, The semantic parsing engine is a time-aware multi-task hybrid deep learning architecture optimized for the security vertical domain. The time-aware multi-task hybrid deep learning architecture is a BERT-BiLSTM-CRF model that has been incrementally fine-tuned using security logs and ATT&CK tactical terminology corpora. The BiLSTM layer of the BERT-BiLSTM-CRF model is used to extract the time-dependent features of cross-field attacks within long text alarms. The CRF layer of the BERT-BiLSTM-CRF model performs security element extraction, alarm semantic classification, and attack tactical label recognition in parallel, and synchronously outputs the time-series feature vector used to construct the dynamic causal association logic.

3. The security risk semantic arrangement and processing method according to claim 1, characterized in that, The security domain concept mapping system adopts a three-layer hierarchical ontology architecture, consisting of a domain category layer, a sub-category layer, and a standard instance layer from top to bottom. The domain category layer includes six types of entities: assets, threats, attack behaviors, security protection, account subjects, and compliance management. The mapping between standardized security elements and standard instances adopts a hierarchical vector matching strategy, performing coarse matching of categories and precise matching of instances in sequence. Only when the cosine similarity corresponding to two matches is not lower than a preset threshold is the normalized mapping of heterogeneous security elements to the standard security entities completed.

4. The security risk semantic arrangement and processing method according to claim 1, characterized in that, The multi-dimensional association rules integrate static subordinate association logic, dynamic causal association logic, and spatiotemporal co-occurrence association logic. The dynamic causal association logic relies on the attack time sequence semantic features output by the semantic parsing engine to construct a progressive attack transmission link to distinguish between static asset subordinate relationships and instantaneous spatiotemporal co-occurrence associations.

5. The security risk semantic arrangement and processing method according to claim 1, characterized in that, The structured association data is a quadruple data containing source entity identifier, association type, target entity identifier, and comprehensive association confidence; the comprehensive association confidence is calculated by weighted fusion of semantic element matching similarity, attack sequence matching overlap, and spatiotemporal window overlap coefficient. The weight coefficients of each dimension are adaptively adjusted according to the asset importance level corresponding to the source entity and the target entity, and the weight of the attack timing matching dimension corresponding to high-value assets is automatically increased.

6. The security risk semantic orchestration processing method according to claim 1, characterized in that, The security risk association topology model is configured with an event-driven incremental update mechanism; the event-driven incremental update mechanism includes two types of execution logic: when new cross-source security awareness data is accessed, nodes and associated edges are incrementally added to the security risk association topology model; When obtaining the security response execution feedback results, the risk weight, handling status, and confidence of the associated edge of the corresponding node in the security risk association topology model are updated synchronously.

7. The security risk semantic arrangement processing method according to claim 1, characterized in that, The global risk quantification value is calculated by introducing a random walk iterative algorithm with an asset weight bias term; The calculation process uses the comprehensive association confidence of the associated edges as the risk transmission weight and the importance level of the node assets as the bias coefficient, and iteratively diffuses the risk score along the association links of the security risk association topology model. For transmission links with the aforementioned dynamic causal relationships, a dedicated risk amplification coefficient is configured to perform weighted amplification calculations on the risks of chain-type penetration attacks.

8. The security risk semantic orchestration processing method according to claim 1, characterized in that, The adaptive scheduling preset set of security response actions is configured with hierarchical differentiated orchestration logic to generate security response execution paths; Based on the aforementioned global risk quantification value, multiple risk levels are divided; High-risk levels invoke multiple blocking response actions in parallel to form a multi-layered protection chain; medium-risk levels execute core handling actions sequentially according to the cause-and-effect sequence of the attack; low-risk levels reduce proactive handling actions and only retain log archiving and alarm retention processes; different risk levels reuse the same set of response actions to complete dynamic process tailoring, without the need to pre-configure multiple independent handling templates.

9. The security risk semantic arrangement and processing method according to claim 1, characterized in that, The closed-loop processing feedback update process forms a self-correcting feedback link of semantic secondary verification, global risk recalculation, topology model update, and response path rescheduling; cross-source security awareness data after processing is collected and input into the semantic parsing engine to verify the convergence status of similar risks; If the risk assessment fails to converge, the risk score of the corresponding node and the risk amplification coefficient of the causal link will be increased, and a security response execution path with a higher protection level will be re-matched. If the verification and judgment of risks are fully converged, the handling status of the topology nodes is locked and the risk transmission weight of the corresponding links is frozen.

10. A security risk semantic orchestration and processing system, characterized in that, include: The unified security semantic model module is used to acquire cross-source security awareness data, process the cross-source security awareness data through a security domain-adapted semantic parsing engine, and output a standardized set of security elements. The security entity mapping module, connected to the unified security semantic model module, is used to map a set of standardized security elements into standard security entities with globally unique identifiers based on a preset security domain concept mapping system. The association modeling module, connected to the security entity mapping module, is used to mine the association relationships between standard security entities and generate structured association data based on multi-dimensional association rules that include at least two types of association logic, such as static subordination, dynamic causality, and spatiotemporal co-occurrence. The risk graph construction and risk calculation module, connected to the association modeling module, is used to construct a dynamically evolving security risk association topology model with standard security entities as nodes and association relationships defined by structured association data as edges. Based on the topology and node attributes of the security risk association topology model, it calculates the global risk quantification value of the corresponding security event. The scene orchestration engine module, connected to the risk graph construction and risk calculation module, is used to adaptively schedule a set of preset security response actions based on semantic tags and global risk quantification values, and generate a security response execution path that is adapted to the current scene. The closed-loop operation module is connected to the scenario orchestration engine module and the risk graph construction and risk calculation module, respectively. It is used to execute the security response execution path and update the status of the corresponding node in the security risk association topology model based on the feedback results after execution, so as to complete the closed-loop handling of security risks.

Images