Alarm processing method, device and equipment and computer readable storage medium

Abstract

The invention discloses an alarm processing method, device and equipment and a computer readable storage medium, and is applied to the field of network security, and the method comprises the steps: carrying out the merging of original alarms through employing an algorithm model based on a dynamic time threshold, and obtaining a merged alarm result; performing association analysis on the merged alarm result by using a hybrid algorithm model to obtain an analyzed alarm result; the hybrid algorithm model is a model based on combination of a time sequence prediction algorithm and a neural network algorithm; and carrying out disposal priority evaluation on the analyzed alarm result, and carrying out disposal according to an evaluation result and a matched disposal strategy. According to the method, an information island in a water conservancy system is broken, the number of alarm events is reduced to the greatest extent on the premise of ensuring that the alarm information is not lost, and a large number of identical and complicated alarm events are prevented from being handled repeatedly; in combination with priority evaluation and strategy matching, high-risk alarms can be responded preferentially, and core safety support is provided for stable operation of the intelligent water conservancy and digital twinborn drainage basin.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to an alarm processing method and device, equipment and a computer readable storage medium. BACKGROUND

[0002] With the acceleration of the smart water strategy and the construction of the digital twin basin platform, the fine classification, grading and all-round security protection of data have become an urgent need for the development of the industry. Although the network security protection of the water industry has initially built a basic framework centered on the graded protection system, the overall protection efficiency still needs to be improved when facing complex and variable network threats.

[0003] Therefore, how to efficiently integrate multi-source alarms and avoid data processing confusion caused by data dispersion has become a technical problem that needs to be solved to improve the efficiency of water network security protection. SUMMARY

[0004] Therefore, the purpose of the present application is to provide an alarm processing method, device, equipment and computer readable storage medium, which solves the problem of data processing confusion caused by data dispersion in the prior art.

[0005] To solve the above technical problems, the present application provides an alarm processing method, comprising:

[0006] Obtaining original alarms; the original alarms include alarms analyzed by a situation awareness system, alarms reported by various security devices and alarms reported by an edge service gateway;

[0007] Merging the original alarms using an algorithm model based on dynamic time threshold to obtain merged alarm results;

[0008] Performing correlation analysis on the merged alarm results using a hybrid algorithm model to obtain analyzed alarm results; the hybrid algorithm model is a model combining a time series prediction algorithm and a neural network algorithm;

[0009] Performing disposition priority evaluation on the analyzed alarm results, and performing disposition according to the evaluation results and matching disposition strategies.

[0010] Optionally, merging the original alarms using an algorithm model based on dynamic time threshold to obtain merged alarm results, comprising:

[0011] Listening to processing tables of at least two different data sources, and determining alarm merging process types corresponding to the original alarms according to data source types of the processing tables;

[0012] Determining whether the original alarms have generated alarm events according to unique identifiers of the original alarms;

[0013] if the alarm event has been generated, performing an alarm event updating operation;

[0014] if the alarm event has not been generated, querying a time threshold table corresponding to an alarm merging process type and a fingerprint value of the original alarm to obtain a corresponding dynamic time threshold; obtaining a sliding time window based on the dynamic time threshold, if the original alarm is within the sliding time window, determining whether the alarm event exists within the sliding time window, if not, merging a plurality of original alarms meeting the conditions into a new alarm event, if so, merging the original alarm to the alarm event.

[0015] Optionally, before obtaining the corresponding dynamic time threshold, further comprising:

[0016] grouping the original alarms within the previous preset time period according to the alarm merging process and the fingerprint value, for each group, calculating the time interval between adjacent original alarms within the previous preset time period in the group;

[0017] for each group, calculating the sum of the time interval in the group, and calculating the mean and standard deviation according to the sum and the number of original alarms within the previous preset time period;

[0018] for each group, calculating the time threshold based on the mean and standard deviation in the group;

[0019] storing the time threshold, the alarm merging process type and the fingerprint value in association to obtain the time threshold table.

[0020] Optionally, using a hybrid algorithm model to perform correlation analysis on the merged alarm result to obtain an analyzed alarm result, comprising:

[0021] converting the merged alarm result into time series data indexed by time;

[0022] decomposing the time series data into linear components and nonlinear residual components;

[0023] based on the linear components, using a first model constructed based on an autoregressive integrated moving average algorithm to perform prediction to obtain a prediction result of the linear components;

[0024] based on the nonlinear residual components, using a second model constructed based on a long short-term memory network to perform prediction to obtain a prediction result of the nonlinear residual components;

[0025] fusing the prediction result of the linear components and the prediction result of the nonlinear residual components to obtain the analyzed alarm result.

[0026] Optionally, the prediction results of the linear component and the prediction results of the nonlinear residual component are fused to obtain the alarm result after analysis, including:

[0027] The prediction results of the linear component and the prediction results of the nonlinear residual component are fused using a linear superposition fusion algorithm, a nonlinear fusion algorithm, or a dynamic weight adjustment fusion algorithm.

[0028] The formula for the linear superposition fusion algorithm is as follows: The formula for the nonlinear fusion algorithm is: The formula for the dynamic weight adjustment fusion algorithm is: ; The alarm results after analysis. The prediction results are for the linear components. The prediction results are for the nonlinear residual components; This refers to a nonlinear function implemented using a neural network. and As weight, and .

[0029] Optionally, the alarm results after analysis are evaluated for handling priority, including:

[0030] The alarm results after analysis are subjected to spatial characteristic analysis, spatiotemporal characteristic analysis, attack feature analysis, and associated information feature analysis to obtain spatial characteristic value, spatiotemporal characteristic value, attack feature value, and associated information feature value.

[0031] The importance score is obtained by using the associated information feature value as the importance score, and the urgency score is calculated based on the spatial characteristic value, spatiotemporal characteristic value and attack feature value.

[0032] The priority of handling alarm results after analysis is determined based on the priority assessment quadrants of urgency and importance, as well as the importance score and the urgency score.

[0033] Optionally, after obtaining the original alarm, the following may also be included:

[0034] The original alarms of different types are deduplicated and filtered, and noise reduction is performed on the original alarms using a dual mode of rules and artificial intelligence to obtain the processed original alarms.

[0035] The processed original alarms are then transformed, mapped, cleaned, and normalized to obtain the final original alarms.

[0036] The present invention also provides an alarm processing device, comprising:

[0037] The data acquisition module is used to acquire raw alarms; the raw alarms include alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway.

[0038] The merging module is used to merge the original alarms using an algorithm model based on a dynamic time threshold, and obtain the merged alarm results.

[0039] The analysis module is used to perform correlation analysis on the merged alarm results using a hybrid algorithm model to obtain the analyzed alarm results; the hybrid algorithm model is a model based on a combination of time series prediction algorithm and neural network algorithm;

[0040] The evaluation module is used to evaluate the priority of handling the analyzed alarm results and to handle them according to the evaluation results and the matching handling strategy.

[0041] The present invention also provides an alarm processing device, comprising:

[0042] Memory, used to store computer programs;

[0043] A processor is used to implement the alarm processing method described above when executing the computer program.

[0044] The present invention also provides a computer-readable storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the alarm processing method described above.

[0045] As can be seen, this invention obtains original alarms, including alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway; merges the original alarms using an algorithm model based on a dynamic time threshold to obtain merged alarm results; performs correlation analysis on the merged alarm results using a hybrid algorithm model to obtain analyzed alarm results; the hybrid algorithm model is a model based on a combination of time-series prediction algorithm and neural network algorithm; evaluates the handling priority of the analyzed alarm results, and handles them according to the evaluation results and the matched handling strategy. The beneficial effects of this invention are as follows: By covering the acquisition mechanism of multi-source alarms, the information barriers and information silos of heterogeneous data in the water conservancy system are broken down, providing a complete foundation for subsequent analysis to avoid missed threat detection; the merging model based on dynamic time thresholds reduces the original alarms by orders of magnitude, avoiding the repeated handling of a large number of identical and complex alarm events, and significantly reducing the time required for manual intervention; a hybrid model based on time-series prediction algorithms and neural network algorithms is used for multi-dimensional classification and prediction, minimizing the number of alarm events while ensuring that alarm information is not lost; combined with priority evaluation and strategy matching, high-risk alarms can be responded to first, effectively avoiding losses such as flood discharge accidents and water supply interruptions, providing core security support for the stable operation of smart water conservancy and digital twin watersheds.

[0046] In addition, the present invention also provides an alarm processing device, apparatus, and computer-readable storage medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0048] Figure 1 A flowchart of an alarm processing method provided in an embodiment of the present invention;

[0049] Figure 2 An example diagram of a disposal priority evaluation quadrant provided in an embodiment of the present invention;

[0050] Figure 3 An example diagram of an alarm processing framework provided in an embodiment of the present invention;

[0051] Figure 4 This is a schematic diagram of the structure of an alarm processing device provided in an embodiment of the present invention;

[0052] Figure 5This is a schematic diagram of an alarm processing device provided in an embodiment of the present invention. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] With the accelerated implementation of the smart water conservancy strategy and the construction of digital twin river basin platforms, the refined classification and grading of data, as well as comprehensive security protection, have become urgent needs for the industry's development. Currently, the cybersecurity situation in the water conservancy industry has significant shortcomings compared to other sectors, requiring comprehensive strengthening. Although the water conservancy industry has initially established a basic framework centered on the graded protection system, its overall protection effectiveness still needs improvement when facing complex and ever-changing network threats. For example: 1) Incomplete protection system: Many water conservancy units have deployed traditional security equipment such as firewalls and intrusion detection systems, but the overall protection system is fragmented, with outdated equipment coexisting, making centralized management and maintenance difficult. 2) High data aggregation risk: The water conservancy industry is characterized by numerous points of attack and a dispersed attack surface, posing significant security risks during the aggregation of related alarms. Existing platforms have limited capabilities in data processing and analysis. 3) Severe data silo phenomenon: Data sharing between different business systems is difficult, making it difficult for the management platform to obtain comprehensive data. 4) Slow emergency response speed: In the event of an emergency, platform analysis and judgment are time-consuming, and the lack of standardized emergency response processes and specifications affects the speed of closed-loop event handling.

[0055] Faced with challenges such as rapid technological iteration, insufficient adaptability of protection strategies, and a shortage of professional talent, the water conservancy industry needs to deepen the construction of its cybersecurity protection system and strengthen its data protection capabilities. Specifically, it needs to build a collaborative early warning platform for cybersecurity assessment with characteristics specific to the water conservancy industry. This platform should comprehensively collect data from various security devices and utilize fusion analysis and intelligent analysis technologies to uncover potential threats. It should provide functions such as real-time monitoring, alarm reporting, alarm management, and automatic emergency response, and, in conjunction with standardized processes and professional personnel, achieve efficient and secure operation and maintenance.

[0056] Please refer to the details. Figure 1 , Figure 1 A flowchart illustrating an alarm processing method provided in an embodiment of the present invention. The method may include:

[0057] S101: Obtain raw alarms; raw alarms include alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway.

[0058] The execution entity in this embodiment is a terminal, but it can also be a big data platform. This method is applicable to the network security protection of enterprises or institutions related to water conservancy facilities such as reservoirs, dams, pumping stations, and urban water supply networks. Step 1 is the data collection process, which mainly involves obtaining raw alarms from subsidiaries of different sizes. This method supports the adaptation and access of security device data from subsidiaries of different sizes, including raw alarms analyzed by the situational awareness system and raw alarms directly reported by various security devices. For small enterprises, data is uniformly reported through an edge service gateway, ultimately achieving the aggregation of multi-dimensional raw alarms. Based on the streaming processing capabilities of the big data platform, the raw alarms are stored persistently in the database for subsequent process analysis and processing.

[0059] Furthermore, after acquiring the original alarms, the process may include: deduplicating and filtering the acquired original alarms of different types, and performing noise reduction processing on the original alarms using a dual-mode approach of rules and artificial intelligence to obtain processed original alarms; then transforming, mapping, cleaning, and normalizing the processed original alarms to obtain the final original alarms. Specifically, this embodiment also performs deduplication and filtering processing on the collected original alarms of different types, and achieves intelligent noise reduction of the original alarms through a dual-mode approach of rules + AI (artificial intelligence) to filter out invalid data. Since the data field values ​​of the original alarms reported by different security devices may be different, they need to be transformed and mapped to a unified format, such as alarm type, high-level, etc. The cleaned and normalized data can be used for subsequent analysis and processing.

[0060] S102: The original alarms are merged using an algorithm model based on dynamic time threshold to obtain the merged alarm results.

[0061] The algorithm model in this step mainly achieves efficient alarm aggregation by comprehensively analyzing attributes such as alarm type, source IP (Internet Protocol), and destination IP, and calculating fingerprints according to different types. It also uses a dynamic time threshold during the aggregation process. The alarm time merging process first relies heavily on the above fingerprint information for merging logic processing. Each alarm event corresponds to a time window and a corresponding dynamic time threshold, which is obtained through offline calculations every morning. This threshold is based on data generated from past original alarms and is calculated dynamically.

[0062] Furthermore, the above-mentioned algorithm model based on dynamic time threshold is used to merge the original alarms to obtain the merged alarm result, which may specifically include:

[0063] Step 21: Monitor the processing tables of at least two different data sources, and determine the alarm merging process type corresponding to the original alarm based on the data source type of the processing table;

[0064] Specifically, this step is the data entry point for merging the real-time process, which can be divided into two parts. The first part is by listening to the original alarm data Hudi (processing) table, and the second part is by listening to the time-series anomaly record Hudi (processing) table. When a change in the original alarm is detected, the alarm event merging process is initiated. At the same time, the type of merging process is determined at this point. The merging process by listening to the original alarm Hudi table belongs to "Security Monitoring - Alarm Merging", and the merging process by listening to the time-series anomaly Hudi table belongs to "Security Monitoring - Time-Series Anomaly - Alarm Merging".

[0065] Step 22: Determine whether an alarm event has been generated based on the unique identifier of the original alarm.

[0066] Specifically, upon entering the merging process, the system first determines whether the original alarm has already been used to generate an alarm event based on its ID (unique identifier). If an alarm event has been generated, the alarm event is updated. If no alarm event has been generated, a new alarm event generation logic is applied, i.e., a new alarm event is generated. This avoids the same alarm being processed repeatedly.

[0067] Step 23: If an alarm event has been generated, perform the alarm event update operation.

[0068] If an event has already been generated, the plaintiff's police event will be updated directly without proceeding to the subsequent window for judgment.

[0069] Step 24: If no alarm event is generated, query the time threshold table by combining the alarm merging process type and fingerprint value corresponding to the original alarm to obtain the corresponding time threshold; obtain a sliding time window based on the dynamic time threshold. If the original alarm is within the sliding time window, determine whether there is an alarm event within the sliding time window. If not, merge multiple original alarms that meet the conditions into a new alarm event. If it exists, merge the original alarms into the alarm event.

[0070] Specifically, by combining the alarm type (e.g., alarm merging process type) and fingerprint value to check if corresponding time threshold information exists in the time threshold table, if it exists, the existing time threshold information is used; if it does not exist, the default time threshold information is used. The default time threshold information can be 12 hours. Using this data, the corresponding time window data can be assembled in the operation memory of Spark (a distributed computing framework). The time window data obtained in the above way is processed by merging logic to determine whether it is within the time window. If it is within the time window, it is checked whether there is an alarm event. If there is no alarm event, multiple original alarms that meet the preset conditions are included in the set for merging and merged into one alarm event. If there is already an alarm event in the time window, the alarm events existing in the time window are updated. Of course, a sliding window processing can also be added. The sliding window processing logic has the following characteristics: 1) The start time of the time window stored in the time threshold is a changing value; 2) The time window for the default event is 24 hours; 3) Since the start time of the time window is a sliding time, the maximum sliding of the window cannot exceed the earliest start time + the preset duration (e.g., 48 hours).

[0071] Furthermore, before obtaining the corresponding dynamic time threshold, the process may further include: grouping the original alarms within a pre-preset time period according to the alarm merging process and fingerprint value; for each group, calculating the time interval between adjacent original alarms within the pre-preset time period within the group; for each group, calculating the sum of the time intervals within the group; and calculating the average value and standard deviation based on the sum and the number of original alarms within the pre-preset time period; for each group, calculating the time threshold based on the average value and standard deviation within the group; and associating and storing the time threshold, alarm merging process type, and fingerprint value to obtain a time threshold table.

[0072] Specifically, this embodiment separates the alarm event merging process from the time threshold calculation during alarm event merging. The merging process is handled in real-time, while the time threshold is calculated offline each day at midnight based on data from the previous preset number of days, and pre-stored in a time threshold table. The time threshold calculation mainly involves the sum of time intervals and the sum of squares of time intervals. When a batch of original alarms is generated, Spark first calculates the time interval between adjacent original alarms and creates a tuple pair of time intervals. By calculating the sum of the event intervals and the number of original alarms, the average value can be obtained. Then, the standard deviation is calculated, and finally, the time threshold (target_dynamic_threshold) is obtained using the calculation formula. During final storage, it is first compared whether the current calculation time is less than 12 hours. If the calculation result is less than 12 hours, 12 hours are used directly, and the time threshold is stored in the time threshold table at the second level for use in the next merging event. Following the above method, the corresponding time threshold can be calculated for each group. Grouping can be based on the alarm merging process and fingerprint value. The calculation formula is: target_dynamic_threshold = avg + 2 * std. Where target_dynamic_threshold is the time threshold, avg is the average (arithmetic mean), and std is the standard deviation.

[0073] S103: Use a hybrid algorithm model to perform correlation analysis on the merged alarm results to obtain the analyzed alarm results; the hybrid algorithm model is a model based on a combination of time series prediction algorithm and neural network algorithm.

[0074] This embodiment does not specifically limit the time series prediction algorithm and neural network algorithm. For example, the time series prediction algorithm can be ARIMA (Autoregressive Integrated Moving Average), and the neural network algorithm in this embodiment can be LSTM (Long Short-Term Memory). Using analysis methods and theories based on time series data for alarm events, a prediction model can be built using the ARIMA algorithm, combined with the LSTM algorithm, utilizing original alarms within a preset time period. The ARIMA-LSTM hybrid model is based on the idea of ​​time series decomposition, decomposing the merged alarm results (i.e., each alarm event) into linear and nonlinear components for processing. Mathematically, the hybrid model can be expressed as: Zt = Lt + Nt. Here, Zt represents the original time series data, Lt is the linear part captured by the ARIMA model, and Nt is the nonlinear residual part processed by the LSTM. This decomposition assumes that the linear and nonlinear features in the original data can be modeled independently, thereby improving the overall prediction accuracy.

[0075] Furthermore, a hybrid algorithm model is used to perform correlation analysis on the merged alarm results to obtain the analyzed alarm results. Specifically, this may include: converting the merged alarm results into time series data indexed by time; decomposing the time series data into linear components and nonlinear residual components; based on the linear components, using a first model constructed based on an autoregressive integral moving average algorithm to make predictions and obtain the prediction results for the linear components; based on the nonlinear residual components, using a second model constructed based on a long short-term memory network to make predictions and obtain the prediction results for the nonlinear residual components; and fusing the prediction results for the linear components and the prediction results for the nonlinear residual components to obtain the analyzed alarm results.

[0076] It should be noted that the ARIMA algorithm uses the differential autoregressive moving average method, the mathematical expression of which is: .in, This represents the data after d-th order differencing. These are the autoregressive coefficients. The moving average coefficient is... This represents the white noise error term. Linear patterns refer to stable trends and periodicity, such as periodic alarms from routine equipment inspections and water level monitoring (increased frequency at fixed times each day) and seasonal fluctuations (significantly higher alarm volume during flood season than dry season). The ARIMA algorithm excels at capturing the trends and periodicity of linear, stationary time series. Through differencing, it transforms non-stationary data into stationary sequences, accurately fitting predictable regular fluctuations in water conservancy alarms (such as the daily peak of equipment self-inspection alarms from 8:00 AM to 10:00 AM), providing a stable baseline for overall prediction.

[0077] It should be noted that the LSTM network part handles the nonlinear relationships in the residual sequence through a gating mechanism. An LSTM unit contains three gating structures and one cell state, and its core formulas include:

[0078] Forgotten Gate: ;

[0079] The forgetting gate determines which information in a cell's state needs to be forgotten. Here is the forget gate weight matrix. This indicates the hidden state at the previous moment. Enter the current time. This means concatenating the previous hidden state with the current input column by column. Forget gate bias vector, The output of the forget gate has a value of 0 to 1. σ() is used to compress the gated output to the interval (0, 1).

[0080] Input Gate: ;

[0081] New cell state: ;

[0082] The input gate determines how new information is added to the cell state. The input gate weight matrix, This is the input gate bias vector. The output corresponding to the input gate is used to control the degree of new information flow. The candidate state weight matrix is... This is the candidate state bias vector. Indicates the state of candidate cells. () is used to compress candidate states and cell states into the (-1,1) interval.

[0083] Cell status update: ;

[0084] The cell state is updated by combining information from forgotten and input data. This represents the cell state at the previous moment. This represents the updated cell state.

[0085] Output gate: ;

[0086] Hidden state: .

[0087] The output gate determines what information is output based on the cell state. This is the output gate weight matrix. This is the output gate bias vector. The output calculated for the output gate. This is the final output.

[0088] For nonlinear anomalies such as the covert fluctuations (irregular sudden increases) of APT attacks and the abrupt changes in alarms (non-periodic jumps) caused by edge gateway tampering, these features are complex and lack fixed patterns. The LSTM algorithm can solve the long-term dependency and forgetting problem of traditional recurrent neural networks through gating mechanisms, effectively capturing nonlinear and sudden features. It is particularly suitable for mining covert threat signals in water conservancy scenarios (such as the slow increase in alarm frequency caused by the gradual infiltration of attackers), and makes up for the insufficient adaptability of ARIMA to nonlinear patterns. When the two are combined, ARIMA provides linear baseline prediction, and LSTM corrects nonlinear residuals, which can not only ensure the trend prediction accuracy of conventional alarms, but also accurately capture abnormal threats, ultimately achieving "predictable conventional fluctuations and early detection of abnormal threats", meeting the core security protection requirements of digital twin watersheds.

[0089] Furthermore, the prediction results of the linear component and the nonlinear residual component are fused to obtain the analyzed alarm result. This can include fusing the prediction results of the linear component and the nonlinear residual component using a linear superposition fusion algorithm, a nonlinear fusion algorithm, or a dynamic weight adjustment fusion algorithm; wherein, the formula for the linear superposition fusion algorithm is: The formula for the nonlinear fusion algorithm is: The formula for the dynamic weight adjustment fusion algorithm is: ; The alarm results after analysis. The prediction results are for the linear components. The prediction results are for the nonlinear residual components; This refers to a nonlinear function implemented using a neural network. and As weight, and Linear superposition refers to directly adding the two prediction results; nonlinear fusion uses an additional LSTM network or fully connected layer to nonlinearly combine the prediction results of ARIMA and LSTM; in dynamic weight adjustment, the weights are determined using the CRITIC method to determine the weights of the two prediction results. and Based on information entropy and coefficient of variation calculations, it can dynamically adapt to changes in data characteristics. This fusion strategy can fully leverage the respective advantages of ARIMA and LSTM: ARIMA handles linear trends, while LSTM captures nonlinear anomalies, thereby improving overall prediction accuracy and alarm processing effectiveness.

[0090] S104: Prioritize the handling of the analyzed alarm results and handle them according to the assessment results and the matching handling strategy.

[0091] Specifically, this priority assessment step involves real-time analysis of various related intelligences, related assets, and related original alarms in the analyzed alarm results. After scoring, alarms are matched with the corresponding alarm event handling level. The handling level of the alarm event is used to determine the subsequent handling process and automated scripts.

[0092] Furthermore, the aforementioned priority assessment of the analyzed alarm results may include: performing spatial characteristic analysis, spatiotemporal characteristic analysis, attack characteristic analysis, and related information characteristic analysis on the analyzed alarm results to obtain spatial characteristic values, spatiotemporal characteristic values, attack characteristic values, and related information characteristic values; using the related information characteristic values ​​as importance scores, and calculating urgency scores based on the spatial characteristic values, spatiotemporal characteristic values, and attack characteristic values; and determining the priority of the analyzed alarm results based on the priority assessment quadrants for urgency and importance, as well as the importance scores and urgency scores.

[0093] Specifically, the priority of handling is evaluated using a weighted analysis method, which scores and calculates the weights of the relevant features of the alarm event. The scoring method involves obtaining and calculating multiple key values. The system will trigger priority analysis calculation in the following scenarios: 1) when an alarm event is generated; 2) when an alarm event is updated; 3) when the original alarm associated with the alarm event changes. It should be noted that the alarm event here refers to the analyzed alarm result generated in step S103. The four quadrants in this step can be referenced... Figure 2 , Figure 2 This is an example diagram illustrating a priority assessment quadrant for embodiments of the present invention. **Urgent and Important:** These are the most pressing and important parts of tasks or activities, requiring immediate attention and completion. They are crucial for achieving goals and resolving urgent issues. **Important but Not Urgent:** These are tasks or activities aligned with goals and values ​​but not requiring immediate action. They require good planning and time management to ensure they are addressed within the appropriate timeframe. **Urgent but Not Important:** These tasks or activities require immediate action but are not critical to achieving goals and values. In terms of priority, these tasks can typically be delegated or have their priority reduced. **Not Urgent and Not Important:** These tasks or activities are neither urgent nor important and do not significantly contribute to achieving goals or personal value. They can typically be excluded from planning or placed with low priority.

[0094] Relevant feature analysis may include:

[0095] (1) Spatial characteristics analysis: Overseas IP judgment: Determine whether there is an overseas IP. The score of overseas IP is higher than that of domestic IP; Important asset identification: Determine whether it is an important asset. The score of important assets is higher than that of other assets.

[0096] (2) Spatiotemporal characteristics analysis: Current alarm handling status: Determine the start time of the handling and the current handling status, and determine the time difference between the start time of the event and the handling status. The longer the alarm handling time, the lower the corresponding handling score; Relationship between alarm event and working time: Determine the score based on whether the alarm is in the working event segment; Periodic judgment: Based on the alarm log associated with the current alarm event, obtain a batch of alarm logs under the current alarm event and calculate with the current version; Attack frequency calculation: Calculate based on the frequency of the corresponding original alarm.

[0097] (3) Attack characteristics analysis; Number of hit intelligences: query intelligence collision data and score according to the number of hit intelligences; Intelligence judgment conclusion: query intelligence collision data and score according to the level of hit intelligences; APT attack stage: calculate according to the APT attack stage score; ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) attack stage: calculate according to the characteristics of ATT&CK alarm events.

[0098] (4) Analysis of related information features: Related assets: Calculated based on the quantity of related assets, key asset units, and asset types; Related vulnerabilities: Calculated based on whether there are related vulnerabilities.

[0099] After the above feature analysis, such as Figure 2 As shown, 400 can be used as the origin. After summing all the total scores, the priority of alarm events is determined by the four quadrants: X-axis = associated information feature column, Y-axis = (spatial characteristics + spatiotemporal characteristics) + attack characteristics.

[0100] The alarm processing method provided in this invention involves acquiring raw alarms, including alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway. The raw alarms are then merged using an algorithm model based on a dynamic time threshold to obtain merged alarm results. A hybrid algorithm model is then used to perform correlation analysis on the merged alarm results to obtain analyzed alarm results. The hybrid algorithm model combines a time-series prediction algorithm and a neural network algorithm. The analyzed alarm results are then prioritized for processing, and processing is carried out based on the evaluation results and the matched processing strategy. This method supports the adaptive access of security device data from subsidiaries of different sizes, including raw alarms analyzed by the situational awareness system and raw alarms directly reported by various security devices. For small enterprises, data is uniformly reported through the edge service gateway, ultimately achieving multi-dimensional raw alarm aggregation. Based on the streaming processing capabilities of the big data platform, the raw alarms are persistently stored in the database for subsequent process analysis and processing. Furthermore, it can combine big data technologies such as Spark and Hudi with data processing algorithms. On the one hand, it uses a combination of algorithms based on dynamic time thresholds to merge and analyze original alarms, combining multiple original alarms into one alarm event. On the other hand, it uses time-series prediction algorithms and neural network algorithms to classify, analyze, and denoise the merged alarm results. By combining the advantages of traditional statistical methods and deep learning technology, it uses a hybrid model of ARIMA algorithm and LSTM neural network for multi-dimensional classification and prediction. The ARIMA algorithm captures alarm trends in time series, and the LSTM network handles non-linear relationships. Finally, it fuses the prediction results of both in a linear or non-linear manner, minimizing the number of alarm events while ensuring no alarm information is lost. Moreover, by performing spatial characteristic analysis, spatiotemporal characteristic analysis, attack feature analysis, and correlation information feature analysis on alarm events, and after scoring calculation, the alarms are matched with the corresponding handling levels: urgent and important, urgent but not important, important but not urgent, and neither urgent nor important. The handling level of alarm events is used to determine subsequent handling processes and automated scripts. The analyzed alarm results can be displayed on a web page. Based on the configured automated handling strategy, alarm events that meet the requirements for automated handling are pushed to the response handling module, triggering the execution of the automated handling script. The automated handling module also incorporates AI-assisted functions, using a pre-trained knowledge base to improve handling efficiency in similar scenarios. A large-screen display function is also provided, allowing users to view automated handling results and related statistical data in real time.

[0101] For a clearer understanding of this invention, please refer to the following details. Figure 3 , Figure 3An example diagram of an alarm processing framework provided in an embodiment of the present invention may specifically include:

[0102] 1. Raw Alarm Collection and Aggregation: Raw alarms are collected from subsidiaries of different sizes. For example, medium and large subsidiaries and small enterprises. Medium and large subsidiaries include WAF (Web Application Firewall, a security device / technology specifically designed to protect against web application layer attacks), EDR (Endpoint Detection and Response), state sensing systems, and other security devices, while small subsidiaries include WAF, EDR, edge service gateways, and other security devices.

[0103] 2. Data Cleaning and Normalization: The collected and aggregated raw alarms of different types undergo deduplication and filtering. A dual-mode approach of "rules + AI" is used to intelligently reduce noise in the events, thereby filtering out invalid data. Since alarm data field values ​​may differ from those reported by different security devices, they need to be converted and mapped to a unified format, such as alarm type and level fields. The cleaned and normalized data can then be used for subsequent analysis and processing.

[0104] 3. Analysis, Prediction, and Data Merging for Alarm Event Generation: On one hand, combining big data technologies such as Spark and Hudi with data processing algorithms, a dynamic time threshold-based algorithm is used to merge and analyze original alarms, consolidating multiple alarms into a single alarm event, reducing the number of alarm events while ensuring no information loss. On the other hand, time-series prediction algorithms and neural network algorithms are used to perform correlation analysis and noise reduction on the merged alarm results. By combining the advantages of traditional statistical methods and deep learning technology, a hybrid model of ARIMA and LSTM neural networks is used for multi-dimensional classification and prediction. The ARIMA model captures alarm trends in time series, the results are input into the LSTM network to process non-linear relationships, and finally, the prediction results from both are fused in a linear or non-linear manner. This hybrid architecture effectively reduces the false alarm rate and false negative rate of network security alarm systems while maintaining high real-time performance, providing security operations personnel with more accurate threat warnings.

[0105] 4. Priority Analysis and Evaluation: Real-time analysis of various related intelligence, related assets, and related original alarms for alarm events is conducted. After scoring, alarms are matched with corresponding priority levels: four quadrants are defined: urgent and important, urgent but not important, important but not urgent, and neither urgent nor important. The priority level of alarm events is used to determine subsequent handling procedures and automated scripts.

[0106] 5. Alarm Event Management and Response: After an alarm event is generated, it is displayed on the web page. Simultaneously, based on the configured automated handling strategy, alarm events meeting the automated handling criteria are pushed to the response module, triggering the execution of automated handling scripts. The automated handling module also incorporates AI-assisted functions, using a pre-trained knowledge base to improve handling efficiency in similar scenarios. A large-screen display function is also provided, allowing users to view the automated handling results and related statistics in real time. The handling strategies can be exemplified as follows: Scenario 1: The system analyzes and determines that alarm event A is a remote brute-force network attack. By matching the handling strategy, an automated interception script is triggered. First, the legitimacy of the attacking source IP address is determined (whether it is on the whitelist, whether it exists in the intelligence system, etc.). Then, it decides whether to execute IP blocking actions, linking the firewall to add the attacking IP to the blacklist, achieving automated handling. Scenario 2: The system analyzes and determines that alarm event B is a computer virus infection alarm event. By matching the handling strategy, a host isolation script is triggered, executing host isolation actions, linking EDR and other devices to isolate the victim host, preventing further virus spread.

[0107] It is evident that the fragmented overall protection systems comprised of traditional security equipment such as firewalls and intrusion detection systems deployed by many units in the water conservancy industry make centralized management and maintenance difficult. This invention addresses this problem by using a multi-dimensional data acquisition model to acquire data from various devices for unified analysis and processing, avoiding issues such as scattered and chaotic data management. Through Hudi and Spark-related big data storage and processing technologies, alarm event data is cleaned, normalized, predicted, and merged, reducing the original alarms by orders of magnitude. This avoids repeatedly handling a large number of identical and complex alarm events, significantly reducing manual intervention time. The system's business-related functions are modularly designed, allowing direct integration with existing customer equipment or systems to improve resource utilization and reduce system upgrade costs. For smaller sites or branch offices, data is collected through edge service gateways, enabling cloud-edge collaboration and reducing system integration and maintenance costs.

[0108] The alarm processing device provided in the embodiments of the present invention will be described below. The alarm processing device described below can be referred to in correspondence with the alarm processing method described above.

[0109] Please refer to the details. Figure 4 , Figure 4 A schematic diagram of an alarm processing device provided in an embodiment of the present invention may include:

[0110] The data acquisition module 100 is used to acquire raw alarms; the raw alarms include alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway.

[0111] The merging module 200 is used to merge the original alarms using an algorithm model based on a dynamic time threshold to obtain the merged alarm results.

[0112] The analysis module 300 is used to perform correlation analysis on the merged alarm results using a hybrid algorithm model to obtain the analyzed alarm results; the hybrid algorithm model is a model based on a combination of time series prediction algorithm and neural network algorithm;

[0113] The evaluation module 400 is used to evaluate the priority of handling the analyzed alarm results and to handle them according to the evaluation results and the matching handling strategy.

[0114] Based on the above embodiments, the merging module 200 may include:

[0115] The monitoring unit is used to monitor at least two processing tables from different data sources and determine the alarm merging process type corresponding to the original alarm based on the data source type of the processing table.

[0116] The first judgment unit is used to determine whether the original alarm has generated an alarm event based on the unique identifier of the original alarm.

[0117] The first execution unit is configured to perform an alarm event update operation if the alarm event has been generated.

[0118] The second execution unit is configured to, if no alarm event is generated, combine the alarm merging process type and fingerprint value corresponding to the original alarm to query the time threshold table and obtain the corresponding dynamic time threshold; obtain a sliding time window based on the dynamic time threshold; if the original alarm is within the sliding time window, determine whether the alarm event exists within the sliding time window; if not, merge multiple original alarms that meet the conditions into a new alarm event; if it exists, merge the original alarm into the alarm event.

[0119] Based on the above embodiments, the alarm processing device may further include:

[0120] The first calculation module is used to group the original alarms within a preset time period according to the alarm merging process and the fingerprint value before obtaining the corresponding dynamic time threshold, and calculate the time interval between adjacent original alarms within the preset time period in each group.

[0121] The second calculation module is used to calculate the sum of the time intervals within each group, and to calculate the average value and standard deviation based on the sum and the number of original alarms within the previous preset time period.

[0122] The third calculation module is used to calculate the time threshold for each group based on the mean and standard deviation within the group.

[0123] The associated storage module is used to associate and store the time threshold, the alarm merging process type, and the fingerprint value to obtain the time threshold table.

[0124] Based on the above embodiments, the analysis module 300 may include:

[0125] A conversion unit is used to convert the merged alarm results into time-series data indexed by time.

[0126] A decomposition unit is used to decompose the time series data into linear components and nonlinear residual components;

[0127] The first prediction unit is used to make predictions based on the linear components using a first model constructed based on an autoregressive integral moving average algorithm, and to obtain the prediction results of the linear components.

[0128] The second prediction unit is used to make predictions based on the nonlinear residual components using a second model constructed based on a long short-term memory network, and to obtain the prediction results of the nonlinear residual components.

[0129] The fusion unit is used to fuse the prediction results of the linear component and the prediction results of the nonlinear residual component to obtain the alarm result after analysis.

[0130] Based on the above embodiments, the fusion unit may include:

[0131] The fusion subunit is used to fuse the prediction results of the linear component and the prediction results of the nonlinear residual component using a linear superposition fusion algorithm, a nonlinear fusion algorithm, or a dynamic weight adjustment fusion algorithm; wherein, the formula for the linear superposition fusion algorithm is: The formula for the nonlinear fusion algorithm is: The formula for the dynamic weight adjustment fusion algorithm is: ; The alarm results after analysis. The prediction results are for the linear components. The prediction results are for the nonlinear residual components; This refers to a nonlinear function implemented using a neural network. and As weight, and .

[0132] Based on any of the above embodiments, the evaluation module 400 may include:

[0133] The analysis unit is used to perform spatial characteristic analysis, spatiotemporal characteristic analysis, attack feature analysis, and associated information feature analysis on the analyzed alarm results to obtain spatial characteristic values, spatiotemporal characteristic values, attack feature values, and associated information feature values.

[0134] The calculation unit is used to use the associated information feature value as an importance score, and calculate the urgency score based on the spatial characteristic value, spatiotemporal characteristic value and the attack feature value.

[0135] The determining unit is used to evaluate the quadrant based on the urgency and importance of the handling priority, as well as the importance score and the urgency score, to determine the handling priority of the analyzed alarm results.

[0136] Based on the above embodiments, the alarm device may further include:

[0137] The first processing module is used to perform deduplication and filtering on the different types of original alarms after acquiring the original alarms, and to perform noise reduction on the original alarms through a dual mode of rules and artificial intelligence to obtain the processed original alarms.

[0138] The second processing module is used to transform, map, clean and normalize the processed original alarms to obtain the final original alarms.

[0139] It should be noted that the order of the modules and units in the alarm processing device can be changed without affecting the logic.

[0140] The alarm processing device provided in this embodiment of the invention uses a data acquisition module 100 to acquire original alarms, including alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway. A merging module 200 is used to merge the original alarms using an algorithm model based on a dynamic time threshold to obtain merged alarm results. An analysis module 300 is used to perform correlation analysis on the merged alarm results using a hybrid algorithm model to obtain analyzed alarm results. The hybrid algorithm model is a model based on a combination of a time-series prediction algorithm and a neural network algorithm. An evaluation module 400 is used to evaluate the handling priority of the analyzed alarm results and handle them according to the evaluation results and the matched handling strategy. This device breaks down information barriers and silos between heterogeneous data in the water conservancy system by acquiring alarms from multiple sources, providing a complete foundation for subsequent analysis and avoiding missed threat detection. A merging model based on dynamic time thresholds reduces the number of original alarms by orders of magnitude, avoiding the repeated handling of a large number of identical and complex alarm events and significantly reducing manual intervention time. A hybrid model combining time-series prediction algorithms and neural network algorithms is used for multi-dimensional classification and prediction, minimizing the number of alarm events while ensuring no alarm information is lost. Combined with priority assessment and strategy matching, high-risk alarms can be responded to first, effectively avoiding losses from flood discharge accidents and water supply interruptions, providing core security support for the stable operation of smart water conservancy and digital twin watersheds.

[0141] The alarm processing device provided in the embodiments of the present invention will be described below. The alarm processing device described below can be referred to in correspondence with the alarm processing method described above.

[0142] Please refer to Figure 5 , Figure 5 A schematic diagram of an alarm processing device provided in an embodiment of the present invention may include:

[0143] Memory 10 is used to store computer programs;

[0144] The processor 20 is used to execute computer programs to implement the alarm processing method described above.

[0145] The memory 10, processor 20, and communication interface 31 all communicate with each other through the communication bus 32.

[0146] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the following functions:

[0147] Obtain raw alarms; raw alarms include alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway;

[0148] The original alarms are merged using an algorithm model based on dynamic time thresholds to obtain the merged alarm results;

[0149] A hybrid algorithm model is used to perform correlation analysis on the merged alarm results to obtain the analyzed alarm results; the hybrid algorithm model is a model based on the combination of time series prediction algorithm and neural network algorithm;

[0150] The alarm results after analysis are evaluated for priority handling, and the appropriate handling strategies are implemented based on the evaluation results.

[0151] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0152] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0153] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0154] Communication interface 31 can be an interface for the communication module, used to connect with other devices or systems.

[0155] Of course, it should be noted that, Figure 5 The structure shown does not constitute a limitation on the alarm processing device in the embodiments of the present invention. In practical applications, the alarm processing device may include more than Figure 5 More or fewer components as shown, or combinations of certain components.

[0156] The computer-readable storage medium provided in the embodiments of the present invention is described below. The computer-readable storage medium described below can be referred to in correspondence with the alarm processing method described above.

[0157] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the alarm processing method described above.

[0158] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0159] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0160] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0161] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0162] The above provides a detailed description of an alarm processing method, apparatus, device, and computer-readable storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An alarm processing method, characterized in that, include: Obtain the original alarms; the original alarms include alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway; The original alarms are merged using an algorithm model based on a dynamic time threshold to obtain the merged alarm result; The merged alarm results are analyzed using a hybrid algorithm model to obtain the analyzed alarm results; the hybrid algorithm model is a model based on a combination of time series prediction algorithm and neural network algorithm. The alarm results after analysis are evaluated for priority handling, and the handling is carried out according to the evaluation results and the matching handling strategy.

2. The alarm processing method according to claim 1, characterized in that, The original alarms are merged using an algorithm model based on a dynamic time threshold to obtain the merged alarm result, including: Monitor processing tables from at least two different data sources, and determine the alarm merging process type corresponding to the original alarm based on the data source type of the processing table; Determine whether the original alarm has generated an alarm event based on the unique identifier of the original alarm; If the alarm event has already been generated, then perform the alarm event update operation; If no alarm event is generated, the corresponding dynamic time threshold is obtained by combining the alarm merging process type and fingerprint value query time threshold table corresponding to the original alarm; a sliding time window is obtained based on the dynamic time threshold. If the original alarm is within the sliding time window, it is determined whether the alarm event exists within the sliding time window. If it does not exist, multiple original alarms that meet the conditions are merged into a new alarm event. If it exists, the original alarm is merged into the alarm event.

3. The alarm processing method according to claim 2, characterized in that, Before obtaining the corresponding dynamic time threshold, the following is also included: Based on the original alarms within a pre-preset time period, they are grouped according to the alarm merging process and the fingerprint value. For each group, the time interval between adjacent original alarms within the pre-preset time period is calculated. For each group, the sum of the time intervals within the group is calculated, and the average value and standard deviation are calculated based on the sum and the number of original alarms in the previous preset time period. For each group, the time threshold is calculated based on the mean and standard deviation within the group; The time threshold, the alarm merging process type, and the fingerprint value are associated and stored to obtain the time threshold table.

4. The alarm processing method according to claim 1, characterized in that, A hybrid algorithm model is used to perform correlation analysis on the merged alarm results to obtain the analyzed alarm results, including: The merged alarm results are converted into time-series data indexed by time. The time series data is decomposed into linear components and nonlinear residual components; Based on the linear component, a first model constructed using an autoregressive integral moving average algorithm is used to make predictions, and the prediction results of the linear component are obtained. Based on the nonlinear residual components, a second model based on a long short-term memory network is used for prediction to obtain the prediction results of the nonlinear residual components. The prediction results of the linear component and the prediction results of the nonlinear residual component are fused to obtain the alarm result after analysis.

5. The alarm processing method according to claim 4, characterized in that, The prediction results of the linear component and the prediction results of the nonlinear residual component are fused to obtain the alarm result after analysis, including: The prediction results of the linear component and the prediction results of the nonlinear residual component are fused using a linear superposition fusion algorithm, a nonlinear fusion algorithm, or a dynamic weight adjustment fusion algorithm. The formula for the linear superposition fusion algorithm is as follows: The formula for the nonlinear fusion algorithm is: The formula for the dynamic weight adjustment fusion algorithm is: ; The alarm results after analysis. The prediction results are for the linear components. The prediction results are for the nonlinear residual components; This refers to a nonlinear function implemented using a neural network. and As weight, and .

6. The alarm processing method according to any one of claims 1 to 5, characterized in that, The alarm results after analysis are used to assess the priority of handling, including: The alarm results after analysis are subjected to spatial characteristic analysis, spatiotemporal characteristic analysis, attack feature analysis, and associated information feature analysis to obtain spatial characteristic value, spatiotemporal characteristic value, attack feature value, and associated information feature value. The importance score is obtained by using the associated information feature value as the importance score, and the urgency score is calculated based on the spatial characteristic value, spatiotemporal characteristic value and attack feature value. The priority of handling alarm results after analysis is determined based on the priority assessment quadrants of urgency and importance, as well as the importance score and the urgency score.

7. The alarm processing method according to claim 1, characterized in that, After obtaining the original alarm, the following is also included: The original alarms of different types are deduplicated and filtered, and noise reduction is performed on the original alarms using a dual mode of rules and artificial intelligence to obtain the processed original alarms. The processed original alarms are then transformed, mapped, cleaned, and normalized to obtain the final original alarms.

8. An alarm processing device, characterized in that, include: The data acquisition module is used to acquire raw alarms; the raw alarms include alarms analyzed by the situational awareness system, alarms reported by various security devices, and alarms reported by the edge service gateway. The merging module is used to merge the original alarms using an algorithm model based on a dynamic time threshold, and obtain the merged alarm results. The analysis module is used to perform correlation analysis on the merged alarm results using a hybrid algorithm model to obtain the analyzed alarm results; the hybrid algorithm model is a model based on a combination of time series prediction algorithm and neural network algorithm; The evaluation module is used to evaluate the priority of handling the analyzed alarm results and to handle them according to the evaluation results and the matching handling strategy.

9. An alarm processing device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the alarm processing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the alarm processing method as described in any one of claims 1 to 7.

Images