Alarm information processing method and device

Abstract

The invention discloses an alarm information processing method and device. The method comprises the steps of extracting an alarm type, a source IP address and a destination IP address of to-be-rated alarm information; in a preset time period, obtaining an alarm type rating value reflecting the occurrence frequency of the alarm type, a threat source rating value reflecting whether a threat source of the alarm information appears for the first time or not, and an IP address information rating value reflecting the associated threat degree of the IP address information; and performing weighted summation based on the alarm type rating value, the threat source rating value and the IP address information rating value to determine an alarm information threat level representing the alarm information threat degree, and sorting the alarm information based on the alarm information threat level. By applying the scheme provided by the invention, the threat event response speed can be increased.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular to a method and device for processing alarm information. Background technique [0002] With the increasing trend of network traffic, network attacks are becoming more and more complex. In the existing technology, in order to deal with various increasingly complex network attacks, network security devices such as intrusion detection equipment, firewall equipment, terminal detection and response equipment, etc. are generally used. The detection equipment monitors the network and terminals in real time, and outputs abnormal situations such as network attacks in the form of alarm information, which is provided to the network security operation and maintenance personnel. For different reasons, the security detection equipment generates a large amount of alarm information, but within a limited time, network security operation and maintenance personnel cannot quickly...

AI Technical Summary

Problems solved by technology

[0003] The embodiment of the present application provides a method and device for processing alarm information, which is used to solve the problem that in the prior art, when a large amount of alarm information is generated on the network, network security operation and maintenance personnel and security researchers cannot quickly locate the real alarm based on a large amount of alarm information. The Problem with Cyber ​​Threat Incidents

Images