A secure intent resolution virtual defense orchestration method, device, medium and product

Abstract

The application discloses a kind of safe intention analysis virtual defense programming methods, equipment, medium and product, the method includes: the unified evidence object of target multi-source security evidence normalization generation is generated;Input large language model generates candidate safe intention;Convert security intention intermediate representation and calculate credibility;When the credibility meets threshold value, obtain asset topology and access control strategy, according to defense target and constraint determined compilation generation contains action node and compensation edge virtualization defense action graph;Accordingly, construct pre-execution reachability matrix and extract malicious path, in digital twin environment application action graph generates execution reachability matrix, according to compensation edge rollback exercise generates rollback reachability matrix;When pre-rehearsal determination meets, action graph is issued to target network environment by range gradually expanding stage by stage, trigger rollback and execute node-level compensation rollback according to compensation edge;The technical scheme of the embodiment of the application can improve accuracy and safety, realize defense controllable and backout and business continuity.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, and in particular to a method, device, medium, and product for security intent parsing virtual defense orchestration. Background Technology

[0002] As cyberattacks become increasingly automated and intelligent, traditional security operation models relying on manual analysis and fixed rules are no longer sufficient to cope with high-frequency and ever-changing advanced threats. Large language models, with their powerful semantic understanding and reasoning capabilities, offer a new technical approach for security intent parsing and automated defense orchestration. However, large language models suffer from issues such as illusion, instability, and uninterpretability when generating security decisions. Ensuring the verifiability, controllability, and rollbackability of security intents generated by large language models, and reliably converting these intents into actionable defensive actions, has become a core technical challenge hindering the practical application of intelligent security orchestration technology.

[0003] In existing technologies, achieving automated security defense orchestration mainly relies on the following methods: First, security orchestration and automated response methods based on expert rules and predefined scripts. These methods depend on manually pre-written, fixed rules, making it difficult to cover unknown attack patterns. Furthermore, the rules have high maintenance costs and poor adaptability to complex and dynamic network environments. Second, methods that directly generate security response commands or call defense interfaces from large language models. While these methods offer some flexibility, the model outputs are inherently uncertain. If errors are generated or malicious commands are injected, misoperations will occur. Moreover, the lack of effective verification mechanisms and rollback methods makes it difficult to guarantee security. Third, response methods based on traditional machine learning models for threat detection combined with manual approval. These detection models rely on a large number of labeled samples, have limited generalization capabilities, and the manual approval process leads to response delays, making it difficult to meet real-time defense requirements. Summary of the Invention

[0004] This invention provides a method, device, medium, and product for virtual defense orchestration based on security intent parsing, in order to solve the problems of untrusted security intents generated by large language models and the difficulty in secure rollback of automatic defenses.

[0005] According to one aspect of the present invention, a method for orchestrating virtual defenses to resolve security intent is provided, the method comprising: Acquire multi-source security evidence of the target, and normalize the multi-source security evidence of the target to generate a unified evidence object of the target, wherein the unified evidence object of the target contains corresponding evidence anchor points; The target unified evidence object is input into a pre-trained large language model to generate candidate security intents; The candidate security intent is converted into an intermediate security intent representation, and the credibility of the intermediate security intent representation is calculated according to a preset multidimensional credibility evaluation index. The key fields of the intermediate security intent representation are bound to evidence anchors or marked as large language model inference fields. When the trustworthiness meets the automatic execution threshold, the asset topology and current access control policy of the target network environment are obtained, and a virtualized defense action graph containing action nodes and compensation edges is generated from the virtualized defense resource catalog according to the defense target and constraint set in the intermediate representation of the security intent through preset deterministic compilation rules. Based on the asset topology and existing access control policies, a pre-execution reachability matrix is ​​constructed. A set of malicious paths is extracted from the pre-execution reachability matrix. The virtualized defense action graph is applied in a preset virtual defense digital twin environment to generate a post-execution reachability matrix. A rollback exercise is performed according to the compensation edge to generate a rollback reachability matrix. When the pre-execution reachability matrix, malicious path set, post-execution reachability matrix and post-rollback reachability matrix are pre-executed and the pre-execution conditions are met, the virtualized defense action map is distributed to the target network environment in stages along the direction of progressively expanding execution range. When the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge.

[0006] According to another aspect of the present invention, a security intent parsing virtual defense orchestration apparatus is provided, the apparatus comprising: The evidence normalization module is used to acquire target multi-source security evidence and normalize the target multi-source security evidence to generate a target unified evidence object, wherein the target unified evidence object contains corresponding evidence anchor points. The candidate intent generation module is used to input the target unified evidence object into a pre-trained large language model to generate candidate security intents; The intent parsing and evaluation module is used to convert the candidate security intent into an intermediate representation of the security intent, and calculate the credibility of the intermediate representation of the security intent according to a preset multidimensional credibility evaluation index, wherein the key fields of the intermediate representation of the security intent are bound to evidence anchors or marked as inference fields of a large language model. The action graph compilation module is used to obtain the asset topology and current access control policies of the target network environment when the trustworthiness meets the automatic execution threshold, and generate a virtualized defense action graph containing action nodes and compensation edges from the virtualized defense resource catalog according to the defense target and constraint set in the intermediate representation of the security intent through preset deterministic compilation rules. The digital twin pre-simulation module is used to construct a pre-execution reachability matrix based on asset topology and existing access control policies, extract a set of malicious paths from the pre-execution reachability matrix, apply the virtualized defense action graph in a preset virtual defense digital twin environment, generate a post-execution reachability matrix, and perform a rollback simulation according to the compensation edge to generate a rollback reachability matrix. The phased delivery and rollback module is used to deliver the virtualized defense action map to the target network environment in stages along the direction of progressively expanding execution range when the pre-execution reachability matrix, malicious path set, post-execution reachability matrix and post-rollback reachability matrix are pre-executed and the pre-execution conditions are met. When the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge.

[0007] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute a security intent parsing virtual defense orchestration method according to any embodiment of the present invention.

[0008] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement a security intent parsing virtual defense orchestration method as described in any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer program product is also provided, including a computer program / instructions that, when executed by a processor, implement the steps of the method as described in any embodiment of the present invention.

[0010] The technical solution of this invention involves acquiring multi-source security evidence of the target and performing normalization processing to generate a unified evidence object of the target. This unified evidence object is then input into a pre-trained large language model to generate candidate security intents. The candidate security intents are converted into intermediate representations of security intents, either by binding key fields to evidence anchors or by labeling them as fields inferred by the large language model. The credibility of these intermediate representations is calculated based on a preset multi-dimensional credibility evaluation index. When the credibility meets the automatic execution threshold, the asset topology and current access control policies of the target network environment are acquired. Based on the defense objectives and constraint sets in the intermediate representations of security intents, a virtualized defense action graph containing action nodes and compensation edges is generated from the virtualized defense resource catalog using preset deterministic compilation rules. This process is repeated based on the asset topology and current access control policies. The system constructs a reachability matrix before the execution of access control policies and extracts a set of malicious paths. In a pre-defined virtual defense digital twin environment, a virtualized defense action graph is applied to generate a reachability matrix after execution. A rollback exercise is then performed according to the compensation edges to generate a rollback reachability matrix. Based on the pre-execution reachability matrix, the set of malicious paths, the post-execution reachability matrix, and the rollback reachability matrix, a pre-executive judgment is performed. When the pre-executive conditions are met, the virtualized defense action graph is distributed to the target network environment in stages along the direction of progressively expanding execution scope. When the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edges. This solves the problems of unreliable security intent generated by large language models and the difficulty of secure rollback in automatic defense, achieving beneficial effects in improving the reliability, verifiability, and rollback capability of security handling.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a virtual defense orchestration method for security intent parsing provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of another security intent parsing virtual defense orchestration method provided in Embodiment 2 of the present invention; Figure 3 This is a flowchart of another security intent parsing virtual defense orchestration method provided in Embodiment 3 of the present invention; Figure 4This is an overall technical flowchart of a virtual defense orchestration method for security intent analysis based on evidence anchoring and digital twin pre-simulation in a specific scenario applicable to the embodiments of the present invention; Figure 5 This is a logical diagram illustrating the preprocessing of multi-source security evidence and the generation of an intermediate representation of security intent in a specific scenario applicable to an embodiment of the present invention. Figure 6 This is a schematic diagram of the structure for deterministic compilation and generation of virtualized defense action graphs in a specific scenario applicable to embodiments of the present invention; Figure 7 This is a logical diagram illustrating the pre-simulation and pre-simulation determination of a digital twin environment in a specific scenario applicable to the embodiments of the present invention; Figure 8 This is a schematic diagram of the process of phased distribution and node-level compensation rollback of virtualized defense action graphs in a specific scenario applicable to the embodiments of the present invention. Figure 9 This is a schematic diagram of a security intent parsing virtual defense orchestration device according to Embodiment 4 of the present invention; Figure 10 This is a schematic diagram of the structure of an electronic device that implements a security intent parsing virtual defense orchestration method according to an embodiment of the present invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] Example 1 Figure 1This is a flowchart of a security intent parsing virtual defense orchestration method provided in Embodiment 1 of the present invention. This embodiment is applicable to the case of automated security response and virtualized defense orchestration assisted by a large language model. The method can be executed by a security intent parsing virtual defense orchestration device, which can be implemented in hardware and / or software and is generally configured in an electronic device.

[0017] Correspondingly, such as Figure 1 As shown, the method includes: S110. Obtain target multi-source security evidence and normalize the target multi-source security evidence to generate a target unified evidence object, wherein the target unified evidence object contains corresponding evidence anchor points.

[0018] In this context, multi-source security evidence can be understood as raw data related to security events collected from multiple sources, such as hosts, network devices, security devices, identity authentication systems, and threat intelligence platforms. Evidence anchors can be understood as unique identifiers within a unified evidence object used to locate and trace the source of evidence. These include evidence identifiers, source identifiers, timestamps, field paths or text spans, integrity hashes, source trustworthiness, and anonymization markers. Evidence anchors are used to establish verifiable binding relationships between key fields in the intermediate representation of security intent and the original evidence.

[0019] In this embodiment, during security operations, original evidence related to cyberattacks is obtained from multiple sources. The format, field meanings, and time standards of this evidence often differ, necessitating normalization to convert the original evidence from different sources into a unified, semantically consistent target evidence object. Each unified target evidence object carries an evidence anchor point, which uniquely identifies the source location, time information, and content location of the evidence. This allows subsequent security intents to be precisely traced back to the original evidence, ensuring that security decisions are based on solid evidence.

[0020] S120. Input the target unified evidence object into a pre-trained large language model to generate candidate security intents.

[0021] In this context, generating candidate security intents can be understood as a description of defense requirements expressed in natural language or structured semantics, generated by a large language model based on the target unified evidence object. This description expresses the desired defense effect or security objective. Candidate security intents do not contain specific network device execution commands and do not directly trigger any network operations.

[0022] In this embodiment, the target unified evidence object is provided as input to a pre-trained large language model. The large language model possesses strong semantic understanding and reasoning capabilities, enabling it to comprehensively identify ongoing attack behaviors or potential threats from multiple evidence objects and generate candidate security intents accordingly. A candidate security intent is a semantic description oriented towards a security objective, used to express the desired defensive effect, such as blocking malicious propagation paths or protecting critical business assets. However, it does not yet contain specific network device instructions and therefore does not directly impact network operations.

[0023] S130. The candidate security intent is converted into an intermediate representation of the security intent, and the credibility of the intermediate representation of the security intent is calculated according to a preset multidimensional credibility evaluation index, wherein the key fields of the intermediate representation of the security intent are bound to evidence anchors or marked as large language model inference fields.

[0024] In this embodiment, candidate security intents need to be converted into a structured intermediate representation of security intents for subsequent machine-processable verification and decision-making. The intermediate representation of security intents consists of several key fields that describe elements such as protected assets, threat objects, defense targets, and constraints. For fields that can find corresponding evidence anchors in the target unified evidence object, they are bound to the evidence anchors to indicate that the field is supported by evidence; for fields that cannot be bound to evidence anchors, they are marked as large language model inference fields, indicating that the field originates from model speculation. After the conversion, the reliability of the intermediate representation of security intents is calculated based on preset multi-dimensional reliability evaluation indicators, comprehensively assessing the reliability of the security intent from multiple dimensions such as evidence coverage, cross-source consistency, model stability, baseline compatibility, and indication of injection risk.

[0025] S140. When the trustworthiness meets the automatic execution threshold, obtain the asset topology and current access control policy of the target network environment, and generate a virtualized defense action graph containing action nodes and compensation edges from the virtualized defense resource catalog according to the defense target and constraint set in the intermediate representation of the security intent through preset deterministic compilation rules.

[0026] Asset topology can be understood as a structured description of assets and their connections in the target network environment, reflecting the interconnectivity between asset nodes in the network. Current access control policies can be understood as the set of currently effective access control rules in the target network environment, including firewall policies, security group rules, and network ACLs. Current access control policies determine whether communication between assets is permitted and are a key basis for analyzing network reachability and constructing a reachability matrix. Defense objectives can be understood as a description of the desired security state extracted from the intermediate representation of security intent, indicating the final effect that automated defense orchestration needs to achieve, such as blocking specified malicious paths, isolating infected hosts, or limiting the lateral movement of threats.

[0027] A constraint set can be understood as the set of boundary conditions that defensive actions must satisfy during orchestration and execution, such as not affecting critical business paths, not interrupting specified services, and not exceeding resource capacity limits. The constraint set plays a restrictive role in both the compilation and execution phases of the virtualized defense action graph. Deterministic compilation rules can be understood as fixed transformation logic that converts the defense objectives and constraint sets in the intermediate representation of security intent into the virtualized defense action graph, ensuring that the same input always produces the same output. The virtualized defense action graph can be understood as a directed graph structure composed of action nodes and connecting edges, where action nodes represent specific defensive operations, and connecting edges include dependency edges, mutual exclusion edges, approval edges, and compensation edges. The virtualized defense action graph is the core product of defense orchestration, used to guide digital twin rehearsals and actual deployment and execution.

[0028] In this embodiment, the automated defense orchestration process is only allowed when the credibility of the intermediate representation of security intent reaches a preset automatic execution threshold. At this point, it is necessary to obtain the asset topology and current access control policies of the target network environment to understand the connectivity relationships between assets in the network and the currently effective access rules. Simultaneously, defense objectives and constraint sets are extracted from the intermediate representation of security intent. The defense objective indicates the desired security state, and the constraint set defines the boundary conditions that defense actions cannot violate. Subsequently, using preset deterministic compilation rules, suitable defense primitives are selected from the virtualization defense resource catalog and compiled into a virtualization defense action graph containing action nodes and compensation edges. Action nodes represent specific defense operations to be performed, and compensation edges represent the rollback operation paths corresponding to the action nodes.

[0029] S150. Construct a pre-execution reachability matrix based on asset topology and existing access control policies, extract a set of malicious paths from the pre-execution reachability matrix, apply the virtualized defense action graph in a preset virtual defense digital twin environment, generate a post-execution reachability matrix, and perform a rollback exercise according to the compensation edge to generate a rollback reachability matrix.

[0030] The pre-execution reachability matrix can be understood as a matrix constructed based on asset topology and existing access control policies before the execution of the virtualized defense action graph. It describes the reachability relationships between assets in the current network environment under the existing access control policies. The malicious path set can be understood as the set of reachable paths between assets that may be exploited by attackers, extracted from the pre-execution reachability matrix. It is used to identify threat propagation channels that need to be blocked and is an important benchmark for verifying the effectiveness of defenses in the pre-deployment assessment. The virtual defense digital twin environment can be understood as a virtual simulation mapping of the target network environment, used to perform security verification of the virtualized defense action graph before actual deployment.

[0031] The post-execution reachability matrix can be understood as the reachability matrix generated after applying the virtualized defense action graph in the virtual defense digital twin environment. It reflects the changes in the reachability relationships between assets in the network after the defense action takes effect and serves as the basis for determining whether malicious paths have been blocked and whether critical business paths remain reachable. The post-rollback reachability matrix can be understood as the reachability matrix generated after performing a rollback exercise with compensation edges in the virtual defense digital twin environment. It is used to verify whether the network state can be restored to the expected security state after the rollback operation is executed and is an important basis for determining whether the rollback capability meets the requirements.

[0032] In this embodiment, based on the asset topology and existing access control policies of the target network environment, a pre-execution reachability matrix is ​​constructed. This matrix describes whether assets in the network are reachable under the access control policies before the defensive action is executed. A set of malicious paths is extracted from the pre-execution reachability matrix to identify possible connectivity paths that attackers may exploit. Subsequently, a virtualized defensive action graph is loaded into a preset virtual defense digital twin environment for simulated execution, resulting in a post-execution reachability matrix that reflects the network connectivity status after the defensive action takes effect. Simultaneously, a rollback exercise is performed according to the compensation edges to obtain a post-rollback reachability matrix, used to verify whether the rollback action can restore the network to the expected state.

[0033] S160. When the pre-execution reachability matrix, malicious path set, post-execution reachability matrix and post-rollback reachability matrix are pre-executed and the pre-execution conditions are met, the virtualized defense action map is distributed to the target network environment in stages along the direction of progressively expanding execution range, and when the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge.

[0034] In this embodiment, a pre-execution judgment is performed by comprehensively considering the pre-execution reachability matrix, the malicious path set, the post-execution reachability matrix, and the post-rollback reachability matrix. This determines whether the defensive action can block malicious paths, whether it will not affect critical business paths, and whether the network state can be restored to within the safety threshold after rollback. When the pre-execution judgment conditions are met, the virtualized defense action map is distributed to the target network environment in stages, expanding the execution scope progressively, avoiding the risks of a one-time full distribution. During actual execution, once an action node triggers the rollback condition, a node-level compensation rollback is performed along the compensation edge corresponding to that action node. Only the problematic action nodes are subject to targeted cancellation or replacement, while action nodes that have not triggered the rollback condition continue to execute. This ensures both the effectiveness of the defense and a secure and controllable rollback capability.

[0035] The technical solution of this invention involves acquiring multi-source security evidence of the target and performing normalization processing to generate a unified evidence object of the target. This unified evidence object is then input into a pre-trained large language model to generate candidate security intents. The candidate security intents are converted into intermediate representations of security intents, either by binding key fields to evidence anchors or by labeling them as fields inferred by the large language model. The credibility of these intermediate representations is calculated based on a preset multi-dimensional credibility evaluation index. When the credibility meets the automatic execution threshold, the asset topology and current access control policies of the target network environment are acquired. Based on the defense objectives and constraint sets in the intermediate representations of security intents, a virtualized defense action graph containing action nodes and compensation edges is generated from the virtualized defense resource catalog using preset deterministic compilation rules. This process is repeated based on the asset topology and current access control policies. The system constructs a reachability matrix before the execution of access control policies and extracts a set of malicious paths. In a pre-defined virtual defense digital twin environment, a virtualized defense action graph is applied to generate a reachability matrix after execution. A rollback exercise is then performed according to the compensation edges to generate a rollback reachability matrix. Based on the pre-execution reachability matrix, the set of malicious paths, the post-execution reachability matrix, and the rollback reachability matrix, a pre-executive judgment is performed. When the pre-executive conditions are met, the virtualized defense action graph is distributed to the target network environment in stages along the direction of progressively expanding execution scope. When the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edges. This solves the problems of unreliable security intent generated by large language models and the difficulty of secure rollback in automatic defense, achieving beneficial effects in improving the reliability, verifiability, and rollback capability of security handling.

[0036] Example 2 Figure 2 This is a flowchart of a virtual defense orchestration method for security intent parsing provided in Embodiment 2 of the present invention. This embodiment is based on and optimized from the above embodiments. Specifically, the step of "normalizing the multi-source security evidence of the target to generate a unified evidence object of the target" has been refined.

[0037] Correspondingly, such as Figure 2 As shown, the method includes: S210. Obtain multi-source security evidence for the target.

[0038] S220. Map host identifiers from different sources in multi-source security evidence from different sources to unique asset identifiers, account fields from different sources to unified identity entity identifiers, and time fields with different time formats to standard time fields with the same time zone and the same time precision, to obtain multiple standard field security evidence after field standardization processing.

[0039] The host identifier can be understood as the naming or numbering method used by different security products in their respective logs or records. Because the naming rules of different products are inconsistent, the same host may appear with different identifiers in different sources, therefore it needs to be mapped to a unique asset identifier. The account field can be understood as the username field used to identify the operating entity in different logs or audit records.

[0040] In this embodiment, since the target multi-source security evidence comes from different sources, its host identifier, account field, and time format differ. Therefore, field standardization processing is first performed on the target multi-source security evidence. Specifically, host identifiers from different sources are uniformly mapped to unique asset identifiers, so that different ways of writing the same asset in different sources correspond to the same identifier; account fields from different sources are mapped to unified identity entity identifiers, so that the account expressions of the same user in multiple sources are unified to the same entity; time fields with different time formats are mapped to standard time fields with the same time zone and the same time precision, so that the time information of all evidence has comparability and alignment basis. After completing the above mapping, multiple standard-field multi-source security evidences are obtained after field standardization processing.

[0041] S230. Perform time alignment, deduplication, and desensitization processing on multi-source security evidence for each standard field to generate multiple unified evidence objects. Generate a corresponding evidence anchor point for each unified evidence object. The evidence anchor point includes evidence identifier, source identifier, timestamp, evidence fragment location information, integrity hash, source credibility, and desensitization identifier. The evidence fragment location information includes field path or text span.

[0042] In this embodiment, even after standardization, multi-source security evidence still faces risks such as inconsistent timestamps, duplicate data, and leakage of sensitive information. Therefore, time alignment, deduplication, and anonymization are performed on each standard-field multi-source security evidence. Time alignment unifies the time fields of evidence from different sources to the same time base; deduplication eliminates redundant records caused by repeated reporting of the same event from different sources; and anonymization masks or replaces sensitive fields in the evidence, resulting in multiple unified evidence objects. When generating unified evidence objects, a corresponding evidence anchor is generated for each unified evidence object. The evidence anchor includes an evidence identifier, source identifier, timestamp, evidence fragment location information, integrity hash, source credibility, and an anonymization identifier. The evidence fragment location information includes field paths or text spans, indicating the specific location of the evidence in the original data, facilitating precise location and backtracking verification of the evidence later.

[0043] S240. Combine each unified evidence object with the matching evidence anchor point to obtain multiple target unified evidence objects.

[0044] In this embodiment, after the unified evidence object and the evidence anchor point are generated separately, they need to be associated so that each unified evidence object carries its corresponding evidence anchor point. Specifically, each unified evidence object is combined with a matching evidence anchor point to obtain multiple target unified evidence objects. Thus, the target multi-source security evidence has completed the transformation from its original form to a unified form with anchor points.

[0045] S250. Input the target unified evidence object into a pre-trained large language model to generate candidate security intents.

[0046] S260. The candidate security intent is converted into an intermediate representation of the security intent, and the credibility of the intermediate representation of the security intent is calculated according to a preset multidimensional credibility evaluation index, wherein the key fields of the intermediate representation of the security intent are bound to evidence anchors or marked as large language model inference fields.

[0047] Optionally, based on the above embodiments, converting the candidate security intent into an intermediate representation of the security intent may include: Construct key fields for the intermediate representation of the security intent, including protected assets, threat objects, defense targets, constraint sets, prohibited side effects, trust vector, effective time window, and rollback conditions; Each key field is bound to the evidence anchor in the target unified evidence object. Key fields that cannot be bound to the evidence anchor are marked as large language model inference fields. The intermediate representation of the security intent is subjected to structured validation, which verifies the type, enumeration range and dependencies of each key field. If the validation passes, the conversion is confirmed to be successful and the validated intermediate representation of the security intent is output.

[0048] Generally, the intermediate representation of security intent needs to carry the security intent output by the large language model in a structured manner. Therefore, it is necessary to pre-construct a set of semantically clear and typed key fields. The protected asset field specifies the core asset object to be protected by the security intent; the threat object field identifies the entity identified as a threat source; the defense target field describes the desired final security effect; the constraint set field defines the boundary conditions and prohibitions that must be met when executing defense actions; the prohibited side effects field clarifies the collateral effects that must not be caused during the defense process; the credibility vector field records the results of each dimension of the subsequent multi-dimensional credibility assessment; the effective time window field defines the effective period of the security intent; and the rollback condition field describes under what circumstances a rollback operation needs to be triggered. These key fields together constitute the main structure of the intermediate representation of security intent, providing a unified semantic foundation for subsequent credibility assessment, action graph compilation, and rollback decisions.

[0049] Generally, after constructing the key fields, it's necessary to establish a relationship between each key field and the original evidence to determine if the field's value is verifiable. During binding, the system searches for evidence anchors semantically matching the key field within each target unified evidence object. If a corresponding evidence anchor is found, the key field is bound to it, allowing the field's value to be precisely traced back to the specific location of the original evidence, thus ensuring verifiability. If no matching evidence anchor is found in the target unified evidence object, the key field is marked as a large language model inference field, meaning its value is derived by the model based on existing evidence, rather than directly from a specific piece of evidence. Through this binding operation, each key field in the intermediate representation of security intent has a clear evidence source status, preserving fields with traceable evidence while explicitly identifying inference fields requiring additional attention.

[0050] Generally, after the intermediate representation of a security intent has completed field construction and evidence binding, it still needs to undergo structured validation to be confirmed as valid. Structured validation mainly focuses on three dimensions: the type of key fields, the enumeration range, and dependencies. Type validation confirms whether the values ​​of each key field conform to the preset data type requirements; enumeration range validation confirms whether the field values ​​fall within the predefined selectable range; and dependency validation confirms whether fields with mutual constraints meet the established logical consistency requirements. For example, when the value of the defense target field points to a specific type of defense action, the constraint set field should contain the corresponding restrictions. If there are contradictions or omissions, the validation will fail. After all validations pass, the candidate security intent is successfully converted into a validated intermediate representation of the security intent. Only this intermediate representation can then serve as the input for subsequent credibility assessment and automated defense orchestration.

[0051] Optionally, based on the above embodiments, calculating the credibility of the intermediate representation of the security intent according to a preset multi-dimensional credibility evaluation index may include: Obtain the evidence binding status of each key field in the intermediate representation of the security intent, and calculate the evidence coverage rate based on the ratio of the number of key fields in the bound evidence anchor points to the total number of key fields. Cross-source consistency is calculated based on the degree of consistency of target multi-source security evidence from different sources in the target unified evidence object in terms of assets, time, attack phase and observable indicators. The candidate security intent is invoked in multiple rounds under controlled conditions. The consistency rate of key fields in the output of each round is calculated, and the model stability is calculated based on the consistency rate. The intermediate representation of the security intent is compared with the existing security baseline and approval permissions, and the baseline compatibility is calculated based on the comparison results. The system detects whether there are malicious inducements in the target unified evidence object and calculates and prompts injection risks based on the detection results. The credibility of the intermediate representation of the security intent is calculated based on the evidence coverage, cross-source consistency, model stability, baseline compatibility, and the risk of injection.

[0052] Generally, it is necessary to examine the degree of correlation between each key field in the intermediate representation of the security intent and the target unified evidence object. The specific operation is to first obtain the evidence binding status of each key field to determine how many fields have been successfully associated with the corresponding evidence anchors, and how many fields can only be inferred by the large language model itself; then, the evidence coverage rate is determined based on the ratio of the number of key fields successfully bound to evidence anchors to the total number of key fields, so as to measure the completeness of the security intent based on traceable evidence.

[0053] Generally, it is necessary to place multi-source security evidence from different sources within a unified objective framework for consistency comparison. Specifically, this involves examining the degree of mutual corroboration between evidence from different sources from multiple dimensions, such as whether the assets involved in the relevant evidence are consistent, whether the time information generated is aligned, whether the attack phases reflected are consistent, and whether key observable indicators match. By comprehensively comparing information from these different sources, cross-source consistency is calculated to determine whether evidence clues scattered across different data sources can collectively support the same security assessment.

[0054] Generally, it is necessary to examine the stability of the output of a large language model when generating security intents for the same batch of unified evidence objects. Specifically, the generation process of the same candidate security intent is run through multiple controlled rounds, and the filling of various key fields in each round's output is recorded. Then, the percentage of these key fields that maintain consistent results across multiple rounds is calculated, and the model stability is determined based on this consistency rate. This allows us to examine whether the model exhibits significant random fluctuations in output under the same input conditions.

[0055] Generally, it is necessary to compare and judge the defense requirements described in the intermediate representation of security intent with the existing security management requirements of the target network environment. Specifically, this involves checking the intermediate representation against the current security baseline and approval permissions item by item to confirm whether the described defense objectives, constraint sets, and expected actions violate established security red lines or exceed the boundaries of permissions granted by automated processes. Based on these comparison results, baseline compatibility is calculated to assess whether there is a risk of conflict between the security intent and the management framework during implementation.

[0056] Generally, a security review is required on the unified evidence objects involved in the candidate security intent generation process. Specifically, this involves detecting whether there are deliberately constructed prompts or malicious inducements within the evidence content. These factors might attempt to induce the large language model to generate erroneous intents that deviate from the true security situation. The risk of prompt injection is calculated based on the degree of presence of detected malicious inducements, thereby measuring the probability of misjudgment of intent due to contamination of the evidence content.

[0057] Generally, the aforementioned five assessment results need to be aggregated and integrated to form a final judgment. During this aggregation and integration, it is fully considered that evidence coverage, cross-source consistency, model stability, and baseline compatibility collectively reflect the reliability of the security intent, while the indication of injection risk weakens this reliability. Specifically, the calculation method involves first determining the credibility benchmark based on the weakest of the four indicators reflecting the reliability benchmark, and then reducing this benchmark based on the indication of injection risk to calculate the credibility of the intermediate representation of the security intent.

[0058] S270. When the trustworthiness meets the automatic execution threshold, obtain the asset topology and current access control policy of the target network environment, and generate a virtualized defense action graph containing action nodes and compensation edges from the virtualized defense resource catalog according to the defense target and constraint set in the intermediate representation of the security intent through preset deterministic compilation rules.

[0059] S280. Construct a pre-execution reachability matrix based on asset topology and existing access control policies, extract a set of malicious paths from the pre-execution reachability matrix, apply the virtualized defense action graph in a preset virtual defense digital twin environment, generate a post-execution reachability matrix, and perform a rollback exercise according to the compensation edge to generate a rollback reachability matrix.

[0060] S290. When the pre-execution reachability matrix, malicious path set, post-execution reachability matrix and post-rollback reachability matrix are pre-executed and the pre-execution conditions are met, the virtualized defense action map is distributed to the target network environment in stages along the direction of progressively expanding execution range, and when the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge.

[0061] Example 3 Figure 3 This is a flowchart of a virtual defense orchestration method for security intent parsing provided in Embodiment 3 of the present invention. This embodiment is based on and optimized from the above embodiments. Specifically, the step of "generating a virtual defense action graph containing action nodes and compensation edges from the virtualization defense resource catalog according to the defense target and constraint set in the intermediate representation of the security intent through preset deterministic compilation rules" has been refined.

[0062] Correspondingly, such as Figure 3 As shown, the method includes: S310. Obtain target multi-source security evidence and normalize the target multi-source security evidence to generate a target unified evidence object, wherein the target unified evidence object contains corresponding evidence anchor points.

[0063] S320. Input the target unified evidence object into a pre-trained large language model to generate candidate security intents.

[0064] S330. Convert the candidate security intent into an intermediate representation of security intent, and calculate the credibility of the intermediate representation of security intent according to a preset multidimensional credibility evaluation index, wherein the key fields of the intermediate representation of security intent are bound to evidence anchors or marked as large language model inference fields.

[0065] S340. When the trust level meets the automatic execution threshold, obtain the asset topology and current access control policy of the target network environment.

[0066] S350. Extract the defense target and constraint set from the intermediate representation of the security intent.

[0067] In this embodiment, it is necessary to extract the defense objective and constraint set from the verified intermediate representation of security intent. The defense objective describes the expected final effect of the current security action, such as blocking a malicious propagation path or protecting critical business assets from being affected. The constraint set defines the boundary conditions that must be followed in achieving the defense objective, such as not interrupting a specified business link or modifying critical equipment parameters. The extracted defense objective and constraint set will serve as the direct basis for subsequent matching of defense primitives and construction of action graphs.

[0068] S360. Match virtualization defense primitives corresponding to the defense target and the constraint set from the virtualization defense resource catalog.

[0069] In this embodiment, a matching search needs to be performed in the virtualization defense resource catalog based on the extracted defense objectives and constraint set. The virtualization defense resource catalog pre-registers various security capabilities that can be orchestrated and invoked, including defense primitives such as network access control, traffic mirroring, threat decoys, identity policy adjustment, and snapshot protection. During the matching process, defense primitives that can satisfy the defense objective requirements without exceeding the constraints need to be selected. This ensures that each selected defense capability is consistent with the desired defense effect in terms of functional orientation and compatible with the defined constraints in terms of side effect boundaries.

[0070] S370. Construct action nodes based on the virtualization defense primitives. The action nodes include defense primitives, target scope, preconditions, execution interfaces, post-verification conditions, idempotency flags, and rollback actions.

[0071] In this embodiment, after matching the defense primitives, action nodes need to be constructed based on them. Each action node corresponds to a defense operation that can be independently scheduled and executed. The node needs to fully describe all the elements required to execute the operation, including the type of defense primitive used, the target asset range covered by this action, the preconditions that need to be met before the action is executed, the execution interface used when calling specific security capabilities, the post-verification conditions used to verify the effectiveness after the action is executed, the idempotency flag indicating whether the action supports repeated execution, and the rollback operation used to recover when an anomaly occurs during the action execution. These elements together ensure that the action nodes can be accurately scheduled, verified, and recovered in the subsequent rehearsal and execution phases.

[0072] S380. Construct dependency edges based on the execution order relationship between the action nodes, construct mutual exclusion edges based on the mutual exclusion relationship that the action nodes cannot be executed simultaneously, and construct approval edges based on the high-risk actions among the action nodes.

[0073] In this embodiment, the multiple action nodes are not isolated from each other, but rather have logical relationships in their execution. Therefore, three types of connection edges need to be constructed based on the relationships between the action nodes. Dependency edges are used to express the execution order that action nodes must follow, for example, the policy backup action must be executed before the blocking policy issuance action; mutual exclusion edges are used to express the conflict relationship that action nodes cannot be executed or take effect at the same time, to avoid policy overlap leading to network anomalies; approval edges are used to connect high-risk action nodes that require manual authorization to execute, so that these actions must enter the approval process before formal execution, thereby imposing additional control on operations with significant impact.

[0074] S390. Generate compensation edges for action nodes configured with rollback requirements, forming a virtualized defense action graph that includes action nodes, dependency edges, mutual exclusion edges, approval edges, and compensation edges.

[0075] In this embodiment, for action nodes that may produce side effects after execution and require recovery capabilities, compensation edges need to be generated for them. The compensation edge associates the action node with the corresponding rollback action, enabling the action node to quickly locate the pre-configured rollback action along the compensation edge when the rollback condition is triggered, thereby performing targeted undo, downgrade, or replacement operations. By configuring compensation edges for action nodes with rollback requirements and combining action nodes, dependency edges, mutual exclusion edges, approval edges, and compensation edges, a virtualized defense action graph is finally formed. This action graph is the complete defense orchestration scheme upon which subsequent digital twin pre-simulation and phased deployment are based.

[0076] S3100. Construct a pre-execution reachability matrix based on asset topology and existing access control policies, extract a set of malicious paths from the pre-execution reachability matrix, apply the virtualized defense action graph in a preset virtual defense digital twin environment, generate a post-execution reachability matrix, and perform a rollback exercise according to the compensation edge to generate a rollback reachability matrix.

[0077] S3110. When the pre-execution reachability matrix, malicious path set, post-execution reachability matrix and post-rollback reachability matrix are pre-executed and the pre-execution conditions are met, the virtualized defense action map is distributed to the target network environment in stages along the direction of progressively expanding execution range, and when the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge.

[0078] Optionally, based on the above embodiments, when a pre-performance determination is made based on the pre-execution reachability matrix, malicious path set, post-execution reachability matrix, and post-rollback reachability matrix, and the pre-performance conditions are met, the virtualized defense action map is distributed to the target network environment in stages along the direction of progressively expanding execution scope. This may include: Compare the pre-execution reachability matrix with the post-execution reachability matrix to determine whether the critical business paths in the pre-execution reachability matrix remain reachable in the post-execution reachability matrix; If the critical business path remains reachable, then continue to compare the malicious path set with the post-execution reachability matrix to determine whether each malicious path in the malicious path set is blocked in the post-execution reachability matrix. If all malicious paths are blocked, the reachability matrix before execution is compared with the reachability matrix after rollback to determine whether the reachability difference of the key business paths in the reachability matrix after rollback and the reachability matrix before execution is within the recovery threshold. If the reachability difference is within the recovery threshold, the virtualization defense action map will be distributed to the target network environment in stages along the direction of progressively expanding execution scope.

[0079] Generally, the reachability matrix before and after execution needs to be compared item by item to assess the changes in network reachability after the virtualization defense action map takes effect. The comparison focuses on whether the critical service paths specified in the constraint set remain accessible; that is, the implementation of defense actions should not interfere with the communication links upon which normal services depend. If these critical service paths remain accessible in the post-execution reachability matrix, it indicates that the current action map has not caused any disruptive impact on core services, and the subsequent pre-rehearsal judgment phase can proceed.

[0080] Generally, after confirming that critical business paths remain reachable, it is necessary to further compare the malicious path set with the post-execution reachability matrix to verify the actual blocking effect of the defense actions. Specifically, for each malicious path in the malicious path set, it is checked one by one whether it has been blocked or lost reachability in the post-execution reachability matrix. Only when all malicious paths are effectively blocked can it be said that the virtualized defense action graph has truly achieved the expected security protection goal and can effectively cut off the threat propagation channel; if there are unblocked malicious paths, it indicates that there are still protection gaps in the current action graph, which need to be adjusted before further judgment.

[0081] Generally, after confirming that all malicious paths have been blocked, it is necessary to verify the recoverability of the rollback operation by comparing the reachability matrix before and after the rollback. The comparison focuses on the reachability status of critical business paths, examining whether the reachability of these paths deviates beyond acceptable limits after the rollback exercise. If the reachability difference is within the recovery threshold, it indicates that after performing the rollback with compensation edges, the network state can be basically restored to the normal level before the defensive action, and the rollback capability meets security requirements. If the difference exceeds the recovery threshold, it indicates that the current action graph may introduce irreversible effects and should not be further deployed.

[0082] Generally, a pre-drill can only be considered successful if all three conditions are met: critical business paths remain reachable, malicious paths are blocked, and the reachability difference after rollback is within the recovery threshold. At this point, the virtualized defense action map is distributed to the target network environment in stages, expanding its execution scope progressively. By gradually expanding the scope of action, the defense actions are implemented in the real environment, thereby controlling risks while achieving automated defense orchestration.

[0083] Optionally, based on the above embodiments, the virtualization defense action graph is distributed to the target network environment in stages along the direction of progressively expanding execution scope, and node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge when the rollback condition is triggered. This may include: The virtualized defense action graph is distributed sequentially in at least two of the following stages: shadow evaluation stage, gray-scale execution stage, partial execution stage, and full execution stage. The shadow evaluation stage only records the hit status and potential impact of the action nodes and does not change the data plane of the target network environment. In subsequent stages, based on the hits and potential impacts recorded in the previous stage, the execution scope of the action node in the target network environment is gradually expanded. When the action node triggers the rollback condition, a node-level compensation rollback is performed along the compensation edge corresponding to the action node, while action nodes that have not triggered the rollback condition continue to execute.

[0084] Generally, when a virtualized defense action graph is actually deployed to the target network environment, it needs to follow an increasing risk pace, successively going through at least two of the following stages: shadow assessment, canary execution, partial execution, and full execution. Among these, the shadow assessment stage is the most cautious initial step. In this stage, only the hit status of each action node in the target network environment and the potential impact are recorded, without making any substantial changes to the data plane of the target network environment. This allows for the acquisition of actual performance data of the action graph without interfering with existing network services, providing a basis for subsequent expansion decisions.

[0085] Generally, after completing the deployment and observation of the current phase, the action graph needs to carefully plan the execution scope of each action node in the target network environment in subsequent phases based on the hit situation and potential impact recorded in the previous phase. This gradual expansion approach ensures that each new phase is built on the feedback of actual operational data from the previous phase, effectively controlling the unknown risks introduced by the expansion of the scope, and ensuring that the execution scope of the action graph increases step by step at a safe and controllable pace until the expected defense coverage scale is reached.

[0086] Generally, during the phased execution process, each action node continuously checks whether the requirements for triggering a rollback are met based on preset conditions. Once an action node triggers the rollback condition, a node-level compensation rollback is performed only on that action node, along its pre-configured compensation edge, restoring the node to its pre-execution safe state. This rollback operation is localized and targeted, and will not affect other normally operating nodes. Meanwhile, action nodes that do not trigger the rollback condition under the same operating environment maintain their current execution state and continue to function according to the established process, thereby achieving the continuous advancement of the overall defense strategy and the precise handling of local anomalies.

[0087] The technical solution of this invention extracts defense targets and constraint sets from the intermediate representation of security intent, matches virtualization defense primitives corresponding to the defense targets and constraint sets from the virtualization defense resource catalog, constructs action nodes based on the virtualization defense primitives, and the action nodes include defense primitives, target scope, preconditions, execution interfaces, post-verification conditions, idempotency flags, and rollback actions; constructs dependency edges based on the execution order relationship between the action nodes, constructs mutual exclusion edges based on the mutual exclusion relationship that the action nodes cannot be executed simultaneously, and constructs approval edges based on high-risk actions in the action nodes; and generates compensation edges for action nodes configured with rollback requirements, forming a virtualization defense action graph containing action nodes, dependency edges, mutual exclusion edges, approval edges, and compensation edges. This solves the problem of uncontrollable and unreversible behavior caused by directly generating defense commands from a large language model, and achieves the beneficial effects of improving the determinism, verifiability, and rollbackability of defense action compilation.

[0088] In this specific embodiment, in order to solve the problems of untrustworthy intent, uninterpretable output, and unverifiable execution when large language models directly generate security response commands, as well as the high risk of misoperation and difficulty in ensuring business continuity due to the lack of security rollback means for automated defense actions, this embodiment of the invention designs a complete virtual defense orchestration method based on evidence anchoring and digital twin pre-simulation for security intent parsing.

[0089] Specifically, Figure 4The overall technical flowchart of the virtual defense orchestration method for security intent parsing based on evidence anchoring and digital twin pre-simulation provided in this embodiment of the invention is as follows: Figure 4 As shown, this process covers the entire chain from multi-source security evidence collection to defense action delivery and rollback. First, multi-source security evidence is collected and preprocessed to generate a unified evidence object. Next, the unified evidence object is input into a large language model to generate candidate security intents without execution commands. Then, the candidate security intents are converted into a Security Intent Representation (SIR), and its key fields are bound to the evidence identifier, field paths, etc., in the unified evidence object to form a verified security intent intermediate representation. Next, the confidence of the security intent intermediate representation (C_sir) is calculated using the formula: the minimum of Evidence Coverage (EC), Cross-source Consistency (CC), Model Stability (MS), and Policy Baseline Compatibility (PB), multiplied by the inverse coefficient of Prompt Injection Risk (PI) (i.e., 1 minus PI). The calculated credibility (C_sir) is compared with a preset automatic execution threshold. If the credibility does not reach the threshold, the process proceeds to manual approval, monitoring only, or evidence supplementation. If the credibility reaches the threshold, subsequent defense orchestration continues. After passing the credibility determination, a pre-execution reachability matrix R0 is constructed, and a malicious path set (M) is generated based on the threat object, attack stage, etc. Subsequently, a virtualized defense action graph containing each defense node, dependency edge, and compensation edge is generated using deterministic compilation rules. Next, a pre-run is performed in a digital twin environment to generate a post-execution reachability matrix R1, a post-rollback reachability matrix R2, and a business health probe H1. The pre-run results are compared with various preset conditions (the judgment includes whether the critical business path remains reachable, whether the malicious path is blocked, whether the difference after rollback is within the recovery threshold, whether the business health changes are within the allowable range, and whether the virtualized resource capacity meets the requirements). If the pre-simulation judgment conditions are not met, the distribution will be rejected, downgraded, or manual approval will be requested. If the pre-simulation judgment conditions are met, the distribution will proceed in stages, expanding the execution scope to the target network environment step by step in the order of shadow assessment, gray-scale, partial to full. Finally, continuous monitoring will be performed after execution, and if the rollback conditions are triggered, a node-level compensation rollback will be executed.

[0090] Specifically, Figure 5This is a logical diagram illustrating the preprocessing of multi-source security evidence and the generation of intermediate representations of security intent provided in embodiments of the present invention, such as... Figure 5 As shown in the diagram, this illustrates the complete transformation process from multi-source data input to the output of a verified security intent intermediate representation. First, the multi-source inputs include security information and event management systems, endpoint detection and response systems, network traffic probes, cloud platform auditing, asset management systems, vulnerability intelligence, and manual handling requests. These inputs undergo field normalization, time alignment, deduplication, anonymization, and integrity verification processes to generate a unified evidence object, which includes evidence identifier, source identifier, timestamp, field path or text span, integrity hash, source credibility, and anonymization identifier. Simultaneously, asset topology, current security policies, and security knowledge fragments are input into a large language model. This model generates only candidate security intents without execution commands, which include threat objects, protected assets, defense targets, and business constraints. The intermediate security intent representation is then transformed and bound to evidence anchors. The specific fields of the generated intermediate security intent representation include protected assets, threat objects, defense targets, constraint sets, prohibited side effects, credibility vectors, effective time windows, and rollback conditions. Next, the evidence anchor binding operation is performed, mapping each key field to the corresponding evidence identifier, field path, or text span. Finally, the verified intermediate security intent representation is output, and the credibility calculation and action compilation stage begins.

[0091] Specifically, Figure 6 This is a schematic diagram of the structure for deterministic compilation to generate virtualized defense action graphs provided in an embodiment of the present invention, such as... Figure 6 As shown in the diagram, this figure illustrates how a verified security intent intermediate representation is compiled into an executable defense action graph containing nodes and edges. First, the defense targets and constraint sets from the verified security intent intermediate representation, along with the virtualization defense resource directory, are input into a deterministic compiler. This compiler, based on compilation rules generated by a non-large language model, selects virtualization defense primitives from the virtualization defense resource directory and generates a virtualization defense action graph according to preset rules. This action graph contains multiple action nodes: N1 is the policy backup node, N2 is the minimum blocking set distribution node, N3 is the traffic mirroring node, N4 is the deception redirection node, and N5 is the temporary identity policy node. Each action node includes a defense primitive, target scope, preconditions, execution interface, post-verification conditions, idempotency flag, and rollback action. Solid lines connect nodes to indicate the order of execution. For example, N1 to N2 are dependent edges, indicating that policy backup must be executed before blocking action. N2 to N3 are dependent edges, indicating that traffic mirroring is started after blocking action is issued. N2 to N4 are conditional dependent edges, indicating that blocking action can be switched to deception redirection as needed. At the same time, dashed lines are configured for each action node with rollback requirements. N3 corresponds to canceling blocking rules, N4 corresponds to canceling redirection rules, and N5 corresponds to canceling identity policies. Nodes without rollback requirements do not have corresponding compensation edges.

[0092] Specifically, Figure 7 This is a logical diagram illustrating the digital twin environment pre-simulation and pre-simulation determination provided in an embodiment of the present invention, as shown below. Figure 7 As shown in the diagram, this illustrates the complete process of verifying the effectiveness and security of the defense through pre-executive drills before the virtualized defense action graph is deployed. First, a virtualized defense digital twin environment is constructed, including asset topology, network partitions, current policies, and anonymized traffic summaries. Next, a pre-execution reachability matrix is ​​calculated, recording the reachability status from the source asset to the target asset in terms of protocol and port dimensions. A set of malicious paths is generated based on the threat object, attack stage, asset topology, and the pre-execution reachability matrix. Then, the virtualized defense action graph is applied in the virtualized defense digital twin environment to generate a post-execution reachability matrix and business health probe results. Subsequently, a rollback drill is performed along the compensation edge to generate a post-rollback reachability matrix. Next, a pre-execution assessment is conducted, requiring the simultaneous fulfillment of several conditions: First, the critical business path maintenance condition, meaning the critical business paths specified by the constraint set remain reachable in the post-execution reachability matrix; second, the malicious path blocking condition, meaning paths in the malicious path set are blocked or redirected in the post-execution reachability matrix; third, the recovery difference condition, meaning the difference between the post-rollback reachability matrix and the pre-execution reachability matrix does not exceed the recovery threshold; fourth, the business health change condition, meaning the change in business health probe results is below the health threshold; and fifth, the virtualization resource capacity condition, meaning the virtualization resource capacity and control plane quota meet the deployment requirements. If all conditions are met, the pre-execution assessment is passed, and phased deployment to the target network environment is permitted; otherwise, automatic deployment is rejected, and the deployment is downgraded to monitoring only or requires manual approval.

[0093] Specifically, Figure 8 This is a schematic diagram illustrating the phased distribution and node-level compensation rollback of the virtualization defense action graph provided in an embodiment of the present invention, as shown below. Figure 8As shown in the diagram, this illustrates the complete logic of the gradual rollout of defensive actions in the target network environment according to an increasing risk level, as well as the handling of anomalies. The entire deployment process is divided into four stages: The first stage is the shadow assessment stage, which only records the hit rate and potential impact of candidate actions without changing the data plane of the target network environment, and then determines whether rollback conditions are triggered; the second stage is the canary execution stage, which deploys actions within a limited asset scope or a limited traffic ratio, and continuously collects health probes, hit statistics, and false blocking feedback, and then determines whether rollback conditions are triggered; the third stage is the partial execution stage, which gradually expands the scope of action based on the canary monitoring results, and then determines whether rollback conditions are triggered; the fourth stage is the full execution stage, which deploys the entire virtualized defensive action map to the target network environment, and then enters continuous monitoring after execution. The continuous monitoring content includes health probes, hit statistics, and false blocking feedback, and continuously determines whether rollback conditions are triggered. If any stage triggers the rollback condition, a node-level compensation rollback will be executed along the corresponding compensation edge. Specific rollback operations include reversal compensation, degradation compensation, and alternative compensation. Reversal compensation is used to delete newly added policies, restore policy versions, or revoke temporary identity policies. Degradation compensation is used to convert blocking actions into mirroring, rate limiting, or alarm-only actions. Alternative compensation is used to convert direct isolation actions into deceptive traction or enhanced monitoring actions. The rollback principle is that only action nodes that trigger the rollback condition will be subject to node-level compensation rollback. Action nodes that do not trigger the rollback condition will continue to be executed. If the rollback condition is not triggered, the current defense state will be maintained and subsequent stages will continue.

[0094] Example 4 Figure 9 This invention provides a security intent parsing virtual defense orchestration device in embodiment four, such as... Figure 9 As shown, the device includes: The evidence normalization module 910 is used to acquire target multi-source security evidence and perform normalization processing on the target multi-source security evidence to generate a target unified evidence object, wherein the target unified evidence object contains corresponding evidence anchor points. The candidate intent generation module 920 is used to input the target unified evidence object into a pre-trained large language model to generate candidate security intents. The intent parsing and evaluation module 930 is used to convert the candidate security intent into an intermediate representation of the security intent, and calculate the credibility of the intermediate representation of the security intent according to a preset multidimensional credibility evaluation index, wherein the key fields of the intermediate representation of the security intent are bound to evidence anchors or marked as inference fields of a large language model. The action graph compilation module 940 is used to obtain the asset topology and current access control policy of the target network environment when the trustworthiness meets the automatic execution threshold, and generate a virtualized defense action graph containing action nodes and compensation edges from the virtualized defense resource catalog according to the defense target and constraint set in the intermediate representation of the security intent through preset deterministic compilation rules. The digital twin pre-simulation module 950 is used to construct a pre-execution reachability matrix based on asset topology and existing access control policies, extract a set of malicious paths from the pre-execution reachability matrix, apply the virtualized defense action graph in a preset virtual defense digital twin environment, generate a post-execution reachability matrix, and perform a rollback simulation according to the compensation edge to generate a rollback reachability matrix. The phased delivery and rollback module 960 is used to deliver the virtualized defense action map to the target network environment in stages along the direction of progressively expanding execution range when the pre-execution reachability matrix, malicious path set, post-execution reachability matrix and post-rollback reachability matrix are pre-executed and the pre-execution conditions are met. When the rollback conditions are triggered, the module performs node-level compensation rollback on the corresponding action nodes according to the compensation edge.

[0095] The technical solution of this invention involves acquiring multi-source security evidence of the target and performing normalization processing to generate a unified evidence object of the target. This unified evidence object is then input into a pre-trained large language model to generate candidate security intents. The candidate security intents are converted into intermediate representations of security intents, either by binding key fields to evidence anchors or by labeling them as fields inferred by the large language model. The credibility of these intermediate representations is calculated based on a preset multi-dimensional credibility evaluation index. When the credibility meets the automatic execution threshold, the asset topology and current access control policies of the target network environment are acquired. Based on the defense objectives and constraint sets in the intermediate representations of security intents, a virtualized defense action graph containing action nodes and compensation edges is generated from the virtualized defense resource catalog using preset deterministic compilation rules. This process is repeated based on the asset topology and current access control policies. The system constructs a reachability matrix before the execution of access control policies and extracts a set of malicious paths. In a pre-defined virtual defense digital twin environment, a virtualized defense action graph is applied to generate a reachability matrix after execution. A rollback exercise is then performed according to the compensation edges to generate a rollback reachability matrix. Based on the pre-execution reachability matrix, the set of malicious paths, the post-execution reachability matrix, and the rollback reachability matrix, a pre-executive judgment is performed. When the pre-executive conditions are met, the virtualized defense action graph is distributed to the target network environment in stages along the direction of progressively expanding execution scope. When the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edges. This solves the problems of unreliable security intent generated by large language models and the difficulty of secure rollback in automatic defense, achieving beneficial effects in improving the reliability, verifiability, and rollback capability of security handling.

[0096] Based on the above embodiments, the evidence normalization module 910 is specifically used for: The host identifiers from different sources in the target multi-source security evidence from different sources are mapped to unique asset identifiers, the account fields from different sources are mapped to unified identity subject identifiers, and the time fields with different time formats are mapped to standard time fields with the same time zone and the same time precision, resulting in multiple standard field security evidences after field standardization. Time alignment, deduplication, and anonymization are performed on multi-source security evidence for each standard field to generate multiple unified evidence objects. For each unified evidence object, a corresponding evidence anchor point is generated. The evidence anchor point includes evidence identifier, source identifier, timestamp, evidence fragment location information, integrity hash, source credibility, and anonymization identifier. The evidence fragment location information includes field path or text span. Each unified evidence object is combined with a matching evidence anchor point to obtain multiple target unified evidence objects.

[0097] Based on the above embodiments, the intent parsing and evaluation module 930 is specifically used for: Construct key fields for the intermediate representation of the security intent, including protected assets, threat objects, defense targets, constraint sets, prohibited side effects, trust vector, effective time window, and rollback conditions; Each key field is bound to the evidence anchor in the target unified evidence object. Key fields that cannot be bound to the evidence anchor are marked as large language model inference fields. The intermediate representation of the security intent is subjected to structured validation, which verifies the type, enumeration range and dependencies of each key field. If the validation passes, the conversion is confirmed to be successful and the validated intermediate representation of the security intent is output.

[0098] Based on the above embodiments, the intent parsing and evaluation module 930 is specifically used for: Obtain the evidence binding status of each key field in the intermediate representation of the security intent, and calculate the evidence coverage rate based on the ratio of the number of key fields in the bound evidence anchor points to the total number of key fields. Cross-source consistency is calculated based on the degree of consistency of target multi-source security evidence from different sources in the target unified evidence object in terms of assets, time, attack phase and observable indicators. The candidate security intent is invoked in multiple rounds under controlled conditions. The consistency rate of key fields in the output of each round is calculated, and the model stability is calculated based on the consistency rate. The intermediate representation of the security intent is compared with the existing security baseline and approval permissions, and the baseline compatibility is calculated based on the comparison results. The system detects whether there are malicious inducements in the target unified evidence object and calculates and prompts injection risks based on the detection results. The credibility of the intermediate representation of the security intent is calculated based on the evidence coverage, cross-source consistency, model stability, baseline compatibility, and the risk of injection.

[0099] Based on the above embodiments, the action graph compilation module 940 is specifically used for: Extract the defense target and constraint set from the intermediate representation of the security intent; Match virtualization defense primitives corresponding to the defense target and the constraint set from the virtualization defense resource catalog; Action nodes are constructed based on the virtualization defense primitives. The action nodes include defense primitives, target scope, preconditions, execution interfaces, post-verification conditions, idempotency flags, and rollback actions. Dependency edges are constructed based on the execution order of the action nodes; mutual exclusion edges are constructed based on the mutual exclusion relationship that the action nodes cannot be executed simultaneously; and approval edges are constructed based on the high-risk actions among the action nodes. Compensation edges are generated for action nodes configured with rollback requirements, forming a virtualized defense action graph that includes action nodes, dependency edges, mutual exclusion edges, approval edges, and compensation edges.

[0100] Based on the above embodiments, the phased deployment and rollback module 960 is specifically used for: Compare the pre-execution reachability matrix with the post-execution reachability matrix to determine whether the critical business paths in the pre-execution reachability matrix remain reachable in the post-execution reachability matrix; If the critical business path remains reachable, then continue to compare the malicious path set with the post-execution reachability matrix to determine whether each malicious path in the malicious path set is blocked in the post-execution reachability matrix. If all malicious paths are blocked, the reachability matrix before execution is compared with the reachability matrix after rollback to determine whether the reachability difference of the key business paths in the reachability matrix after rollback and the reachability matrix before execution is within the recovery threshold. If the reachability difference is within the recovery threshold, the virtualization defense action map will be distributed to the target network environment in stages along the direction of progressively expanding execution scope.

[0101] Based on the above embodiments, the phased deployment and rollback module 960 is specifically used for: The virtualized defense action graph is distributed sequentially in at least two of the following stages: shadow evaluation stage, gray-scale execution stage, partial execution stage, and full execution stage. The shadow evaluation stage only records the hit status and potential impact of the action nodes and does not change the data plane of the target network environment. In subsequent stages, based on the hits and potential impacts recorded in the previous stage, the execution scope of the action node in the target network environment is gradually expanded. When the action node triggers the rollback condition, a node-level compensation rollback is performed along the compensation edge corresponding to the action node, while action nodes that have not triggered the rollback condition continue to execute.

[0102] The security intent parsing virtual defense orchestration device provided in the embodiments of the present invention can execute the security intent parsing virtual defense orchestration method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0103] The collection, storage, use, processing, transmission, provision, and disclosure of client personal information in this technical solution comply with relevant laws and regulations and do not violate public order and good morals.

[0104] Example 5 Figure 10 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0105] like Figure 10As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0106] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0107] Processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as performing a security intent parsing virtual defense orchestration method as described in any embodiment of the present invention, namely: Acquire multi-source security evidence of the target, and normalize the multi-source security evidence of the target to generate a unified evidence object of the target, wherein the unified evidence object of the target contains corresponding evidence anchor points; The target unified evidence object is input into a pre-trained large language model to generate candidate security intents; The candidate security intent is converted into an intermediate security intent representation, and the credibility of the intermediate security intent representation is calculated according to a preset multidimensional credibility evaluation index. The key fields of the intermediate security intent representation are bound to evidence anchors or marked as large language model inference fields. When the trustworthiness meets the automatic execution threshold, the asset topology and current access control policy of the target network environment are obtained, and a virtualized defense action graph containing action nodes and compensation edges is generated from the virtualized defense resource catalog according to the defense target and constraint set in the intermediate representation of the security intent through preset deterministic compilation rules. Based on the asset topology and existing access control policies, a pre-execution reachability matrix is ​​constructed. A set of malicious paths is extracted from the pre-execution reachability matrix. The virtualized defense action graph is applied in a preset virtual defense digital twin environment to generate a post-execution reachability matrix. A rollback exercise is performed according to the compensation edge to generate a rollback reachability matrix. When the pre-execution reachability matrix, malicious path set, post-execution reachability matrix and post-rollback reachability matrix are pre-executed and the pre-execution conditions are met, the virtualized defense action map is distributed to the target network environment in stages along the direction of progressively expanding execution range. When the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge.

[0108] In some embodiments, a security intent parsing virtual defense orchestration method as described in any one of the embodiments of the present invention can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the security intent parsing virtual defense orchestration method described above as described in any one of the embodiments of the present invention can be performed. Alternatively, in other embodiments, processor 11 can be configured by any other suitable means (e.g., by means of firmware) to perform the security intent parsing virtual defense orchestration method as described in any one of the embodiments of the present invention.

[0109] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0110] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0111] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0112] To provide interaction with a client, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the client; and a keyboard and pointing device (e.g., a mouse or trackball) through which the client provides input to the electronic device. Other types of devices can also be used to provide interaction with the client; for example, feedback provided to the client can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the client can be received in any form (including sound input, voice input, or tactile input).

[0113] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., client computers with a graphical client interface or web browser through which clients can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0114] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0115] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0116] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for orchestrating virtual defenses to resolve security intent, characterized in that, The method includes: Acquire multi-source security evidence of the target, and normalize the multi-source security evidence of the target to generate a unified evidence object of the target, wherein the unified evidence object of the target contains corresponding evidence anchor points; The target unified evidence object is input into a pre-trained large language model to generate candidate security intents; The candidate security intent is converted into an intermediate security intent representation, and the credibility of the intermediate security intent representation is calculated according to a preset multidimensional credibility evaluation index. The key fields of the intermediate security intent representation are bound to evidence anchors or marked as large language model inference fields. When the trustworthiness meets the automatic execution threshold, the asset topology and current access control policy of the target network environment are obtained, and a virtualized defense action graph containing action nodes and compensation edges is generated from the virtualized defense resource catalog according to the defense target and constraint set in the intermediate representation of the security intent through preset deterministic compilation rules. Based on the asset topology and existing access control policies, a pre-execution reachability matrix is ​​constructed. A set of malicious paths is extracted from the pre-execution reachability matrix. The virtualized defense action graph is applied in a preset virtual defense digital twin environment to generate a post-execution reachability matrix. A rollback exercise is performed according to the compensation edge to generate a rollback reachability matrix. When the pre-execution reachability matrix, malicious path set, post-execution reachability matrix and post-rollback reachability matrix are pre-executed and the pre-execution conditions are met, the virtualized defense action map is distributed to the target network environment in stages along the direction of progressively expanding execution range. When the rollback conditions are triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge.

2. The method according to claim 1, wherein the target multi-source security evidence is normalized to generate a target unified evidence object, comprising: The host identifiers from different sources in the target multi-source security evidence from different sources are mapped to unique asset identifiers, the account fields from different sources are mapped to unified identity subject identifiers, and the time fields with different time formats are mapped to standard time fields with the same time zone and the same time precision, resulting in multiple standard field security evidences after field standardization. Time alignment, deduplication, and anonymization are performed on multi-source security evidence for each standard field to generate multiple unified evidence objects. For each unified evidence object, a corresponding evidence anchor point is generated. The evidence anchor point includes evidence identifier, source identifier, timestamp, evidence fragment location information, integrity hash, source credibility, and anonymization identifier. The evidence fragment location information includes field path or text span. Each unified evidence object is combined with a matching evidence anchor point to obtain multiple target unified evidence objects.

3. The method according to claim 2, characterized in that, Converting the candidate security intent into an intermediate representation of the security intent includes: Construct key fields for the intermediate representation of the security intent, including protected assets, threat objects, defense targets, constraint sets, prohibited side effects, trust vector, effective time window, and rollback conditions; Each key field is bound to the evidence anchor in the target unified evidence object. Key fields that cannot be bound to the evidence anchor are marked as large language model inference fields. The intermediate representation of the security intent is subjected to structured validation, which verifies the type, enumeration range and dependencies of each key field. If the validation passes, the conversion is confirmed to be successful and the validated intermediate representation of the security intent is output.

4. The method according to claim 3, characterized in that, The credibility of the intermediate representation of the security intent is calculated based on a preset multi-dimensional credibility assessment index, including: Obtain the evidence binding status of each key field in the intermediate representation of the security intent, and calculate the evidence coverage rate based on the ratio of the number of key fields in the bound evidence anchor points to the total number of key fields. Cross-source consistency is calculated based on the degree of consistency of target multi-source security evidence from different sources in the target unified evidence object in terms of assets, time, attack phase and observable indicators. The candidate security intent is invoked in multiple rounds under controlled conditions. The consistency rate of key fields in the output of each round is calculated, and the model stability is calculated based on the consistency rate. The intermediate representation of the security intent is compared with the existing security baseline and approval permissions, and the baseline compatibility is calculated based on the comparison results. The system detects whether there are malicious inducements in the target unified evidence object and calculates and prompts injection risks based on the detection results. The credibility of the intermediate representation of the security intent is calculated based on the evidence coverage, cross-source consistency, model stability, baseline compatibility, and the risk of injection.

5. The method according to claim 1, characterized in that, Based on the defense objectives and constraint set in the intermediate representation of the security intent, a virtualized defense action graph containing action nodes and compensation edges is generated from the virtualized defense resource catalog using preset deterministic compilation rules, including: Extract the defense target and constraint set from the intermediate representation of the security intent; Match virtualization defense primitives corresponding to the defense target and the constraint set from the virtualization defense resource catalog; Action nodes are constructed based on the virtualization defense primitives. The action nodes include defense primitives, target scope, preconditions, execution interfaces, post-verification conditions, idempotency flags, and rollback actions. Dependency edges are constructed based on the execution order of the action nodes; mutual exclusion edges are constructed based on the mutual exclusion relationship that the action nodes cannot be executed simultaneously; and approval edges are constructed based on the high-risk actions among the action nodes. Compensation edges are generated for action nodes configured with rollback requirements, forming a virtualized defense action graph that includes action nodes, dependency edges, mutual exclusion edges, approval edges, and compensation edges.

6. The method according to claim 1, characterized in that, When the pre-execution reachability matrix, malicious path set, post-execution reachability matrix, and post-rollback reachability matrix are pre-performed and the pre-execution conditions are met, the virtualized defense action map is distributed to the target network environment in stages along the direction of progressively expanding execution scope, including: Compare the pre-execution reachability matrix with the post-execution reachability matrix to determine whether the critical business paths in the pre-execution reachability matrix remain reachable in the post-execution reachability matrix; If the critical business path remains reachable, then continue to compare the malicious path set with the post-execution reachability matrix to determine whether each malicious path in the malicious path set is blocked in the post-execution reachability matrix. If all malicious paths are blocked, the reachability matrix before execution is compared with the reachability matrix after rollback to determine whether the reachability difference of the key business paths in the reachability matrix after rollback and the reachability matrix before execution is within the recovery threshold. If the reachability difference is within the recovery threshold, the virtualization defense action map will be distributed to the target network environment in stages along the direction of progressively expanding execution scope.

7. The method according to any one of claims 1-6, characterized in that, The virtualized defense action graph is distributed to the target network environment in stages along the direction of progressively expanding execution scope, and when the rollback condition is triggered, node-level compensation rollback is performed on the corresponding action nodes according to the compensation edge, including: The virtualized defense action graph is distributed sequentially in at least two of the following stages: shadow evaluation stage, gray-scale execution stage, partial execution stage, and full execution stage. The shadow evaluation stage only records the hit status and potential impact of the action nodes and does not change the data plane of the target network environment. In subsequent stages, based on the hits and potential impacts recorded in the previous stage, the execution scope of the action node in the target network environment is gradually expanded. When the action node triggers the rollback condition, a node-level compensation rollback is performed along the compensation edge corresponding to the action node, while action nodes that have not triggered the rollback condition continue to execute.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the security intent parsing virtual defense orchestration method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the security intent parsing virtual defense orchestration method according to any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the security intent parsing virtual defense orchestration method according to any one of claims 1-7.

Images