A method, device, equipment and storage medium for processing security alarm events

Abstract

The embodiment of the present invention discloses a method, device, equipment and storage medium for processing security alarm events. The method includes: obtaining multiple security alarm events generated within a set time period, and identifying the target alarm hardware corresponding to each security alarm event; obtaining the target asset type corresponding to each target alarm hardware, and querying the mapping relationship between the asset type and the asset importance index to obtain the target asset importance index; obtaining the target hazard level corresponding to each security alarm event, and querying the mapping relationship between the hazard level and the hazard importance index to obtain the target hazard importance index; according to each target asset importance index and each target hazard importance index, determining the processing order of each security alarm event and processing it. The embodiment of the present invention solves the problem of effective protection of tens of thousands of information technology assets, realizes the improvement of the efficiency of handling security incidents, and maximizes the cost-effectiveness of security reinforcement.

Description

Technical Field

[0001] The embodiments of the present invention relate to computer data processing technology, and in particular to a method, device, equipment and storage medium for processing a security alarm event. Background Art

[0002] With the accelerated evolution of digital transformation, enterprises are moving to the cloud more and more, and information technology (IT) assets are increasing, resulting in more and more vulnerabilities. Faced with increasingly complex attacks, network security issues are becoming increasingly prominent. The traditional model that relies on limited manpower and dozens of monitoring and protection tools cannot meet current needs.

[0003] During the invention process, the inventor discovered the following defects in the prior art: faced with tens of thousands of assets that need protection, many critical security alarms may be overwhelmed, and the best protection time may be missed, bringing unimaginable consequences. Core data may be modified and leaked, and production systems may be interrupted, affecting the healthy development of the enterprise and even affecting the country's cyberspace sovereignty, security and development interests. Summary of the invention

[0004] The embodiments of the present invention provide a method, device, equipment and storage medium for processing security alarm events, which can scientifically and efficiently determine the defense order of each alarming hardware asset in a scenario where multiple hardware assets alarm at the same time.

[0005] In a first aspect, an embodiment of the present invention provides a method for processing a security alarm event, which includes:

[0006] Acquire multiple security alarm events generated within a set period of time, and identify the target alarm hardware corresponding to each security alarm event;

[0007] Obtaining the target asset type corresponding to each of the target alarm hardware, and querying the mapping relationship between the asset type and the asset importance index, to obtain the target asset importance index corresponding to each of the target alarm hardware;

[0008] Obtaining the target hazard level corresponding to each of the security warning events, and querying the mapping relationship between the hazard level and the hazard importance index, to obtain the target hazard importance index corresponding to each of the target hazard levels;

[0009] According to each of the target asset importance indexes and each of the target hazard importance indexes, a processing order for each of the security alarm events is determined, and each of the security alarm events is processed according to the processing order.

[0010] In a second aspect, an embodiment of the present invention further provides a device for processing a security alarm event, the device for processing a security alarm event comprising:

[0011] A security alarm event acquisition module is used to acquire multiple security alarm events generated within a set period of time and identify the target alarm hardware corresponding to each security alarm event;

[0012] The target asset importance index acquisition module is used to acquire the target asset type corresponding to each of the target alarm hardware, and query the mapping relationship between the asset type and the asset importance index to acquire the target asset importance index corresponding to each of the target alarm hardware;

[0013] A target hazard importance index acquisition module is used to acquire the target hazard level corresponding to each of the security warning events, and query the mapping relationship between the hazard level and the hazard importance index to acquire the target hazard importance index corresponding to each of the target hazard levels;

[0014] The processing sequence determination module is used to determine the processing sequence of each of the security alarm events according to the importance index of each of the target assets and the importance index of each of the target hazards, and to process each of the security alarm events according to the processing sequence.

[0015] In a third aspect, an embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for processing security alarm events as described in any embodiment of the present invention is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a storage medium comprising computer executable instructions, on which a computer program is stored, wherein when the program is executed by a processor, a method for processing a security alarm event as described in any embodiment of the present invention is implemented.

[0017] The technical solution provided by the embodiment of the present invention obtains multiple security alarm events generated within a set time period, and identifies the target alarm hardware corresponding to each security alarm event; obtains the target asset type corresponding to each target alarm hardware, and queries the mapping relationship between the asset type and the asset importance index, and obtains the target asset importance index corresponding to each target alarm hardware; obtains the target hazard level corresponding to each security alarm event, and queries the mapping relationship between the hazard level and the hazard importance index, and obtains the target hazard importance index corresponding to each target hazard level; according to each target asset importance index and each target hazard importance index, the processing order of each security alarm event is determined, and each security alarm event is processed according to the processing order. It solves the problem of effective protection of tens of thousands of information technology assets, realizes the improvement of security event handling efficiency, can scientifically defend against network security and reduce the serious impact of network attacks on IT assets with high quality and efficiency, and maximizes the cost-effectiveness of security reinforcement. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1a A flowchart of a method for processing a security alarm event provided in Embodiment 1 of the present invention;

[0019] Figure 1b A schematic diagram of the structure of an asset importance assessment result model of a hierarchical analysis method in a method for processing a security alarm event provided in the first embodiment of the present invention;

[0020] Figure 1c A schematic diagram of the structure of a security alarm event priority evaluation result model using a weighted analysis method in a method for processing security alarm events provided in Embodiment 1 of the present invention;

[0021] Figure 2 It is a structural diagram of a device for processing a security alarm event provided in Embodiment 2 of the present invention;

[0022] Figure 3 It is a structural diagram of a computer device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0024] Embodiment 1

[0025] Figure 1aA flowchart of a method for handling a security alarm event provided in Embodiment 1 of the present invention. This embodiment can be applied to the situation where a defense order of multiple alarming hardware assets is determined in a scenario where multiple hardware assets alarm at the same time. The method of this embodiment can be executed by a device for handling security alarm events, which can be implemented in software and / or hardware, and can be configured in a computer device such as a server or terminal device.

[0026] Accordingly, the method specifically comprises the following steps:

[0027] S110: Acquire multiple security alarm events generated within a set period of time, and identify target alarm hardware corresponding to each security alarm event.

[0028] Among them, security alarm events can be threats existing in servers or cloud products detected by the cloud security center. These threats can be attacks on IT assets by a malicious IP or abnormal situations in which assets have been invaded. Security alarm event information includes the time of occurrence, victim asset IP, victim asset type, attacker IP, attack event type, attack status, and hazard level. The target alarm hardware can be the alarm hardware corresponding to the security alarm event.

[0029] Optionally, obtain multiple security warning events generated within a set period of time, including:

[0030] At set time intervals, multiple security alarm events generated within the time interval are obtained from the security alarm event monitoring platform.

[0031] The set duration can be a duration set according to previous experience or the field of application. The system can obtain multiple security alarm events generated during the period from the security alarm event monitoring platform regularly according to the set duration. The set duration can be 5 minutes or 10 minutes. There is no limit on the set duration here. The security alarm event monitoring platform can combine modern audio and video compression technology, network communication technology, computer control technology, and streaming media transmission technology, adopt a modular software design concept, and implement different needs in the form of component modules. With network centralized management and network transmission as the core, it completes the entire process of information collection, transmission, control, management, and storage. It can be built on various private networks, local area networks, metropolitan area networks, or wide area networks, realizing monitoring networking and centralized management. Authorized users can monitor the monitoring site in real time on any computer on the network, providing a powerful and flexible network centralized monitoring comprehensive solution.

[0032] In this embodiment, by obtaining multiple security alarm events generated within a set period of time from the security alarm event monitoring platform and identifying the target alarm hardware corresponding to each security alarm event, multiple security alarm events can be obtained from the security alarm event monitoring platform, thereby realizing real-time monitoring of security alarm events that attack IT assets and providing timely feedback to the monitoring platform, ensuring that staff can receive security alarm events in a timely manner and can handle them in a timely manner.

[0033] S120: Obtain the target asset type corresponding to each of the target alarm hardware, query the mapping relationship between the asset type and the asset importance index, and obtain the target asset importance index corresponding to each of the target alarm hardware.

[0034] The asset type may be the type of asset corresponding to the target alarm hardware, which may specifically include: network equipment (routers or switches, etc.), security equipment, terminal computers, host terminals, application systems, middleware, and databases, etc. The asset importance index may be the importance of the asset expressed in the form of specific data, for example, the asset importance index of the network equipment may be 0.2 and the asset importance index of the security equipment may be 0.4, etc. The mapping relationship may refer to the relationship between the elements of the sets of two elements, and may be the relationship between the asset type and the asset importance index.

[0035] In this embodiment, the system obtains multiple security alarm events generated within a set time period from the security alarm event monitoring platform, and each security alarm event corresponds to a target alarm hardware. According to the target alarm hardware, the corresponding target asset type can be obtained, and the mapping relationship between the asset type and the asset importance index can be queried to calculate the asset importance index.

[0036] Specifically, the mapping relationship between the asset type and the asset importance index can be determined by using the hierarchical analysis method or other analysis methods, which are not limited here. Therefore, the asset importance index is obtained by calculation.

[0037] Optionally, before querying the mapping relationship between the asset type and the asset importance index to obtain the target asset importance index corresponding to each of the target alarm hardware, the following may also be included:

[0038] Acquire multiple reference factors matching the asset importance index;

[0039] Based on the first allocation weights of the reference factors in the same asset type and the second allocation weights of the same reference factors for different asset types, a mapping relationship between the asset type and the asset importance index is generated.

[0040] Optionally, a mapping relationship between asset types and asset importance indexes is generated according to the first allocation weights of the reference factors in the same asset type and the second allocation weights of the same reference factors for different asset types, including:

[0041] Get a target asset type in turn;

[0042] Performing a weighted summation of the first allocation weight and the second allocation weight respectively corresponding to each reference factor of the target asset type to obtain an asset importance index corresponding to the target asset type;

[0043] Return to execute the operation of obtaining a target asset type in sequence until all asset types are processed to form a mapping relationship between the asset type and the asset importance index.

[0044] In this embodiment, by obtaining multiple reference factors that match the asset importance index, and according to the first allocation weight of each reference factor in the same asset type, and the second allocation weight of the same reference factor for different asset types, the first allocation weight and the second allocation weight corresponding to each reference factor of the target asset type are weighted and summed, and finally a mapping relationship between the asset type and the asset importance index is generated. Therefore, the asset importance index can be calculated more accurately, and the priority of the security alarm event can be determined for processing.

[0045] For example, we use the analytic hierarchy process to calculate. First, we need to collect statistics on the basic situation of the assets. We mainly use manual research combined with active detection technology to sort out the basic information of the assets, including the asset type, the IP or domain name of the asset, the category and version, the severity of the exploitable vulnerabilities, the value of the asset, the impact of correlation, etc., to lay a good foundation for security defense. Secondly, we need to determine the asset importance index. Here we use the analytic hierarchy process.

[0046] Specifically, the analytic hierarchy process is a decision analysis method that combines qualitative and quantitative methods. The goal is decomposed into multiple goals or criteria, and then decomposed into several levels of multiple indicators (or criteria, constraints). The single ranking (weight) and total ranking of the levels are calculated through the fuzzy quantification method of qualitative indicators, which is used as a systematic method for optimizing decisions on goals (multiple indicators) and multiple programs. The analytic hierarchy process is suitable for situations where subjective information exists, and it also allows the use of experience and insight in a logical way, so it is very suitable for the evaluation of asset importance index. The specific evaluation steps are as follows:

[0047] like Figure 1bThe following is a structural diagram of the asset importance index evaluation result model of the hierarchical analysis method in a method for handling security alarm events. First, the asset importance index is taken as the goal; secondly, the factors to be considered are determined, where the asset value (or importance), vulnerability severity, impact on business relevance, attack suitability and other elements are taken as criteria; finally, the asset objects to be protected are identified. The asset objects included in general information systems include network equipment, security equipment, terminal computers, host terminals, application systems, middleware, databases, etc. Here, databases, network equipment, and host terminals are used as assignment options for the asset importance index. Therefore, according to the hierarchical analysis method, the discriminant matrix can be constructed as follows:

[0048]

[0049] Among them, the values ​​of the matrix are as follows:

[0050] a ij =1, element i and element j have the same importance;

[0051] a ij =3, element i is slightly more important than element j;

[0052] a ij =5, element i is obviously more important than element j;

[0053] a ij =7, element i is more important than element i;

[0054] a ij =9, element i is extremely more important than element j;

[0055] a ij =2, 4, 6, 8, indicating the middle value of the same judgment above;

[0056] a ij =1 / a ji , the ratio of the importance of element j to element i.

[0057] Next, we need to perform a consistency check. After calculation, we can get, A =4.193CI A =0.061CR A =0.0734<0.10, which meets the consistency requirement, so the weight value of the evaluation element can be determined. After calculation, it can be obtained that the weight vector of the element to the target, that is, the first allocation weight is: w0=[0.5820, 0.2786, 0.0899, 0.0495].

[0058] Therefore, after obtaining the weight vector of the element to the target, the corresponding weight of the asset is calculated by using the hierarchical analysis method when the corresponding weight vector is the target. For example, when the asset value is the target and the database, network equipment and host terminal are the criteria, the matrix can be constructed as follows:

[0059]

[0060] Similarly, consistency verification is performed to meet the consistency requirements, and the weight values ​​of the evaluation elements can be obtained. When the asset value is the target, the weight values ​​of the database, network equipment and host terminal are calculated to be 0.5396, 0.2970 and 0.1634 respectively, which are the second allocation weights.

[0061] Similarly, with the severity of vulnerability, correlation impact and attack adaptability as the goal, and database, network equipment and host terminal as the criteria, the hierarchical analysis method can be used to obtain the corresponding weight values ​​of database, network equipment and host terminal. As shown in Table 1:

[0062] Table 1

[0063]

[0064]

[0065] Therefore, according to the mapping relationship between asset type and asset importance index, the importance index of the database can be calculated as:

[0066] 0.5820*0.5396+0.2786*0.3575+0.0899*0.2608+0.0495*0.4638=0.4601

[0067] Similarly, the importance indexes of network equipment and host terminals can be calculated to be 0.3421 and 0.1978 respectively. Therefore, the asset importance index corresponding to the asset type can be calculated.

[0068] The advantage of this setting is that by obtaining multiple reference factors that match the asset importance index, and according to the first allocation weight of each reference factor in the same asset type, and the second allocation weight of the same reference factor for different asset types, the first allocation weight and the second allocation weight corresponding to each reference factor of the target asset type are weighted and summed, and finally a mapping relationship between the asset type and the asset importance index is generated. Therefore, the asset importance index can be obtained more accurately, and the priority of security alarm events can be determined more accurately, so as to reduce the serious impact of network attacks on target units with high quality and conduct scientific network security defense.

[0069] S130: Obtain the target hazard level corresponding to each of the security warning events, query the mapping relationship between the hazard level and the hazard importance index, and obtain the target hazard importance index corresponding to each of the target hazard levels.

[0070] The target risk level may be the degree of risk of a virus attacking an IT asset, which may include high risk, medium risk, and low risk. The risk importance index may be the importance of a virus that harms an IT asset expressed in the form of specific data.

[0071] Specifically, according to the mapping relationship between the hazard level and the hazard importance index, the hazard importance index of the high-risk level, the hazard importance index of the medium-risk level and the hazard importance index of the low-risk level can be obtained.

[0072] S140: Determine a processing order for each of the security warning events according to each of the target asset importance indexes and each of the target hazard importance indexes, and process each of the security warning events according to the processing order.

[0073] Among them, the processing order of security alarm events is calculated by the importance index of each target asset and the importance index of each target hazard. The higher the priority, the earlier the processing order.

[0074] In this embodiment, by obtaining multiple security alarm events generated within a set period of time from the security alarm event monitoring platform at set intervals, and querying the mapping relationship between asset type and asset importance index and the mapping relationship between hazard level and hazard importance index, the priority order of multiple security alarm events is calculated according to each target asset importance index and each target hazard importance index, and the processing order of each security alarm event is determined according to the priority, and feedback is given to the staff for processing.

[0075] Optionally, determining the processing order of each of the security warning events according to each of the target asset importance indexes and each of the target hazard importance indexes includes:

[0076] Obtaining a first importance weight and a second importance weight corresponding to the asset importance index and the hazard importance index respectively;

[0077] According to the first importance weight, the second importance weight, a weighted sum of the target asset importance index and the target hazard importance index respectively corresponding to each security alarm event is performed to obtain a standard importance index respectively corresponding to each security alarm event;

[0078] The processing order of each of the security alarm events is determined according to the order of the standard importance index from large to small.

[0079] Among them, the first importance weight is represented by w1, and the second importance weight is represented by w2.

[0080] In this embodiment, Figure 1c This is a schematic diagram of the structure of the security alarm event priority evaluation result model based on the weighted analysis method. The priority of the security alarm event is calculated by formula (1):

[0081] P=w1L1+w2L2 (1)

[0082] Where P is the priority of the security alarm event, L1 is the asset importance index, L2 is the hazard importance index, w1 is the first importance weight, and w2 is the second importance weight.

[0083] Among them, when the first importance weight w1 and the second importance weight w2 are 0.5 and 0.5 respectively, it is temporarily determined that the importance of the damaged assets and the importance of the attack incident are the same; when the first importance weight w1 and the second importance weight w2 are 0.6 and 0.4 respectively, it is temporarily determined that the importance of the damaged assets is higher than the importance of the attack incident; when the first importance weight w1 and the second importance weight w2 are 0.4 and 0.6 respectively, it is temporarily determined that the importance of the damaged assets is lower than the importance of the attack incident.

[0084] Correspondingly, the order of the standard importance index from large to small can be calculated according to the above formula, that is, the priority of the security alarm event. According to the order of priority, the processing order of each security alarm event is determined.

[0085] For example, the hazard importance index of security alarm events can be determined as follows: the hazard importance index of high risk is 0.5; the hazard importance index of medium risk is 0.3; and the hazard importance index of low risk is 0.2. At the same time, when the first importance weight w1 and the second importance weight w2 are 0.5 and 0.5 respectively, it is temporarily determined that the importance of the damaged assets and the importance of the attack events are the same. Table 2 below is an example of an alarm event of a security monitoring system of a certain unit.

[0086] Table 2

[0087]

[0088]

[0089] Based on the analytic hierarchy process, the importance index of the unit's database, network equipment, host terminal and other assets is calculated as follows: i =[0.4601,0.3421,0.1978], the asset importance index of this environment is from high to low: database, network equipment, host terminal, among which the database has the highest importance index.

[0090] In addition, the hazard level of the security alarm event, including the high-risk, medium-risk, and low-risk importance index, can be assigned as y i =[0.5:0.3:0.2].

[0091] In summary, the key factor matrix for the priority evaluation of event 1 and event 2 is:

[0092]

[0093] The priority of event 1 is:

[0094] P1=0.5*L 11 +0.5*L 12 =0.5*0.4601+0.5*0.3=0.38005

[0095] The priority of event 2 is:

[0096] P2=0.5*L 21 +0.5*L 22 =0.5*0.1978+0.5*0.5=0.3489

[0097] Therefore, the priority of security alarm event 1 is higher than that of security alarm event 2 and needs to be processed first.

[0098] The advantage of this setting is that the standard importance index corresponding to each security alarm event can be obtained by weighting and summing the first importance weight, the second importance weight, the target asset importance index corresponding to each security alarm event, and the target hazard importance index. The standard importance index is calculated by the formula, which makes the calculated standard importance index more accurate, so the priority order of security alarm events can be better determined.

[0099] Optionally, obtaining a first importance weight and a second importance weight corresponding to the asset importance index and the hazard importance index, respectively, includes:

[0100] Acquire multiple security warning sample events in advance, and obtain standard importance index labeling results corresponding to each of the security warning sample events;

[0101] The first importance weight and the second importance weight are obtained by fitting according to the asset importance index and the hazard importance index corresponding to each of the security alarm sample events, and the standard importance index labeling results corresponding to each of the security alarm sample events.

[0102] In this embodiment, it is necessary to obtain multiple security alarm sample events in advance, and the standard importance index labeling results corresponding to each security alarm sample event can be obtained. Through the asset importance index, hazard importance index and standard importance index labeling results, the first importance weight and the second importance weight can be further fitted.

[0103] The advantage of this setting is that the first importance weight and the second importance weight can be fitted by using the asset importance index and hazard importance index corresponding to each security alarm sample event, as well as the standard importance index labeling results corresponding to each security alarm sample event. Therefore, the priority of the calculated security alarm event can be made more accurate, and the protection of assets can be further rationalized and improved in accuracy, so as to achieve high-quality and efficient reduction of the serious impact of network attacks on target units.

[0104] Optionally, the asset type includes at least one of the following: a database, a network device, and a host terminal;

[0105] The hazard level includes at least one of the following: high risk, medium risk, and low risk.

[0106] The technical solution provided by the embodiment of the present invention obtains multiple security alarm events generated within a set time period, and identifies the target alarm hardware corresponding to each security alarm event; obtains the target asset type corresponding to each target alarm hardware, and queries the mapping relationship between the asset type and the asset importance index, and obtains the target asset importance index corresponding to each target alarm hardware; obtains the target hazard level corresponding to each security alarm event, and queries the mapping relationship between the hazard level and the hazard importance index, and obtains the target hazard importance index corresponding to each target hazard level; according to each target asset importance index and each target hazard importance index, the processing order of each security alarm event is determined, and each security alarm event is processed according to the processing order. It solves the problem of effective protection of tens of thousands of information technology assets, realizes the improvement of security event handling efficiency, can scientifically defend against network security and reduce the serious impact of network attacks on IT assets with high quality and efficiency, and maximizes the cost-effectiveness of security reinforcement.

[0107] Embodiment 2

[0108] Figure 2 This is a schematic diagram of the structure of a security alarm event processing device provided in the second embodiment of the present invention. The security alarm event processing device provided in this embodiment can be implemented by software and / or hardware, and can be configured in a server or terminal device to implement a security alarm event processing method in the embodiment of the present invention. Figure 2 As shown, the device may specifically include: a security alarm event acquisition module 210, a target asset importance index acquisition module 220, a target hazard importance index acquisition module 230 and a processing order determination module 240.

[0109] The security alarm event acquisition module 210 is used to acquire multiple security alarm events generated within a set time period and identify the target alarm hardware corresponding to each security alarm event;

[0110] The target asset importance index acquisition module 220 is used to acquire the target asset type corresponding to each of the target alarm hardware, and query the mapping relationship between the asset type and the asset importance index to acquire the target asset importance index corresponding to each of the target alarm hardware;

[0111] The target hazard importance index acquisition module 230 is used to acquire the target hazard level corresponding to each of the security warning events, and query the mapping relationship between the hazard level and the hazard importance index to acquire the target hazard importance index corresponding to each of the target hazard levels;

[0112] The processing sequence determination module 240 is used to determine the processing sequence of each of the security alarm events according to the importance index of each of the target assets and the importance index of each of the target hazards, and to process each of the security alarm events according to the processing sequence.

[0113] The technical solution provided by the embodiment of the present invention obtains multiple security alarm events generated within a set time period, and identifies the target alarm hardware corresponding to each security alarm event; obtains the target asset type corresponding to each target alarm hardware, and queries the mapping relationship between the asset type and the asset importance index, and obtains the target asset importance index corresponding to each target alarm hardware; obtains the target hazard level corresponding to each security alarm event, and queries the mapping relationship between the hazard level and the hazard importance index, and obtains the target hazard importance index corresponding to each target hazard level; according to each target asset importance index and each target hazard importance index, the processing order of each security alarm event is determined, and each security alarm event is processed according to the processing order. It solves the problem of effective protection of tens of thousands of information technology assets, realizes the improvement of security event handling efficiency, can scientifically defend against network security and reduce the serious impact of network attacks on IT assets with high quality and efficiency, and maximizes the cost-effectiveness of security reinforcement.

[0114] Based on the above embodiments, the security alarm event acquisition module 210 can be specifically used for:

[0115] At set time intervals, multiple security alarm events generated within the time interval are obtained from the security alarm event monitoring platform.

[0116] Based on the above embodiments, a reference factor acquisition module may be further included, which is used to:

[0117] Before querying the mapping relationship between the asset type and the asset importance index and obtaining the target asset importance index corresponding to each of the target alarm hardware, the method further includes:

[0118] A reference factor acquisition subunit, used to acquire a plurality of reference factors matching the asset importance index;

[0119] The mapping relationship generating subunit is used to generate a mapping relationship between asset types and asset importance indexes according to the first allocation weights of each reference factor in the same asset type and the second allocation weights of different asset types for the same reference factor.

[0120] Based on the above embodiments, the mapping relationship generating subunit may be specifically used for:

[0121] Get a target asset type in turn;

[0122] Performing a weighted summation of the first allocation weight and the second allocation weight respectively corresponding to each reference factor of the target asset type to obtain an asset importance index corresponding to the target asset type;

[0123] Return to execute the operation of obtaining a target asset type in sequence until all asset types are processed to form a mapping relationship between the asset type and the asset importance index.

[0124] Based on the above embodiments, the processing sequence determination module 240 can be specifically used for:

[0125] The importance weight acquisition subunit is used to acquire the first importance weight and the second importance weight corresponding to the asset importance index and the hazard importance index respectively;

[0126] A standard importance index obtaining subunit is used to perform weighted summation of the target asset importance index and the target hazard importance index corresponding to each security alarm event according to the first importance weight, the second importance weight, and obtain the standard importance index corresponding to each security alarm event;

[0127] The processing order determination subunit is used to determine the processing order of each of the security alarm events according to the order of the standard importance index from large to small.

[0128] Based on the above embodiments, the importance weight acquisition subunit can be specifically used for:

[0129] Acquire multiple security warning sample events in advance, and obtain standard importance index labeling results corresponding to each of the security warning sample events;

[0130] The first importance weight and the second importance weight are obtained by fitting according to the asset importance index and the hazard importance index corresponding to each of the security alarm sample events, and the standard importance index labeling results corresponding to each of the security alarm sample events.

[0131] Based on the above embodiments, the asset type includes at least one of the following: a database, a network device, and a host terminal;

[0132] The hazard level includes at least one of the following: high risk, medium risk, and low risk.

[0133] The above-mentioned security alarm event processing device can execute the security alarm event processing method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0134] Embodiment 3

[0135] Figure 3 is a structural diagram of a computer device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes a processor 310, a memory 320, an input device 330 and an output device 340; the number of processors 310 in the device can be one or more. Figure 3 A processor 310 is taken as an example; the processor 310, memory 320, input device 330 and output device 340 in the device can be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0136] The memory 320, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the method for processing security alarm events in the embodiment of the present invention (for example, the security alarm event acquisition module 210, the target asset importance index acquisition module 220, the target hazard importance index acquisition module 230 and the processing order determination module 240). The processor 310 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 320, that is, implements the above-mentioned method for processing security alarm events, which includes:

[0137] Acquire multiple security alarm events generated within a set period of time, and identify the target alarm hardware corresponding to each security alarm event;

[0138] Obtaining the target asset type corresponding to each of the target alarm hardware, and querying the mapping relationship between the asset type and the asset importance index, to obtain the target asset importance index corresponding to each of the target alarm hardware;

[0139] Obtaining the target hazard level corresponding to each of the security warning events, and querying the mapping relationship between the hazard level and the hazard importance index, to obtain the target hazard importance index corresponding to each of the target hazard levels;

[0140] According to each of the target asset importance indexes and each of the target hazard importance indexes, a processing order for each of the security alarm events is determined, and each of the security alarm events is processed according to the processing order.

[0141] The memory 320 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 320 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 320 may further include a memory remotely arranged relative to the processor 310, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0142] The input device 330 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 340 may include a display device such as a display screen.

[0143] Embodiment 4

[0144] Embodiment 4 of the present invention further provides a storage medium including computer executable instructions, wherein the computer executable instructions are used to execute a method for processing a security warning event when executed by a computer processor, the method comprising:

[0145] Acquire multiple security alarm events generated within a set period of time, and identify the target alarm hardware corresponding to each security alarm event;

[0146] Obtaining the target asset type corresponding to each of the target alarm hardware, and querying the mapping relationship between the asset type and the asset importance index, to obtain the target asset importance index corresponding to each of the target alarm hardware;

[0147] Obtaining the target hazard level corresponding to each of the security warning events, and querying the mapping relationship between the hazard level and the hazard importance index, to obtain the target hazard importance index corresponding to each of the target hazard levels;

[0148] According to each of the target asset importance indexes and each of the target hazard importance indexes, a processing order for each of the security alarm events is determined, and each of the security alarm events is processed according to the processing order.

[0149] Of course, the computer executable instructions of a storage medium including computer executable instructions provided in an embodiment of the present invention are not limited to the method operations described above, and can also execute related operations in the security alarm event processing method provided in any embodiment of the present invention.

[0150] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FLASH), a hard disk or an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0151] It is worth noting that in the embodiment of the above-mentioned search device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0152] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for processing a security alarm event, characterized in that: Acquire multiple security alarm events generated within a set period of time, and identify the target alarm hardware corresponding to each security alarm event; Obtain the target asset type corresponding to each of the target alarm hardware, and query the mapping relationship between the asset type and the asset importance index, and obtain the target asset importance index corresponding to each of the target alarm hardware; wherein the asset importance index is the importance of the asset; Obtaining the target hazard level corresponding to each of the security warning events, and querying the mapping relationship between the hazard level and the hazard importance index, to obtain the target hazard importance index corresponding to each of the target hazard levels; Determine the processing order of each of the security warning events according to the importance index of each of the target assets and the importance index of each of the target hazards, and process each of the security warning events according to the processing order; According to the importance index of each target asset and the importance index of each target hazard, the processing order of each security warning event is determined, including: Obtaining a first importance weight and a second importance weight corresponding to the asset importance index and the hazard importance index respectively; According to the first importance weight, the second importance weight, a weighted sum of the target asset importance index and the target hazard importance index respectively corresponding to each security alarm event is performed to obtain a standard importance index respectively corresponding to each security alarm event; Determine the processing order of each of the security warning events according to the order of the standard importance index from large to small; Before querying the mapping relationship between the asset type and the asset importance index and obtaining the target asset importance index corresponding to each of the target alarm hardware, the method further includes: Acquire multiple reference factors matching the asset importance index; Generate a mapping relationship between asset types and asset importance indexes based on the first allocation weights of each reference factor in the same asset type and the second allocation weights of different asset types for the same reference factor; Based on the first allocation weights of each reference factor in the same asset type and the second allocation weights of different asset types for the same reference factor, a mapping relationship between asset types and asset importance indexes is generated, including: Get a target asset type in turn; Performing a weighted summation of the first allocation weight and the second allocation weight respectively corresponding to each reference factor of the target asset type to obtain an asset importance index corresponding to the target asset type; Return to execute the operation of obtaining a target asset type in sequence until all asset types are processed to form a mapping relationship between the asset type and the asset importance index; The asset type is the type of asset corresponding to the target alarm hardware.

2. The method according to claim 1, characterized in that Get multiple security warning events generated within a set period of time, including: At set time intervals, multiple security alarm events generated within the time interval are obtained from the security alarm event monitoring platform.

3. The method according to claim 1, characterized in that Obtaining a first importance weight and a second importance weight corresponding to the asset importance index and the hazard importance index, respectively, including: Acquire multiple security warning sample events in advance, and obtain standard importance index labeling results corresponding to each of the security warning sample events; The first importance weight and the second importance weight are obtained by fitting according to the asset importance index and the hazard importance index corresponding to each of the security alarm sample events, and the standard importance index labeling results corresponding to each of the security alarm sample events.

4. The method according to any one of claims 1 to 3, characterized in that: The asset type includes at least one of the following: database, network equipment, host terminal, middleware and security equipment; The hazard level includes at least one of the following: high risk, medium risk, and low risk.

5. A device for processing security alarm events, characterized in that: A security alarm event acquisition module is used to acquire multiple security alarm events generated within a set period of time and identify the target alarm hardware corresponding to each security alarm event; The target asset importance index acquisition module is used to acquire the target asset type corresponding to each of the target alarm hardware, and query the mapping relationship between the asset type and the asset importance index to acquire the target asset importance index corresponding to each of the target alarm hardware; wherein the asset importance index is the importance of the asset; A target hazard importance index acquisition module is used to acquire the target hazard level corresponding to each of the security warning events, and query the mapping relationship between the hazard level and the hazard importance index to acquire the target hazard importance index corresponding to each of the target hazard levels; A processing sequence determination module, used to determine the processing sequence of each of the security warning events according to the importance index of each of the target assets and the importance index of each of the target hazards, and process each of the security warning events according to the processing sequence; The processing sequence determination module is specifically used for: The importance weight acquisition subunit is used to acquire the first importance weight and the second importance weight corresponding to the asset importance index and the hazard importance index respectively; A standard importance index obtaining subunit is used to perform weighted summation of the target asset importance index and the target hazard importance index corresponding to each security alarm event according to the first importance weight, the second importance weight, and obtain the standard importance index corresponding to each security alarm event; A processing order determination subunit, used to determine the processing order of each of the security alarm events according to the order of the standard importance index from large to small; Reference factor acquisition module, used for: Before querying the mapping relationship between the asset type and the asset importance index and obtaining the target asset importance index corresponding to each of the target alarm hardware, the method further includes: A reference factor acquisition subunit, used to acquire a plurality of reference factors matching the asset importance index; A mapping relationship generating subunit, for generating a mapping relationship between an asset type and an asset importance index according to a first allocation weight of each reference factor in the same asset type and a second allocation weight of different asset types for the same reference factor; The mapping relationship generating subunit is specifically used for: Get a target asset type in turn; Performing a weighted summation of the first allocation weight and the second allocation weight respectively corresponding to each reference factor of the target asset type to obtain an asset importance index corresponding to the target asset type; Return to execute the operation of obtaining a target asset type in sequence until all asset types are processed to form a mapping relationship between the asset type and the asset importance index; The asset type is the type of asset corresponding to the target alarm hardware.

6. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for processing a security alarm event according to any one of claims 1 to 4 is implemented.

7. A computer executable instruction storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for processing a security alarm event as described in any one of claims 1 to 4 is implemented.

Images