Security event identification method, apparatus and electronic device

Abstract

The present disclosure provides a security event identification method and device, and electronic equipment, and relates to the technical field of network security. The method comprises the following steps: in response to obtaining security event information, extracting a plurality of entity information related to the security event from the security event information, wherein the plurality of entity information comprises event entity information and network entity information; determining entity association information corresponding to the security event according to the plurality of entity information, wherein the entity association information represents the association relationship between the event entity information and another entity information, and the another entity information is the event entity information or the network entity information; extracting an alarm feature of the event entity information according to the entity association information; and identifying the alarm type of the security event through the alarm feature. According to the technical scheme, the alarm type of the security event is identified based on the multidimensional information of the security event and the relatively complex association relationship between the multidimensional information, and the accuracy of identification can be improved.

Description

TECHNICAL FIELD

[0001] The present disclosure belongs to the technical field of network security, and particularly relates to a security event identification method and device and electronic equipment. BACKGROUND

[0002] An Intrusion Detection System (IDS) is a security system that detects malicious activities and generates alarms by monitoring the traffic of a network system. However, the detection results of the traditional IDS include a large number of false positives and false negatives. Therefore, in order to improve the effectiveness of detection, the security events detected by the IDS are usually identified to identify the false positives and false negatives.

[0003] The commonly used security event identification methods all identify the security events according to relatively simple and one-sided information, which results in low identification accuracy. SUMMARY

[0004] The present disclosure provides a security event identification method, device and electronic equipment, which can solve the problem of low identification accuracy caused by identifying security events according to relatively simple and one-sided information.

[0005] The first aspect of the present disclosure provides a security event identification method, which comprises the following steps:

[0006] In response to obtaining security event information, extracting a plurality of entity information related to the security event from the security event information, wherein the plurality of entity information comprises event entity information and network entity information;

[0007] Determining entity association information corresponding to the security event according to the plurality of entity information, wherein the entity association information represents the association relationship between the event entity information and another entity information, and the another entity information is the event entity information or the network entity information;

[0008] Extracting an alarm feature of the event entity information according to the entity association information;

[0009] Identifying the alarm type of the security event through the alarm feature.

[0010] In the embodiments of the present disclosure, the step of determining the entity association information corresponding to the security event according to the plurality of entity information comprises:

[0011] Detecting whether there is generated entity association information;

[0012] If there is no generated entity association information, taking the plurality of entity information as nodes, and constructing edges between the nodes according to the association relationship of the plurality of entity information to obtain the entity association information.

[0013] If the generated entity association information exists, the generated entity association information is updated according to the relationship between the plurality of entity information and the generated entity association information, and the updated entity association information is the entity association information.

[0014] In the embodiment of the present disclosure, the updating the generated entity association information according to the relationship between the plurality of entity information and the generated entity association information comprises:

[0015] Determine the nodes corresponding to the plurality of entity information respectively to obtain a plurality of new nodes;

[0016] Determine the nodes matched with the nodes contained in the generated entity association information and the nodes not matched in the plurality of new nodes;

[0017] Determine the matched nodes in the generated entity association information as an extension node to be expanded;

[0018] Based on the association relationship between the unmatched nodes and the extension node to be expanded, add the unmatched nodes and the edges associated with the unmatched nodes and the extension node to be expanded in the generated entity association information to obtain the entity association information.

[0019] In the embodiment of the present disclosure, the extracting the event feature of the event entity information according to the entity association information comprises:

[0020] Take the node corresponding to the event entity information as a target center node, and determine a plurality of neighbor nodes of the target center node in the entity association information;

[0021] Calculate the weight corresponding to the target center node according to the plurality of neighbor nodes, and the weight represents the influence degree of the plurality of neighbor nodes on the target center node;

[0022] Determine the alarm feature according to the initial alarm feature of the event entity information and the weight.

[0023] In the embodiment of the present disclosure, the calculating the weight corresponding to the target center node according to the plurality of neighbor nodes comprises:

[0024] Obtain the initial alarm feature of the target center node and the initial alarm feature of the plurality of neighbor nodes;

[0025] Perform the i-th round of attention calculation on the initial alarm feature of the target center node and the initial alarm feature of the plurality of neighbor nodes to obtain the weight calculated in the i-th round; the i is an integer greater than or equal to 1;

[0026] determining whether the i th round of attention calculation is a preset last round of calculation;

[0027] if yes, determining the weight as a weight corresponding to the target central node;

[0028] if no, updating the initial alarm feature of the target central node and the initial alarm features of the plurality of neighbor nodes by using the weight, and performing i+1 th round of attention calculation on the updated initial alarm feature of the target central node and the initial alarm features of the plurality of neighbor nodes.

[0029] In the embodiments of the present disclosure, the alarm type of the security event is identified by the alarm feature, comprising:

[0030] respectively calculating a false alarm rate and a missed alarm rate of the alarm feature;

[0031] if the false alarm rate is greater than or equal to a preset false alarm threshold, determining that the alarm type of the security event is a false alarm;

[0032] if the missed alarm rate is greater than or equal to a preset missed alarm threshold, determining that the alarm type of the security event is a missed alarm.

[0033] In the embodiments of the present disclosure, further comprising: training a security event identification model, wherein the security event identification model is used to perform the security event identification.

[0034] The training of the security event identification model comprises:

[0035] calling a to-be-trained model to identify a training sample to obtain an identification result, wherein the training sample is false alarm security event information or missed alarm security event information;

[0036] calculating a loss value for the identification result, wherein the loss value comprises a false alarm loss and a missed alarm loss, the false alarm loss represents a loss between the identification result and a false alarm rate of the training sample, and the missed alarm loss represents a loss between the identification result and a missed alarm rate of the training sample;

[0037] judging whether the loss value converges;

[0038] if the loss value converges, taking the to-be-trained model as the security event identification model;

[0039] if the loss value does not converge, adjusting parameters of the to-be-trained model, taking the model with the adjusted parameters as a new to-be-trained model, and performing again the operation of calling the to-be-trained model to identify the alarm type of the training sample.

[0040] In the embodiments of the present disclosure, further comprising:

[0041] sending the alarm type of the security event to a security event detection system to trigger the security event detection system to update a security event output result according to the alarm type.

[0042] Embodiments of the second aspect of the present disclosure provide a security event identification apparatus, the apparatus comprising:

[0043] an information extraction module configured to extract, in response to obtaining security event information, a plurality of entity information related to the security event from the security event information, the plurality of entity information comprising event entity information and network entity information;

[0044] a determination module configured to determine, according to the plurality of entity information, entity association information corresponding to the security event, the entity association information representing an association relationship between the event entity information and another entity information, the another entity information being the event entity information or the network entity information;

[0045] a feature extraction module configured to extract, according to the entity association information, an alarm feature of the event entity information;

[0046] an identification module configured to identify, by the alarm feature, an alarm type of the security event.

[0047] Embodiments of the third aspect of the present disclosure provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method of the first aspect.

[0048] Embodiments of the fourth aspect of the present disclosure provide a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method of the first aspect.

[0049] The technical solutions provided by the embodiments of the present disclosure have at least the following technical effects or advantages:

[0050] According to the multi-dimensional information in the security event information, the security event is identified. Furthermore, the entity correlation information corresponding to the security event is determined according to the plurality of entity information. Since the entity correlation information represents the correlation between the event entity information and another entity information, and the another entity information is the event entity information or the network entity information, the alarm feature of the event entity information extracted according to the entity correlation information is an alarm feature extracted based on the multi-dimensional information of the security event and the relatively complex correlation between the multi-dimensional information. Based on this, the expression of the security event characteristics based on the alarm feature is more accurate, and the alarm type accuracy of the security event identified by the alarm feature is also higher.

[0051] Additional aspects and advantages of the present disclosure will be made apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0052] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not intended to limit the scope of the present disclosure. Moreover, like reference numerals designate like parts throughout the several views in the drawings. In the drawings:

[0053] Figure 1 A method flowchart of a security event identification method provided by an embodiment of the present disclosure is shown;

[0054] Figure 2A An exemplary relationship of entity correlation information provided by an embodiment of the present disclosure is shown Figure 1 ;

[0055] Figure 2B An exemplary relationship diagram two of entity correlation information provided by an embodiment of the present disclosure is shown

[0056] Figure 3 A composition schematic diagram of a security event identification apparatus provided by an embodiment of the present disclosure is shown;

[0057] Figure 4 A structure schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown;

[0058] Figure 5 A schematic diagram of a storage medium provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0059] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0060] It should be noted that, unless otherwise specified, technical terms or scientific terms used in the present disclosure should be understood as their common meanings to those skilled in the art to which the present disclosure pertains.

[0061] The implementation scenarios and related technologies involved in the embodiments of the present disclosure are introduced below.

[0062] The technical solutions of the present disclosure relate to a security event identification service in network security technology. In network security technology, an IDS system is usually used to monitor the activities of a network system, find and report security events. Since the detection results of the IDS system include a large number of false positives (FP) and false negatives (FN), the detection performance of network security is not high. Therefore, false positives and false negatives in the detection results of the IDS system should be identified. False positives refer to the incorrect determination of normal network behavior as attack behavior, and false negatives refer to the failure to detect or report attack behavior.

[0063] Currently, some commonly used security event identification methods rely on setting rules based on the characteristics of false positive security events, and identify false positives and false negatives based on the rules. However, this method is difficult to balance the identification performance of false positives and the identification performance of false negatives. If the set rules are relatively strict, false positives can be reduced, but false negatives will increase. If the set rules are relatively lenient, false negatives can be reduced, but false positives will increase. Another commonly used security event identification method establishes the association relationship of a certain number of security events by taking the entity information (such as Internet Protocol (IP) address) of one dimension in these security events as a reference, and determines any security event as a false negative security event if the security event is associated with multiple alarm events, or as a false positive security event if the security event is not associated with other alarm events. Since this security event identification method only establishes the association of security events from a single dimension, the association relationship between the events constructed lacks the representation of other dimension association characteristics, thereby missing some false positive and / or false negative security events, resulting in low identification accuracy.

[0064] Therefore, the embodiment of the present disclosure proposes a technical solution. According to the multi-dimensional information in the security event information and the association relationship between the multi-dimensional information, the alarm feature of the event entity information is extracted, so that the expression of the alarm feature to the characteristics of the security event is more accurate, thereby making the alarm type accuracy of the security event identified by the alarm feature higher.

[0065] The security event identification method, device and electronic equipment according to the embodiment of the present disclosure are described below. The technical solutions of the present disclosure are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described in detail in some embodiments. The embodiments of the present disclosure will be described below with reference to the accompanying drawings.

[0066] Referring to Figure 1 , Figure 1 The security event identification method provided by an embodiment of the present disclosure is shown, and the method comprises:

[0067] In step S11, in response to obtaining the security event information, a plurality of entity information related to the security event is extracted from the security event information.

[0068] The plurality of entity information comprises event entity information and network entity information.

[0069] In some embodiments, the security event information can be obtained from the IDS, each security event information can be implemented as a security event log, and each security event log corresponds to a security event. As an example, a plurality of security event information can be received within a unit time (for example, 1 millisecond).

[0070] In some embodiments, one security event information can include part or all of the following information: timestamp, source IP address, source port, destination IP address, destination port, event identification, event type, identification of the security device performing event detection, event severity, confidence, event description, attack feature description, and corresponding information of IP address and port number.

[0071] The timestamp represents the time when the event occurs. The source IP address is the IP address of the device that initiates the security event, and the source port is the port of the device that initiates the security event. The destination IP address is the IP address of the device that the security event is directed to, and the destination port is the port of the device that the security event is directed to. The event identifier can be used to uniquely identify a security event. For example, the event identifier can be the event name of a security event. The event type can include scanning, attack, intrusion, etc. The identifier of the security device that performs the event detection can be used to uniquely identify a security device. The event severity can be used to indicate the threat degree of the security event to the network security, which is predicted, and therefore, the confidence degree needs to be used to indicate the credibility of the event severity. The event description can be used to describe a security event, and the event description can include the relationship between the source IP address, the event identifier, and the destination IP address. For example, the event description can be that the device corresponding to the IP address A attacks the device corresponding to the IP address B in the manner of a, where a is the event identifier of the security event. The attack feature description can be used to describe the identifier, type, etc. of the attack or vulnerability. For example, the vulnerability identifier can be used to indicate the existing vulnerability in the system or software installed in the device corresponding to the source IP address or the destination IP address. The attack type includes virus, Trojan, threat, and penetration, etc.

[0072] It should be understood that the above is only a schematic description of the entity information, and the security event related entity information of the embodiments of the present disclosure is not limited. In some other embodiments, the entity information can also include more or less information. As an example, if the security event information is a non-attack type event, such as a regular detection event of a firewall, the attack feature description can not be included in the entity information of the security event.

[0073] As an example, the event entity information can include part or all of the timestamp, event identifier, event type, event description, and attack feature description. The network entity information can include the source IP address, source port, destination IP address, and destination port.

[0074] In step S12, the entity association information corresponding to the security event is determined according to the plurality of entity information.

[0075] The entity association information represents the association relationship between the event entity information and another entity information, and the another entity information is the event entity information or the network entity information.

[0076] In some embodiments, the other entity information can include: other event entity information adjacent to the event entity information in time sequence, the network entity information. The association relationship can include a time sequence relationship between the event entity information and the other event entity information, an association relationship between the event entity information and the network entity information, and optionally, if the security event is an attack type event, the association relationship can also include an association relationship between the event entity information and the attack feature description. The association relationship between the event entity information and the network entity information is used to represent the network entity information involved in the event entity information, for example, the source IP address and the destination IP address involved in the event entity information. The source IP address can refer to the IP address of the initiating end of the event, and the destination IP address can refer to the IP address of the destination end of the event. The association relationship between the event entity information and the attack feature description is used to represent the attack feature of the attack related to the event entity information, for example, the attack type of the attack related to the event entity information.

[0077] In some embodiments, the entity association information can be implemented as a directed graph. In the process of constructing the directed graph, multiple entity information can be taken as nodes respectively, and edges between nodes can be constructed according to the association relationship of the multiple entity information. Among them, the direction of the edge constructed according to different association relationships can be different, and after constructing an edge according to a certain association relationship, the attribute of the edge represents the association relationship.

[0078] As an example, taking the above event entity information including event identifier and attack feature description, and the above network entity information including source IP address and destination IP address as an example, the event identifier can be taken as an event node (V E ), the source IP address and the destination IP address can be taken as IP nodes (V IP ) respectively, and the attack feature description can be taken as an attack feature node (V Sig ). In the technical solution of the disclosure, the edges between nodes of different types can represent different association relationships, for example, the types of edges can include time sequence edges (E time ), shared IP edges (E IP ) and shared attack feature edges (E Sig ) and the like. The time sequence edge (E time ) is the edge between events, representing the time sequence between events. The shared IP edge (E IP ) is the edge between events and IP addresses, representing the IP addresses involved in the event. The shared attack feature edge (E Sig ) is the edge between events and attack feature descriptions, representing the attack features involved in the event. The entity association information G corresponding to the security event information can be represented as: G=(VE∪VIP∪VSig,Etime∪Eip∪Esig).

[0079] The types of nodes and the entity information corresponding to the types of nodes can refer to the examples shown in Table 1:

[0080] Table 1

[0081]

[0082] The types of edges and the association relationships represented by the edges can refer to the examples shown in Table 2:

[0083] Table 2

[0084]

[0085] For example, the implementation of each node and the edge between each node is as shown in Figure 2A . Referring to Figure 2A , Figure 2A , the event node V E -a corresponds to the time when the security event occurs earlier than the event node V E -b corresponds to the time when the security event occurs, but later than the event node V E -c corresponds to the time when the security event occurs, and therefore, the edge E E -c between the event node V E -a and the event node V time -1 is directed from the event node V E -c to the event node V E -a; the edge E E -a between the event node V E -b and the event node V time -2 is directed from the event node V E -a to the event node V E -b. The IP node V IP -A corresponds to the IP address, which is the source IP address in the security event corresponding to the event node V E -a and the security event corresponding to the event node V E -b, and is the destination IP address in the security event corresponding to the event node V E -c, and therefore, the edge E IP -A between the IP node V E -A and the event node V IP -1 is directed from the IP node V IP -A to the event node V E -a; the edge E IP -A between the IP node V E -A and the event node V IP -2 is directed from the IP node V IP -A to the event node V E -b; and the IP node V IP-A and event node V E The edge E between -c IP -3, from event node V E -c points to the IP node V IP -A. Event Node V E -a corresponds to the security event and event node V E The security events corresponding to -c have the same attack characteristics; they are all attack characteristic nodes V. Sig The attack characteristics corresponding to -x, therefore, event node V E -a and attack signature node V Sig The edge E between -x Sig -1, from event node V E -a points to the attack signature node V Sig -x; Event node V E -b and attack signature node V Sig The edge E between -x Sig -2, from event node V E -b points to the attack signature node V Sig -x.

[0086] It should be understood that Tables 1 and 2, as well as Figure 2A These are all illustrative descriptions and do not constitute a limitation on the nodes and edges included in the entity association information of this disclosure. In some other embodiments, the entity association information may include more or fewer nodes and edges. For example, in one optional example, the entity association information also includes port nodes, while in another optional example, the entity association information does not include attack feature nodes. This disclosure does not limit this.

[0087] As can be seen, by adopting this implementation method, a heterogeneous relationship graph is constructed based on the correlation between the multi-dimensional entity information of security events, thereby extracting the impact of entity information of different dimensions on security events, thus providing a comprehensive and accurate data foundation for obtaining the characteristics of security events.

[0088] It should be noted that conventional security event identification algorithms use offline batch processing to calculate the collected batch events for each round of collection. This not only incurs significant memory and computational overhead, but the calculation process also takes a considerable amount of time. During this period, some attacks may have already caused harm to the network. In view of this, the embodiments of this disclosure can determine the entity association relationships of newly added security event information by partially updating the entity association information generated before step S11.

[0089] In some embodiments, the generated entity correlation information can be generated according to entity information of pre-acquired security event information, where the pre-acquired security event information refers to security event information acquired before step S11. Based on this, after extracting a plurality of entity information related to a security event from the security event information, it can be detected whether there is generated entity correlation information. If there is no generated entity correlation information, it indicates that the security event information acquired in step S11 belongs to the first batch of security event information, and the entity correlation information has not been constructed at present. The plurality of entity information are respectively taken as nodes, and edges between nodes are constructed according to the correlation relationship of the plurality of entity information to obtain the entity correlation information. The implementation of constructing the entity correlation information can refer to the description above, and will not be described here. If there is the generated entity correlation information, the generated entity correlation information is updated according to the relationship between the plurality of entity information and the generated entity correlation information, and the updated entity correlation information is the entity correlation information.

[0090] As an example, in the scenario of acquiring the first batch of security event information, the entity correlation information between the entity information sets can be constructed for the entity information set of the security event information satisfying the preset condition when the security event information satisfying the preset condition is acquired. In an optional example, the preset condition can be a preset quantity threshold, which can be flexibly set according to the application scenario, for example, 2 million security event information. In another optional example, the preset condition can be a preset time length, which can be, for example, 1 second.

[0091] As an example, updating the generated entity correlation information according to the relationship between the plurality of entity information and the generated entity correlation information can include: determining nodes corresponding to the plurality of entity information respectively to obtain a plurality of new nodes; determining nodes in the plurality of new nodes that match nodes contained in the generated entity correlation information and nodes that do not match; determining the matching nodes in the generated entity correlation information as to-be-extended nodes; based on the correlation relationship between the non-matching nodes and the to-be-extended nodes, adding the non-matching nodes and edges associated with the non-matching nodes and the to-be-extended nodes in the generated entity correlation information to obtain the entity correlation information.

[0092] The node in the plurality of new nodes that matches the node contained in the generated entity association information can refer to that the entity information corresponding to the node of the generated entity association information is the same as the entity information corresponding to a new node, and it is determined that the new node matches the node corresponding to the same entity information in the generated entity association information. In the case where the node of the generated entity association information does not contain the entity information corresponding to the new node, it is determined that the new node has no matching node in the generated entity association information, and then the new node is a non-matching node.

[0093] In some embodiments, if the node matching the plurality of new nodes is one, the node in the generated entity association information is determined as the node to be expanded.

[0094] In some embodiments, if the node matching the plurality of new nodes is at least two, one node can be selected from the at least two nodes to be determined as the node to be expanded.

[0095] As an example, the non-matching node and the edge associated with the node to be expanded in the generated entity association information can be implemented as follows: adding the non-matching node in the generated entity association information, and then constructing the edge between the non-matching node and the node to be expanded and the neighbor node of the node to be expanded according to the association relationship between the non-matching node and the node to be expanded and the neighbor node of the node to be expanded, respectively.

[0096] For example, the obtained security event information includes the following entity information: event identifier E010, attack feature description "penetration", source IP address "192.168.0.10", and destination IP address "10.0.0.100". The generated entity association information is implemented as Figure 2A The directed graph shown in the figure contains the node matching the entity information of the security event information, for example, the IP node V Figure 2A The node matching the entity information of the security event information is determined from the node contained in the schematic directed graph, for example, the IP node V IP The corresponding IP address of A is "10.0.0.100", which is the same as the destination IP address in this example. In this example, the node V IP A is the node matching the plurality of entity information in this example, and the other entity information in this example is not found to match the node. Correspondingly, the event identifier E010, the attack feature description "penetration", and the source IP address "192.168.0.10" in the above example can be determined as non-matching nodes. Further, in the schematic directed graph Figure 2A The above non-matching nodes are added to the schematic directed graph, and each added node is as shown in Figure 2B The event node V E o, the IP node V IP L, and the attack feature node V Sig-y, and the event node V IP -A, respectively, and the event node V E -o, the IP node V IP -L and the attack feature node V Sig -y, and the event node V E -o and Figure 2A The edges between the nodes are constructed according to the time sequence relationship of the other event nodes shown in FIG. 10. For example, the time sequence of the security event information of the present example corresponds to the edge E E -10, which is adjacent to the event node V E -b and later than the event node V Figure 2B b corresponds to the security event, with reference to the edge E IP -10 in FIG. 10. IP -11 in FIG. 10. time -100 in FIG. 10, and the edge E Sig -20 in FIG. 10. IP -10 is directed from the IP node V IP -L to the event node V E -o, the edge E IP -11 is directed from the event node V E -o to the IP node V IP -A, the edge E Sig -20 is directed from the event node V E -o to the attack feature node V Sig -y, the edge E time -100 is directed from the event node V E -b to the event node V E -o.

[0097] In some embodiments, Figure 2B The directed graph shown in FIG. 10 can be used as new generated entity association information, so that the subsequently acquired security event information can obtain the entity association information in a partial update manner.

[0098] As can be seen, according to the present implementation, the batch security events are no longer processed offline in batches, but are processed in real time based on the already obtained entity association information in a partial update manner. This not only has a small amount of calculation and does not need to occupy too much memory overhead, but also can maintain efficient security event identification in the scenario where the number of security events increases explosively and continuously, and support rapid identification of attack events at each stage to avoid the harm of attack events to the network.

[0099] In step S13, an alarm feature of the event entity information is extracted according to the entity association information.

[0100] The alarm feature can be used to represent the degree of association of each entity information related to the event entity information, and the alarm feature can include the influence degree of each entity information related to the event entity information on the event entity information.

[0101] In combination Figure 2A and Figure 2B As shown in the figure, in the embodiments of the present disclosure, the node corresponding to the event entity information can be taken as a target center node, a plurality of neighbor nodes of the target center node can be determined in the entity association information, a weight corresponding to the target center node can be calculated according to the plurality of neighbor nodes, and the alarm feature can be determined according to the initial alarm feature of the event entity information and the weight. The weight represents the influence degree of the plurality of neighbor nodes on the target center node. For example, the greater the weight, the greater the influence degree of the plurality of neighbor nodes on the target center node, and the smaller the weight, the smaller the influence degree of the plurality of neighbor nodes on the target center node.

[0102] In some embodiments, the entity association information processed in step S12 can be input into the security event identification model trained to call the security event identification model to extract the alarm feature of the event entity information, and to identify the alarm type of the security event through the alarm feature. As an example, the security event identification model can be implemented as a graph neural network (GNN) model. In the embodiments of the present disclosure, the GNN model can use an attention mechanism convolutional layer to extract the alarm feature of the event entity information. In this way, based on the self-attention mechanism, more significant features associated with the target center node can be extracted for different types of nodes and edges.

[0103] It should be noted that during the execution of the security event identification method in the embodiments of the present disclosure, the IDS system generates new security event information in real time. According to the description of step S12, the entity association information is also constantly updated, so that the number and type of neighbor nodes associated with the target center node are also constantly updated. Based on this, in the embodiments of the present disclosure, at least one attention mechanism convolutional layer can be deployed in the GNN model to perform corresponding rounds of attention calculation on the entity association information to sufficiently extract and fuse the influence features of the constantly updated neighbor nodes on the target center node.

[0104] For example, the attention mechanism convolutional layer deployed in the GNN model can be 5 layers.

[0105] For scenarios requiring at least one round of attention calculation, calculating the weight corresponding to the target center node based on multiple neighbor nodes can be implemented as follows: Obtain the initial alarm features of the target center node and the initial alarm features of multiple neighbor nodes. Perform the i-th round of attention calculation on the initial alarm features of the target center node and the initial alarm features of multiple neighbor nodes to obtain the weight calculated in the i-th round. Then, determine whether the i-th round of attention calculation is the preset last round. If so, determine the weight corresponding to the target center node; otherwise, update the initial alarm features of the target center node and the initial alarm features of multiple neighbor nodes using the weight, and perform the (i+1)-th round of attention calculation on the updated initial alarm features of the target center node and the initial alarm features of multiple neighbor nodes until the last round of attention calculation is completed. Here, i is an integer greater than or equal to 1.

[0106] For example, when i is 1, the initial alarm features of the target center node and the initial alarm features of multiple neighboring nodes can both be feature vectors of the corresponding nodes. Event node V E The feature vector can be composed of the attributes of the event node, such as the event timestamp h. time The source port encoding of the event, h port-1 and target port encoding h port-2 Event-triggered attack signature encoding h Sig The initial alarm characteristics for each event node are: The initial alarm features for other types of nodes can be set as unit vectors, such as feature vectors where all feature values ​​are 1: .

[0107] Regarding the first For each attention convolutional layer, the weights corresponding to the target center node i and its neighboring nodes j can be calculated using the following algorithm. : ,in, Refers to the target center node The set of neighboring nodes, , Refers to the target center node In the In the layer, the alarm feature, || refers to the vector concatenation operation. These are all learnable model parameters. Furthermore, based on the weights... Calculate the target center node i Alarm features updated by an attention convolutional layer: Where W0 and W1 are learnable transformation matrices, and σ is a nonlinear activation function.

[0108] By using the graph attention network, features with a greater influence on the event node can be extracted and fused from entity information in different dimensions, richer context features can be extracted by fusing multi-source information, and compared with traditional single-dimensional identification, the identification accuracy of false positives and false negatives is higher.

[0109] In step S14, the alarm type of the security event is identified by the alarm feature.

[0110] The alarm type of the security event can be a false positive, a false negative, or a normal alarm.

[0111] In some embodiments, the false positive rate and the false negative rate of the alarm feature can be calculated respectively. If the false positive rate is greater than or equal to a preset false positive threshold, the alarm type of the security event is determined to be a false positive. If the false negative rate is greater than or equal to a preset false negative threshold, the alarm type of the security event is determined to be a false negative. If the false positive rate is less than the preset false positive threshold and the false negative rate is less than the preset false negative threshold, the alarm type of the security event is determined to be a normal alarm.

[0112] As an example, the last layer in at least one attention mechanism convolutional layer of the GNN model can be connected to a false positive classifier and a false negative classifier. The false positive classifier is used for false positive identification, and the false negative classifier is used for false negative identification. The at least one attention mechanism convolutional layer calculates the alarm feature After that, the alarm feature is input into the two classifiers respectively, and then the two classifiers can be called to calculate the false positive rate and the false negative rate of the security event in parallel.

[0113] For example, the false positive classifier can calculate the false positive rate of the alarm feature by using the following algorithm: The false negative classifier can calculate the false negative rate of the alarm feature by using the following algorithm: . Wherein, and are the weights of the GNN model, , and are the biases of the GNN model.

[0114] For a certain security event i, if the of the security event is greater than a preset false positive threshold, the security event can be marked as a false positive and deleted from the output alarm list, which can reduce the number of false positive alarms and alleviate the alarm overload. If the greater than a preset false negative threshold, it can be determined that the security event is a false negative, i.e., the security event is an attack feature that is not identified by the IDS, and then the security event can be recorded as an alarm, for example, it can be marked as a "suspected false negative attack". If the security event is less than a preset false positive threshold, less than a preset false negative threshold, it is determined that the alarm is normal, and the original judgment result of the IDS can be output.

[0115] It can be seen that, in the implementation mode, the false negative and false positive identification is performed in parallel by using two branches, the knowledge fusion between the two tasks can be realized by sharing the underlying parameters, so that the two types of false alarms can be detected synchronously and efficiently, thereby solving the problem that the existing mode is difficult to consider the identification of false positives and false negatives.

[0116] In some embodiments, the security event identification model can be obtained by pre-training. The manner of training the security event identification model can be implemented as follows: calling a to-be-trained model to identify a training sample to obtain an identification result, the training sample being false positive security event information or false negative security event information. A loss value is calculated for the identification result, and it is determined whether the loss value converges. If the loss value converges, the to-be-trained model is taken as the security event identification model. If the loss value does not converge, the parameters of the to-be-trained model are adjusted, and the model after the adjustment is taken as a new to-be-trained model, and the operation of calling the to-be-trained model to identify the type of the alarm of the training sample is performed again.

[0117] The loss value may include a false positive loss and a false negative loss , for example, it can satisfy: , is a balance parameter. The false positive loss characterizes the loss between the identification result and the false positive rate of the training sample, for example, it can satisfy: . The false negative loss characterizes the loss between the identification result and the false negative rate of the training sample, for example, it can satisfy: , k is an event node in the sample data, and N is the total number of neighbor nodes of the event node K in the sample data.

[0118] By using the implementation mode, the weights of the false positive loss and the false negative loss can be adaptively adjusted, so that the model obtained by training supports automatic balancing of false positive and false negative identification, and maintains high identification accuracy for false positives and false negatives.

[0119] Further, after identifying the alarm type of the security event, the alarm type of the security event can also be sent to the security event detection system to trigger the IDS to update the security event output result according to the alarm type, so as to further improve the security protection capability of the IDS. For example, for the alarm marked as a false alarm, the IDS can reduce the sensitivity of the corresponding detection rule, or temporarily shield in a similar environment, to reduce repeated false alarms. For example, for the missed alarm event, the IDS can extract the features of the missed alarm time, and generate new detection rules or threat indicators based on the extracted features and add them to the IDS rule library to avoid similar missed alarms from occurring again. Thus, the detection strategy of the IDS is optimized, and the adaptive security protection capability is improved.

[0120] In summary, for the obtained security event information, the embodiments of the present disclosure extract a plurality of entity information including event entity information and network entity information from the security event information. It can be seen that the embodiments of the present disclosure identify the security event according to the multi-dimensional information in the security event information. Further, the entity association information corresponding to the security event is determined according to the plurality of entity information. Since the entity association information represents the association relationship between the event entity information and another entity information, and the another entity information is the event entity information or the network entity information, the alarm feature of the event entity information extracted according to the entity association information is an alarm feature extracted based on the multi-dimensional information of the security event and the relatively complex association relationship between the multi-dimensional information. Based on this, the expression of the security event characteristics based on the alarm feature is more accurate, and the accuracy of the alarm type of the security event identified by the alarm feature is also higher.

[0121] Corresponding to the security event identification method illustrated in the above embodiments, the embodiments of the present disclosure also provide a security event identification device. As shown in Figure 3 , a security event identification device is provided for performing all or part of the operations illustrated in Figures 1 to 2B , as shown in Figure 3 , the security event identification device includes:

[0122] The information extraction module 301 is configured to, in response to obtaining the security event information, extract a plurality of entity information related to the security event from the security event information, the plurality of entity information including event entity information and network entity information.

[0123] The determination module 302 is configured to determine entity association information corresponding to the security event according to the plurality of entity information, the entity association information representing an association relationship between the event entity information and another entity information, the another entity information being the event entity information or the network entity information.

[0124] The feature extraction module 303 is configured to extract an alarm feature of the event entity information according to the entity association information.

[0125] identify the alarm type of the security event through the alarm feature.

[0126] Optionally, the determining module 302 is further configured to detect whether there is generated entity correlation information; if there is no generated entity correlation information, take the plurality of entity information as nodes respectively, and construct edges between nodes according to the correlation relationship of the plurality of entity information to obtain the entity correlation information; if there is the generated entity correlation information, update the generated entity correlation information according to the relationship between the plurality of entity information and the generated entity correlation information, and the updated entity correlation information is the entity correlation information.

[0127] Optionally, the determining module 302 is further configured to determine the nodes corresponding to the plurality of entity information respectively to obtain a plurality of new nodes; determine the nodes matched with the nodes contained in the generated entity correlation information and the nodes not matched in the plurality of new nodes; determine the matched nodes in the generated entity correlation information as to-be-extended nodes; based on the correlation relationship between the not-matched nodes and the to-be-extended nodes, add the not-matched nodes and the edges associated with the not-matched nodes and the to-be-extended nodes in the generated entity correlation information to obtain the entity correlation information.

[0128] Optionally, the feature extraction module 303 is further configured to take the node corresponding to the event entity information as a target center node, and determine a plurality of neighbor nodes of the target center node in the entity correlation information; calculate the weight corresponding to the target center node according to the plurality of neighbor nodes, and the weight represents the influence degree of the plurality of neighbor nodes on the target center node; determine the alarm feature according to the initial alarm feature of the event entity information and the weight.

[0129] Optionally, the feature extraction module 303 is further configured to obtain the initial alarm feature of the target center node and the initial alarm feature of the plurality of neighbor nodes; perform i-th round attention calculation on the initial alarm feature of the target center node and the initial alarm feature of the plurality of neighbor nodes to obtain the weight of the i-th round calculation; i is an integer greater than or equal to 1; determine whether the i-th round attention calculation is the last round of calculation of the preset; if yes, determine the weight as the weight corresponding to the target center node; if not, update the initial alarm feature of the target center node and the initial alarm feature of the plurality of neighbor nodes by using the weight, and perform (i+1)-th round attention calculation on the updated initial alarm feature of the target center node and the initial alarm feature of the plurality of neighbor nodes.

[0130] Optionally, the identification module 304 is further configured to calculate the false alarm rate and the missed alarm rate of the alarm feature respectively; if the false alarm rate is greater than or equal to a preset false alarm threshold, the alarm type of the security event is determined to be a false alarm; if the missed alarm rate is greater than or equal to a preset missed alarm threshold, the alarm type of the security event is determined to be a missed alarm.

[0131] Optionally, the security event identification device further includes a training module, which is used to train a security event identification model, and the security event identification model is used to perform the security event identification. Specifically, the training module is used to call the model to be trained to identify training samples and obtain identification results, wherein the training samples are false alarm security event information or missed alarm security event information; calculate a loss value for the identification results, the loss value including false alarm loss and missed alarm loss, wherein the false alarm loss represents the loss between the identification results and the false alarm rate of the training samples, and the missed alarm loss represents the loss between the identification results and the missed alarm rate of the training samples; determine whether the loss value converges; if the loss value converges, use the model to be trained as the security event identification model; if the loss value does not converge, adjust the parameters of the model to be trained, and use the model with adjusted parameters as a new model to be trained, and execute the operation of calling the model to be trained to identify the alarm type of the training samples again.

[0132] Optionally, the security event identification device further includes a sending module, which is used to send the alarm type of the security event to the security event detection system to trigger the security event detection system to update the security event output result according to the alarm type.

[0133] The security event identification device and the security event identification method provided in the above embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run, or implemented by the applications stored therein. Used to perform the above... Figures 1 to 2B All or part of the operations shown in the diagram

[0134] This disclosure also provides an electronic device for performing the above-described embodiments. Figures 1 to 2B The diagram illustrates all or part of the operations. Please refer to it. Figure 4 This illustrates a schematic diagram of an electronic device provided by some embodiments of the present disclosure. For example... Figure 4 As shown, the electronic device 6 includes: a processor 600, a memory 601, a bus 602, and a communication interface 603. The processor 600, the communication interface 603, and the memory 601 are connected via the bus 602. The memory 601 stores a computer program that can run on the processor 600. The processor 600 can execute the security event identification method provided in any of the foregoing embodiments of this disclosure when running the computer program.

[0135] The memory 601 can include a high-speed random access memory (RAM), and can also include a non-volatile memory, such as at least one disk memory. The communication connection between the system virtual devices is realized through at least one communication interface 603 (which can be wired or wireless), and the Internet, a wide area network, a local network, a metropolitan area network, etc. can be used.

[0136] The bus 602 can be an ISA bus, a PCI bus, an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 601 is used to store programs, and the processor 600 executes the programs after receiving execution instructions. The security event identification method disclosed in any of the embodiments of the present disclosure can be applied to the processor 600 or implemented by the processor 600.

[0137] The processor 600 can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by integrated logic circuits or instructions in the form of software in the processor 600. The processor 600 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a ready-to-program gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. Each method, step and logic block disclosed in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present disclosure can be directly embodied as a hardware coding processor for execution, or a combination of hardware and software modules in the coding processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory 601, and the processor 600 reads the content in the memory 601, and combines the hardware to complete the steps of the above method.

[0138] The electronic device provided by the embodiments of the present disclosure and the security event identification method provided by the embodiments of the present disclosure have the same beneficial effects as the method they adopt, run or implement.

[0139] The embodiment of the present disclosure further provides a computer readable storage medium corresponding to the security event identification method provided by the foregoing embodiment, please refer to Figure 5 The computer readable storage medium shown in the figure is an optical disc 30, and a computer program (i.e. program product) is stored on the optical disc 30. When the computer program is run by a processor, the security event identification method provided by any of the foregoing embodiments is executed.

[0140] It should be noted that examples of the computer readable storage medium can further include, but are not limited to, a phase change memory (PRAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), other types of random access memory (RAM), a read only memory (ROM), an electrically erasable programmable read only memory (EEPROM), a flash memory, or other optical or magnetic storage media, which are not described one by one here.

[0141] The computer readable storage medium provided by the foregoing embodiments of the present disclosure has the same beneficial effects as the method adopted, run or implemented by the application program stored therein, based on the same inventive concept as the security event identification method provided by the embodiments of the present disclosure.

[0142] Although the optional embodiments of the present disclosure have been described, those skilled in the art can make further changes and modifications to the embodiments once they know the basic inventive concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present disclosure.

[0143] The above detailed description of the specific implementation further explains the purpose, technical solutions and beneficial effects of the present disclosure. It should be understood that the above detailed description is only the specific implementation of the present disclosure and is not intended to limit the protection scope of the present disclosure. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A security event identification method characterized by, The method comprises: in response to obtaining the security event information, extracting a plurality of entity information related to the security event from the security event information, the plurality of entity information comprising event entity information and network entity information; determining entity association information corresponding to the security event according to the plurality of entity information, the entity association information representing an association relationship between the event entity information and another entity information, the another entity information being event entity information or network entity information; extracting an alarm feature of the event entity information according to the entity association information, the alarm feature comprising an influence degree of each entity information related to the event entity information on the event entity information, the alarm feature being used to represent an association degree between the event entity information and each entity information related to the event entity information; identifying an alarm type of the security event through the alarm feature.

2. The method of claim 1, wherein, The method comprises: detecting whether there is generated entity association information; if there is no generated entity association information, taking the plurality of entity information as nodes respectively, and constructing edges between the nodes according to the association relationship of the plurality of entity information to obtain the entity association information; if there is the generated entity association information, updating the generated entity association information according to the relationship between the plurality of entity information and the generated entity association information, the updated entity association information being the entity association information.

3. The method of claim 2, wherein, The method comprises: determining nodes corresponding to the plurality of entity information respectively to obtain a plurality of new nodes; determining nodes matched with nodes contained in the generated entity association information and nodes not matched with the nodes contained in the generated entity association information in the plurality of new nodes; determining the matched nodes in the generated entity association information as to-be-extended nodes; based on the association relationship between the nodes not matched and the to-be-extended nodes, adding the nodes not matched and edges associated with the to-be-extended nodes in the generated entity association information to obtain the entity association information.

4. The method according to any one of claims 1 to 3, characterized in that, The method comprises: taking a node corresponding to the event entity information as a target center node, and determining a plurality of neighbor nodes of the target center node in the entity association information; calculating a weight corresponding to the target center node according to the plurality of neighbor nodes, the weight representing an influence degree of the plurality of neighbor nodes on the target center node; determining the alarm feature according to an initial alarm feature of the event entity information and the weight.

5. The method of claim 4, wherein, The method comprises: obtaining an initial alarm feature of the target center node and initial alarm features of the plurality of neighbor nodes; performing i-th round attention calculation on the initial alarm feature of the target central node and the initial alarm features of the plurality of neighbor nodes to obtain a weight of the i-th round calculation; the i is an integer greater than or equal to 1; determining whether the i-th round attention calculation is a preset last round calculation; if yes, determining the weight as a weight corresponding to the target central node; if no, updating the initial alarm feature of the target central node and the initial alarm features of the plurality of neighbor nodes by using the weight, and performing (i+1)-th round attention calculation on the updated initial alarm feature of the target central node and the initial alarm features of the plurality of neighbor nodes.

6. The method of claim 1, wherein, the alarm type of the security event is identified by the alarm feature, comprising: respectively calculating a false alarm rate and a missed alarm rate of the alarm feature; if the false alarm rate is greater than or equal to a preset false alarm threshold, determining that the alarm type of the security event is false alarm; if the missed alarm rate is greater than or equal to a preset missed alarm threshold, determining that the alarm type of the security event is missed alarm.

7. The method of claim 1, wherein, Further comprising: training a security event identification model, wherein the security event identification model is used to perform the security event identification, the training of the security event identification model comprises: calling a to-be-trained model to identify a training sample to obtain an identification result, wherein the training sample is false alarm security event information or missed alarm security event information; calculating a loss value for the identification result, wherein the loss value comprises a false alarm loss and a missed alarm loss, the false alarm loss represents a loss between the identification result and a false alarm rate of the training sample, and the missed alarm loss represents a loss between the identification result and a missed alarm rate of the training sample; determining whether the loss value converges; if the loss value converges, taking the to-be-trained model as the security event identification model; if the loss value does not converge, adjusting parameters of the to-be-trained model, taking the model with the adjusted parameters as a new to-be-trained model, and performing again the operation of calling the to-be-trained model to identify the alarm type of the training sample.

8. The method of claim 1, wherein, Further comprising: sending the alarm type of the security event to a security event detection system to trigger the security event detection system to update a security event output result according to the alarm type.

9. A security event identification apparatus characterized by comprising: The device comprises: an information extraction module configured to extract a plurality of entity information related to a security event from security event information in response to obtaining the security event information, wherein the plurality of entity information comprises event entity information and network entity information; a determination module configured to determine entity association information corresponding to the security event according to the plurality of entity information, wherein the entity association information represents an association relationship between the event entity information and another entity information, and the another entity information is event entity information or network entity information; a feature extraction module configured to extract an alarm feature of the event entity information according to the entity association information, wherein the alarm feature comprises an influence degree of each entity information related to the event entity information on the event entity information, and the alarm feature is used to represent an association degree between the event entity information and each entity information related to the event entity information. a recognition module for recognizing the alarm type of the security event by means of the alarm feature.

10. An electronic device, comprising: A computer program product comprising a memory, a processor and a computer program stored on the memory and loadable on the processor, the processor running the computer program implementing the method according to any one of claims 1 to 8.

Images