Security event management method and device

Abstract

The invention discloses a security event management method and device. The method comprises the following steps: acquiring multiple groups of first event data of different modes corresponding to a target security event; for each group of first event data, determining a pre-processing mode corresponding to the modal type of the first event data to pre-process the first event data to obtain second event data; performing format conversion on each group of second event data to obtain multiple groups of third event data matched with the input format of the security event classification model; the multiple sets of third event data are analyzed through a security event classification model, the target event type of the target security event is obtained, and the security event classification model is provided with a multi-head attention mechanism; and determining a security event processing strategy corresponding to the target event type, and executing the security event processing strategy. According to the method and the device, the technical problem that the system security is easily influenced due to difficulty in accurately identifying and processing the security event in a related scheme is solved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a security incident management method and device. Background Art

[0002] With the rapid development of big data and artificial intelligence technologies, the field of network security is facing unprecedented challenges. Automatic detection and classification of security incidents are becoming increasingly important, especially in the face of increasingly complex network attacks and threats. Traditional rule-based methods have been unable to cope with the ever-changing attack patterns. Therefore, security incident detection methods based on machine learning and deep learning have gradually become a research hotspot. Existing security incident detection methods, such as those based on recurrent neural networks, can process sequence data to a certain extent, but they are insufficient in processing long-distance dependencies and parallel computing, and cannot accurately identify and process security incidents, which in turn affects system security.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a security event management method and device to at least solve the technical problem that related solutions are difficult to accurately identify and process security events, which can easily affect system security.

[0005] According to one aspect of an embodiment of the present application, a security event management method is provided, including: obtaining multiple groups of first event data of different modalities corresponding to a target security event; for each group of first event data, determining a preprocessing method corresponding to the modal type of the first event data to preprocess the first event data to obtain second event data; formatting each group of second event data separately to obtain multiple groups of third event data that match the input format of a security event classification model; analyzing the multiple groups of third event data using a security event classification model to obtain a target event type of the target security event, wherein the security event classification model is provided with a multi-head attention mechanism; determining a security event processing strategy corresponding to the target event type, and executing the security event processing strategy.

[0006] Optionally, a preprocessing method corresponding to the modal type of the first event data is determined to preprocess the first event data to obtain second event data, including: when the first event data is text description data, performing word segmentation on the first event data, and successively deleting stop words and special characters in the word segmentation results to obtain second event data; when the first event data is monitoring image data, using a target detection algorithm to identify abnormal objects in the first event data, and marking the abnormal objects to obtain second event data; when the first event data is network traffic data, performing data cleaning and normalization on the first event data to obtain second event data; when the first event data is user behavior data, all user behavior records in the first event data are organized into a user behavior sequence according to time, and the user behavior sequence is used as the second event data; when the first event data is unstructured log data, using a log parsing tool to parse the first event data to obtain structured second event data.

[0007] Optionally, format conversion is performed on each group of second event data to obtain multiple groups of third event data that match the input format of the security event classification model, including: for each group of second event data, extracting features from the second event data using a feature extraction network corresponding to the modal type of the second event data to obtain a set of security event feature sets; and converting each security event feature in the security event feature set into a format that matches the input format of the security event classification model using a feature conversion network to obtain third event data corresponding to the second event data.

[0008] Optionally, the training process of the security incident classification model includes: constructing an initial classification model based on Transformer, wherein the initial classification model includes: an encoding module, a decoding module and a classification module; obtaining multiple second event data sets corresponding to multiple historical security events, and taking each second event data set as a training sample, determining the security event type corresponding to the second event data set as a sample label, wherein each second event data set includes multiple groups of second event data of different modalities; dividing the multiple training samples into training sets and verification sets, and determining the hyperparameters for model training; based on the hyperparameters, iteratively training the initial classification model using the training set, and performing performance verification on the trained model using the verification set; if the performance verification fails, adjusting the hyperparameters, and continuing to iteratively train the trained model using the training set; if the performance verification passes, using the trained model as the security incident classification model.

[0009] Optionally, in the initial classification model, the encoding module includes: a first input embedding layer, a first position encoding layer, a first normalization layer, a multi-head attention layer, a second normalization layer, a first feedforward neural network layer and a third normalization layer connected in sequence, a first residual connection layer connected to the output of the first position encoding layer and the input of the second normalization layer respectively, and a second residual connection layer connected to the output of the multi-head attention layer and the input of the third normalization layer respectively; the decoding module includes: a second input embedding layer, a second position encoding layer, a fourth normalization layer, a self-attention layer, a fifth normalization layer, a second feedforward neural network layer and a sixth normalization layer connected in sequence, a third residual connection layer connected to the output of the second position encoding layer and the input of the fifth normalization layer respectively, and a fourth residual connection layer connected to the output of the self-attention layer and the input of the sixth normalization layer respectively; the classification module includes: a fully connected layer or a multilayer perceptron.

[0010] Optionally, a security event classification model is used to analyze multiple groups of third event data to obtain target event types of target security events, including: using a first input embedding layer to process multiple groups of third event data respectively, and forming a first vector set with the obtained starting vectors of multiple preset dimensions; using a first position encoding layer to perform position encoding processing on the first vector set to obtain a second vector set; using a first normalization layer to normalize the second vector set to obtain a third vector set; using a multi-head attention layer to process the third vector set to obtain the weights of each third vector in the third vector set, and forming multiple weights into a first weight set; using a second normalization layer to normalize the first weight set and the sum of the second vector set transmitted through the first residual connection layer to obtain a fourth vector set; using a first feedforward neural network layer to perform nonlinear transformation processing on the fourth vector set to obtain a fifth vector set; using a third normalization layer to normalize the fifth vector set and the sum of the first weight set transmitted through the second residual connection layer The target input sequence is obtained by performing position encoding processing on the target input sequence by using the second input embedding layer; the sixth vector set is position-encoded by using the second position encoding layer to obtain the seventh vector set; the seventh vector set is normalized by using the fourth normalization layer to obtain the eighth vector set; the eighth vector set is masked by using the self-attention layer to obtain the weights of each eighth vector in the eighth vector set, and the multiple weights are combined into a second weight set; the sum of the second weight set and the seventh vector set transmitted through the third residual connection layer is normalized by using the fifth normalization layer to obtain the ninth vector set; the ninth vector set is nonlinearly transformed by using the second feedforward neural network layer to obtain the tenth vector set; the tenth vector set and the sum of the second weight set transmitted through the fourth residual connection layer are normalized by using the sixth normalization layer to obtain the target output sequence; the target output sequence is analyzed by using a fully connected layer or a multi-layer perceptron to obtain the target event type of the target security event.

[0011] Optionally, multiple third event data sets corresponding to multiple historical security events within a preset time period before the target security event occurs are obtained, wherein each third event data set includes multiple groups of third event data of different modalities; a pre-trained graph neural network is used to analyze the multiple groups of first event data and the multiple third event data sets to obtain a global event representation corresponding to the target security event; a security event classification model is used to comprehensively analyze the multiple groups of third event data and the global event representation to obtain a target event type for the target security event.

[0012] Optionally, determining a security event handling strategy corresponding to the target event type includes: when the target event type is abnormal user login, determining that the security event handling strategy includes at least one of the following: authenticating the user and closing user access rights; when the target event type is abnormal system performance, determining that the security event handling strategy includes at least one of the following: detecting system fault nodes and adjusting system resource allocation; when the target event type is a network attack, determining that the security event handling strategy includes at least one of the following: blocking access to the source IP or source device and rolling back the database; when the target event type is a physical security event, determining that the security event handling strategy includes at least one of the following: blocking the scene and notifying security personnel.

[0013] According to another aspect of an embodiment of the present application, a security event management device is also provided, including: an acquisition module, used to acquire multiple groups of first event data of different modalities corresponding to a target security event; a preprocessing module, used to determine, for each group of first event data, a preprocessing method corresponding to the modal type of the first event data to preprocess the first event data to obtain second event data; a conversion module, used to format each group of second event data respectively to obtain multiple groups of third event data that match the input format of a security event classification model; an analysis module, used to analyze the multiple groups of third event data using the security event classification model to obtain a target event type of the target security event, wherein the security event classification model is provided with a multi-head attention mechanism; a processing module, used to determine a security event processing strategy corresponding to the target event type, and execute the security event processing strategy.

[0014] According to another aspect of an embodiment of the present application, a computer program product is also provided, the computer program product comprising: a computer program, wherein the computer program implements the above-mentioned security event management method when executed by a processor.

[0015] According to another aspect of an embodiment of the present application, an electronic device is further provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned security event management method through the computer program.

[0016] In an embodiment of the present application, a security event management method is provided, including: obtaining multiple groups of first event data of different modalities corresponding to a target security event; for each group of first event data, determining a preprocessing method corresponding to the modal type of the first event data to preprocess the first event data to obtain second event data; formatting each group of second event data separately to obtain multiple groups of third event data that match the input format of a security event classification model; analyzing the multiple groups of third event data using the security event classification model to obtain a target event type of the target security event, wherein the security event classification model is provided with a multi-head attention mechanism; determining a security event processing strategy corresponding to the target event type, and executing the security event processing strategy. Using this method, by integrating and processing the first event data of different modalities (such as text, images, network traffic, etc.), this technical solution can comprehensively capture the multiple feature information of security events, overcoming the limitations of traditional single modality analysis. In addition, the third event data after format conversion is analyzed using a Transformer model with a multi-head attention mechanism, which can capture long-distance dependencies in the sequence, significantly improving the accuracy and processing speed of security event classification, especially when processing large-scale and complex security data sets. The advantages are obvious, thereby solving the technical problem that related solutions are difficult to accurately identify and process security events, which easily affects system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flowchart of an optional security incident management method according to an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of the structure of an optional security event management device according to an embodiment of the present application;

[0020] Figure 3 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0024] Transformer model: A deep learning model based on the self-attention mechanism, which is mainly used for natural language processing tasks such as machine translation, text generation, question-answering systems, etc. Unlike traditional recurrent neural networks and convolutional neural networks, Transformer does not rely on sequential processing of sequences, but processes input data in parallel through the self-attention mechanism, thereby significantly improving training speed and performance.

[0025] Security incidents: refers to any activity or phenomenon that occurs in an information system or network environment and may threaten or damage the security and integrity of data, networks, devices or applications. Security incidents can be accidental, unauthorized or malicious behaviors. They may originate from internal or external attackers, or they may be caused by system vulnerabilities, configuration errors or natural factors (such as hardware failure). They include but are not limited to the following types: intrusion attempts, malware infections, system anomalies, data leaks, physical security incidents, network attacks, abnormal user behavior, etc.

[0026] Example 1

[0027] According to an embodiment of the present application, a security incident management method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Figure 1 is a flow chart of a security incident management method provided according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0029] Step S102, obtaining multiple groups of first event data of different modes corresponding to the target security event;

[0030] Step S104, for each group of first event data, determine a preprocessing method corresponding to the modality type of the first event data to preprocess the first event data to obtain second event data;

[0031] Step S106, performing format conversion on each set of second event data respectively to obtain multiple sets of third event data that match the input format of the security event classification model;

[0032] Step S108, analyzing the multiple groups of third event data using a security event classification model to obtain a target event type of the target security event, wherein the security event classification model is provided with a multi-head attention mechanism;

[0033] Step S110, determining a security event handling strategy corresponding to the target event type, and executing the security event handling strategy.

[0034] The following describes each step of the security incident management method in conjunction with a specific implementation process.

[0035] Acquire multiple groups of first event data of different modes corresponding to the target security event.

[0036] In the field of information security, in order to accurately identify and classify target security events, it is particularly important to collect and analyze multimodal data. The original security event data obtained by the system from the database may cover system logs (text mode), network traffic (network data mode), user behavior data (text or sensor data mode), and even image or audio data in certain cases. These data from different data sources with their own formats and characteristics together constitute the cornerstone of a comprehensive understanding of security events. By integrating and analyzing these multimodal data, the system can comprehensively capture the characteristic information of security events from multiple angles, which not only includes the direct manifestation of the event, such as abnormal system behavior, network access mode, etc., but also deeply explore the potential impact and background of the event, such as the user's authentication process, abnormal fluctuations in data transmission, etc. This multi-dimensional analysis method overcomes the limitations of single modality analysis, improves the accuracy and efficiency of intelligent identification and classification of security events, and is an important part of building a modern information security protection system. Therefore, when identifying and classifying target security events, the system first reads the raw data containing the above-mentioned various modalities from the database, and then organizes the data into a format suitable for machine learning model input through preprocessing steps such as data cleaning, format conversion, and feature extraction, providing a high-quality data foundation for subsequent intelligent analysis.

[0037] For each set of first event data, a preprocessing method corresponding to the modality type of the first event data is determined to preprocess the first event data to obtain second event data. The specific process may be as follows:

[0038] When the first event data is text description data, the first event data is segmented, and stop words and special characters in the segmentation results are deleted in turn to obtain second event data; when the first event data is monitoring image data, the target detection algorithm is used to identify abnormal objects in the first event data, and the abnormal objects are marked to obtain second event data; when the first event data is network traffic data, the first event data is cleaned and normalized to obtain second event data; when the first event data is user behavior data, all user behavior records in the first event data are organized into a user behavior sequence according to time, and the user behavior sequence is used as the second event data; when the first event data is unstructured log data, the first event data is parsed using a log parsing tool to obtain structured second event data.

[0039] After obtaining the above-mentioned second event data, format conversion is performed on each set of second event data to obtain multiple sets of third event data that match the input format of the security event classification model. This process can be performed in the following manner:

[0040] For each group of second event data, a feature extraction network corresponding to the modal type of the second event data is used to extract features from the second event data to obtain a set of security event feature sets; then a feature conversion network is used to convert each security event feature in the security event feature set into a format that matches the input format of the security event classification model to obtain third event data corresponding to the second event data.

[0041] For example, for text data, word embedding models such as BERT (Bidirectional Encoder Representations from Transformers) can be used to extract the semantic features of each word, forming a sequence of word vectors to form a security event feature set. For image data, convolutional neural networks can be used to extract image features such as edges, textures, colors, etc. These features will be organized into a feature vector to form a security event feature set. For network traffic data, statistical features of traffic can be extracted, such as the size, frequency, and direction of data packets. These features will also be organized into a vector to form a security event feature set. For user behavior data, time series features of behavior can be extracted, such as the time interval, number of repetitions, and patterns of behavior, which also form feature vectors.

[0042] The specific conversion process may include: Vectorization: Ensure that each feature can be represented in the form of a numerical vector. For example, text word embedding is already a vectorization process, and the feature extraction results of image and network data are usually also in vector form. Serialization: Organize the feature vector into a sequence so that the Transformer model can process it. For example, image features may need to be rearranged into a sequence so that the encoder can consider each feature one by one. Dimension adjustment: Adjust the dimension of the feature vector to match the input dimension of the Transformer model. This may be achieved by adding or subtracting elements of the vector, or using linear transformations such as fully connected layers to adjust the dimension of the vector. Position encoding: Add position information to the feature vector sequence. Because the Transformer model itself does not have the ability to handle sequence positions, position encoding uses a special position vector to inject the position information of each feature in the sequence. This is an important part of the Transformer model format data.

[0043] After obtaining the above-mentioned third event data, multiple groups of third event data are analyzed using a security event classification model to obtain target event types of target security events, wherein the security event classification model is provided with a multi-head attention mechanism.

[0044] As an optional implementation, the training process of the security event classification model can adopt the following steps:

[0045] S1, constructing an initial classification model based on Transformer, wherein the initial classification model includes: an encoding module, a decoding module and a classification module;

[0046] S2, obtaining multiple second event data sets corresponding to multiple historical security events, and taking each second event data set as a training sample, determining the security event type corresponding to the second event data set as a sample label, wherein each second event data set includes multiple groups of second event data of different modes;

[0047] S3, divide the multiple training samples into training sets and validation sets, and determine the hyperparameters of model training, which may include learning rate, batch size, etc.;

[0048] S4, based on the hyperparameters, the initial classification model is iteratively trained using the training set, and the performance of the trained model is verified using the validation set;

[0049] S5: If the performance verification fails, adjust the hyperparameters and continue to iteratively train the trained model using the training set. If the performance verification passes, use the trained model as the security event classification model.

[0050] It should be noted that the model can be trained periodically based on the predicted events and results to continuously optimize the model parameters.

[0051] As an optional implementation, the initial classification model includes an encoding module, a decoding module, and a classification module, wherein:

[0052] The encoding module includes: a first input embedding layer, a first position encoding layer, a first normalization layer, a multi-head attention layer, a second normalization layer, a first feedforward neural network layer and a third normalization layer connected in sequence, a first residual connection layer connected to the output of the first position encoding layer and the input of the second normalization layer respectively, and a second residual connection layer connected to the output of the multi-head attention layer and the input of the third normalization layer respectively;

[0053] The decoding module includes: a second input embedding layer, a second position encoding layer, a fourth normalization layer, a self-attention layer, a fifth normalization layer, a second feedforward neural network layer and a sixth normalization layer connected in sequence, a third residual connection layer connected to the output of the second position encoding layer and the input of the fifth normalization layer respectively, and a fourth residual connection layer connected to the output of the self-attention layer and the input of the sixth normalization layer respectively;

[0054] The classification module includes: fully connected layers or multi-layer perceptrons.

[0055] As an optional implementation, after obtaining the trained security event classification model, the model is used to analyze multiple sets of third event data to obtain the target event type of the target security event, wherein the purpose of the encoding module is to convert multiple sets of third event data into vector representations that can be understood and processed by the model, and the work of the decoding module is to generate a sequence of output vector representations based on the output of the encoding module. The classification module converts the vector sequence generated by the decoder into a probability distribution of the event type, thereby determining the target event type of the target security event. This process is divided into several steps:

[0056] The first input embedding layer is used to process multiple sets of third event data respectively, and the obtained starting vectors of multiple preset dimensions are combined into a first vector set. The function of this layer is to map the original data into a high-dimensional space, so that the model can capture the intrinsic characteristics of the data.

[0057] Since the Transformer model needs to know the position information of each element when processing sequence data, the first position encoding layer is used to perform position encoding on the first vector set to obtain the second vector set. Position encoding ensures that the model can understand the relative order and position of elements in the sequence, which is crucial for the correct understanding and classification of events.

[0058] In order to ensure the smooth propagation of data in the model and avoid the problem of gradient disappearance or explosion, the first normalization layer is used to normalize the second vector set to obtain the third vector set;

[0059] The third vector set is processed by a multi-head attention layer to obtain the weights of each third vector in the third vector set, and the multiple weights are combined into a first weight set. The multi-head attention mechanism allows the model to analyze data from multiple different dimensions, thereby more comprehensively understanding the characteristics of the input sequence.

[0060] The second normalization layer is used to normalize the sum of the first weight set and the second vector set transmitted through the first residual connection layer to obtain a fourth vector set. The residual connection helps the model learn deeper representations, while the normalization ensures stable data propagation.

[0061] The fourth vector set is processed by nonlinear transformation using the first feedforward neural network layer to obtain a fifth vector set. The feedforward neural network layer enhances the expression ability of the model and helps the model learn more complex feature representations.

[0062] Using a third normalization layer, normalizing the sum of the fifth vector set and the first weight set transmitted through the second residual connection layer to obtain a target input sequence;

[0063] Processing the target input sequence using the second input embedding layer to obtain a sixth vector set;

[0064] The sixth vector set is processed by position encoding using the second position encoding layer to obtain a seventh vector set, thereby further strengthening the position information of the sequence data;

[0065] The seventh vector set is normalized by using the fourth normalization layer to obtain an eighth vector set, thereby ensuring smooth propagation of data in the decoder;

[0066] Using the self-attention layer to perform mask processing on the eighth vector set, obtain the weight of each eighth vector in the eighth vector set, and form the multiple weights into a second weight set;

[0067] Using a fifth normalization layer, normalizing the sum of the second weight set and the seventh vector set transmitted through the third residual connection layer to obtain a ninth vector set;

[0068] Using the second feed-forward neural network layer to perform nonlinear transformation processing on the ninth vector set, to obtain a tenth vector set;

[0069] Using a sixth normalization layer, normalizing the sum of the tenth vector set and the second weight set transmitted through the fourth residual connection layer to obtain a target output sequence;

[0070] The target output sequence is analyzed using a fully connected layer or a multi-layer perceptron to obtain the target event type of the target security event.

[0071] In order to further improve the performance of the intelligent identification and classification system of security events based on the Transformer model, especially when dealing with the correlation between security events, a graph neural network can be introduced to analyze historical security event data. This will help the system to form a global event representation based not only on the characteristics of the current event, but also on the relationship and contextual information between events, thereby improving the accuracy of classification. The following is a detailed description of this expansion solution:

[0072] Acquire multiple third event data sets corresponding to multiple historical security events within a preset time period before the target security event occurs, wherein each third event data set includes multiple groups of third event data of different modalities; use a pre-trained graph neural network to analyze the multiple groups of first event data and the multiple third event data sets to obtain a global event representation corresponding to the target security event; use a security event classification model to comprehensively analyze the multiple groups of third event data and the global event representation to obtain a target event type for the target security event.

[0073] After obtaining the target event type of the above-mentioned target security event, determine the security event handling strategy corresponding to the target event type, and the following strategies can be adopted: when the target event type is abnormal user login, determine that the security event handling strategy includes at least one of the following: authenticate the user and close the user access rights; when the target event type is system performance abnormality, determine that the security event handling strategy includes at least one of the following: detect system fault nodes and adjust system resource allocation; when the target event type is a network attack, determine that the security event handling strategy includes at least one of the following: block access to the source IP or source device and roll back the database; when the target event type is a physical security event, determine that the security event handling strategy includes at least one of the following: block the scene and notify security personnel.

[0074] In an embodiment of the present application, a security event management method is provided, including: obtaining multiple groups of first event data of different modalities corresponding to a target security event; for each group of first event data, determining a preprocessing method corresponding to the modal type of the first event data to preprocess the first event data to obtain second event data; formatting each group of second event data separately to obtain multiple groups of third event data that match the input format of a security event classification model; analyzing the multiple groups of third event data using the security event classification model to obtain a target event type of the target security event, wherein the security event classification model is provided with a multi-head attention mechanism; determining a security event processing strategy corresponding to the target event type, and executing the security event processing strategy. Using this method, by integrating and processing the first event data of different modalities (such as text, images, network traffic, etc.), this technical solution can comprehensively capture the multiple feature information of security events, overcoming the limitations of traditional single modality analysis. In addition, the third event data after format conversion is analyzed using a Transformer model with a multi-head attention mechanism, which can capture long-distance dependencies in the sequence and significantly improve the accuracy and processing speed of security event classification. It has obvious advantages when processing large-scale and complex security data sets, and solves the technical problem that related solutions are difficult to accurately identify and process security events, which easily affects system security.

[0075] Example 2

[0076] According to an embodiment of the present application, a security event management device for implementing the security event management method in embodiment 1 is also provided. Figure 2 As shown, the security event management device at least includes: an acquisition module 21, a preprocessing module 22, a conversion module 23, an analysis module 24 and a processing module 25, wherein:

[0077] An acquisition module 21 is used to acquire multiple groups of first event data of different modes corresponding to a target security event;

[0078] A preprocessing module 22, for determining, for each set of first event data, a preprocessing method corresponding to a modality type of the first event data to preprocess the first event data to obtain second event data;

[0079] A conversion module 23, used to convert the format of each set of second event data respectively to obtain multiple sets of third event data matching the input format of the security event classification model;

[0080] An analysis module 24 is used to analyze the multiple groups of third event data using a security event classification model to obtain a target event type of a target security event, wherein the security event classification model is provided with a multi-head attention mechanism;

[0081] The processing module 25 is used to determine the security event processing strategy corresponding to the target event type and execute the security event processing strategy.

[0082] The functions of each module of the security event management device are explained below in conjunction with a specific implementation process.

[0083] The acquisition module acquires multiple groups of first event data of different modes corresponding to the target security event.

[0084] For each set of first event data, the preprocessing module determines a preprocessing method corresponding to the modality type of the first event data to preprocess the first event data to obtain second event data. The specific process may be as follows:

[0085] When the first event data is text description data, the first event data is segmented, and stop words and special characters in the segmentation results are deleted in turn to obtain second event data; when the first event data is monitoring image data, the target detection algorithm is used to identify abnormal objects in the first event data, and the abnormal objects are marked to obtain second event data; when the first event data is network traffic data, the first event data is cleaned and normalized to obtain second event data; when the first event data is user behavior data, all user behavior records in the first event data are organized into a user behavior sequence according to time, and the user behavior sequence is used as the second event data; when the first event data is unstructured log data, the first event data is parsed using a log parsing tool to obtain structured second event data.

[0086] After obtaining the above-mentioned second event data, the conversion module performs format conversion on each set of second event data respectively to obtain multiple sets of third event data that match the input format of the security event classification model. This process can be performed in the following manner:

[0087] For each group of second event data, a feature extraction network corresponding to the modal type of the second event data is used to extract features from the second event data to obtain a set of security event feature sets; a feature conversion network is used to convert each security event feature in the security event feature set into a format that matches the input format of the security event classification model to obtain third event data corresponding to the second event data.

[0088] For example, for text data, word embedding models such as Word2Vec or BERT can be used to extract the semantic features of each word, forming a sequence of word vectors to form a security event feature set. For image data, convolutional neural networks can be used to extract image features such as edges, textures, colors, etc. These features will be organized into a feature vector to form a security event feature set. For network traffic data, statistical features of traffic can be extracted, such as the size, frequency, and direction of data packets. These features will also be organized into a vector to form a security event feature set. For user behavior data, time series features of behavior can be extracted, such as the time interval, number of repetitions, and patterns of behavior, which also form feature vectors.

[0089] As an optional implementation, the training process of the security event classification model can adopt the following steps:

[0090] S1, constructing an initial classification model based on Transformer, wherein the initial classification model includes: an encoding module, a decoding module and a classification module;

[0091] S2, obtaining multiple second event data sets corresponding to multiple historical security events, and taking each second event data set as a training sample, determining the security event type corresponding to the second event data set as a sample label, wherein each second event data set includes multiple groups of second event data of different modes;

[0092] S3, divide multiple training samples into training sets and validation sets, and determine hyperparameters for model training;

[0093] S4, based on the hyperparameters, the initial classification model is iteratively trained using the training set, and the performance of the trained model is verified using the validation set;

[0094] S5: If the performance verification fails, adjust the hyperparameters and continue to iteratively train the trained model using the training set. If the performance verification passes, use the trained model as the security event classification model.

[0095] As an optional implementation, in the initial classification model, the encoding module includes: a first input embedding layer, a first position encoding layer, a first normalization layer, a multi-head attention layer, a second normalization layer, a first feedforward neural network layer and a third normalization layer connected in sequence, a first residual connection layer connected to the output of the first position encoding layer and the input of the second normalization layer respectively, and a second residual connection layer connected to the output of the multi-head attention layer and the input of the third normalization layer respectively; the decoding module includes: a second input embedding layer, a second position encoding layer, a fourth normalization layer, a self-attention layer, a fifth normalization layer, a second feedforward neural network layer and a sixth normalization layer connected in sequence, a third residual connection layer connected to the output of the second position encoding layer and the input of the fifth normalization layer respectively, and a fourth residual connection layer connected to the output of the self-attention layer and the input of the sixth normalization layer respectively; the classification module includes: a fully connected layer or a multilayer perceptron.

[0096] As an optional implementation, after obtaining the trained security event classification model, the analysis module uses the model to analyze multiple groups of third event data to obtain the target event type of the target security event, and the following steps can be used:

[0097] Using the first input embedding layer to process the multiple sets of third event data respectively, and forming a first vector set from the obtained starting vectors of the multiple preset dimensions;

[0098] Performing position encoding processing on the first vector set using the first position encoding layer to obtain a second vector set; performing normalization processing on the second vector set using the first normalization layer to obtain a third vector set;

[0099] Processing the third vector set by using a multi-head attention layer to obtain a weight of each third vector in the third vector set, and combining the multiple weights into a first weight set;

[0100] Using a second normalization layer, normalizing the sum of the first weight set and the second vector set transmitted through the first residual connection layer to obtain a fourth vector set;

[0101] Using the first feedforward neural network layer to perform nonlinear transformation processing on the fourth vector set to obtain a fifth vector set;

[0102] Using a third normalization layer, normalizing the sum of the fifth vector set and the first weight set transmitted through the second residual connection layer to obtain a target input sequence;

[0103] Processing the target input sequence using the second input embedding layer to obtain a sixth vector set;

[0104] Performing position encoding processing on the sixth vector set using the second position encoding layer to obtain a seventh vector set;

[0105] Using the fourth normalization layer to normalize the seventh vector set, to obtain an eighth vector set;

[0106] Using the self-attention layer to perform mask processing on the eighth vector set, obtain the weight of each eighth vector in the eighth vector set, and form the multiple weights into a second weight set;

[0107] Using a fifth normalization layer, normalizing the sum of the second weight set and the seventh vector set transmitted through the third residual connection layer to obtain a ninth vector set;

[0108] Using the second feed-forward neural network layer to perform nonlinear transformation processing on the ninth vector set, to obtain a tenth vector set;

[0109] Using a sixth normalization layer, normalizing the sum of the tenth vector set and the second weight set transmitted through the fourth residual connection layer to obtain a target output sequence;

[0110] The target output sequence is analyzed using a fully connected layer or a multi-layer perceptron to obtain the target event type of the target security event.

[0111] In order to further improve the performance of the intelligent identification and classification system of security events based on the Transformer model, especially when dealing with the correlation between security events, a graph neural network can be introduced to analyze historical security event data. This will help the system to form a global event representation based not only on the characteristics of the current event, but also on the relationship and contextual information between events, thereby improving the accuracy of classification. The following is a detailed description of this expansion plan:

[0112] Acquire multiple third event data sets corresponding to multiple historical security events within a preset time period before the target security event occurs, wherein each third event data set includes multiple groups of third event data of different modalities; use a pre-trained graph neural network to analyze the multiple groups of first event data and the multiple third event data sets to obtain a global event representation corresponding to the target security event; use a security event classification model to comprehensively analyze the multiple groups of third event data and the global event representation to obtain a target event type for the target security event.

[0113] The processing module determines a security event handling strategy corresponding to the target event type, including: when the target event type is abnormal user login, determining that the security event handling strategy includes at least one of the following: authenticating the user and closing user access rights; when the target event type is system performance abnormality, determining that the security event handling strategy includes at least one of the following: detecting system fault nodes and adjusting system resource allocation; when the target event type is a network attack, determining that the security event handling strategy includes at least one of the following: blocking access to the source IP or source device and rolling back the database; when the target event type is a physical security event, determining that the security event handling strategy includes at least one of the following: blocking the scene and notifying security personnel.

[0114] It should be noted that each module in the security event management device in the embodiment of the present application corresponds one-to-one to each implementation step of the security event management method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be repeated here.

[0115] Example 3

[0116] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein the computer program implements the security event management method in Example 1 when executed by a processor.

[0117] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the security event management method in Example 1 by running the computer program.

[0118] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the security event management method in Example 1 is executed when the computer program is running.

[0119] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the security event management method in Example 1 through the computer program.

[0120] Specifically, the computer program executes the following steps when it is running: obtaining multiple groups of first event data of different modalities corresponding to the target security event; for each group of first event data, determining a preprocessing method corresponding to the modal type of the first event data to preprocess the first event data to obtain second event data; performing format conversion on each group of second event data respectively to obtain multiple groups of third event data that match the input format of the security event classification model; using the security event classification model to analyze the multiple groups of third event data to obtain the target event type of the target security event, wherein the security event classification model is provided with a multi-head attention mechanism; determining the security event processing strategy corresponding to the target event type, and executing the security event processing strategy.

[0121] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 3 The hardware structure block diagram of an electronic device for implementing a security event management method is shown. Figure 3 As shown, the electronic device 30 may include one or more (302a, 302b, ..., 302n are used to illustrate) processors 302 (the processor 302 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 304 for storing data, and a transmission device 306 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 3 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 3 More or fewer components as shown, or with Figure 3 Different configurations are shown.

[0122] It should be noted that the one or more processors 302 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the electronic device 30. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0123] The memory 304 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the security event management method in the embodiment of the present application. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 304, that is, realizing the vulnerability detection method of the above-mentioned application. The memory 304 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 304 may further include a memory remotely arranged relative to the processor 302, and these remote memories may be connected to the electronic device 30 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0124] The transmission device 306 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 30. In one example, the transmission device 306 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 306 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0125] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 30 .

[0126] The serial numbers of the above embodiments are only for description and do not represent the advantages or disadvantages of the embodiments.

[0127] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0128] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0129] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0130] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0131] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), mobile hard disk, disk or optical disk, etc., which can store program code.

[0132] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A security incident management method, characterized in that: include: Acquire multiple groups of first event data of different modes corresponding to the target security event; For each group of the first event data, determine a preprocessing method corresponding to the modality type of the first event data to preprocess the first event data to obtain second event data; Performing format conversion on each group of the second event data respectively to obtain multiple groups of third event data matching the input format of the security event classification model; Analyzing the plurality of groups of the third event data using the security event classification model to obtain a target event type of the target security event, wherein the security event classification model is provided with a multi-head attention mechanism; Determine a security event handling strategy corresponding to the target event type, and execute the security event handling strategy.

2. The method according to claim 1, characterized in that Determining a preprocessing method corresponding to the modality type of the first event data to preprocess the first event data to obtain second event data includes: In the case where the first event data is text description data, performing word segmentation processing on the first event data, and sequentially deleting stop words and special characters in the word segmentation results to obtain the second event data; In the case where the first event data is surveillance image data, an abnormal object in the first event data is identified by using a target detection algorithm, and the abnormal object is marked to obtain the second event data; In the case where the first event data is network traffic data, performing data cleaning and normalization processing on the first event data to obtain the second event data; In the case where the first event data is user behavior data, all user behavior records in the first event data are combined into a user behavior sequence according to time, and the user behavior sequence is used as the second event data; In the case where the first event data is unstructured log data, the first event data is parsed using a log parsing tool to obtain structured second event data.

3. The method according to claim 1, characterized in that Performing format conversion on each group of the second event data respectively to obtain multiple groups of third event data matching the input format of the security event classification model, including: For each set of the second event data, extract features from the second event data using a feature extraction network corresponding to the modal type of the second event data to obtain a set of security event feature sets; A feature conversion network is used to convert each security event feature in the security event feature set into a format that matches the input format of the security event classification model, so as to obtain the third event data corresponding to the second event data.

4. The method according to claim 1, characterized in that: The training process of the security event classification model includes: Constructing an initial classification model based on Transformer, wherein the initial classification model includes: an encoding module, a decoding module and a classification module; Acquire multiple second event data sets corresponding to multiple historical security events, and use each of the second event data sets as a training sample, and determine the security event type corresponding to the second event data set as a sample label, wherein each of the second event data sets includes multiple groups of second event data of different modalities; Dividing the plurality of training samples into a training set and a validation set, and determining hyperparameters for model training; Based on the hyperparameters, the initial classification model is iteratively trained using the training set, and the performance of the trained model is verified using the verification set; if the performance verification fails, the hyperparameters are adjusted, and the trained model is continued to be iteratively trained using the training set; if the performance verification passes, the trained model is used as the security event classification model.

5. The method according to claim 4, characterized in that In the initial classification model, The encoding module includes: a first input embedding layer, a first position encoding layer, a first normalization layer, a multi-head attention layer, a second normalization layer, a first feedforward neural network layer and a third normalization layer connected in sequence, a first residual connection layer connected to the output of the first position encoding layer and the input of the second normalization layer respectively, and a second residual connection layer connected to the output of the multi-head attention layer and the input of the third normalization layer respectively; The decoding module includes: a second input embedding layer, a second position encoding layer, a fourth normalization layer, a self-attention layer, a fifth normalization layer, a second feedforward neural network layer and a sixth normalization layer connected in sequence, a third residual connection layer connected to the output of the second position encoding layer and the input of the fifth normalization layer respectively, and a fourth residual connection layer connected to the output of the self-attention layer and the input of the sixth normalization layer respectively; The classification module includes: a fully connected layer or a multi-layer perceptron.

6. The method according to claim 5, characterized in that Analyzing the plurality of groups of the third event data using the security event classification model to obtain the target event type of the target security event includes: Using the first input embedding layer to process the plurality of sets of the third event data respectively, and forming a first vector set from the obtained starting vectors of the plurality of preset dimensions; Using the first position encoding layer to perform position encoding processing on the first vector set to obtain a second vector set; Using the first normalization layer to normalize the second vector set to obtain a third vector set; Processing the third vector set by using the multi-head attention layer to obtain weights of each third vector in the third vector set, and combining the multiple weights into a first weight set; Using the second normalization layer to normalize the sum of the first weight set and the second vector set transmitted through the first residual connection layer to obtain a fourth vector set; Using the first feedforward neural network layer to perform nonlinear transformation processing on the fourth vector set to obtain a fifth vector set; Using the third normalization layer to normalize the sum of the fifth vector set and the first weight set transmitted through the second residual connection layer to obtain a target input sequence; Processing the target input sequence using the second input embedding layer to obtain a sixth vector set; Using the second position coding layer to perform position coding processing on the sixth vector set to obtain a seventh vector set; Using the fourth normalization layer to normalize the seventh vector set to obtain an eighth vector set; Using the self-attention layer to perform mask processing on the eighth vector set, obtain the weight of each eighth vector in the eighth vector set, and form the plurality of weights into a second weight set; Using the fifth normalization layer to normalize the sum of the second weight set and the seventh vector set transmitted through the third residual connection layer to obtain a ninth vector set; Using the second feedforward neural network layer to perform nonlinear transformation processing on the ninth vector set to obtain a tenth vector set; Using the sixth normalization layer to normalize the sum of the tenth vector set and the second weight set transmitted through the fourth residual connection layer to obtain a target output sequence; The target output sequence is analyzed using the fully connected layer or the multi-layer perceptron to obtain a target event type of the target security event.

7. The method according to claim 1, characterized in that The method further comprises: Acquire multiple third event data sets corresponding to multiple historical security events within a preset time period before the target security event occurs, wherein each of the third event data sets includes multiple groups of third event data of different modes; Analyze multiple sets of the first event data and multiple sets of the third event data using a pre-trained graph neural network to obtain a global event representation corresponding to the target security event; The security event classification model is used to comprehensively analyze multiple groups of the third event data and the global event representation to obtain a target event type of the target security event.

8. The method according to claim 1, characterized in that: Determining a security incident handling strategy corresponding to the target incident type includes: In the case where the target event type is abnormal user login, determining the security event handling strategy includes at least one of the following: authenticating the user and closing the user access rights; In the case where the target event type is system performance abnormality, determining the security event handling strategy includes at least one of the following: detecting a system fault node, adjusting system resource allocation; In the case where the target event type is a network attack, determining that the security event handling strategy includes at least one of the following: blocking access to a source IP or source device, and rolling back a database; In the case where the target event type is a physical security event, determining the security event handling strategy includes at least one of the following: blocking the scene, notifying security personnel.

9. A security event management device, characterized in that: include: An acquisition module, used to acquire multiple groups of first event data of different modes corresponding to a target security event; a preprocessing module, configured to determine, for each group of the first event data, a preprocessing method corresponding to a modality type of the first event data to preprocess the first event data to obtain second event data; A conversion module, used to convert the format of each group of the second event data respectively, to obtain multiple groups of third event data matching the input format of the security event classification model; An analysis module, configured to analyze the plurality of groups of the third event data using the security event classification model to obtain a target event type of the target security event, wherein the security event classification model is provided with a multi-head attention mechanism; The processing module is used to determine a security event processing strategy corresponding to the target event type and execute the security event processing strategy.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the security event management method according to any one of claims 1 to 8 through the computer program.

Images