Method and device for processing alarm information

Abstract

The present application discloses a method and device for processing alarm information. The method includes: extracting alarm type, source IP address and destination IP address of alarm information to be rated; obtaining, within a preset time period, the occurrence frequency reflecting the alarm type The alarm type rating value, the threat source rating value reflecting whether the threat source of the alarm information appears for the first time, and the IP address information rating value reflecting the threat level associated with the IP address information; based on the alarm type rating value, the threat source rating The numerical value and the IP address information rating numerical value are weighted and summed to determine an alarm information threat level representing the threat level of the alarm information, and the alarm information is sorted based on the alarm information threat level. By applying the solution provided in this application, the response speed of a threat event can be improved.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to a method and device for processing alarm information. Background technique [0002] With the growing trend of network traffic, network attacks are becoming more and more complex. In the prior art, in order to deal with various increasingly complex network attacks, network security devices such as intrusion detection equipment, firewall equipment, and terminal detection and response equipment are generally used. The detection device monitors the network, terminals, etc. in real time, and outputs abnormal conditions such as network attacks in the form of alarm information, which is provided to the network security operation and maintenance personnel. Due to different reasons, security detection equipment generates a large amount of alarm information, and network security operation and maintenance personnel cannot quickly locate real network threat events fro...

AI Technical Summary

Problems solved by technology

[0003] The embodiment of the present application provides a method and device for processing alarm information, which is used to solve the problem that in the prior art, when a large amount of alarm information is generated on the network, network security operation and maintenance personnel and security researchers cannot quickly locate the real alarm based on a large amount of alarm information. The Problem with Cyber ​​Threat Incidents

Images