Security playbook execution method and apparatus, and device and storage medium

Abstract

A security playbook execution method and apparatus, and a device and a storage medium. The method comprises: determining an anomaly event and a system state corresponding to the anomaly event (S110); on the basis of the system state, determining a plurality of execution tasks that are running when the anomaly event occurs (S120); performing risk recognition on the plurality of execution tasks, and determining a risk task from the plurality of execution tasks (S130); querying, from a security playbook library, a security playbook corresponding to the risk task, wherein the security playbook comprises a process definition file (S140); and on the basis of the queried security playbook, responding to the risk task, and executing the security playbook (S150).

Description

Methods, apparatus, devices and storage media for executing secure text

[0001] This application claims priority to Chinese Patent Application No. 202411508244.0, filed with the Chinese Patent Office on October 28, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of communication technology, and for example to a method, apparatus, device and storage medium for executing secure text. Background Technology

[0003] With the accelerated advancement of digital transformation and the construction of new power systems, a large number of new energy power plants and third-party market entities are connecting to the network. Cyberspace is shifting from closed to open, leading to a dramatic expansion of network risk exposure, increasingly blurred protection boundaries, and greater difficulty in security management. The analysis and application of massive amounts of data have highlighted data security issues, posing new challenges to existing protection systems. In the context of new power systems, the network security of distributed energy systems lacks effective assessment and defense mechanisms. The main station network faces security risks, and the existing protection architecture is not yet adapted to the needs of building new energy systems, with insufficient security protection and security service provision capabilities. In particular, the handling of network security anomalies, involving rapid response and effective processing of events such as network attacks, data breaches, and malware infections, typically involves integrating existing security capabilities into secure text for automatic response to security anomalies.

[0004] A security playbook is a documented guide that defines processes for organizations to prevent, detect, and respond to cybersecurity incidents. This text typically includes descriptions of various potential anomalous scenarios and specific action steps for dealing with these anomalies. Based on the workflow defined in the security playbook, tasks can be executed by matching the text. When a security incident occurs and meets the triggering rules of the security playbook, the workflow defined in the text automatically executes tasks that can be performed automatically by computer programs, services, or systems. It is commonly used to perform automated operations such as data processing, integrating external systems, and executing scripts. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for executing secure text, in order to solve the problem of low efficiency and accuracy of secure text in response to abnormal events in related technologies.

[0006] In a first aspect, embodiments of this application provide a method for executing secure text, including:

[0007] Determine the abnormal event and the corresponding system state;

[0008] Based on the system state, determine the multiple execution tasks that were running when the abnormal event occurred;

[0009] Risk identification is performed on the multiple execution tasks, and risky tasks are identified from the multiple execution tasks;

[0010] Retrieve the security text corresponding to the risk task from the security text library; wherein, the security text includes a process definition file;

[0011] The system responds to the risk task based on the retrieved security text and executes the security text.

[0012] In some embodiments, determining the abnormal event and the system state corresponding to the abnormal event includes:

[0013] Detect network traffic, and determine that an abnormal event has occurred when the network traffic exceeds a preset alarm traffic threshold;

[0014] Query the system logs and determine the system status corresponding to the abnormal event based on the system logs.

[0015] In some embodiments, the step of risk identification of the plurality of execution tasks, and determining risky tasks from the plurality of execution tasks, includes:

[0016] Obtain task information corresponding to the plurality of execution tasks, wherein the task information includes: process information, service information, and planned task information;

[0017] The task information is judged based on preset judgment conditions to determine whether there is any abnormal task behavior in the multiple execution tasks.

[0018] In response to the presence of abnormal task behavior in the multiple execution tasks, the execution tasks exhibiting abnormal behavior are determined to be risky tasks.

[0019] In some embodiments, querying the security text corresponding to the risk task from the security text library includes:

[0020] The risk task is identified to determine the corresponding task type.

[0021] Based on the task type, query the security text corresponding to the task type from the security text library.

[0022] In some embodiments, the step of identifying the task type of the risk task and determining the task type corresponding to the risk task includes:

[0023] Multiple task type theme dictionaries are pre-configured;

[0024] Keyword extraction is performed on the task names of the aforementioned risky tasks;

[0025] The keywords are matched with each task type theme dictionary to determine the task type theme corresponding to the keywords, and the task type corresponding to the task type theme is taken as the task type corresponding to the risk task.

[0026] In some embodiments, responding to the risk task based on the retrieved security text and executing the security text includes:

[0027] Obtain the process definition file for the retrieved security text;

[0028] Based on the task configuration in the process definition file, execute the task configured in the security text.

[0029] In some embodiments, after responding to the risk task based on the retrieved security text and executing the security text, the method further includes:

[0030] The execution result of the secure text is obtained and recorded, wherein the execution result includes the execution status, timestamp, and executor;

[0031] Based on the execution result, perform at least one of the following: generate a chart based on the execution result, and map and transfer the execution result as input data among the plurality of execution tasks.

[0032] Secondly, embodiments of this application provide a secure text execution device, comprising:

[0033] The first determining module is configured to determine the abnormal event and the system state corresponding to the abnormal event;

[0034] The second determining module is configured to determine, based on the system state, multiple execution tasks that will run when the abnormal event occurs.

[0035] The identification module is configured to identify risks from the plurality of execution tasks and determine risky tasks from the plurality of execution tasks;

[0036] The query module is configured to query the security text corresponding to the risk task from the security text library; wherein, the security text includes a process definition file;

[0037] The execution module is configured to respond to the risk task based on the retrieved security text and execute the security text.

[0038] Thirdly, embodiments of this application provide an electronic device, the electronic device comprising:

[0039] At least one processor; and

[0040] A memory communicatively connected to the at least one processor; wherein,

[0041] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the secure text execution method described in any embodiment of this application.

[0042] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the secure text execution method described in any embodiment of this application. Attached Figure Description

[0043] The accompanying drawings used in the following description of the embodiments will be introduced. The drawings described below are drawings of some embodiments related to this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0044] Figure 1 is a flowchart of a secure text execution method provided in Embodiment 1 of this application;

[0045] Figure 2 is a flowchart of a secure text execution method provided in Embodiment 2 of this application;

[0046] Figure 3 is a schematic diagram of the structure of a secure text execution device provided in Embodiment 3 of this application;

[0047] Figure 4 shows a schematic diagram of the structure of an electronic device that can be used to implement an embodiment of this application. Detailed Implementation

[0048] The embodiments of this application will now be described with reference to the accompanying drawings. These described embodiments are some related to this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort should fall within the scope of protection of this application.

[0049] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, for example, including, in addition to processes, methods, systems, products, or devices that include the series of steps or units shown in the embodiments of this application, other processes, methods, systems, products, and devices not listed in this series of steps or units, or other steps or units inherent to these processes, methods, systems, products, or devices.

[0050] Example 1

[0051] Figure 1 is a flowchart of a secure text execution method provided in Embodiment 1 of this application. This embodiment is applicable to the execution of secure text. The method can be executed by a secure text execution device, which can be implemented in hardware and / or software and can be configured in an electronic device. As shown in Figure 1, the method includes:

[0052] S110. Determine the abnormal event and the system state corresponding to the abnormal event.

[0053] An abnormal event can refer to an event in which network data is abnormal, such as a network attack, data breach, or malware infection; system state can refer to the status records of all tasks executing on the system host. For example, the system state corresponding to an abnormal event can refer to the status records of all tasks executing on the system host at the time the abnormal event occurred.

[0054] In this embodiment, the abnormal event that occurred can be determined by detecting the system host, as well as the status records of all tasks executed in the system host when the abnormal event occurred.

[0055] S120. Determine the multiple execution tasks that will run when the abnormal event occurs based on the system state.

[0056] Task execution refers to the process by which a system automatically performs a series of operations based on a predetermined plan or real-time needs. These operations can include data processing, file management, and network communication.

[0057] In this embodiment, by recording the status of all tasks running on the system host when the abnormal event occurs, it is possible to determine all tasks running on the system host at the time of the abnormal event.

[0058] S130. Perform risk identification on the plurality of execution tasks and determine the risky tasks from the plurality of execution tasks.

[0059] Risk identification can refer to the identification of anomalies in task execution; risky tasks can refer to tasks that exhibit anomalies.

[0060] In this embodiment, anomaly identification can be performed on all execution tasks running on the system host at the time of the abnormal event, and the abnormal execution tasks can be identified as risk tasks from all execution tasks running on the system host at the time of the abnormal event.

[0061] S140. Query the security text corresponding to the risk task from the security text library; wherein, the security text includes a process definition file.

[0062] A security text library can refer to a database that stores various security texts; a security text can refer to a documented guide that defines the processes by which an organization prevents, detects, and responds to cybersecurity incidents; a process definition document can refer to a document that describes and defines business processes, such as a series of steps, rules, conditions, data, and other relevant information.

[0063] In this embodiment, the security text corresponding to the risk task can be queried from the security text library according to the risk task.

[0064] S150. Respond to the risk task based on the retrieved security text and execute the security text.

[0065] For example, a risk task can be responded to based on the retrieved security text corresponding to the risk task, and multiple main processes contained in the security text can be executed according to the process definition file in the security playbook. Each main process includes multiple sub-processes, which can contain multiple sub-tasks and sub-activities, forming an independent sub-process. For example, the sub-process can be a nested Business Process Modeling Notation (BPMN) process. In addition, during the execution of the security text, the business process tasks described and defined in the process definition file can be executed, which can send messages, notifications, or signals to external systems or participants.

[0066] In this embodiment, by determining an abnormal event and the corresponding system state; determining multiple execution tasks running when the abnormal event occurs based on the system state; identifying risks among the multiple execution tasks and determining risky tasks from among the multiple execution tasks; querying the security text corresponding to the risky task from a security text library; wherein the security text includes a process definition file; responding to the risky task according to the queried security text and executing the security text, this embodiment solves the problem of low efficiency and accuracy of security text response to abnormal events in related technologies, and effectively improves the accuracy of security text response to risky tasks corresponding to abnormal events and the efficiency of executing security text.

[0067] In some embodiments, determining the abnormal event and the corresponding system state includes:

[0068] Detect network traffic; if the network traffic exceeds the preset alarm traffic threshold, an abnormal event is determined to have occurred.

[0069] Network traffic can refer to the amount of data transmitted over a network; preset alarm traffic threshold can refer to the minimum network traffic value that is preset to trigger an alarm.

[0070] In this embodiment, network traffic can be detected in real time. If the network traffic exceeds the preset alarm traffic threshold, it can be determined that an abnormal event has occurred.

[0071] Query the system logs and determine the system status corresponding to the abnormal event based on the system logs.

[0072] System logs can record information about hardware, software, and system problems in the system, and can also monitor events that occur in the system and tasks that are executed.

[0073] In this embodiment, the system log can be queried in real time, and all execution tasks running on the system host at the time of the abnormal event can be determined based on the information recorded in the system log.

[0074] In some embodiments, risk identification is performed on the plurality of execution tasks, and risky tasks are identified from the plurality of execution tasks, including:

[0075] Obtain task information corresponding to the plurality of execution tasks, wherein the task information includes: process information, service information, and planned task information;

[0076] Task information can refer to detailed data and parameters related to the execution of a task; process information can refer to instances of programs running in the system, each process having a unique process identifier; service information can refer to long-running tasks running in the system, usually running in the background, providing continuous functions such as network connectivity and printing support; scheduled task information can refer to tasks that are scheduled to be executed at a future point in time or periodically.

[0077] For example, task information corresponding to multiple execution tasks can be obtained from the system log.

[0078] The task information is judged based on preset judgment conditions to determine whether there is any abnormal task behavior in the multiple execution tasks.

[0079] The preset judgment conditions can refer to the pre-set conditions for judging whether there is abnormal behavior in the task information; abnormal behavior can refer to abnormal behavior in the task information corresponding to the execution of the task.

[0080] For example, the preset judgment conditions may include: judging whether there are processes from unknown sources or unauthorized processes running based on process information; whether there are processes consuming a large amount of CPU or memory resources; whether processes have made abnormal network connection attempts; whether there are processes that have modified system files or sensitive configuration files; judging whether there are abnormally started or hidden services based on service information; and judging whether scheduled tasks have been modified or created based on scheduled task information.

[0081] If abnormal task behavior is found, the task with abnormal behavior is determined to be a risky task.

[0082] For example, task information can be judged according to preset judgment conditions. If abnormal task behavior is judged, the task with abnormal task behavior is determined to be a risky task.

[0083] In this embodiment, after determining the multiple execution tasks running when the abnormal event occurs, the task information corresponding to the multiple execution tasks can be obtained, and the task information can be judged according to the preset judgment conditions. If it is determined that there is abnormal behavior in the task, the execution task with abnormal behavior is determined to be a risk task, which effectively improves the efficiency and accuracy of determining risk tasks from multiple execution tasks.

[0084] Example 2

[0085] Figure 2 is a flowchart of a secure text execution method provided in Embodiment 2 of this application. This embodiment is an adjustment based on the above embodiment. As shown in Figure 2, the method includes:

[0086] S210. Determine the abnormal event and the system state corresponding to the abnormal event.

[0087] S220. Based on the system state, determine the multiple execution tasks that will run when the abnormal event occurs.

[0088] S230. Perform risk identification on the plurality of execution tasks and determine the risky tasks from the plurality of execution tasks.

[0089] S240. Perform task type identification on the risk task to determine the task type corresponding to the risk task;

[0090] Task type can refer to the type of risky task; task type identification can refer to identifying the task type of risky task. For example, the task type of risky task can include workflow task type, compliance task type, application task type, user and identity management task type, temporary task type, and scheduled task type.

[0091] In this embodiment, after identifying the risky task, the task type can be identified to determine the corresponding task type.

[0092] S250. Based on the task type, query the security text corresponding to the task type from the security text library.

[0093] The security text library stores security texts corresponding to various task types. For example, security texts include workflow security texts, compliance security texts, application security texts, user and identity management security texts, and scheduled task security texts.

[0094] In this embodiment, after determining the task type corresponding to the risky task, the corresponding security text can be queried from the security text library based on the task type.

[0095] S260. Respond to the risk task based on the retrieved security text and execute the security text.

[0096] In this embodiment, by determining an abnormal event and the corresponding system state; determining multiple execution tasks running when the abnormal event occurs based on the system state; identifying risks among the multiple execution tasks; identifying the task type of the risk task; querying a security text corresponding to the task type from a security text library based on the task type; and responding to the risk task according to the queried security text and executing the security text, this method solves the problem of low efficiency and accuracy of security text response to abnormal events in related technologies, and effectively improves the accuracy of security text response to risk tasks corresponding to abnormal events and the efficiency of executing security text.

[0097] In some embodiments, the step of identifying the task type of the risk task and determining the task type corresponding to the risk task includes:

[0098] Multiple task type theme dictionaries are pre-configured;

[0099] A task type theme dictionary can refer to a collection of words that are classified and summarized according to different task type themes; for example, multiple task type theme dictionaries can be pre-set according to different task types.

[0100] Keyword extraction is performed on the task names of the aforementioned risky tasks;

[0101] The task name can refer to the name that identifies and describes the risk task; for example, keywords can be extracted from the task name of the risk task, and at least one keyword can be extracted.

[0102] The keywords are matched with each task type theme dictionary to determine the task type theme corresponding to the keywords, and the task type corresponding to the task type theme is taken as the task type corresponding to the risk task.

[0103] For example, workflow tasks are used to handle routine business processes, such as order processing and approval processes. You can view the task name and description of this workflow task through the Task Manager and extract keywords such as "workflow" and "approval".

[0104] Compliance tasks are designed to ensure that systems and applications comply with security policies and regulations, such as regular security scans and audit log backups. You can view the task names of compliance tasks through Task Manager and extract keywords such as "compliance," "audit," and "security."

[0105] Application tasks are typically associated with a specific application and are responsible for the application's proper functioning, such as database backups and cache clearing. You can use Task Manager to view the application names or related keywords within the task names.

[0106] User and Identity Management Tasks are related to user account management, including account creation, password reset, and permission assignment. You can view the task names of User and Identity Management Tasks through the Task Manager and extract keywords such as "user," "account," and "permission."

[0107] Scheduled tasks are tasks that are executed according to a predetermined schedule, such as regular system backups and data synchronization. You can view the task names of scheduled tasks through Task Manager and extract keywords such as "scheduled," "backup," and "sync."

[0108] For example, for risky tasks where no corresponding terms were found and keywords were difficult to extract, specialized tools, such as Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools, can be used to identify the task type of the risky task.

[0109] In this embodiment, multiple task type theme dictionaries can be pre-set; keywords can be extracted from the task names of the risk tasks; the keywords can be matched with each task type theme dictionary to determine the task type theme corresponding to the keywords, and the task type corresponding to the task type theme can be used as the task type corresponding to the risk task; based on the task type, the security text corresponding to the task type can be queried from the security text library; the risk task can be responded to according to the queried security text, and the security text can be executed, which effectively improves the accuracy of the security text in responding to the risk tasks corresponding to abnormal events and the efficiency of executing the security text.

[0110] In some embodiments, responding to the risk task based on the retrieved security text and executing the security text includes:

[0111] Obtain the process definition file for the retrieved security text;

[0112] Based on the task configuration in the process definition file, execute the task configured in the security text.

[0113] Task configuration can refer to the tasks configured in the process definition file corresponding to the security text. For example, the process definition file includes business rules, which execute the tasks configured in the security text according to the business rules, and can make corresponding decisions based on the business rules, such as Internet Protocol (IP) blocking, alarms, etc.

[0114] In this embodiment, the security text corresponding to the task type is queried from the security text library, and the process definition file of the queried security text is obtained. According to the task configuration in the process definition file, the task configured by the corresponding security text is executed, and the corresponding decision is made. This effectively improves the accuracy of the security text in responding to risk tasks corresponding to abnormal events and the efficiency of executing the security text.

[0115] In some embodiments, the process definition file may include boundary event tasks and compensation tasks.

[0116] Boundary event tasks can refer to unforeseen or non-standard cybersecurity events and tasks outside of security playbooks. The existence of boundary event tasks is typically determined by process definition files; different process definition files contain the definition of at least one boundary event and its triggering conditions. For example, the definition of a boundary event and its triggering conditions can be found by examining a process definition file, such as a BPMN Extensible Markup Language (XML) file. When the conditions associated with the boundary event are met, the associated boundary event task will be executed. Types of boundary events include signal events, message events, timer events, error events, compensation events, and interrupt events, etc.

[0117] For example, if there is a "risk audit" task in the security process, to ensure the accuracy of the audit, an "interruption event" can be defined next to this task to check for cancellation requests from users. If a cancellation request is received from the user during the audit process, the interruption event is triggered, the current audit process is stopped, and the "risk audit" task is cancelled instead.

[0118] Compensation tasks refer to undoing previously executed operations to restore the system to its previous state. In complex business processes, ensuring data consistency is crucial, and compensation tasks help restore data consistency when problems occur. The existence of compensation tasks is typically determined by the process definition file; different process definition files can contain at least one compensation task definition and its triggering conditions. For example, a compensation task can be triggered when an activity fails, or when an error is detected during the execution of a security text, such as command execution failure or timeout. The definition of compensation events and their triggering conditions can be found by examining the process definition file, such as a BPMN XML file. When the conditions related to executing a compensation task for a security text are met, the compensation task will be executed. This can be done using a Business Process Management (BPM) engine that supports compensation mechanisms, such as Camunda BPM or Java Business Process Management (jBPM).

[0119] For example, if a process is triggered by a command execution failure, a rollback operation is required. The process needs to roll back to the state before the task failed, restoring the system or device to its state before the command execution. This could include canceling the operation, restoring the configuration, or isolating the infected device. Furthermore, if errors require manual intervention, the system can provide manual intervention options so that staff can take appropriate error correction measures.

[0120] In some embodiments, after responding to the risk task based on the retrieved security text and executing the security text, the method further includes:

[0121] The execution result of the secure text is obtained and recorded, wherein the execution result includes the execution status, timestamp, and executor;

[0122] The execution result can refer to the result of executing the security text configuration task; the execution status can refer to the status when the security text execution is completed, such as execution success or execution failure; the timestamp can refer to the time point when the security text started execution, such as a 13-digit value; the executor can refer to the executor's identifier (ID).

[0123] For example, when the secure text execution is complete, the execution result of the secure text is output: whether the secure text execution was successful or failed, timestamp, and the executor's ID, etc.

[0124] Based on the execution result, perform at least one of the following: generate a chart based on the execution result, and map and transfer the execution result as input data among the plurality of execution tasks.

[0125] Mapping can refer to the process of mapping the result of an execution to another execution task.

[0126] For example, charts can be generated based on the execution status, timestamps, and executor included in the execution results to communicate the results to relevant personnel or systems. Execution results can be used as input data and mapped and transferred between multiple execution tasks. The execution result output needs to record the script's execution information for data transfer, ensuring complete data backup and providing data support for rapid recovery after abnormal events.

[0127] For example, when execution results are transferred between multiple execution tasks, a flag field, such as a fixed bit or a unique identifier, can be added to the execution results input into the execution tasks. This map the results to the output data of the execution tasks, ensuring the consistency and correctness of data transfer. For example, expression languages ​​(such as XPath or EL expressions) can be used to define mapping rules for data mapping and transfer.

[0128] In some embodiments, the verification process for secure text includes:

[0129] A pre-set simulated security text is determined, and the correctness of the execution logic of the simulated security text is verified. The verification of the execution logic of the simulated security text includes: single-step execution, step-by-step execution, breakpoint setting, viewing the variables, status and data of the current execution step, and viewing the generated logs and output data of each execution step.

[0130] For example, step-by-step execution (Step Over) can refer to executing one line of code at a time and observing the program's execution flow. Step-by-step execution (Step Into / Out) includes: Step Into, when encountering a function call, you can choose to enter the function and execute line by line instead of skipping directly; Step Out, if you have already entered the function, you can use this function to jump out of the current function and continue executing the code that called the function. Breakpoints can pause execution at specific points in the code to examine variable values, stack traces, and other information at that moment. Variables in the current execution step can include local and global variables of the current execution step, the status of the current execution step can include success or failure, and the data of the current execution step can refer to detailed data and parameters of the current execution step. Viewing the generated logs and output data of each execution step allows you to insert log records at key execution step locations, facilitating the tracking of the program's execution process. By viewing the generated log files and console output data, you can understand the running trajectory of the simulated security text program and the data changes at each stage of the simulated security text.

[0131] In this embodiment, the correctness of the simulated secure text execution logic can be verified through steps such as single-step execution, step-by-step execution, setting breakpoints, viewing variables, status and data of the current execution step, and viewing the generated logs and output data of each execution step.

[0132] The simulation process for secure text includes:

[0133] Execute the simulated secure text process to obtain the simulated execution result;

[0134] The simulation execution result can refer to the result obtained by executing the simulated secure text.

[0135] Determine whether the simulated execution result is consistent with the preset expected execution result;

[0136] The preset expected execution result can refer to the result that should be obtained by executing the simulated security text in advance. For example, the simulated execution result is compared with the preset expected execution result to determine whether the simulated execution result is consistent with the preset expected execution result.

[0137] If the simulated secure text execution logic is verified correctly, and the simulated secure text execution result is consistent with the preset expected execution result, then the simulated secure text is stored in the secure text library;

[0138] Otherwise, issue an alarm and correct and update the simulated security text until the updated simulated security text's execution logic verification is correct and the simulation execution result is consistent with the preset expected execution result, and then store the updated simulated security text in the security text library.

[0139] In this embodiment, by verifying the execution logic of the simulated secure text and simulating the simulated secure text, if the execution logic of the simulated secure text is verified to be correct and the execution result of the simulated secure text is consistent with the preset expected execution result, the simulated secure text is stored in the secure text library, thus ensuring the accuracy of the secure text in the secure text library.

[0140] Example 3

[0141] Figure 3 is a schematic diagram of a secure text execution device provided in Embodiment 3 of this application. As shown in Figure 3, the device includes:

[0142] The first determining module 310 is configured to determine the abnormal event and the system state corresponding to the abnormal event;

[0143] The second determining module 320 is configured to determine, based on the system state, multiple execution tasks that will run when the abnormal event occurs.

[0144] The identification module 330 is configured to identify risks in the plurality of execution tasks and determine risky tasks from the plurality of execution tasks;

[0145] The query module 340 is configured to query the security text corresponding to the risk task from the security text library; wherein, the security text includes a process definition file;

[0146] The execution module 350 is configured to respond to the risk task based on the retrieved security text and execute the security text.

[0147] In some embodiments, the first determining module 310 is configured as follows:

[0148] Detect network traffic, and determine that an abnormal event has occurred when the network traffic exceeds a preset alarm traffic threshold;

[0149] Query the system logs and determine the system status corresponding to the abnormal event based on the system logs.

[0150] In some embodiments, the identification module 330 is configured as follows:

[0151] Obtain task information corresponding to the plurality of execution tasks, wherein the task information includes: process information, service information, and planned task information;

[0152] The task information is judged based on preset judgment conditions to determine whether there is any abnormal task behavior in the multiple execution tasks.

[0153] In response to the presence of abnormal task behavior in the multiple execution tasks, the execution tasks exhibiting abnormal behavior are determined to be risky tasks.

[0154] In some embodiments, the query module 340 includes:

[0155] The determining unit is configured to identify the task type of the risk task and determine the task type corresponding to the risk task.

[0156] The query unit is configured to query the security text corresponding to the task type from the security text library based on the task type.

[0157] In some embodiments, the determining unit is configured as follows:

[0158] Multiple task type theme dictionaries are pre-configured;

[0159] Keyword extraction is performed on the task names of the aforementioned risky tasks;

[0160] The keywords are matched with each task type theme dictionary to determine the task type theme corresponding to the keywords, and the task type corresponding to the task type theme is taken as the task type corresponding to the risk task.

[0161] In some embodiments, the execution module 350 includes:

[0162] The acquisition unit is configured to acquire the process definition file for the queried security text;

[0163] The execution unit is configured to execute the tasks configured in the security text based on the task configuration in the process definition file.

[0164] In some embodiments, the device for executing the secure text further includes a transmission module configured to:

[0165] The execution result of the secure text is obtained and recorded, wherein the execution result includes the execution status, timestamp, and executor;

[0166] Based on the execution result, perform at least one of the following: generate a chart based on the execution result, and map and transfer the execution result as input data among the plurality of execution tasks.

[0167] The secure text execution device provided in this application embodiment can execute the secure text execution method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of the execution method.

[0168] Example 4

[0169] Figure 4 illustrates a schematic diagram of an electronic device that can be used to implement embodiments of this application. The electronic device 10 represents various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are provided as examples.

[0170] As shown in Figure 4, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor 11, and the computer program is executed by the at least one processor 11 to enable the at least one processor 11 to perform the method provided in this application.

[0171] The processor 11 can perform various appropriate actions and processes based on a computer program stored in the read-only memory (ROM) 12 or a computer program loaded from the storage unit 18 into the random access memory (RAM) 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0172] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0173] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 may include a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the secure text execution method.

[0174] In some embodiments, the secure text execution method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, at least one step of the secure text execution method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the secure text execution method by any other suitable means (e.g., by means of firmware).

[0175] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard parts (ASSPs), systems on chips (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0176] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0177] In the context of this application, a computer-readable storage medium stores computer instructions that, when executed by a processor, implement the method for executing the secure text provided in this application. The computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. The computer-readable storage medium may include electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium may be a machine-readable signal medium. Examples of machine-readable storage media may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0178] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD) or monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0179] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0180] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and Virtual Private Server (VPS) services, such as high management difficulty and weak business scalability.

[0181] The various processes shown above can be used to reorder, add, or delete steps. For example, the multiple steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of this application can be achieved.

Claims

1. A method for executing secure text, comprising: Determine the abnormal event and the corresponding system state; Based on the system state, determine the multiple execution tasks that were running when the abnormal event occurred; Risk identification is performed on the multiple execution tasks, and risky tasks are identified from the multiple execution tasks; Retrieve the security text corresponding to the risk task from the security text library; wherein, the security text includes a process definition file; The system responds to the risk task based on the retrieved security text and executes the security text.

2. The method according to claim 1, wherein, The determination of the abnormal event and the corresponding system state includes: Detect network traffic, and determine that an abnormal event has occurred when the network traffic exceeds a preset alarm traffic threshold; Query the system logs and determine the system status corresponding to the abnormal event based on the system logs.

3. The method according to claim 1, wherein, The step of identifying risks from the plurality of execution tasks, and determining risky tasks from the plurality of execution tasks, includes: Obtain task information corresponding to the plurality of execution tasks, wherein the task information includes: process information, service information, and planned task information; The task information is judged based on preset judgment conditions to determine whether there is any abnormal task behavior in the multiple execution tasks. In response to the presence of abnormal task behavior in the multiple execution tasks, the execution tasks exhibiting abnormal behavior are determined to be risky tasks.

4. The method according to claim 1, wherein, The step of querying the security text corresponding to the risk task from the security text library includes: The risk task is identified to determine the corresponding task type. Based on the task type, query the security text corresponding to the task type from the security text library.

5. The method according to claim 4, wherein, The step of identifying the task type of the risk task and determining the corresponding task type includes: Multiple task type theme dictionaries are pre-configured; Keyword extraction is performed on the task names of the aforementioned risky tasks; The keywords are matched with each task type theme dictionary to determine the task type theme corresponding to the keywords, and the task type corresponding to the task type theme is taken as the task type corresponding to the risk task.

6. The method according to claim 1, wherein, The step of responding to the risk task based on the retrieved security text and executing the security text includes: Obtain the process definition file for the retrieved security text; Based on the task configuration in the process definition file, execute the task configured in the security text.

7. The method of claim 6, further comprising, after responding to the risk task based on the retrieved security text and executing the security text: The execution result of the secure text is obtained and recorded, wherein the execution result includes the execution status, timestamp, and executor; Based on the execution result, perform at least one of the following: generate a chart based on the execution result, and map and transfer the execution result as input data among the plurality of execution tasks.

8. A secure text execution device, comprising: The first determining module is configured to determine the abnormal event and the system state corresponding to the abnormal event; The second determining module is configured to determine, based on the system state, multiple execution tasks that will run when the abnormal event occurs. The identification module is configured to identify risks from the plurality of execution tasks and determine risky tasks from the plurality of execution tasks; The query module is configured to query the security text corresponding to the risk task from the security text library; wherein, the security text includes a process definition file; The execution module is configured to respond to the risk task based on the retrieved security text and execute the security text.

9. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the secure text execution method according to any one of claims 1-7.

10. A computer-readable storage medium storing computer instructions for causing a processor to execute a method for executing the secure text according to any one of claims 1-7.

Images