Network security alarm automatic studying and judging method, device, equipment and medium

Abstract

The invention discloses a network security alarm automatic research and judgment method, device and equipment and a medium, and relates to the technical field of artificial intelligence, original alarm data of various network security equipment and systems are acquired, and the original alarm data are processed; the processing comprises data preprocessing, feature extraction and classification aggregation; performing deep packet analysis on the processed original alarm data to obtain an analysis structure and content, and performing abnormal behavior identification and attack purpose derivation on the analysis structure and content to obtain an abnormal behavior attack purpose; the method comprises the following steps: performing threat level evaluation on an abnormal behavior attack purpose based on a threat intelligence source in a preset third-party knowledge base to obtain a network security alarm threat level, performing dynamic research and judgment evaluation on the network security alarm threat level to obtain a dynamic research and judgment evaluation result of network security equipment and system, and sending the dynamic research and judgment evaluation result to the network security equipment and system. According to the invention, deep interpretation and analysis of network security alarms can be realized, real attack events are automatically screened out, and the accuracy and efficiency of alarm research and judgment are improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method, device, equipment and medium for automatically analyzing and judging network security alarms. Background Art

[0002] With the continuous advancement of network security technology, security threats in the network environment are becoming increasingly complex, resulting in an exponential growth in the number of network security alerts. When faced with massive amounts of alert data, traditional methods rely on manual screening and judgment of the authenticity of alerts, which not only consumes a lot of human resources, but also easily leads to misjudgments and missed judgments, affecting the efficiency and effectiveness of overall security protection. For advanced research and judgment, configuration templates are mostly used to judge alerts based on some pre-set rules. For example, when the source IP (Internet Protocol) is in a certain network segment and the network message contains certain content. This alert is labeled with a certain label, etc. Waiting for subsequent security personnel to handle it, but there are still many problems. First, network alert information is not static and needs to be constantly maintained with new rules. Second, the rules can only be judged based on some fixed conditions, and there are many false positives and missed positives.

[0003] From the above, it can be seen that how to achieve in-depth interpretation and analysis of network security alerts, automatically screen out real attack events, and improve the accuracy and efficiency of alert analysis are issues to be solved in this field. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for automatic judgment of network security alarms, which can realize in-depth interpretation and analysis of network security alarms, automatically screen out real attack events, and improve the accuracy and efficiency of alarm judgment. The specific scheme is as follows:

[0005] In the first aspect, the present application discloses a method for automatically analyzing network security alarms, which is applied to an artificial intelligence large model, including:

[0006] Acquire original alarm data of various network security devices and systems, and process the original alarm data to obtain processed original alarm data; the processing includes data preprocessing, feature extraction, and classification aggregation;

[0007] Performing in-depth message analysis on the processed original alarm data to obtain analysis structure and content, and performing abnormal behavior identification and attack purpose deduction on the analysis structure and content to obtain the abnormal behavior attack purpose;

[0008] Based on the threat intelligence source in the preset third-party knowledge base, the threat level of the abnormal behavior attack purpose is evaluated to obtain the network security alarm threat level, and the network security alarm threat level is dynamically analyzed and evaluated to obtain the dynamic analysis and evaluation results of the network security equipment and system.

[0009] Optionally, before obtaining the original alarm data of various network security devices and systems, the following steps are included:

[0010] Build the initial AI big model based on the capability platform subsystem, agent update subsystem, and data update subsystem;

[0011] The initial artificial intelligence big model is configured to obtain the artificial intelligence big model; the configuration includes service configuration and policy configuration.

[0012] Optionally, the obtaining of original alarm data of various network security devices and systems includes:

[0013] Establish connections with various network security devices and systems;

[0014] The local application programming interface is called and the connection relationship is used to obtain different original alarm data from various network security devices and systems.

[0015] Optionally, the processing the original alarm data to obtain the processed original alarm data includes:

[0016] The original alarm data is preprocessed to obtain the preprocessed original alarm data, feature extraction is performed on the preprocessed original alarm data to extract key feature data, and the key feature data is classified and aggregated using a window aggregation strategy to obtain the processed original alarm data.

[0017] Optionally, the performing data preprocessing on the original alarm data to obtain the preprocessed original alarm data, performing feature extraction on the preprocessed original alarm data to extract key feature data, and classifying and aggregating the key feature data using a window aggregation strategy to obtain the processed original alarm data includes:

[0018] Performing data cleaning and standardization processing on the original alarm data to obtain the pre-processed original alarm data;

[0019] Performing feature extraction on the preprocessed raw alarm data to extract key feature data; the key feature data includes timestamp, source Internet protocol or target Internet protocol, port, protocol type, and alarm level;

[0020] The key feature data are classified and aggregated according to the time window or the alarm characteristic correlation and the sliding time window technology to obtain the processed original alarm data.

[0021] Optionally, the performing of in-depth message analysis on the processed original alarm data to obtain an analysis structure and content includes:

[0022] Performing deep message analysis on the processed original alarm data to extract message header information and payload content;

[0023] The message header information and payload content are analyzed using deep packet inspection technology to obtain the analysis structure and content.

[0024] Optionally, the performing abnormal behavior identification and attack purpose derivation on the analysis structure and content to obtain the abnormal behavior attack purpose includes:

[0025] Using a behavioral analysis algorithm to identify abnormal behaviors of the analysis structure and content to identify abnormal communication patterns and malicious behaviors; the abnormal behavior identification includes scanning and penetration attempts;

[0026] The attack purpose of the abnormal communication pattern and the malicious behavior is deduced using natural language processing technology to obtain the attack purpose of the abnormal behavior.

[0027] In the second aspect, the present application discloses a network security alarm automatic analysis and judgment device, which is applied to an artificial intelligence large model, including:

[0028] A data acquisition and processing module is used to acquire original alarm data of various network security devices and systems, and process the original alarm data to obtain processed original alarm data; the processing includes data preprocessing, feature extraction and classification aggregation;

[0029] An analysis and identification derivation module is used to perform in-depth message analysis on the processed original alarm data to obtain an analysis structure and content, and to perform abnormal behavior identification and attack purpose derivation on the analysis structure and content to obtain the abnormal behavior attack purpose;

[0030] The dynamic analysis and evaluation module is used to evaluate the threat level of the abnormal behavior attack purpose based on the threat intelligence source in the preset third-party knowledge base to obtain the network security alarm threat level, and dynamically analyze and evaluate the network security alarm threat level to obtain the dynamic analysis and evaluation results of the network security equipment and system.

[0031] In a third aspect, the present application discloses an electronic device, comprising:

[0032] Memory, used to store computer programs;

[0033] The processor is used to execute the computer program to implement the aforementioned network security alarm automatic analysis method.

[0034] In a fourth aspect, the present application discloses a computer storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed method for automatic analysis of network security alarms are implemented.

[0035] It can be seen that the present application provides a method for automatic analysis of network security alarms, including obtaining original alarm data of various network security devices and systems, processing the original alarm data to obtain the processed original alarm data; the processing includes data preprocessing, feature extraction and classification aggregation; performing deep message analysis on the processed original alarm data to obtain an analysis structure and content, identifying abnormal behaviors and deducing attack purposes from the analysis structure and content to obtain the abnormal behavior attack purpose; performing a threat level assessment on the abnormal behavior attack purpose based on a threat intelligence source in a preset third-party knowledge base to obtain a network security alarm threat level, and dynamically analyzing and evaluating the network security alarm threat level to obtain a dynamic analysis and evaluation result of the network security device and system. The present application is applied to an artificial intelligence big model, which is a comprehensive network security product framework. It collects original alarm data from different sources. After processing the original alarm data, it can ensure that all alarm information formats are consistent, reduce repeated and redundant alarms, and reveal potential attack patterns or trends to obtain processed original alarm data. The processed original alarm data undergoes in-depth message analysis, abnormal behavior identification, and attack purpose deduction to obtain the abnormal behavior attack purpose. The abnormal behavior attack purpose is evaluated and dynamically judged to obtain dynamic judgment and evaluation results, and real attack events are automatically screened out. In addition, the artificial intelligence big model can judge the alarm information from a global perspective to improve the accuracy and efficiency of alarm judgment. The natural language interpretation unique to the big model is impossible to achieve with traditional technologies, and can save a lot of manpower screening processes. At the same time, it can also interpret a certain alarm to facilitate network security personnel to quickly understand the characteristic information of the alarm, and can guide subsequent disposal actions based on the hazard and repair suggestion information, which helps enterprises achieve more efficient network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flowchart of a method for automatically analyzing and judging network security alarms disclosed in this application;

[0038] Figure 2 A flowchart of the analysis and judgment of an alarm message disclosed in this application;

[0039] Figure 3 This is a flow chart of another method for automatically analyzing and judging network security alarms disclosed in this application;

[0040] Figure 4 This is a diagram showing an example of a service configuration disclosed in this application;

[0041] Figure 5 This is an example diagram of a policy configuration disclosed in this application;

[0042] Figure 6 A preview image of an alarm page disclosed in this application;

[0043] Figure 7 An analysis diagram of an artificial intelligence large model disclosed in this application;

[0044] Figure 8 This is a schematic diagram of the structure of a network security alarm automatic analysis and judgment device disclosed in this application;

[0045] Fig. 9 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] With the continuous advancement of network security technology, security threats in the network environment are becoming increasingly complex, resulting in an exponential growth in the number of network security alarms. When faced with massive amounts of alarm data, traditional methods rely on manual screening and judgment of the authenticity of alarms, which not only consumes a lot of human resources, but also easily leads to misjudgment and missed judgments, affecting the efficiency and effectiveness of overall security protection. For advanced analysis, most configuration templates are used to judge alarms according to some pre-set rules. For example, when the source IP is in a certain network segment and the network message contains certain content. This alarm is labeled with a certain label, etc. Waiting for subsequent security personnel to handle it, but there are still many problems. First, network alarm information is not static and needs to be constantly maintained. New rules need to be maintained. Secondly, the rules can only be judged by some fixed conditions, and there are many false positives and missed positives. As can be seen from the above, how to achieve in-depth interpretation and analysis of network security alarms, automatically screen out real attack events, and improve the accuracy and efficiency of alarm analysis is a problem to be solved in this field.

[0048] See also Figure 1 As shown, the embodiment of the present invention discloses a method for automatically analyzing and judging network security alarms, which is applied to an artificial intelligence large model and may specifically include:

[0049] Step S11: acquiring original alarm data of various network security devices and systems, and processing the original alarm data to obtain processed original alarm data; the processing includes data preprocessing, feature extraction, and classification aggregation.

[0050] In this embodiment, original alarm data of various network security devices and systems are obtained, data preprocessing is performed on the original alarm data to obtain the preprocessed original alarm data, feature extraction is performed on the preprocessed original alarm data to extract key feature data, and a window aggregation strategy is used to classify and aggregate the key feature data to obtain the processed original alarm data.

[0051] Among them, the process of processing the original alarm data is: performing data cleaning and standardization on the original alarm data to obtain the pre-processed original alarm data; performing feature extraction on the pre-processed original alarm data to extract key feature data; the key feature data includes timestamp, source Internet protocol or target Internet protocol, port, protocol type, alarm level; according to the time window or alarm characteristic correlation, sliding time window technology, the key feature data are classified and aggregated respectively to obtain the processed original alarm data.

[0052] Specifically, first, it is necessary to integrate with various network security devices and systems, collect raw alarm data from different sources, and ensure that all alarm information formats are consistent through data cleaning and standardization, so as to facilitate subsequent processing, and obtain the pre-processed raw alarm data. Then, using pattern recognition and machine learning technology, extract key features from the pre-processed raw alarm data, such as timestamp, source IP (Internet Protocol) / destination IP, port, protocol type, alarm level, etc., and then classify closely connected or similar alarms according to the time window or alarm feature correlation to obtain the processed raw alarm data. For example, through the sliding time window technology, all attack alarms from the same source IP within a certain period of time are aggregated to reduce duplicate and redundant alarms, while revealing potential attack patterns or trends.

[0053] Step S12: performing deep message analysis on the processed original alarm data to obtain analysis structure and content, and performing abnormal behavior identification and attack purpose deduction on the analysis structure and content to obtain the abnormal behavior attack purpose.

[0054] In this embodiment, deep message analysis is performed on the processed original alarm data to extract message header information and payload content, deep packet inspection technology is used to analyze the message header information and payload content to obtain analysis structure and content, and a behavior analysis algorithm is used to perform abnormal behavior recognition on the analysis structure and content to identify abnormal communication patterns and malicious behaviors; the abnormal behavior recognition includes scanning and penetration attempts, and natural language processing technology is used to deduce the attack purpose of the abnormal communication pattern and the malicious behavior to obtain the attack purpose of the abnormal behavior.

[0055] Step S13: Based on the threat intelligence source in the preset third-party knowledge base, the threat level of the abnormal behavior attack purpose is evaluated to obtain the network security alarm threat level, and the network security alarm threat level is dynamically evaluated to obtain the dynamic evaluation results of the network security equipment and system.

[0056] The specific process of warning message analysis includes: in-depth message analysis, abnormal behavior identification and attack purpose deduction, threat level assessment, and dynamic analysis and assessment. Figure 2As shown, first, the messages involved in the processed original alarm data are deeply analyzed to extract the message header information, payload content, etc.; the DPI (Deep Packet Inspection) technology is used to understand the deep structure and content of the message, and the analysis structure and content are obtained; then the behavior analysis algorithm is used to identify abnormal communication patterns and malicious behaviors, such as scanning and penetration attempts. At the same time, the commands and request contents in the message are understood through natural language processing technology, the attacker's intentions are inferred, and the purpose of the abnormal behavior attack is obtained; then, the threat intelligence sources in the preset third-party knowledge base, such as the security knowledge base, the vulnerability knowledge base, etc., are combined to evaluate the threat level and authenticity of the network security alarm; finally, the machine learning model is used to dynamically evaluate the urgency and impact range of each alarm based on historical cases and the current network environment, and the dynamic judgment and evaluation results of network security equipment and systems are obtained.

[0057] In this embodiment, original alarm data of various network security devices and systems are obtained, and the original alarm data is processed to obtain the processed original alarm data; the processing includes data preprocessing, feature extraction and classification aggregation; deep message analysis is performed on the processed original alarm data to obtain analysis structure and content, abnormal behavior identification and attack purpose deduction are performed on the analysis structure and content to obtain abnormal behavior attack purpose; threat level assessment is performed on the abnormal behavior attack purpose based on the threat intelligence source in the preset third-party knowledge base to obtain the network security alarm threat level, and the network security alarm threat level is dynamically evaluated to obtain dynamic evaluation results of the network security devices and systems. The present application is applied to an artificial intelligence big model, which is a comprehensive network security product framework. It collects original alarm data from different sources. After processing the original alarm data, it can ensure that all alarm information formats are consistent, reduce repeated and redundant alarms, and reveal potential attack patterns or trends to obtain processed original alarm data. The processed original alarm data undergoes in-depth message analysis, abnormal behavior identification, and attack purpose deduction to obtain the abnormal behavior attack purpose. The abnormal behavior attack purpose is evaluated and dynamically judged to obtain dynamic judgment and evaluation results, and real attack events are automatically screened out. In addition, the artificial intelligence big model can judge the alarm information from a global perspective to improve the accuracy and efficiency of alarm judgment. The natural language interpretation unique to the big model is impossible to achieve with traditional technologies, and can save a lot of manpower screening processes. At the same time, it can also interpret a certain alarm to facilitate network security personnel to quickly understand the characteristic information of the alarm, and can guide subsequent disposal actions based on the hazard and repair suggestion information, which helps enterprises achieve more efficient network security protection.

[0058] See also Figure 3As shown, the embodiment of the present invention discloses a method for automatically analyzing and judging network security alarms, which is applied to an artificial intelligence large model and may specifically include:

[0059] Step S21: construct an initial artificial intelligence big model based on the capability middle platform subsystem, the intelligent agent update subsystem and the data update subsystem, and configure the initial artificial intelligence big model to obtain the artificial intelligence big model; the configuration includes service configuration and policy configuration.

[0060] In this embodiment, the artificial intelligence big model is a comprehensive network security product framework. It has three core subsystems, including the capability middle platform subsystem, the intelligent body update subsystem and the data update subsystem, and is tightly integrated with external systems through standard interfaces, so as to provide enterprises with comprehensive intelligent protection and response capabilities.

[0061] The intelligent agents in the artificial intelligence big model gather Ahnheng's massive offensive and defensive knowledge, identify message intent, evaluate behavior, analyze message threats, and make disposal recommendations.

[0062] Specific service configuration such as Figure 4 As shown, it includes: request URL (Uniform Resource Locator): open API address, AppKey (application key): API authentication parameter, AppSecret: API authentication parameter, and cockpit URL;

[0063] Policy configuration such as Figure 5 As shown, including: Mode Description: Side-hang mode, side-hanging on the real-time data stream of the business, does not affect the main business. After the alarm data is generated, it is written to the fixed topic of Kafka (open source stream processing platform). The main business will consume the kafka data and write it to es (Elasticsearch, distributed search and analysis engine) for storage. The side-hang mode is to create a new consumer group to consume kafka data, and then update the data in es according to the results; serial mode, stringing on the real-time data stream of the business, artificial intelligence performance will affect the main business. After the alarm data is generated, it is written to the fixed topic of kafka. The main business will consume kafka data and call the interface for analysis before writing it to es, and update the data according to the results and write it directly to es.

[0064] Analysis description: Quick analysis, read-only data for analysis. Assign the analysis results to alarms (unsupported, unknown, harmless traffic, real attack, vulnerability risk); comprehensive analysis, analyze the data and give a detailed interpretation.

[0065] Configuration combination: Bypass mode + quick analysis: consume es data and update the alarm judgment field results in es according to the result of calling the interface; Bypass mode + comprehensive analysis: consume es data and update the alarm judgment and analysis field results in es according to the result of calling the interface; Serial mode + quick analysis: directly call the artificial intelligence big model before writing to es and write the result information to es together. Omit one step of update operation; Serial mode + comprehensive analysis: configuration is not allowed, and comprehensive analysis will consume more time. Affect the normal storage of alarm data.

[0066] In serial mode, whether the data meets the requirements of active attack is determined as follows: only the data that meets the requirements of automatic attack is directly judged by calling the artificial intelligence model on the data stream. Other types of data are still judged by default in the bypass mode.

[0067] Step S22: Establish a connection relationship with various network security devices and systems, call the local application programming interface and use the connection relationship to obtain different original alarm data from various network security devices and systems, and process the original alarm data to obtain the processed original alarm data; the processing includes data preprocessing, feature extraction and classification aggregation.

[0068] This application obtains the original alarm data by automatically calling the API (Application Programming Interface).

[0069] Step S23: performing deep message analysis on the processed original alarm data to obtain analysis structure and content, and performing abnormal behavior identification and attack purpose deduction on the analysis structure and content to obtain the abnormal behavior attack purpose.

[0070] Step S24: Based on the threat intelligence source in the preset third-party knowledge base, the threat level of the abnormal behavior attack purpose is evaluated to obtain the network security alarm threat level, and the network security alarm threat level is dynamically evaluated to obtain the dynamic evaluation results of the network security equipment and system.

[0071] In addition, after obtaining the dynamic analysis and evaluation results of network security equipment and systems, the artificial intelligence big model updates the original alarm data according to the dynamic analysis and evaluation results and displays it.

[0072] The alarm page preview is as follows Figure 6 As shown in the figure, in the alarm list, there are a judgment field and a marking method field. Judgment field: the result of the judgment (unsupported, unknown, harmless traffic, real attack, vulnerability risk); marking method: corresponding to the bypass mode and serial mode in the mode configuration.

[0073] Artificial intelligence big model analysis Figure 7 As shown in the figure, the artificial intelligence model uses natural language to describe the key information of the alarm, which helps security personnel to understand and respond quickly.

[0074] This application is based on the analysis and judgment of alarms based on artificial intelligence big models, and relies on massive alarm data training. Compared with the traditional configuration template method, the accuracy of the analysis and judgment has been greatly improved. Security personnel only need to pay attention to alarms that are judged to be real attacks, which greatly reduces their workload. At the same time, the system uses pre-trained AI (Artificial Intelligence) big models to deeply interpret and analyze network security alarms, which can help security personnel quickly grasp the key information of the alarm, and can also guide subsequent disposal actions based on the hazard and repair suggestion information.

[0075] In this embodiment, original alarm data of various network security devices and systems are obtained, and the original alarm data is processed to obtain the processed original alarm data; the processing includes data preprocessing, feature extraction and classification aggregation; deep message analysis is performed on the processed original alarm data to obtain analysis structure and content, abnormal behavior identification and attack purpose deduction are performed on the analysis structure and content to obtain abnormal behavior attack purpose; threat level assessment is performed on the abnormal behavior attack purpose based on the threat intelligence source in the preset third-party knowledge base to obtain the network security alarm threat level, and the network security alarm threat level is dynamically evaluated to obtain dynamic evaluation results of the network security devices and systems. The present application is applied to an artificial intelligence big model, which is a comprehensive network security product framework. It collects original alarm data from different sources. After processing the original alarm data, it can ensure that all alarm information formats are consistent, reduce repeated and redundant alarms, and reveal potential attack patterns or trends to obtain processed original alarm data. The processed original alarm data undergoes in-depth message analysis, abnormal behavior identification, and attack purpose deduction to obtain the abnormal behavior attack purpose. The abnormal behavior attack purpose is evaluated and dynamically judged to obtain dynamic judgment and evaluation results, and real attack events are automatically screened out. In addition, the artificial intelligence big model can judge the alarm information from a global perspective to improve the accuracy and efficiency of alarm judgment. The natural language interpretation unique to the big model is impossible to achieve with traditional technologies, and can save a lot of manpower screening processes. At the same time, it can also interpret a certain alarm to facilitate network security personnel to quickly understand the characteristic information of the alarm, and can guide subsequent disposal actions based on the hazard and repair suggestion information, which helps enterprises achieve more efficient network security protection.

[0076] See also Figure 8As shown, the embodiment of the present invention discloses a network security alarm automatic analysis and judgment device, which is applied to an artificial intelligence large model and may specifically include:

[0077] The data acquisition and processing module 11 is used to acquire the original alarm data of various network security devices and systems, and process the original alarm data to obtain the processed original alarm data; the processing includes data preprocessing, feature extraction and classification aggregation;

[0078] The analysis and identification derivation module 12 is used to perform in-depth message analysis on the processed original alarm data to obtain the analysis structure and content, and to perform abnormal behavior identification and attack purpose derivation on the analysis structure and content to obtain the abnormal behavior attack purpose;

[0079] The dynamic analysis and evaluation module 13 is used to evaluate the threat level of the abnormal behavior attack purpose based on the threat intelligence source in the preset third-party knowledge base to obtain the network security alarm threat level, and dynamically analyze and evaluate the network security alarm threat level to obtain the dynamic analysis and evaluation results of the network security equipment and system.

[0080] In this embodiment, original alarm data of various network security devices and systems are obtained, and the original alarm data is processed to obtain the processed original alarm data; the processing includes data preprocessing, feature extraction and classification aggregation; deep message analysis is performed on the processed original alarm data to obtain analysis structure and content, abnormal behavior identification and attack purpose deduction are performed on the analysis structure and content to obtain abnormal behavior attack purpose; threat level assessment is performed on the abnormal behavior attack purpose based on the threat intelligence source in the preset third-party knowledge base to obtain the network security alarm threat level, and the network security alarm threat level is dynamically evaluated to obtain dynamic evaluation results of the network security devices and systems. The present application is applied to an artificial intelligence big model, which is a comprehensive network security product framework. It collects original alarm data from different sources. After processing the original alarm data, it can ensure that all alarm information formats are consistent, reduce repeated and redundant alarms, and reveal potential attack patterns or trends to obtain processed original alarm data. The processed original alarm data undergoes in-depth message analysis, abnormal behavior identification, and attack purpose deduction to obtain the abnormal behavior attack purpose. The abnormal behavior attack purpose is evaluated and dynamically judged to obtain dynamic judgment and evaluation results, and real attack events are automatically screened out. In addition, the artificial intelligence big model can judge the alarm information from a global perspective to improve the accuracy and efficiency of alarm judgment. The natural language interpretation unique to the big model is impossible to achieve with traditional technologies, and can save a lot of manpower screening processes. At the same time, it can also interpret a certain alarm to facilitate network security personnel to quickly understand the characteristic information of the alarm, and can guide subsequent disposal actions based on the hazard and repair suggestion information, which helps enterprises achieve more efficient network security protection.

[0081] In some specific embodiments, the data acquisition and processing module 11 may specifically include:

[0082] The initial model building module is used to build the initial artificial intelligence large model based on the capability platform subsystem, the intelligent agent update subsystem, and the data update subsystem;

[0083] A configuration module is used to configure the initial artificial intelligence big model to obtain the artificial intelligence big model; the configuration includes service configuration and policy configuration.

[0084] In some specific embodiments, the data acquisition and processing module 11 may specifically include:

[0085] A connection relationship establishment module is used to establish connection relationships with various network security devices and systems;

[0086] The data acquisition module is used to call the local application programming interface and use the connection relationship to acquire different original alarm data from various network security devices and systems.

[0087] In some specific embodiments, the data acquisition and processing module 11 may specifically include:

[0088] The preprocessing module is used to perform data preprocessing on the original alarm data to obtain the preprocessed original alarm data, perform feature extraction on the preprocessed original alarm data to extract key feature data, and classify and aggregate the key feature data using a window aggregation strategy to obtain the processed original alarm data.

[0089] In some specific embodiments, the data acquisition and processing module 11 may specifically include:

[0090] A data cleaning and standardization processing module, used for performing data cleaning and standardization processing on the original alarm data to obtain the pre-processed original alarm data;

[0091] A feature extraction module, used to extract features from the pre-processed raw alarm data to extract key feature data; the key feature data includes timestamp, source Internet protocol or target Internet protocol, port, protocol type, and alarm level;

[0092] The classification and aggregation module is used to classify and aggregate the key feature data according to the time window or the alarm characteristic correlation and the sliding time window technology to obtain the processed original alarm data.

[0093] In some specific embodiments, the analysis and identification derivation module 12 may specifically include:

[0094] A deep message analysis module, used to perform deep message analysis on the processed original alarm data to extract message header information and payload content;

[0095] The analysis structure and content module is used to analyze the message header information and payload content using deep packet inspection technology to obtain the analysis structure and content.

[0096] In some specific embodiments, the dynamic analysis and evaluation module 13 may specifically include:

[0097] An abnormal behavior identification module, used to identify abnormal behaviors of the analysis structure and content using a behavior analysis algorithm to identify abnormal communication patterns and malicious behaviors; the abnormal behavior identification includes scanning and penetration attempts;

[0098] The attack purpose derivation module is used to use natural language processing technology to deduce the attack purpose of the abnormal communication mode and the malicious behavior to obtain the attack purpose of the abnormal behavior.

[0099] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the automatic judgment method of network security alarms performed by the electronic device disclosed in any of the aforementioned embodiments.

[0100] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0101] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0102] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20 to realize the operation and processing of the data 223 in the memory 22 by the processor 21, which can be Windows, Unix, Linux, etc. In addition to including a computer program that can be used to complete the network security alarm automatic analysis method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can also further include a computer program that can be used to complete other specific tasks. In addition to including data transmitted from an external device received by the network security alarm automatic analysis device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0103] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0104] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium, in which a computer program is stored. When the computer program is loaded and executed by a processor, the steps of the method for automatic analysis of network security alarms disclosed in any of the aforementioned embodiments are implemented.

[0105] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0106] The above is a detailed introduction to the network security alarm automatic analysis method, device, equipment and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for automatically analyzing and judging network security alarms, characterized in that: Applied to large AI models, including: Acquire original alarm data of various network security devices and systems, and process the original alarm data to obtain processed original alarm data; the processing includes data preprocessing, feature extraction, and classification aggregation; Performing in-depth message analysis on the processed original alarm data to obtain analysis structure and content, and performing abnormal behavior identification and attack purpose deduction on the analysis structure and content to obtain the abnormal behavior attack purpose; Based on the threat intelligence source in the preset third-party knowledge base, the threat level of the abnormal behavior attack purpose is evaluated to obtain the network security alarm threat level, and the network security alarm threat level is dynamically analyzed and evaluated to obtain the dynamic analysis and evaluation results of the network security equipment and system.

2. The method for automatically analyzing network security alarms according to claim 1 is characterized in that: Before obtaining the original alarm data of various network security devices and systems, it includes: Build the initial AI big model based on the capability platform subsystem, agent update subsystem, and data update subsystem; The initial artificial intelligence big model is configured to obtain the artificial intelligence big model; the configuration includes service configuration and policy configuration.

3. The method for automatically analyzing network security alarms according to claim 1 is characterized in that: The acquisition of original alarm data of various network security devices and systems includes: Establish connections with various network security devices and systems; The local application programming interface is called and the connection relationship is used to obtain different original alarm data from various network security devices and systems.

4. The method for automatically analyzing network security alarms according to claim 1 is characterized in that: The processing of the original alarm data to obtain the processed original alarm data includes: The original alarm data is preprocessed to obtain the preprocessed original alarm data, feature extraction is performed on the preprocessed original alarm data to extract key feature data, and the key feature data is classified and aggregated using a window aggregation strategy to obtain the processed original alarm data.

5. The method for automatically analyzing network security alarms according to claim 4 is characterized in that: The performing data preprocessing on the original alarm data to obtain the preprocessed original alarm data, performing feature extraction on the preprocessed original alarm data to extract key feature data, and classifying and aggregating the key feature data using a window aggregation strategy to obtain the processed original alarm data includes: Performing data cleaning and standardization processing on the original alarm data to obtain the pre-processed original alarm data; Performing feature extraction on the preprocessed raw alarm data to extract key feature data; the key feature data includes timestamp, source Internet protocol or target Internet protocol, port, protocol type, and alarm level; The key feature data are classified and aggregated according to the time window or the alarm characteristic correlation and the sliding time window technology to obtain the processed original alarm data.

6. The method for automatically analyzing network security alarms according to claim 1 is characterized in that: The deep message analysis of the processed original alarm data to obtain the analysis structure and content includes: Performing deep message analysis on the processed original alarm data to extract message header information and payload content; The message header information and payload content are analyzed using deep packet inspection technology to obtain the analysis structure and content.

7. The method for automatically analyzing and judging network security alarms according to any one of claims 1 to 6, characterized in that: The abnormal behavior identification and attack purpose derivation of the analysis structure and content to obtain the abnormal behavior attack purpose includes: Using a behavioral analysis algorithm to identify abnormal behaviors of the analysis structure and content to identify abnormal communication patterns and malicious behaviors; the abnormal behavior identification includes scanning and penetration attempts; The attack purpose of the abnormal communication pattern and the malicious behavior is deduced using natural language processing technology to obtain the attack purpose of the abnormal behavior.

8. A network security alarm automatic analysis and judgment device, characterized in that: Applied to large AI models, including: A data acquisition and processing module is used to acquire original alarm data of various network security devices and systems, and process the original alarm data to obtain processed original alarm data; the processing includes data preprocessing, feature extraction and classification aggregation; An analysis and identification derivation module is used to perform in-depth message analysis on the processed original alarm data to obtain an analysis structure and content, and to perform abnormal behavior identification and attack purpose derivation on the analysis structure and content to obtain the abnormal behavior attack purpose; The dynamic analysis and evaluation module is used to evaluate the threat level of the abnormal behavior attack purpose based on the threat intelligence source in the preset third-party knowledge base to obtain the network security alarm threat level, and dynamically analyze and evaluate the network security alarm threat level to obtain the dynamic analysis and evaluation results of the network security equipment and system.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the method for automatic analysis of network security alarms as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the method for automatically analyzing and judging network security alarms as described in any one of claims 1 to 7 is implemented.

Images