Threat alarm information processing method and system

Abstract

The invention relates to the technical field of information processing, and discloses a threat alarm information processing method and system, and the system comprises a data collection module, a feature extraction module, a data analysis module, and a data integration module. In information collection, data can be obtained from multiple sources, and the coverage range is wide; in the aspect of feature extraction, features such as time, source IP and target IP are accurately extracted, and a foundation is built for subsequent analysis; through time feature analysis, the continuous attack risk can be judged according to the time interval; the source IP and the target IP are analyzed to find out an abnormal address, and a potential threat source and an attacked target are positioned; the correlation analysis can deeply analyze behavior relevance between the IP addresses, the attack frequency, the target vulnerable attack state and the like, and comprehensively and accurately determine the network security situation; finally, a report is generated through the data integration module, network security management personnel are assisted to make a decision efficiently, safe and stable operation of a network system is powerfully guaranteed, and the overall network security protection level is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of information processing, and in particular to a threat warning information processing method and system. Background Art

[0002] With the rapid development of information technology, the Internet has been deeply integrated into key areas such as finance, energy, and communications. In the power system, although the smart grid uses the Internet to improve the level of intelligence and realize remote monitoring and automatic dispatching, it also introduces many network security risks. Network attackers may invade the monitoring network, tamper with power data, interfere with dispatching instructions, and seriously affect power supply.

[0003] The network security protection system of enterprises and organizations is becoming increasingly complex, covering multiple devices such as firewalls, intrusion detection systems, and security intelligence platforms. However, problems arise when these devices and platforms work independently. On the one hand, the sources of threat alert information are scattered, and the formats and data volumes vary greatly. Firewall logs focus on network access blocking, intrusion detection systems focus on traffic anomaly patterns, and security intelligence platforms cover external threat intelligence, making it difficult for network security managers to have a comprehensive view. On the other hand, traditional manual analysis of threat alert information is inefficient and prone to omissions. Due to the lack of an automated analysis and processing system, it is impossible to conduct in-depth mining and correlation analysis, and it is difficult to quickly lock in key information such as persistent attacks, attack sources, and key targets, making it difficult to implement targeted protection measures in a timely manner.

[0004] In summary, at a time when the network security situation is severe and the sources of device intelligence are diverse, there is an urgent need for systems and methods that can integrate multi-source threat warning information, automatically extract features, conduct in-depth analysis, and generate intuitive reports, so as to improve the efficiency and accuracy of network security management and ensure stable network operation. Summary of the invention

[0005] The purpose of the present invention is to provide a threat warning information processing method and system, which solves the technical problems raised in the background technology.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] Threat warning information processing system, including:

[0008] Data collection module, used to collect threat warning information from multiple data sources;

[0009] A feature extraction module is used to extract multiple warning features from the collected threat warning information;

[0010] The data analysis module is used to analyze and process the threat warning information according to the extracted features, and determine the network security situation through the analysis and processing results;

[0011] The data integration module is used to summarize and organize the analysis results of the data analysis module to form a threat warning information analysis report.

[0012] As a further solution of the present invention: the threat warning information includes logs of network security devices, abnormal information in power system monitoring data, and warning data of relevant security intelligence platforms;

[0013] Among them, network security equipment includes firewalls and intrusion detection systems.

[0014] As a further solution of the present invention: the extraction method of the feature extraction module is as follows:

[0015] StepA1, time feature extraction:

[0016] StepA1.1. According to the timestamp in the log, extract the alarm occurrence time from the threat alarm information and define it as T = {t j}, j = 1, 2, ... m, m represents the number of threat warning information, t j is the alarm occurrence time of the jth threat alarm information;

[0017] StepA1.2, through TJ = t j -t j-1 , calculate the time interval TJ between the threat warning information and the alarm occurrence time at each adjacent time point;

[0018] StepA2: Source IP feature extraction:

[0019] The source IP address refers to the unique identifier of the device that sends the network data packet in the network;

[0020] First, identify the source IP address in the threat alert information;

[0021] Then count the number of occurrences of each source IP address and define it as IPYC = {IPyc i1}, where IPyc i1 is the number of occurrences of threat alert information in the i 1th source IP address, i 1 = 1, 2, ... n1, n1 represents the number of source IP addresses;

[0022] StepA3, target IP feature extraction:

[0023] The target IP address refers to the unique identifier of the device that the network data packet is destined for in the network;

[0024] First, identify the target IP address in the threat alert information;

[0025] Then count the number of occurrences of each target IP address and define it as IPMC = {IPmc i2}, where IPmc i2 is the number of occurrences of threat alarm information in the i 2 th target IP address, i 2 = 1, 2, ... n2, where n2 represents the number of target IP addresses.

[0026] As a further solution of the present invention: the analysis and processing method is as follows:

[0027] Step B1. Time analysis:

[0028] The time interval of all threat alert information is marked as TJ j0 , j0=1, 2, ... m-1;

[0029] Then through: Calculate the average time interval ATJ of the corresponding time intervals of all threat warning information;

[0030] The average time interval ATJ is then compared with the preset time interval threshold TJy:

[0031] If ATJ<TJy, it is judged that there is a risk of continuous attack;

[0032] Step B2, Time-Source IP Correlation Analysis:

[0033] First, we construct the correlation matrix between time and source IP address and define it as MTY=[MTY j，i1 ], where MTY j，i1 Indicates that the alarm occurs at time t j The source IP address is IPyc i1 Number of alarms that occurred;

[0034] Then through: Calculate the similarity index s imTY of the association matrix j，i1 ;

[0035] Then the similarity index s imTY j，i1 Similarity threshold s imTY y For comparison:

[0036] If s imTY j，i1 >s imTY y , then it means that at this time t j The behavior of the source IP address is relevant;

[0037] If s imTY j，i1 ≤s imTY y , then it means that at this time t jThe behavior of the source IP address is not relevant;

[0038] Step B3, Time-target IP correlation analysis:

[0039] First, we construct the association matrix between time and target IP address and define it as MTM = [MTM j，i2 ], where MTM j，i2 Indicates that the alarm occurs at time t j The target IP address is IPmc i2 Number of alarms that occurred;

[0040] Then through: Calculate the similarity index si MTM of the association matrix j，i2 ;

[0041] Then the similarity index si MTM j，i2 Similarity threshold si MTM y For comparison:

[0042] If si MTM j，i2 >si MTM y , then it means that at this time t j The behavior of the target IP address is relevant;

[0043] If si MTM j，i2 ≤si MTM y , then it means that at this time t j The behavior of the target IP address is not relevant;

[0044] Step B4, Source IP address analysis:

[0045] pass: Calculate the average number of occurrences of each source IP address A IPY;

[0046] Then the number of occurrences of each source IP address is IPyc i1 Compare with F times A IPY:

[0047] Wherein, F is the preset multiple value;

[0048] If IPyc i1 >F×A IPY, then the source IP address is recorded as an abnormal source IP address;

[0049] If IPyc i1 ≤F×A IPY, the source IP address will not be recorded as an abnormal source IP address;

[0050] Step B5, target IP address analysis:

[0051] pass: Calculate the average number of occurrences of each target IP address A IPM;

[0052] Then the number of occurrences of each target IP address IPmc i2 Compare with F times AIPM:

[0053] If IPmc i2 >F×A IPM, then the target IP address is recorded as an abnormal target IP address;

[0054] If IPmc i1 ≤F×A IPM, the target IP address will not be recorded as an abnormal target IP address;

[0055] Step B6, Source IP address-destination IP association analysis:

[0056] Establish source IP-target IP association matrix MYM=[MYM i1，i2 ], MYM i1，i2 Indicates the number of times the source IP address sends alarm information to the target IP address;

[0057] A source IP address is then selected and: Calculate the attack frequency FYM1 of the source IP address on the target IP address i1，i2 ;

[0058] Then the attack frequency FYM1 of the source IP address to the target IP address i1，i2 The attack frequency threshold FYM1 y of the preset source IP-target IP;

[0059] If FYM1 i1，i2 >FYM1y, it means that the source IP address has frequent attacks on the target IP address, and the source IP address is recorded as a risky source IP address;

[0060] At the same time, select a target IP address and pass: Calculate the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 ;

[0061] Then the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 and the preset alarm frequency distribution coefficient threshold FYM2y;

[0062] If FYM2 i1，i2 >FYM2y, it means that the target IP address is in a vulnerable state or the network environment has a security vulnerability, and the target IP address is recorded as a risky target IP address.

[0063] A method for processing threat warning information, which is implemented by the threat warning information processing system, comprises the following steps:

[0064] Step 1: Data collection:

[0065] Collect threat alert information from multiple data sources;

[0066] Step 2: Feature extraction:

[0067] Extract multiple warning features from the collected threat warning information;

[0068] Step 3: Data Analysis:

[0069] Analyze and process threat warning information based on extracted features, and determine network security situation through analysis and processing results;

[0070] Step 4: Data integration:

[0071] The time analysis results, time-source IP correlation analysis results, time-target IP correlation analysis results, source IP address analysis results, target IP address analysis results, and source IP address-target IP correlation analysis results are summarized and organized to form a complete threat alarm information analysis report.

[0072] Beneficial effects of the present invention:

[0073] The present invention can collect threat warning information from multiple data sources, including logs of network security equipment (such as firewalls, intrusion detection systems), abnormal information in power system monitoring data, alarm data of relevant security intelligence platforms, etc., covering multiple key information sources, making the monitoring of network security status more comprehensive without missing any relevant information that may pose a security risk.

[0074] The present invention summarizes and organizes the analysis results of the data analysis module through the data integration module to form a threat warning information analysis report, which is convenient for management personnel to clearly and intuitively understand the overall network security situation and provide a strong basis for subsequent decision-making.

[0075] In the present invention, the feature extraction module can extract multiple key alarm features from the collected threat alarm information, such as time features, source IP features, target IP features, etc. Through the careful time feature extraction, the alarm occurrence time and the time interval between adjacent time points can be accurately obtained, which is helpful for analyzing the persistence of the attack and other situations.

[0076] The present invention extracts and subsequently analyzes the source IP and target IP features, including counting their occurrence times, building an association matrix and calculating similarity indices, etc., which can accurately identify abnormal source IP addresses, abnormal target IP addresses, risky source IP addresses and risky target IP addresses, etc., thereby accurately determining which devices or nodes in the network may pose security risks and whether the associated behaviors between them are abnormal, greatly improving the accuracy of locating and identifying network security threats.

[0077] In the data analysis module of the present invention, multiple analysis and processing methods are used, such as time analysis to determine whether there is a persistent attack risk; time-source IP, time-target IP association analysis to determine the behavior correlation of related IP addresses at a specific time point; source IP address and target IP address analysis to find abnormal IP addresses; source IP address-target IP association analysis to determine the attack frequency of the source IP on the target IP and the vulnerable state of the target IP, etc. These analysis and processing methods are combined to comprehensively and accurately evaluate network security risks and determine network security situations, so that network security managers can take effective preventive and countermeasures in a timely manner to ensure the safe and stable operation of the network system.

[0078] In summary, the threat alarm information processing system and method of the present invention have significant advantages in network security monitoring, risk assessment and management, and can effectively improve the ability to handle network security threats and the overall security protection level of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] The present invention will be further described below in conjunction with the accompanying drawings.

[0080] Figure 1 It is a system block diagram of the threat warning information processing system of the present invention.

[0081] Figure 2 It is a flowchart of the threat warning information processing method of the present invention. DETAILED DESCRIPTION

[0082] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0083] Embodiment 1

[0084] See also Figure 1 and Figure 2 As shown, the present invention is a threat warning information processing method and system, comprising the following steps:

[0085] Step 1: Data collection:

[0086] Collect threat alert information from multiple data sources;

[0087] Threat alert information includes, but is not limited to, logs of network security equipment, abnormal information in power system monitoring data, and alert data from relevant security intelligence platforms;

[0088] In this embodiment, the network security equipment includes a firewall, an intrusion detection system, etc.;

[0089] Step 2: Feature extraction:

[0090] Extract multiple warning features from the collected threat warning information;

[0091] The specific method is as follows:

[0092] StepA1, time feature extraction:

[0093] StepA1.1. According to the timestamp in the log, extract the alarm occurrence time from the threat alarm information and define it as T = {t j}, j = 1, 2, ... m, m represents the number of threat warning information, t j is the alarm occurrence time of the jth threat alarm information;

[0094] StepA1.2, through TJ = t j -t j-1 , calculate the time interval TJ between the threat warning information and the alarm occurrence time at each adjacent time point;

[0095] StepA2: Source IP feature extraction:

[0096] The source IP address refers to the unique identifier of the device that sends the network data packet in the network;

[0097] First, identify the source IP address in the threat alert information;

[0098] Then count the number of occurrences of each source IP address and define it as IPYC = {IPyc i1}, where IPyc i1 is the number of occurrences of threat alert information in the i 1th source IP address, i 1 = 1, 2, ... n1, n1 represents the number of source IP addresses;

[0099] StepA3, target IP feature extraction:

[0100] The target IP address refers to the unique identifier of the device that the network data packet is destined for in the network;

[0101] First, identify the target IP address in the threat alert information;

[0102] Then count the number of occurrences of each target IP address and define it as IPMC = {IPmc i2}, where IPmc i2 is the number of occurrences of threat alarm information in the i2th target IP address, i2=1, 2, ... n2, n2 represents the number of target IP addresses;

[0103] Step 3: Data Analysis:

[0104] Analyze and process threat warning information based on extracted features, and determine network security situation through analysis and processing results;

[0105] The specific method is as follows:

[0106] Step 1: Time analysis:

[0107] The time interval of all threat alert information is marked as TJ j0 , j0=1, 2, ... m-1;

[0108] Then through: Calculate the average time interval ATJ of the corresponding time intervals of all threat warning information;

[0109] The average time interval ATJ is then compared with the preset time interval threshold TJy:

[0110] If ATJ<TJy, it is judged that there is a risk of continuous attack;

[0111] Step 2: Source IP address analysis:

[0112] pass: Calculate the average number of occurrences of each source IP address A IPY;

[0113] Then the number of occurrences of each source IP address is IPyc i1 Compare with F times A IPY:

[0114] Wherein, F is the preset multiple value;

[0115] If IPyc i1 >F×A IPY, then the source IP address is recorded as an abnormal source IP address;

[0116] If IPyc i1 ≤F×A IPY, the source IP address will not be recorded as an abnormal source IP address;

[0117] Step 3: Target IP address analysis:

[0118] pass: Calculate the average number of occurrences of each target IP address A IPM;

[0119] Then the number of occurrences of each target IP address IPmc i2 Compare with F times AIPM:

[0120] If IPmc i2 >F×A IPM, then the target IP address is recorded as an abnormal target IP address;

[0121] If IPmc i1 ≤F×A IPM, the target IP address will not be recorded as an abnormal target IP address;

[0122] Step 4: Data Integration

[0123] Summarize and organize the analysis results of the data analysis module to form a complete threat warning information analysis report.

[0124] In this embodiment, a structured data table is created to record each analysis result in sequence according to the corresponding threat warning information number or time sequence.

[0125] This embodiment can collect threat alarm information from multiple data sources, including network security equipment logs, abnormal information of power system monitoring data, and alarm data of security intelligence platform, etc., to ensure that the information sources are extensive and avoid missing important threat clues; through the extraction of time, source IP and target IP features, a rich data foundation is provided for subsequent in-depth analysis. Time features help to understand the time pattern and frequency of alarm occurrence; source IP features can identify possible attack sources, and can preliminarily determine abnormal source IPs by counting the number of occurrences; target IP features can determine the target devices or network areas of concern, which is convenient for targeted protection; time, source IP and target IP analysis based on the extracted features can quickly determine the network security situation. For example, through time interval analysis, continuous attack risks can be discovered in time; source IP address analysis can locate abnormal source IPs and assist in tracking the source of attacks; target IP address analysis can find abnormal target IPs and strengthen protection for key targets; the analysis results are summarized and organized into a complete report, recorded in the form of a structured data table, which is convenient for subsequent viewing, statistics and management, and helps the security team to fully grasp the network security situation and provide a strong basis for decision-making.

[0126] Embodiment 2

[0127] As the second embodiment of the present invention, when the present application is specifically implemented, compared with the first embodiment, the technical solution of the present embodiment is different from the first embodiment only in that in the present embodiment, the analysis and processing further includes: time-source IP association analysis and time-destination IP association analysis;

[0128] The time-source IP correlation analysis method is as follows:

[0129] First, we construct the correlation matrix between time and source IP address and define it as MTY=[MTY j，i1 ], where MTY j，i1 Indicates that the alarm occurs at time t j The source IP address is IPyc i1 Number of alarms that occurred;

[0130] Then through: Calculate the similarity index s imTY of the association matrix j，i1 ;

[0131] In this embodiment, MTY j，i1 Measured the alarm occurrence time t j and source IP address IPyc i1 The "intensity" of co-occurrence; if the number of alarms from the source IP address at the time of alarm occurrence is large, it means that they are strongly correlated in this dimension, and the value of the numerator will be relatively large; Calculate the alarm occurrence time t j A certain "scale" of the number of alarms related to all source IP addresses can be understood as a measure of the "influence" of the alarm occurrence time in the dimension of source IP addresses; Calculated the source IP address IPyc i1 The “influence” on the timing of all alarms;

[0132] Then the similarity index s imTY j，i1 Similarity threshold s imTY y For comparison:

[0133] If s imTY j，i1 >s imTY y , then it means that at this time t j The behavior of the source IP address is relevant;

[0134] If s imTY j，i1 ≤s imTY y , then it means that at this time t j The behavior of the source IP address is not relevant;

[0135] The time-target IP correlation analysis method is as follows:

[0136] First, we construct the association matrix between time and target IP address and define it as MTM = [MTM j，i2 ], where MTM j，i2 Indicates that the alarm occurs at time t j The target IP address is IPmc i2 Number of alarms that occurred;

[0137] Then through: Calculate the similarity index si MTM of the association matrix j，i2 ;

[0138] In this embodiment, MTM j，i2 Measured the alarm occurrence time t j and the target IP address IPmc i2 The "intensity" of co-occurrence; if the number of alarms for the target IP address is large at the time of alarm occurrence, it means that they are strongly correlated in this dimension, and the value of the numerator will be relatively large; Calculate the alarm occurrence time t j A certain "scale" of the number of alarms related to all target IP addresses can be understood as a measure of the "influence" of the alarm occurrence time in the target IP address dimension; Calculated the target IP address IPmc i2 The “influence” on the timing of all alarms;

[0139] Then the similarity index si MTM j，i2 Similarity threshold si MTM y For comparison:

[0140] If si MTM j，i2 >si MTM y , then it means that at this time t j The behavior of the target IP address is relevant;

[0141] If si MTM j，i2 ≤si MTM y , then it means that at this time t j The behavior of the target IP address is not relevant.

[0142] This embodiment adds time-source IP correlation analysis and time-target IP correlation analysis on the basis of embodiment 1. By constructing a correlation matrix and calculating the similarity index, the intrinsic connection between the alarm occurrence time and the source IP or target IP can be deeply explored. When a strong correlation is found, the attack behavior pattern can be judged more accurately, such as concentrated attacks by certain source IPs at a specific time, or the regularity of frequent attacks on target IPs within a specific time, which helps to provide early warning and take targeted preventive measures, thereby improving the accuracy and timeliness of network security protection.

[0143] Embodiment 3

[0144] As the third embodiment of the present invention, when the present application is implemented, compared with the first and second embodiments, the technical solution of this embodiment is to combine the solutions of the first and second embodiments, and the difference between the technical solution of this embodiment and the first and second embodiments is that the analysis and processing in this embodiment also includes:

[0145] Source IP address-destination IP association analysis:

[0146] Establish source IP-target IP association matrix MYM=[MYM i1，i2 ], MYM i1，i2 Indicates the number of times the source IP address sends alarm information to the target IP address;

[0147] A source IP address is then selected and: Calculate the attack frequency FYM1 of the source IP address on the target IP address i1，i2 ;

[0148] Then the attack frequency FYM1 of the source IP address to the target IP address i1，i2 The attack frequency threshold FYM1 y of the preset source IP-target IP;

[0149] If FYM1 i1，i2 >FYM1y, it means that the source IP address has frequent attacks on the target IP address, and the source IP address is recorded as a risky source IP address;

[0150] At the same time, select a target IP address and pass: Calculate the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 ;

[0151] Then the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 and the preset alarm frequency distribution coefficient threshold FYM2y;

[0152] If FYM2 i1，i2>FYM2y, it means that the target IP address is in a vulnerable state or the network environment has a security vulnerability, and the target IP address is recorded as a risky target IP address.

[0153] This embodiment further expands the association analysis to the source IP address-target IP association analysis, establishes the source IP-target IP association matrix and calculates the attack frequency and the distribution coefficient of the number of alarms. This can not only discover the frequent attack behaviors of the source IP on the target IP and mark the risk source IP address in time, but also can determine whether the network environment where the target IP is located has security vulnerabilities or is in a vulnerable state by analyzing the distribution of the number of alarms received by the target IP and mark the risk target IP address. In this way, a comprehensive risk assessment from the source of the attack to the target is achieved, network security resources are deployed more effectively, high-risk areas are focused on protection and vulnerability repair, and the overall network security defense capability is improved.

[0154] Embodiment 4

[0155] As the fourth embodiment of the present invention, when the present application is specifically implemented, compared with the first, second and third embodiments, the technical solution of this embodiment is to combine and implement the solutions of the above-mentioned first, second and third embodiments.

[0156] This embodiment integrates the solutions of embodiments one, two, and three to form a comprehensive, multi-level threat warning information processing system. Combining multiple data collection channels, multi-dimensional feature extraction, comprehensive analysis methods, and perfect correlation analysis, it is possible to maximize the value of threat warning information, accurately and comprehensively grasp the network security situation, and promptly discover various potential security risks. Whether it is a persistent attack, abnormal source or target IP behavior, or a complex source-target IP correlation attack mode, it can effectively identify and respond, provide high-intensity, refined security protection for the network, and effectively ensure the stable operation of the network system and data security.

[0157] The present invention also provides a threat warning information processing system, which is used to execute the threat warning information processing method, and the system includes:

[0158] Data collection module, used to collect threat warning information from various data sources;

[0159] A feature extraction module is used to extract multiple warning features from the collected threat warning information;

[0160] The data analysis module is used to analyze and process the threat warning information according to the extracted features, and determine the network security situation through the analysis and processing results;

[0161] The data integration module is used to summarize and organize the analysis results of the data analysis module to form a threat warning information analysis report.

[0162] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0163] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for processing threat warning information, characterized in that: The following steps are involved: Step 1: Data collection: Collect threat alert information from multiple data sources; Step 2: Feature extraction: Extract warning features from the collected threat warning information; Step 3: Data Analysis: Analyze and process threat warning information based on extracted features, and determine network security situation through analysis and processing results; Step 4: Data integration: The analysis and processing results are summarized and organized to form a threat warning information analysis report.

2. The threat warning information processing method according to claim 1, characterized in that: The extraction method of the feature extraction module is as follows: StepA1, time feature extraction: StepA1.

1. According to the timestamp in the log, extract the alarm occurrence time from the threat alarm information and define it as T = {t j }, j = 1, 2, ... m, m represents the number of threat warning information, t j is the alarm occurrence time of the jth threat alarm information; StepA1.2, through TJ = t j -t j-1 , calculate the time interval TJ between the threat warning information and the alarm occurrence time at each adjacent time point; StepA2: Source IP feature extraction: The source IP address refers to the unique identifier of the device that sends the network data packet in the network; First, identify the source IP address in the threat alert information; Then count the number of occurrences of each source IP address and define it as IPYC = {IPyc i1 }, where IPyc i1 is the number of occurrences of threat alarm information in the i1th source IP address, i 1 = 1, 2, ... n1, n1 represents the number of source IP addresses; StepA3, target IP feature extraction: The target IP address refers to the unique identifier of the device that the network data packet is destined for in the network; First, identify the target IP address in the threat alert information; Then count the number of occurrences of each target IP address and define it as IPMC = {IPmc i2 }, where IPmc i2 is the number of occurrences of threat alarm information in the i2th target IP address, i2=1, 2, ... n2, where n2 represents the number of target IP addresses.

3. The method for processing threat warning information according to claim 2, characterized in that: The analysis and processing methods for time characteristics are as follows: The time interval of all threat alert information is marked as TJ j0 , j0=1, 2, ... m-1; Then through: Calculate the average time interval ATJ of the corresponding time intervals of all threat warning information; The average time interval ATJ is then compared with the preset time interval threshold TJy: If ATJ<TJy, it is determined that there is a risk of continuous attack.

4. The method for processing threat warning information according to claim 2, characterized in that: The method for analyzing and processing the source IP address is as follows: pass: Calculate the average number of occurrences of each source IP address AIPY; Then the number of occurrences of each source IP address is IPyc i1 Compare with AIPY times F: Wherein, F is the preset multiple value; If IPyc i1 >F×AIPY, then the source IP address is recorded as an abnormal source IP address; If IPyc i1 ≤F×AIPY, the source IP address will not be recorded as an abnormal source IP address.

5. The method for processing threat warning information according to claim 2, characterized in that: The method for analyzing and processing the target IP address is as follows: pass: Calculate the average AIPM of the number of occurrences of each target IP address; Then the number of occurrences of each target IP address IPmc i2 Compare with AIPM times F: If IPmc i2 >F×AIPM, then the target IP address is recorded as an abnormal target IP address; If IPmc i1 ≤F×AIPM, the target IP address will not be recorded as an abnormal target IP address.

6. The threat warning information processing method according to claim 2, characterized in that: The analytical processing also includes: Source IP address-destination IP association analysis: Establish source IP-target IP association matrix MYM=[MYM i1，i2 ], MYM i1，i2 Indicates the number of times the source IP address sends alarm information to the target IP address; A source IP address is then selected and: Calculate the attack frequency FYM1 of the source IP address on the target IP address i1，i2 ; Then the attack frequency FYM1 of the source IP address to the target IP address i1，i2 The attack frequency threshold FYM1 y of the preset source IP-target IP; If FYM1 i1，i2 >FYM1y, it means that the source IP address has frequent attacks on the target IP address, and the source IP address is recorded as a risky source IP address; At the same time, select a target IP address and pass: Calculate the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 ; Then the distribution coefficient FYM2 of the number of alarms received by the target IP address from different source IP addresses i1，i2 and the preset alarm frequency distribution coefficient threshold FYM2y; If FYM2 i1，i2 >FYM2y, it means that the target IP address is in a vulnerable state or the network environment has a security vulnerability, and the target IP address is recorded as a risky target IP address.

7. The threat warning information processing method according to claim 2, characterized in that: The analytical processing also includes: Time-Source IP Correlation Analysis: First, we construct the correlation matrix between time and source IP address and define it as MTY=[MTY j，i1 ], where MTY j，i1 Indicates that the alarm occurs at time t j The source IP address is IPyc i1 Number of alarms that occurred; Then through: Calculate the similarity index simTY of the association matrix j，i1 ; Then the similarity index simTY j，i1 Similarity threshold simTY y For comparison: If simTY j，i1 >simTY y , then it means that at this time t j The behavior of the source IP address is relevant; If simTY j，i1 ≤simTY y , then it means that at this time t j The source IP address is irrelevant.

8. The threat warning information processing method according to claim 2, characterized in that: The analytical processing also includes: Time-target IP correlation analysis: First, we construct the association matrix between time and target IP address and define it as MTM = [MTM j，i2 ], where MTM j，i2 Indicates that the alarm occurs at time t j The target IP address is IPmc i2 Number of alarms that occurred; Then through: Calculate the similarity index si MTM of the association matrix j，i2 ; Then the similarity index siMTM j，i2 Similarity threshold si MTM y For comparison: If siMTM j，i2 >si MTM y , then it means that at this time t j The behavior of the target IP address is relevant; If siMTM j，i2 ≤si MTM y , then it means that at this time t j The behavior of the target IP address is not relevant.

9. The threat warning information processing method according to claim 1, characterized in that: Threat alert information includes logs of network security devices, abnormal information in power system monitoring data, and alert data from relevant security intelligence platforms; Among them, network security equipment includes firewalls and intrusion detection systems.

10. A threat warning information processing system, the system being used to execute the threat warning information processing method according to any one of claims 1 to 9, characterized in that: The system includes: Data collection module, used to collect threat warning information from multiple data sources; A feature extraction module is used to extract multiple warning features from the collected threat warning information; The data analysis module is used to analyze and process the threat warning information according to the extracted features, and determine the network security situation through the analysis and processing results; The data integration module is used to summarize and organize the analysis results of the data analysis module to form a threat warning information analysis report.

Images