Alarm filtering method, device, medium and electronic equipment

Abstract

The purpose of the embodiments of the present application is to provide a method, apparatus, medium, and electronic device for alarm filtering, the method comprising: obtaining an initial alarm event according to a detection rule; and confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in a noise filter set, wherein the events in the noise filter set are obtained by clustering the aggregated events. The embodiments of the present application do not require manual configuration of filtering rules (instead, the events in the noise filter set are obtained by clustering through an automatic clustering algorithm), which can eliminate the influence of human subjective judgment to a certain extent. The embodiments of the present application can effectively filter false alarms, reduce the false alarm rate, and thus reduce the burden on analysts.

Description

Technical Field

[0001] The present application relates to the field of security, and in particular to an alarm filtering method, device, medium and electronic device. Background Art

[0002] An APT attack (Advanced Persistent Threat) is a highly complex and organized network attack method. Attackers often lurk and repeatedly attack targets over a long period of time. By using tools and techniques, they adapt to the defense measures of the target security system to maintain access to the system for as long as possible. By maintaining a high level of interaction, they obtain information and achieve attack objectives such as penetration, control, collection and transmission of target data.

[0003] ATP attacks are becoming increasingly sophisticated, and the details of the vulnerabilities used vary. One of the goals of APT attacks is to steal sensitive data. By matching events in the system with known TTP (Tactics, Techniques, and Procedures) detection rules, APT attack traces can be analyzed. One of the challenges of analyzing attack behavior in host logs with related technologies is the presence of noise, that is, normal events can also match rules in TTP detection rules. For example, long-lived processes such as browsers, web servers, and SSH daemons will occasionally trigger the matching of TTP detection rules, which will result in a large number of false alarms during the detection process, increasing the workload of analysts. Determining the accuracy of threat alerts remains a huge challenge. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a method, device, medium and electronic device for alarm filtering. Through the embodiments of the present application, there is no need to manually configure the filtering rules (instead, clustering is performed through an automatic clustering algorithm to obtain events in the noise filtering set), which can eliminate the influence of human subjective judgment to a certain extent. In addition, through the embodiments of the present application, false alarms can be effectively filtered, the false alarm rate can be reduced, and the burden on analysts can be reduced.

[0005] In the first aspect, an embodiment of the present application provides a method for alarm filtering, the method comprising: obtaining an initial alarm event according to a detection rule; confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in a noise filtering set, wherein the events in the noise filtering set are obtained by clustering the aggregated events.

[0006] Some embodiments of the present application perform secondary confirmation on the initial alarm events determined by rules through events in the noise filtering set obtained through clustering results. On the one hand, it can effectively eliminate false alarm events and reduce the false alarm rate. On the other hand, based on automatic clustering, it can get rid of the dependence on manual experience and reduce the human impact on the alarm results.

[0007] In some embodiments, the events in the noise filtering set are obtained based on analyzing the number of byte streams of benign activities and attack activities of similar events.

[0008] Some embodiments of the present application obtain events in a noise filtering set by analyzing the difference in the number of byte streams corresponding to benign activities and attack activities, which can improve the accuracy of the data in the set and further improve the efficiency of filtering out false alarms.

[0009] In some embodiments, the step of confirming whether the initial alarm event is real alarm information is at least performed by matching the initial alarm event with events in the noise filtering set, including: if it is confirmed that the initial alarm event matches an event in the noise filtering set, then confirming that the initial alarm event is a false alarm event; if it is confirmed that the initial alarm event does not match all events in the noise filtering set, then confirming that the initial alarm event is a real alarm event.

[0010] Some embodiments of the present application store all false alarm events through noise filtering, and then perform secondary identification of whether the initial alarm event is a real alarm by matching the alarm event to be confirmed with these events.

[0011] In some embodiments, before confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in the noise filter set, the method further includes: collecting benign activity data and collecting attack activity data; matching the benign activity data and the attack activity data with TTP detection rules respectively, and using the successfully matched events as the events to be aggregated; obtaining the noise filter set based on the events to be aggregated and the clustering algorithm, wherein the noise filter set is used to store false alarm events.

[0012] Some embodiments of the present application perform cluster analysis on benign activity data to obtain a noise filtering set, which can improve the accuracy of false alarm information stored in the set, thereby improving the accuracy of the secondary confirmation result.

[0013] In some embodiments, the noise filter set is obtained based on the events to be aggregated and the clustering algorithm, including: using the K-medoids algorithm to divide the events of process-to-file operations and process-to-socket operations in the events to be aggregated into K categories to obtain clustering results, where K is an integer greater than 1; based on the clustering results, calculating the distance from the samples in the cluster to the medoid of the cluster center; comparing the distance with a threshold, and if it is less than or equal to the threshold, taking the corresponding event as an event in the noise filter set.

[0014] Some embodiments of the present application perform cluster analysis on all events obtained from benign activities and attack activities using a K-medoids algorithm to obtain a noise filtering set for storing false alarm events.

[0015] In some embodiments, the threshold is 3 standard deviations of the distance between samples in any cluster and the corresponding medoid.

[0016] The threshold value of some embodiments of the present application is three standard deviations.

[0017] In some embodiments, before confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in the noise filter set, the method further includes: collecting benign activity data and attack activity data; matching the benign activity data and the attack activity data with TTP detection rules respectively, and using the successfully matched events as events to be aggregated; obtaining the noise filter set based on the events to be aggregated and a clustering algorithm, wherein the noise filter set is used to store false alarm events.

[0018] Some embodiments of the present application perform cluster analysis on benign activity data to obtain a noise-filtered set, which can improve the accuracy of obtaining the true alarm information stored in the set, thereby improving the accuracy of the secondary confirmation result.

[0019] In some embodiments, the noise filter set is obtained based on the events to be aggregated and the clustering algorithm, including: using the K-medoids algorithm to divide the events of process-to-file operations and process-to-socket operations in the events to be aggregated into K categories to obtain clustering results, where K is an integer greater than 1; based on the clustering results, calculating the distance from the samples in the cluster to the medoid of the cluster center; comparing the distance with a threshold, and if it is less than or equal to the threshold, taking the corresponding event as an event in the noise filter set.

[0020] Some embodiments of the present application perform cluster analysis on all events obtained from benign activities and attack activities using a K-medoids algorithm to obtain a noise filtering set for storing false alarm events.

[0021] In some embodiments, the threshold is 3 standard deviations of the distance between samples in any cluster and the corresponding medoid.

[0022] The threshold value of some embodiments of the present application is three standard deviations.

[0023] In some embodiments, at least confirming whether the initial alarm event is real alarm information by matching the initial alarm event with events in the noise filtering set includes: confirming whether the initial alarm event is real alarm information by matching the initial alarm event with events in the noise filtering set and through information flow.

[0024] Some embodiments of the present application ultimately determine whether an initial alarm event is a real alarm through information flow consistency and matching results with events in a noise filtering set, thereby improving the accuracy of alarm events.

[0025] In some embodiments, acquiring the initial alarm event according to the detection rule includes: acquiring the initial alarm event through a TTP detection rule.

[0026] Some embodiments of the present application filter out initial alarm events through TTP monitoring rules.

[0027] In some embodiments, the initial alarm event is an operation of a process on a file or an operation of a process on a socket.

[0028] In a second aspect, some embodiments of the present application provide an alarm filtering device, comprising: an initial alarm event acquisition module, configured to acquire an initial alarm event according to a detection rule; an alarm event confirmation module, configured to confirm whether the initial alarm event is real alarm information at least by matching the initial alarm event with events in a noise filtering set, wherein the events in the noise filtering set are obtained by clustering alarm events of benign activities.

[0029] In a third aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0030] In a fourth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the method described in any embodiment of the first aspect can be implemented.

[0031] In order to make the above-mentioned objectives, features and advantages to be achieved by the embodiments of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 An architectural diagram of the alarm filtering system provided in an embodiment of the present application;

[0034] Figure 2 One of the flow charts of the alarm filtering method provided in an embodiment of the present application;

[0035] Figure 3 Flowchart 2 of the alarm filtering method provided in an embodiment of the present application;

[0036] Figure 4 A block diagram of the alarm filtering device provided in an embodiment of the present application;

[0037] Figure 5 This is a block diagram of the composition of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0038] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0039] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0040] Figure 1 The alarm filtering system provided in the embodiment of the present application includes multiple terminal devices, for example, Figure 1 A first terminal device 101, a second terminal device 102 and a third terminal device 103, and a security server 100, wherein the security server 100 is used to monitor the alarm data on each terminal device to improve the security of network communications and the security of the terminal devices.

[0041] The terminal device and the server may be a computing device including a processor and a memory. For example, the terminal device may be an interactive device such as a smart phone with Internet access, a gaming device, or a robot.

[0042] The server can be a network device with security protection functions such as a firewall.

[0043] It should be noted that Figure 1 As an achievable architecture of the embodiment of the present application, those skilled in the art can design a different Figure 1 The network architecture is used to implement the alarm filtering method of some embodiments of the present application.

[0044] like Figure 2 As shown, the figure provides an alarm filtering method according to an embodiment of the present application, the method comprising:

[0045] S101: Obtain an initial alarm event according to a detection rule.

[0046] It should be noted that in some embodiments of the present application, the events in the noise filtering set are obtained by analyzing the byte stream counts of benign and attack activities of the same type of event. In some embodiments of the present application, by analyzing the difference in byte stream counts corresponding to benign and attack activities to obtain the events in the noise filtering set, the accuracy of the data in the set can be improved, thereby improving the efficiency of filtering out false alarms.

[0047] S102, confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in a noise filtering set, wherein the events in the noise filtering set are obtained by clustering the events to be aggregated.

[0048] It can be understood that some embodiments of the present application perform secondary confirmation on the initial alarm events determined by the rules through the events in the noise filtering set obtained through clustering results. On the one hand, it can effectively eliminate false alarm events and reduce the false alarm rate. On the other hand, based on automatic clustering, it can get rid of the dependence on manual experience and reduce the human impact on the alarm results.

[0049] The following exemplifies the alarm filtering methods of some embodiments of the present application.

[0050] In some embodiments of the present application, S101 exemplarily includes: obtaining the initial alarm event through TTP detection rules. That is, in some embodiments of the present application, the initial alarm event is screened out through TTP monitoring rules.

[0051] For example, in some embodiments of the present application, the initial alarm event is an operation of a process on a file or an operation of a process on a socket.

[0052] It should be noted that, in some embodiments of the present application, before S102 , the method further includes a process of acquiring events in the noise filtering set.

[0053] For example, in some embodiments of the present application, before S102, the method further includes:

[0054] The first step is to collect benign activity data and attack activity data.

[0055] In the second step, the benign activity data and the attack activity data are matched with TTP detection rules respectively, and the events in which the benign activity data is successfully matched are used as events to be aggregated.

[0056] The third step is to obtain the noise filter set based on the events to be aggregated and a clustering algorithm, wherein the noise filter set is used to store true alarm events. For example, this third step may include: using the K-medoids algorithm to divide the number of byte streams corresponding to the process's file operations and the number of byte streams corresponding to the process's socket operations in the events to be aggregated into K clusters, obtaining clustering results, where K is an integer greater than 1; based on the clustering results, calculating the distance between samples within the cluster and the medoid at the cluster center; comparing the distance with a threshold; if the distance is less than or equal to the threshold, the corresponding event is included in the noise filter set. This is because events greater than the threshold are true alarms and need to be removed from the noise filter set, not belonging to the noise filter set. Furthermore, the noise filter set contains events with and without byte transmission. Clustering is performed to remove true alarms. After these events are removed, the remaining events in the TTP event set constitute the filtered noise set. For example, in some embodiments of the present application, the threshold is three standard deviations of the distance between samples in any cluster and the corresponding medoid.

[0057] In other words, some embodiments of the present application improve the accuracy of the true alarm information stored in this set by clustering benign activity data to obtain a noise-filtered set, thereby improving the accuracy of secondary confirmation results. This is because the benign activity data collected over a four-day period is 100% benign, but benign data also matches the TTP. Of the 20-day attack activity data collected, less than 0.01% is attack data; the rest is data generated by normal system activity, i.e., benign data. To detect true alarms in attack activity data, some embodiments of the present application do not require clustering the attack activity data. Instead, they only cluster the benign activity data to obtain a set of false alarm events. This set of false alarm events is used to filter out false alarms in the attack activity data. Clustering benign activity is intended to eliminate true alarms from benign activity. Clustering attack activity data would also eliminate true alarms from attack activity. Some embodiments of the present application perform cluster analysis on all events generated from benign and attack activities using the K-medoids algorithm to obtain a noise-filtered set for storing true alarm events. The threshold in some embodiments of the present application is three standard deviations.

[0058] In some embodiments, at least confirming whether the initial alarm event is real alarm information by matching the initial alarm event with events in the noise filtering set includes: confirming whether the initial alarm event is real alarm information by matching the initial alarm event with events in the noise filtering set and through information flow.

[0059] Some embodiments of the present application ultimately determine whether an initial alarm event is a real alarm through information flow consistency and matching results with events in a noise filtering set, thereby improving the accuracy of alarm events.

[0060] For example, in some embodiments of the present application, before S102, the method further includes:

[0061] The first step is to collect benign activity data and attack activity data.

[0062] In the second step, the benign activity data and the attack activity data are matched with TTP detection rules respectively, and the events for which the benign activity data is successfully matched are used as the events to be aggregated.

[0063] The third step is to obtain the noise filter set based on the events to be aggregated and the clustering algorithm, wherein the noise filter set is used to store false alarm events. For example, in some embodiments of the present application, the third step exemplarily includes: using the K-medoids algorithm to divide the file operation events and socket operation events in the events to be aggregated into K categories to obtain clustering results, wherein K is an integer greater than 1; based on the clustering results, calculating the distance between the samples in the cluster and the medoid at the center of the cluster; comparing the distance with a threshold, and if it is less than or equal to the threshold, the corresponding event is included as an event in the noise filter set. For example, in some embodiments of the present application, the threshold is 3 standard deviations of the distance between the samples in any cluster and the corresponding medoid.

[0064] In other words, some embodiments of the present application perform cluster analysis on benign activity data to obtain a noise filter set. This filter is used to reconfirm events that successfully match attack activity data, thereby improving the accuracy of detection results. Some embodiments of the present application perform cluster analysis on benign activity events using the K-medoids algorithm to obtain a noise filter set for storing false alarm events. Some embodiments of the present application use a threshold of three standard deviations.

[0065] The implementation process of S102 is described below by way of example.

[0066] In some embodiments of the present application, S102 exemplarily includes: if it is confirmed that the initial alarm event matches an event in the noise filtering set, then the initial alarm event is confirmed to be a false alarm event; if it is confirmed that the initial alarm event does not match all events in the noise filtering set, then the initial alarm event is confirmed to be a real alarm event.

[0067] That is, some embodiments of the present application store all false alarm events through noise filtering, and then secondarily identify whether the initial alarm event is a real alarm by matching the alarm event to be confirmed with these events.

[0068] The following collection Figure 3 The alarm filtering method of some embodiments of the present application is exemplified.

[0069] The alarm filtering method of some embodiments of the present application is as follows: conduct an APT simulation attack of data leakage on the target host, collect data for a period of 20 days as attack activity data, and separately collect log data for a period of 4 days in the experimental host as benign activity data. Sort the benign log data (or benign activity data) according to the timestamp, search in the benign data using the same detection rules as the attack activity, and record the TTP events that meet the detection rules. Then, remove the event set of {TTP event with byte transmission and number of bytes>byte_thres} in the benign TTP events. Thus, a noise filter set is obtained. Finally, the attack activity log is matched using the detection rules, and the matched TTP events are recorded to obtain the initial alarm event, and it is determined whether the TTP events matched from the attack activity belong to the events in the noise filter set. If they do, the corresponding TTP events are filtered out. Otherwise, the matched TTP events, i.e., the alarm event, are considered to be true attack behavior.

[0070] It should be noted that some embodiments of the present application combine the TTP in benign data with the number of bytes transmitted in benign data to filter out false alarms. The number of bytes transmitted refers to the number of bytes generated when a process reads or writes a system object, where a system object refers to a file, socket, or memory. For example, in a Linux system, when the nginx process reads the / etc / passwd folder, the number of bytes transmitted is equal to the size of the / etc / passwd file. If a larger number of bytes is observed in the information flow from / etc / passwd to nginx, then this information flow may be part of an attack. In some embodiments of the present application, benign data is matched with known TTP detection rules to obtain TTP alarm events that conform to the TTP behavior pattern. Byte_thres represents the byte threshold for benign data. Using the same set of TTP detection rules, rule matching is performed on attack activity data and benign activity data from the same host, resulting in a set of TTP events matched to the attack activity and a noise filter set. TTP events in the attack activity may contain false alarms, and the noise filter set is also needed to filter out false alarms. For example, obtaining the noise filtering algorithm that results in the filter set can be expressed as: normal model = {{TTP event with no byte transmission}, {TTP event with byte transmission and the number of bytes>byte_thres}}.

[0071] like Figure 3 As shown, the alarm filtering method of some embodiments of the present application includes:

[0072] The first step is to collect raw log data.

[0073] A simulated APT attack of data leakage is carried out on the target host, and data for 20 days is collected as attack activity data. Log data for 4 days from the experimental host is separately collected as benign activity data.

[0074] The second step is to use the open source rule library (i.e., TTP detection rules) to match attack behaviors in benign data and record the TTP events that meet the detection rules.

[0075] The third step is to use the K-mediods algorithm to remove the event set of {TTP events with bytes transmitted and the number of bytes > byte_thres} from the benign TTP events to obtain the noise filtering set (or noise filtering model). The algorithm is as follows:

[0076] a) First, the K-medoids algorithm is used to classify the TTP events of process-to-file operations and process-to-socket operations in benign activities into K categories, where K is selected to maximize the silhouette coefficient of the final cluster.

[0077] b) Based on the clustering results, the distance between the samples in the cluster (i.e., each TTP event) and the cluster center medoid is calculated.

[0078] c) Compare the distance to the threshold. If it is greater than the threshold, it is considered an anomaly, otherwise it is normal. The anomaly threshold for each cluster is 3 standard deviations of the distance between the cluster sample and the medoid.

[0079] d) Eliminate abnormal values ​​in the TTP events of process operations on files and processes on sockets to obtain a noise filtering model.

[0080] The fourth step is to use the detection rules to match the attack activity log, record the matched TTP events, and determine whether the TTP events matched from the attack activity belong to the events in the noise filter set. If they belong to the noise filter set, the corresponding TTP events are filtered out. Otherwise, the matched TTP event is considered to be a true attack behavior.

[0081] It should be noted that the K-medoids algorithm of some embodiments of the present application requires the selection of K and medoid. The selection of K maximizes the silhouette coefficient of the final cluster. The initial medoid is randomly selected. After the clustering is completed, each cluster has an updated cluster center medoid. Some embodiments of the present application select byte_thres in order to eliminate true alarms in benign activity data. For example, the value of byte_thres can be selected based on experience. Some embodiments of the present application eliminate true alarms in benign activity data through clustering. The threshold here is the threshold of the clustering algorithm, which can also be said to be a distance threshold, which is used to eliminate outliers in the cluster. The outliers in the cluster refer to true alarms in the cluster.

[0082] Some embodiments of the present application provide an alarm filtering method, comprising: first, collecting raw log data and conducting a simulated data leakage APT attack on a target host. Data collected over a 20-day period serves as experimental data for the attack activity, while four days of log data from the experimental host serves as benign data. Second, using an open-source rule library to match attack behaviors in the benign data, the TTP events that meet the detection rules are recorded. Third, obtaining a noise filter set according to the method described in the detailed description. Fourth, matching the attack activity logs with the detection rules and recording the matched TTP events. If an untrusted read operation is found in any TTP event in the attack activity, and the information flow direction of this operation is from the file / var / log / nginx-access.log to the process nginx, and if the same untrusted read operation is found in the noise filter set, and the system entity name and information flow direction of the read operation are the same as those of the untrusted read operation in the attack activity, the alarm information corresponding to the untrusted read operation is filtered out. Otherwise, the untrusted read matched by the attack activity is considered to be a true attack behavior.

[0083] Please refer to Figure 4 , Figure 4 The embodiment of the present application provides an alarm filtering device. It should be understood that the device is similar to the above-mentioned Figure 2 The method embodiment corresponds to the method embodiment and can execute each step involved in the above method embodiment. The specific functions of the device can be found in the description above. To avoid repetition, a detailed description is omitted here. The device includes at least one software functional module that can be stored in a memory in the form of software or firmware or embedded in the device's operating system. The alarm filtering device includes: an initial alarm event acquisition module 110 and an alarm event confirmation module 120.

[0084] The initial alarm event acquisition module is configured to acquire the initial alarm event according to the detection rule.

[0085] The alarm event confirmation module is configured to confirm whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in a noise filtering set, wherein the events in the noise filtering set are obtained by clustering alarm events of benign activities.

[0086] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0087] Some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the method described in any embodiment of the above-mentioned alarm filtering method can be implemented.

[0088] like Figure 5 As shown, some embodiments of the present application provide an electronic device 500, comprising a memory 510, a processor 520, and a computer program stored on the memory 510 and executable on the processor 520, wherein the processor 520 can implement the method described in any embodiment of the above-mentioned alarm filtering method when reading the program through a bus 530 and executing the program.

[0089] Processor 520 can process digital signals and can include various computing architectures, such as a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, processor 520 can be a microprocessor.

[0090] The memory 510 may be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 520 of the present disclosure may be used to execute the instructions in the memory 510 to implement Figure 2 The memory 510 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory or other memory known to those skilled in the art.

[0091] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0092] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0093] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A method for alarm filtering, characterized in that: The method comprises: Obtain initial alarm events based on detection rules; Confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in a noise filtering set, wherein the events in the noise filtering set are obtained by clustering the events to be aggregated; Before confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in the noise filtering set, the method further includes: Collect data on benign activities; Matching the benign activity data with TTP detection rules, and using successfully matched events as the events to be aggregated; The noise filter set is obtained according to the events to be aggregated and a clustering algorithm, wherein the noise filter set is used to store false alarm events.

2. The method according to claim 1, wherein The events in the noise filtering set are obtained based on analyzing the number of byte streams of benign activities and attack activities of the same type of events.

3. The method according to claim 1, wherein The confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in the noise filtering set includes: If it is confirmed that the initial alarm event matches an event in the noise filtering set, then the initial alarm event is confirmed to be a false alarm event; If it is confirmed that the initial alarm event does not match any events in the noise filtering set, it is confirmed that the initial alarm event is a real alarm event.

4. The method according to any one of claims 1 to 3, wherein The obtaining of the noise filtering set according to the events to be aggregated and a clustering algorithm includes: Using the K-medoids algorithm, the events of process-to-file operations and process-to-socket operations in the events to be aggregated are divided into K categories to obtain a clustering result, where K is an integer greater than 1; Based on the clustering results, the distance between the samples in the cluster and the medoid of the cluster center is calculated; The distance is compared with a threshold, and if the distance is less than or equal to the threshold, the corresponding event is taken as an event in the noise filtering set.

5. The method according to claim 4, wherein The threshold is 3 standard deviations of the distance between samples in any cluster and the corresponding medoid.

6. The method according to any one of claims 1 to 3, wherein: Before confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in the noise filtering set, the method further includes: Collect benign activity data and collect attack activity data; Matching the benign activity data and the attack activity data with TTP detection rules respectively; The noise filtering set is obtained according to the events to be aggregated and a clustering algorithm.

7. The method according to claim 6, wherein The obtaining of the noise filtering set according to the events to be aggregated and a clustering algorithm includes: Using the K-medoids algorithm, the events of process-to-file operations and process-to-socket operations in the events to be aggregated are divided into K categories to obtain a clustering result, where K is an integer greater than 1; Based on the clustering results, the distance between the samples in the cluster and the medoid of the cluster center is calculated; The distance is compared with a threshold, and if the distance is less than or equal to the threshold, the corresponding event is taken as an event in the noise filtering set.

8. The method according to claim 7, wherein The threshold is 3 standard deviations of the distance between samples in any cluster and the corresponding medoid.

9. The method according to claim 1, wherein The confirming whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in the noise filtering set includes: By matching the initial alarm event with events in the noise filtering set and through information flow, it is confirmed whether the initial alarm event belongs to the real alarm information.

10. The method according to claim 1, wherein The acquiring the initial alarm event according to the detection rule includes: acquiring the initial alarm event through the TTP detection rule.

11. The method according to claim 1, wherein The initial alarm event is an operation of a process on a file or an operation of a process on a socket.

12. An alarm filtering device, characterized in that: The device comprises: An initial alarm event acquisition module is configured to acquire an initial alarm event according to a detection rule; an alarm event confirmation module, configured to confirm whether the initial alarm event is real alarm information by at least matching the initial alarm event with events in a noise filtering set, wherein the events in the noise filtering set are obtained by clustering alarm events of benign activities; The alarm event confirmation module is further configured to: Collect data on benign activities; Matching the benign activity data with TTP detection rules, and using successfully matched events as the events to be aggregated; The noise filter set is obtained according to the events to be aggregated and a clustering algorithm, wherein the noise filter set is used to store false alarm events.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 11 can be implemented.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 11 can be implemented.

Images