Alarm analysis method and device and computer device

Abstract

The application relates to an alarm analysis method and device and a computer device. The method comprises the following steps: acquiring attack alarm information, wherein the attack alarm information represents suspected detection of an attack; analyzing the attack alarm information to obtain a confidence degree of the attack alarm information and a first alarm judgment result of the attack alarm information, wherein the first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a review strategy; determining a target review strategy from the review strategies corresponding to the multiple alarm judgment results based on the confidence degree; analyzing the attack alarm information by using the target review strategy to obtain a second alarm judgment result of the attack alarm information; and determining an alarm analysis result of the attack alarm information based on the first alarm judgment result and the second alarm judgment result. The method can improve the accuracy of alarm analysis.

Description

Technical Field

[0001] This application relates to the fields of log analysis and auditing, automated network security analysis, and artificial intelligence, and in particular to an alarm analysis method, apparatus, and computer equipment. Background Technology

[0002] With the rapid development of internet technology and the widespread adoption of web applications, cybersecurity threats are becoming increasingly severe. Security devices generate alarm data every day.

[0003] Traditional alert handling methods rely on security analysts manually parsing logs, reproducing attacks, and verifying evidence, which is prone to errors. Furthermore, different analysts may arrive at different conclusions for the same alert, leading to inconsistent assessments and consequently, low accuracy in alert analysis. Summary of the Invention

[0004] Therefore, it is necessary to provide an alarm analysis method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the accuracy of alarm analysis in response to the above-mentioned technical problems.

[0005] On one hand, this application provides an alarm analysis method, comprising: acquiring attack alarm information, wherein the attack alarm information represents a suspected attack; analyzing the attack alarm information to obtain a confidence level of the attack alarm information and obtaining a first alarm judgment result of the attack alarm information, wherein the first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a review strategy; determining a target review strategy from the review strategies corresponding to the multiple alarm judgment results based on the confidence level; analyzing the attack alarm information using the target review strategy to obtain a second alarm judgment result of the attack alarm information; and determining an alarm analysis result of the attack alarm information based on the first alarm judgment result and the second alarm judgment result.

[0006] On the other hand, this application also provides an alarm analysis device, comprising: an alarm acquisition module for acquiring attack alarm information, wherein the attack alarm information indicates a suspected attack; a first analysis module for analyzing the attack alarm information to obtain a confidence level of the attack alarm information and a first alarm judgment result of the attack alarm information, wherein the first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a review strategy; a strategy filtering module for determining a target review strategy from the review strategies corresponding to the multiple alarm judgment results based on the confidence level; a second analysis module for analyzing the attack alarm information using the target review strategy to obtain a second alarm judgment result of the attack alarm information; and a judgment result acquisition module for determining an alarm analysis result of the attack alarm information based on the first alarm judgment result and the second alarm judgment result.

[0007] On the other hand, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described alarm analysis method.

[0008] On the other hand, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described alarm analysis method.

[0009] On the other hand, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the above-described alarm analysis method.

[0010] The aforementioned alarm analysis method, apparatus, computer equipment, computer-readable storage medium, and computer program product acquire attack alarm information, which indicates a suspected attack. The attack alarm information is analyzed to obtain a confidence level and a first alarm judgment result. This first alarm judgment result is one of several alarm judgment results, each corresponding to a verification strategy. Based on the confidence level, a target verification strategy is determined from the verification strategies corresponding to the various alarm judgment results. The attack alarm information is then analyzed using the target verification strategy to obtain a second alarm judgment result. Finally, the first and second alarm judgment results are combined to determine the alarm analysis result, thereby improving the accuracy of the target alarm judgment result and the overall accuracy of the alarm analysis. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a diagram illustrating the application environment of an alarm analysis method in one embodiment;

[0013] Figure 2 This is a flowchart illustrating an alarm analysis method in one embodiment;

[0014] Figure 3 This is a flowchart illustrating the process of outputting a manual review prompt message in one embodiment.

[0015] Figure 4 This is a structural block diagram of an alarm analysis device in one embodiment;

[0016] Figure 5 This is an internal structural diagram of a computer device in one embodiment;

[0017] Figure 6 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0019] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0020] With the rapid development of internet technology and the widespread adoption of web applications, cybersecurity threats are becoming increasingly severe. Security devices such as Web Application Firewalls (WAFs), Intrusion Detection Systems (IDS), and vulnerability scanners generate massive amounts of alert data daily. Research reports indicate that large enterprise security operations centers need to process over 100,000 raw alerts daily, of which over 90% are invalid or false alarms, and less than 1% are truly high-value alerts requiring attention. Current alert processing faces the following technical bottlenecks: 1. Heterogeneous alert sources: Log formats and field meanings vary significantly across different vendors; 2. High false alarm rate: Rule-triggered alerts lack contextual and semantic understanding capabilities; 3. High cost of manual analysis: Security analysts need to repeatedly perform log parsing, attack reproduction, and evidence verification; 4. Inconsistent analysis conclusions: Different analysts may arrive at different conclusions for the same alert; 5. Insufficient automation capabilities: Existing systems are mostly based on a "rule + single model" architecture, lacking the ability to review, correct errors, and self-correct.

[0021] Based on this, embodiments of this application provide an alarm analysis method, which can be applied to, for example... Figure 1 In the application environment shown, security device 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on another network server.

[0022] Specifically, security device 102 can send attack alarm logs to server 104. Server 104 obtains attack alarm information based on the attack alarm logs. The attack alarm logs represent suspected attack detections, and the attack alarm information represents suspected attack detections. The attack alarm information can be from the attack alarm logs. Server 104 analyzes the attack alarm information to obtain the confidence level of the attack alarm information and obtains a first alarm judgment result. The first alarm judgment result is one of several alarm judgment results, and each alarm judgment result corresponds to a review strategy. Based on the confidence level, a target review strategy is determined from the review strategies corresponding to the various alarm judgment results. The attack alarm information is analyzed using the target review strategy to obtain a second alarm judgment result. Combining the first and second alarm judgment results, the alarm analysis result of the attack alarm information is determined.

[0023] Among them, security device 102 may be, but is not limited to, a Web Application Firewall (WAF), an Intrusion Detection System (IDS), and a vulnerability scanner. Server 104 may be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0024] In one exemplary embodiment, such as Figure 2 As shown, an alarm analysis method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the following steps are included:

[0025] Step 202: Obtain attack alarm information. Attack alarm information indicates that an attack has been suspected to be detected.

[0026] Attack alerts can be generated from alert logs. Alert logs are logs indicating suspected attacks; therefore, alert logs can also be called attack alert logs. Alert logs can be, but are not limited to, web alert logs. The source of alert logs can be, but is not limited to, security devices.

[0027] The alarm analysis method provided in this application can be used to analyze multi-source alarm logs, i.e., alarm logs from multiple different sources, where "multiple" means at least two. Multiple sources can be, for example, multiple different security devices. However, since the formats of alarm logs from different sources may be the same or different, for example, the format of alarm logs may be, but is not limited to, json, python dict, kv, cef, leef, wal, and syslog. Here, "cef" is an abbreviation for Common Event Format, "dict" is an abbreviation for dictionary, "kv" is an abbreviation for key-value pairs, "leef" is an abbreviation for Log Event Extended Format, "WAL" is an abbreviation for Write-Ahead Logging, and "Syslog" is an abbreviation for System Logging Protocol.

[0028] To facilitate the analysis of alert logs from different sources, attack alert information in a unified format can be generated based on the attack alert logs. For example, web alert logs from different security devices can be parsed, decoded, cleaned, and normalized at least once, converting each web alert log from the multi-source heterogeneous web alert logs into a structured alert log. For instance, attack alert logs from security devices can be structured, and attack alert information can be obtained based on the structured alert logs; for example, the structured alert logs can be used as attack alert information. The structured format can be, but is not limited to, standard JSON format.

[0029] For example, attack alert information can be obtained by mapping fields in attack alert logs or structured alert logs to a standardized field set. The standardized field set contains multiple standardized fields, which can be set according to actual needs. For instance, for each field in the structured alert log, a standardized field matching that field is determined from the standardized field set, and that field in the structured alert log is replaced with the matching standardized field. The structured alert log can then be padded with standardized fields to obtain the attack alert information. If field 1 matches standardized field A, it can be understood that field 1 represents the same meaning as standardized field A. Since the number of fields in the structured alert log may be less than the number of fields in the standardized field set, meaning the structured alert log may lack some fields matching standardized fields, standardized field padding can be performed on the structured alert log. That is, if no matching standardized field exists in the structured alert log, the corresponding standardized field is added. Since attack alert logs may be encoded... Therefore, the fields and / or field values ​​in the attack alert log can be decoded before the attack alert log is converted to a structured alert log, or the fields and / or field values ​​in the structured alert log can be decoded after the attack alert log is converted to a structured alert log.

[0030] For example, when the attack alarm log is encoded, the attack alarm log can be structured to obtain a structured alarm log; the structured alarm log can be decoded to obtain a decoded alarm log; and the fields in the decoded alarm log can be mapped to a standardized field set to obtain the attack alarm information.

[0031] For example, when the attack alarm log is unencoded, it can be structured to obtain a structured alarm log. The fields in the structured alarm log can be mapped to fill a standardized field set to obtain the attack alarm information.

[0032] Attack alert logs from security devices can also be called raw alert logs. For example, a raw alert log in CEF format might look like this: "CEF:0|Imperva|SecureSphere|13.5|2003|Brute Force AttackDetected|7|src=192.168.1.105 dst=10.0.0.5 dpt=443 proto=TCP act=Block msg=Toomany failed login attempts within 1 minute requestClientApplication=Mozilla / 5.0". This raw alert log's alert type is "Brute Force Attack," indicating that a brute force attack has been detected. A structured alert log obtained from a raw alert log in CEF format might look like this:

[0033] {

[0034] "cef_version": "0",

[0035] "vendor": "Imperva",

[0036] "product": "XX",

[0037] "version": "13.5",

[0038] "signature_id": "2003",

[0039] "name": "Brute Force Attack Detected",

[0040] "severity": "7",

[0041] src: "192.168.1.105",

[0042] "dst": "10.0.0.5",

[0043] "dpt": "443",

[0044] "proto": "TCP",

[0045] "act": "Block",

[0046] "msg": "Too",

[0047] "requestClientApplication": "Mozilla / 5.0"

[0048] }

[0049] Here, `cef_version` is a standardized field representing the CEF format version. `vendor` is a standardized field representing the security device vendor. `product` is a standardized field representing the product name. `Version` is a standardized field representing the product version number. `signature_id` is a field representing the rule ID or signature ID. `name` is a field representing the alarm name; `Brute Force Attack Detected` means "Brute-force attack detected". `Severity` is a field representing the authentication level. `Src` is a field representing the attack source IP address, `dst` is a field representing the target server IP address, `dpt` is a field representing the target port, `proto` is a resource representing the protocol used, `act` is a field representing the action taken, `Block` represents the blocked action taken, `msg` is a field representing the message description, and `requestClientApplication` is a field representing the User-Agent used by the attacker.

[0050] For example, library functions or tools can be used to automatically decode various encodings such as Base64, URL, Hex, and Unicode to address the issue of truncated encoded fields in the original alarm logs.

[0051] For example, the attack alert log includes: "payload": "R0VUIC9jb2xsZWN0P3Vj……". Here, "payload" is the field representing the attack payload, and "R0VUIC9jb2xsZWN0P3Vj……" is the encoded attack payload. Decoding it with a decoding tool yields: "payload": "GET / collect?uc_param_str=dnds……".

[0052] For example, attack alert information can be generated by a data cleaning agent. The data cleaning agent can use heuristic rules and machine learning classifiers to identify the format of attack alert logs and perform format conversion to obtain structured alert logs. For example, it can convert attack alert logs in JSON, Python dict, kv, cef, leef, wal, or syslog formats into standard JSON format logs.

[0053] For example, the completeness of the attack alert information and the matching degree of the attack alert information can be determined. The matching degree reflects the degree of matching between different pieces of information in the attack alert information. Based on at least one of the completeness and matching degree, the confidence level of the attack alert information is determined. For instance, either the completeness or the matching degree can be used as the confidence level of the attack alert information. Alternatively, the completeness and matching degree can be weighted to obtain the confidence level of the attack alert information.

[0054] Step 204: Analyze the attack alarm information to obtain the confidence level of the attack alarm information and obtain the first alarm judgment result of the attack alarm information. The first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a review strategy.

[0055] The confidence level of the attack alert information reflects the credibility of the attack alert information. Multiple alert judgment results include, but are not limited to, one or more of the following: "attack successful," "attack failed," "false alarm," and "insufficient information."

[0056] The verification strategy can be based on LLM (Large Language Model). For example, the verification strategy can be implemented using an agent. For instance, the verification strategy corresponding to "attack success" is "attack success verification agent", the verification strategy corresponding to "attack failure" is "attack failure verification agent", the verification strategy corresponding to "false positive" is "false positive verification agent", and the verification strategy corresponding to "insufficient information" is "data to be supplemented verification agent".

[0057] Step 206: Determine the target review strategy from the review strategies corresponding to the various alarm judgment results based on the confidence level.

[0058] Among them, confidence level refers to the confidence level of attack alert information.

[0059] For example, for each review strategy, the review probability of the review strategy is determined based on the accuracy and confidence of the review strategy; if the review probability of the review strategy is greater than the probability threshold, the review strategy is determined as the target review strategy.

[0060] Step 208: Analyze the attack alarm information using the target verification strategy to obtain the second alarm judgment result of the attack alarm information.

[0061] The second alarm judgment result is one of the multiple alarm judgment results.

[0062] For example, the verification strategy corresponding to "attack success" is "attack success verification agent", the verification strategy corresponding to "attack failure" is "attack failure verification agent", the verification strategy corresponding to "false alarm" is "false alarm verification agent", and the verification strategy corresponding to "insufficient information" is "data to be supplemented verification agent".

[0063] Step 210: Based on the first alarm judgment result and the second alarm judgment result, determine the alarm analysis result of the attack alarm information.

[0064] The alarm analysis results may include a first alarm judgment result, a second alarm judgment result, the content on which the first alarm judgment result is based, the content on which the second alarm judgment result is based, and the confidence level of the attack alarm information. The alarm analysis results may be generated through an alarm analysis model; for example, steps 202-210 may be implemented based on an alarm analysis model.

[0065] For example, the target alarm judgment result can be determined based on the alarm analysis results. If the first alarm judgment result and the second alarm judgment result are inconsistent, the second alarm judgment result is determined as the target alarm judgment result. If the first alarm judgment result and the second alarm judgment result are consistent, then the target alarm judgment result is either the first alarm judgment result or the second alarm judgment result. The target alarm judgment result can be understood as the alarm judgment result automatically and ultimately determined by the attack alarm information, for example, the alarm judgment result determined by the alarm analysis model for the attack alarm information.

[0066] For example, if the confidence level of the second alarm judgment result is lower than the confidence level threshold, a manual review prompt message is output, and the alarm judgment result determined by the human review of the attack alarm information is obtained. The alarm judgment result determined by the human is used as the target alarm judgment result.

[0067] For example, determine whether the attack alarm information or attack alarm log has storage value, such as whether it is a real attack or a high-value false alarm. If so, store it in the alarm database or knowledge base.

[0068] In the above alarm analysis method, attack alarm information is acquired, which indicates a suspected attack. The attack alarm information is analyzed to obtain the confidence level of the attack alarm information and obtain a first alarm judgment result. The first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a verification strategy. Based on the confidence level, a target verification strategy is determined from the verification strategies corresponding to the multiple alarm judgment results. The attack alarm information is analyzed using the target verification strategy to obtain a second alarm judgment result. The first alarm judgment result and the second alarm judgment result are combined to determine the alarm analysis result of the attack alarm information, thereby improving the accuracy of the target alarm judgment result and the accuracy of alarm analysis.

[0069] In an exemplary embodiment, determining the confidence level of attack alarm information includes: determining the information completeness of the attack alarm information; determining the information matching degree of the attack alarm information, wherein the information matching degree reflects the degree of matching between different pieces of information in the attack alarm information; and determining the confidence level of the attack alarm information based on the information completeness and the information matching degree.

[0070] The attack alert information may include an attack payload, which reflects the attacker's malicious intent and attack methods. The attack alert information may also include the attack type and attack response content, which characterizes the response or action taken in response to the attack.

[0071] Information matching degree can include at least one of attack semantic matching degree and response feature matching degree. Attack semantic matching degree refers to the degree of matching between the attack payload and the attack type. Response feature matching degree refers to the degree of matching between the attack payload and the attack response content.

[0072] For example, the confidence level of an attack alert can be determined based on at least one of the attack semantic matching degree and the response feature matching degree, as well as the information completeness. For instance, the confidence level of the attack alert can be obtained by weighting at least one of the attack semantic matching degree and the response feature matching degree with the information completeness.

[0073] For example, the confidence level of an attack alert can be calculated using the following formula:

[0074]

[0075] in, Represents the completeness of information. Represents the semantic matching degree of the attack. This represents the degree of matching of response features. , and Represents weight. This represents the Sigmoid function, which maps any real number to the interval (0, 1). This represents the confidence level of the attack alert information.

[0076] In this embodiment, combining information completeness and information matching can improve the accuracy of the confidence level of attack alarm information.

[0077] In an exemplary embodiment, obtaining attack alarm information includes: obtaining attack alarm logs, mapping fields in the attack alarm logs to standardized fields in a standardized field set to obtain attack alarm information; determining the information completeness of the attack alarm information includes: using the proportion of standardized fields with corresponding field values ​​in the attack alarm information to determine the information completeness of the attack alarm information.

[0078] The process of generating attack alert information has been described previously and will not be repeated here. Since attack alert information may contain some completed standardized fields without corresponding values, for example, the attack alert information might be:

[0079] {

[0080] "timestamp": "XX...",

[0081] "src_ip": "XX...",

[0082] "dst_url": "XX...",

[0083] "payload": "...",

[0084] "decode_chain": ["url", "base64"],

[0085] "device_type": "WAF",

[0086] "raw_integrity": 0.93

[0087] "Field 1":

[0088] "Field 2":

[0089] "Field 3":

[0090] }

[0091] Among them, Field 1, Field 2 and Field 3 are the completed standardized fields, and Field 1, Field 2 and Field 3 are missing field values.

[0092] For example, the number of standardized fields with corresponding field values ​​in the attack alarm information can be counted to obtain a first quantity. The total number of all standardized fields in the attack alarm information can then be obtained. The information completeness of the attack alarm information can be determined based on the ratio of the first quantity to the total quantity. Information completeness is positively correlated with this ratio. For instance, the ratio of the first quantity to the total quantity can be used as the information completeness.

[0093] For example, the standardized fields in the standardized field set are divided into required fields and optional fields. The proportion of required fields with corresponding values ​​in the attack alarm information among all required fields or among all standardized fields can be determined to obtain the required field proportion. Similarly, the proportion of optional fields with corresponding values ​​in the attack alarm information among all optional fields or among all standardized fields can be determined to obtain the optional field proportion. Then, based on the required field proportion and the optional field proportion, the information completeness of the attack alarm information is determined. Information completeness is positively correlated with the required field proportion, and information completeness is also positively correlated with the optional field proportion.

[0094] For example, the weights corresponding to the percentages of required fields and optional fields can be obtained respectively. The weights are then used to calculate the weighted average of the required and optional field percentages to obtain the information completeness. The weights can be set according to actual needs. For example, the weight of the required field percentage can be greater than the weight of the optional field percentage. For instance, the weight of the required field percentage could be 0.6, and the weight of the optional field percentage could be 0.4. The formula for calculating information completeness is:

[0095]

[0096] in, Represents the completeness of information. This represents the percentage of required fields. This represents the percentage of optional fields.

[0097] In this embodiment, the completeness of the attack alarm information is determined by the proportion of standardized fields with corresponding field values ​​in the attack alarm information, which can ensure the reliability of the completeness of the information.

[0098] In an exemplary embodiment, a target review strategy is determined from the review strategies corresponding to various alarm judgment results based on confidence level, including: for each review strategy, determining the review probability of the review strategy based on the accuracy and confidence level of the review strategy; if the review probability of the review strategy is greater than the probability threshold, the review strategy is determined as the target review strategy.

[0099] The accuracy of the review strategy can also be the credibility of the review strategy (e.g., historical credibility or current credibility).

[0100] For example, the accuracy and confidence of the review strategy can be fused to obtain the fusion result corresponding to the review strategy; based on the fusion result corresponding to the review strategy, the review probability of the review strategy can be determined.

[0101] In this embodiment, when the probability of a review strategy is greater than the probability threshold, the review strategy is determined as the target review strategy, which can improve the accuracy of the second alarm judgment result obtained from the review.

[0102] In an exemplary embodiment, determining the review probability of a review strategy based on its accuracy and confidence includes: fusing the accuracy and confidence of the review strategy to obtain a fusion result corresponding to the review strategy; and determining the review probability of the review strategy based on the proportion of the fusion result corresponding to the review strategy in the fusion results corresponding to multiple review strategies respectively.

[0103] The accuracy of the review strategy can also be its credibility (e.g., historical credibility or current credibility). The likelihood of review is positively correlated with the proportion; for example, the proportion of the fusion result corresponding to a review strategy among the fusion results corresponding to multiple review strategies can be used as the likelihood of review for that strategy. Fusion can include at least one of weighted operations, product operations, or exponential operations.

[0104] For example, the first The fusion result corresponding to each review strategy = .in, and The balancing parameters can be set using empirical values ​​or according to actual needs. For the first The accuracy of each review strategy (e.g., historical accuracy or current accuracy). The likelihood of a review is calculated as follows:

[0105]

[0106] in, For the first The likelihood of review by each review strategy. This represents the accuracy of any review strategy. N is the number of review strategies.

[0107] For example, the first The fusion result corresponding to each review strategy = .in, For the first The accuracy of each review strategy. The calculation method for review probability is as follows:

[0108]

[0109] in: This represents the accuracy of the j-th review strategy. This represents the likelihood of review for the j-th review strategy. This represents the accuracy of any review strategy.

[0110] In this embodiment, the verification probability of a verification strategy is determined based on the proportion of the fusion result corresponding to the verification strategy in the fusion results corresponding to multiple verification strategies, which can improve the reliability of the verification probability.

[0111] In one exemplary embodiment, there are at least two target review strategies, such as Figure 3 As shown, the method further includes: step 302, determining that each target review strategy is the second alarm judgment result generated by the attack alarm information; step 304, for each alarm judgment result, determining the matching target review strategy corresponding to the alarm judgment result, and the second alarm judgment result generated by the matching target review strategy is consistent with the alarm judgment result; step 306, generating the result score corresponding to the alarm judgment result based on the confidence level of the matching target review strategy under the attack alarm information; step 308, if the result scores corresponding to the various alarm judgment results determine that the conditions for manual review are met, outputting manual review prompt information.

[0112] The second alarm judgment result is one of several alarm judgment results. The second alarm judgment result obtained by different target review strategies may be the same or different.

[0113] The manual review prompt message is used to prompt manual review of the attack alarm information or the corresponding attack alarm log to determine the alarm judgment result of the attack alarm information or the corresponding attack alarm log.

[0114] For example, the result score corresponding to the alarm judgment result can be calculated using the following formula:

[0115]

[0116] in, This represents the m-th alarm judgment result among multiple alarm judgment results. This represents the weight, accuracy, or reliability of the nth review strategy. This represents the confidence level of the nth review strategy under the ith attack alert. The ith attack alert can be any attack alert. This represents the second alarm judgment result generated for the nth review strategy based on the i-th attack alarm message. and Under the condition of consistency, The value is 1. and In case of inconsistency, The value of is 0. The result score represents the judgment result of the m-th alarm.

[0117] For example, the maximum and second maximum result scores can be determined from the result scores corresponding to various alarm judgment results. If the difference between the maximum and second maximum result scores is less than a target threshold, it is determined that the conditions for manual review are met; otherwise, it is determined that the conditions for manual review are not met. For example, if If so, it is determined that the conditions for manual review are met. Represents the maximum result score. This represents the second-largest result score. This represents the target threshold, which can be set based on experience or actual needs.

[0118] For example, the alarm judgment result corresponding to the maximum result score can be output. The alarm judgment result corresponding to the maximum result score is, for example,... :

[0119]

[0120] In this embodiment, if the results score corresponding to the various alarm judgment results determines that the conditions for manual review are met, a manual review prompt message is output, so that manual review can be performed when the automatic judgment result is inaccurate.

[0121] In an exemplary embodiment, the alarm analysis results are generated using an alarm analysis model; the method further includes: obtaining processing evaluation information of the alarm analysis model for attack alarm information, the processing evaluation information including at least one of efficiency evaluation value, consistency evaluation value and evidence reliability evaluation value; and adjusting the alarm analysis model based on at least one of the efficiency evaluation value, consistency evaluation value and evidence reliability evaluation value.

[0122] The evaluation information is used to evaluate the process by which the alarm analysis model generates alarm analysis results based on attack alarm information.

[0123] The consistency evaluation value is used to characterize whether the alarm judgment result of manual attack alarm information is consistent with the alarm judgment result of the alarm analysis model. For example, using This represents the consistency assessment value. If... If, then it represents consistency, if This indicates inconsistency. For example, .in, This represents the alarm judgment result determined by the alarm analysis. This represents the alarm judgment result determined manually based on the attack alarm information.

[0124] Efficiency evaluation values ​​are used to characterize the efficiency of the alarm analysis model in generating alarm analysis results based on attack alarm information. They can represent alarm processing speed and resource efficiency. For example, using... This represents the efficiency evaluation value, and the formula for calculating the efficiency evaluation value can be:

[0125]

[0126] in, This represents the actual processing time. This represents the maximum allowed processing time. The maximum allowed processing time can be set according to actual needs.

[0127] The evidence reliability assessment value reflects the reliability of the chain of evidence upon which the alarm analysis results are based. It reflects the completeness, verifiability, and interpretability of the chain of evidence. The evidence reliability assessment value can be used... express.

[0128] For example, the PPO (Proximal Policy Optimization) algorithm is used to update the alarm analysis model (also known as the policy network). For instance, a reward function can be determined, which is a weighted calculation of at least two of the efficiency assessment value, consistency assessment value, and evidence reliability assessment value. The reward function can be used to adjust the alarm analysis model. For example, the reward function might be:

[0129]

[0130] in, , and For weights.

[0131] In this embodiment, the alarm analysis model is adjusted based on at least one of the efficiency evaluation value, consistency evaluation value, and evidence reliability evaluation value, thereby improving the accuracy of the alarm analysis model.

[0132] In an exemplary embodiment, the method further includes: obtaining alarm analysis results corresponding to attack alarm information, wherein the alarm analysis results include target alarm judgment results and judgment basis content, wherein the judgment basis content includes multiple pieces of evidence on which the target alarm judgment results are based; obtaining the credibility weights corresponding to the multiple pieces of evidence, wherein the credibility weights are determined according to the source of the corresponding evidence; obtaining the confidence levels corresponding to the multiple pieces of evidence; and determining the confidence level of the judgment basis content based on the credibility weights and confidence levels corresponding to the multiple pieces of evidence.

[0133] The alarm analysis results can also include the confidence level of attack alarm information, the first alarm judgment result, the second alarm judgment result, and the confidence levels corresponding to each of these multiple pieces of evidence. The alarm analysis results can be output.

[0134] The credibility weight is determined based on the reliability of the source of the corresponding evidence; the more reliable the source, the greater the credibility weight. The confidence level corresponding to the evidence reflects the degree of credibility of the evidence. The confidence level corresponding to the evidence can be generated by the alarm analysis model.

[0135] Multiple pieces of evidence include at least one of the following: payload characteristics, server response characteristics, historical similar cases, and knowledge base matching results.

[0136] For example, the confidence levels of multiple pieces of evidence can be weighted using their respective credibility weights to obtain the confidence level of the content on which the analysis is based. For instance, the confidence level of the content on which the analysis is based can be calculated using the following formula:

[0137]

[0138] in, Representing the The credibility weight corresponding to each piece of evidence. Representing the The confidence level corresponding to each piece of evidence. This represents the amount of evidence.

[0139] In this embodiment, the confidence level of the judgment basis is determined based on the credibility weights and confidence levels of multiple pieces of evidence, thereby allowing the credibility of the judgment basis to be measured.

[0140] The alarm analysis model in the alarm analysis method of this application can be based on multi-agent collaboration. Each agent communicates through a standardized intermediate data structure, forming a closed-loop judgment process of "cleaning -> understanding -> routing -> review -> learning". For example, the overall process includes:

[0141] 1. Data Cleaning Agent: Responsible for parsing, decoding, and standardizing multi-source heterogeneous alarm logs.

[0142] The data cleaning agent's functions include: parsing, decoding, cleaning, and normalizing raw web alert logs from different security devices; converting multi-source heterogeneous web alert logs into structured alert logs; and automatically identifying and converting log format types using heuristic rules and machine learning classifiers. For example, it can convert data from JSON, Pythondict, key-value pairs, CEF, LEEF, WAL, and syslog into standard JSON format. This provides a high-quality, low-noise input data foundation for subsequent intelligent analysis. A `raw_integrity` field is introduced to quantify the integrity of the raw logs, providing input for subsequent confidence calculations. Information completeness and attack alert information can be generated by the data cleaning agent.

[0143] 2. Semantic Preliminary Assessment Agent: Based on LLM, attack intent is identified and preliminarily assessed.

[0144] The semantic preliminary judgment agent adopts a "knowledge enhancement + constraint reasoning" architecture, and performs semantic understanding and preliminary judgment on the cleaned alarm data based on LLM. The judgment content includes: (1) attack intent analysis: through the knowledge retrieval module, TOP-K related attack patterns (such as SQL injection, command execution, file inclusion, etc.) are retrieved from the security knowledge base; (2) preliminary judgment on whether the attack was successful; (3) extraction of key judgment evidence (such as payload, response features and contextual information, etc.); (4) output of preliminary judgment type label. The type label is the alarm judgment result. The preliminary judgment type label is the first alarm judgment result. The output content of the semantic preliminary judgment agent is as follows:

[0145] {

[0146] "judgment": "Preliminary assessment of type tags",

[0147] "evidence": ["payload contains sleep()", "no database response characteristics"],

[0148] "confidence": 0.72

[0149] }

[0150] Here, confidence represents the level of confidence in the attack alert information.

[0151] The semantic initialization agent uses Chain of Thought (COT) prompting technology to require the model to demonstrate its reasoning process. It introduces an "explicit evidence" mechanism to avoid simply providing conclusions without interpretability. It can also calculate the attack semantic matching degree and response feature matching degree, as well as the confidence level of attack alert information. Evidence constraints can be implemented, mandating that conclusions be supported by evidence.

[0152] For example, in response to the limitations of a single LLM in the security field, this application supports a knowledge-enhanced reasoning framework, which supports: (1) real-time retrieval of security knowledge base: before LLM reasoning, relevant attack knowledge is retrieved from CVE (Common Vulnerabilities and Exposures) databases, ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) frameworks, etc.; (2) tool call middleware layer: a standardized tool call interface is designed to enable LLM to call professional verification tools such as SQL (Structured Query Language) simulators and HTTP (Hypertext Transfer Protocol) replay tools; (3) evidence-constrained reasoning: in the prompt word project, LLM is required to reason based on verified evidence to reduce the risk of "illusion".

[0153] 3. Dynamic Routing Decision Agent: Intelligently routes traffic based on the initial judgment results and confidence level.

[0154] The routing agent employs probabilistic traffic splitting, calculating the probability of traffic entering each review agent based on the initial judgment result and confidence level, thus achieving intelligent traffic splitting for alarm analysis. The dynamic routing decision agent can execute the above steps of "determining the target review strategy from the review strategies corresponding to various alarm judgment results based on confidence level".

[0155] The advantages of this dynamic routing decision agent include: different specialized agents handle different assessment scenarios; it avoids a "one-size-fits-all" unified assessment strategy; and it improves the overall system stability and accuracy. It features non-fixed routing; the same alarm can be processed by multiple agents in parallel; and it supports dynamically expanding new review strategies.

[0156] 4. Review and Analysis of Agent Clusters: Includes specialized modules for reviewing agent clusters with data to be supplemented, such as attack failure, attack success, false alarms, and agent clusters with data to be supplemented.

[0157] The verification and analysis agent cluster includes multiple verification agents with different focuses, such as attack success verification agents, attack failure verification agents, false alarm verification agents, and data supplementation verification agents. This cluster is used to perform secondary and in-depth verification of the initial analysis results.

[0158] The attack failure review agent can be used to: determine whether an attack was intercepted or failed naturally; analyze server return characteristics; and call tools to perform payload semantic simulation. The attack success review agent can be used to: determine if an attack has a real impact; verify signs of data leakage, command execution, etc.; and compare with historical attack samples. The false positive review agent can be used to: identify situations where normal business requests are misjudged; analyze business context and access patterns; and output explanations for the causes of false positives. The data supplementation agent can be used to: identify missing log fields; generate supplementary data suggestions (such as suggesting association with access logs); and mark alerts as not meeting the conditions for final judgment. Common characteristics of all agents include: the ability to call external tools or knowledge bases; support for contextual reasoning and evidence enhancement; and output auditable review conclusions.

[0159] 5. Evidence Fusion and Consistency Judgment Agent: Integrates multi-source analysis results to resolve conflicting conclusions.

[0160] The Evidence Fusion and Consistency Assessment Agent can be used to synthesize and verify the results of multiple review paths. This includes: merging conclusions from multiple agents; handling conflicting conclusions (such as voting or confidence-weighted approaches); outputting the final assessment result and evidence chain; and generating standardized structured alert objects.

[0161] The evidence fusion and consistency judgment agent can be used to perform the following: "For each alarm judgment result, determine the matching target review strategy corresponding to the alarm judgment result; the second alarm judgment result generated by the matching target review strategy is consistent with the alarm judgment result; based on the confidence level of the matching target review strategy under the attack alarm information, generate the result score corresponding to the alarm judgment result; and if the result score corresponding to multiple alarm judgment results determines that the conditions for manual review are met, output the manual review prompt information."

[0162] 6. Risk Scoring Agent: Quantifies security risk values ​​and assists in prioritizing alarms.

[0163] Quantifying security risks through multiple dimensions:

[0164]

[0165] in, This represents a risk score. The potential impact score (0-10) reflects the data sensitivity or system criticality. The probability of a successful attack (0-10) is determined based on the assessment conclusion and the strength of the evidence. Represents the target asset value (0-10), obtained from the Configuration Management Database (CMDB). The target asset value refers to the value of the attacked asset. This represents the threat intelligence match score (0-10), such as the degree of match with known APT group TTPs. APT stands for Advanced Persistent Threat, and TTPs stands for Tactics, Techniques, and Procedures.

[0166] 7. Knowledge Graph Association Agent: Enables cross-alarm correlation analysis and identifies API (Application Programming Interface) attack patterns.

[0167] Knowledge graph association agents are used to construct attack relationship networks. In these networks, node types can include IP (Internet Protocol Address) addresses, URL (Uniform Resource Locator Path) paths, payload characteristics, attack types, and victim assets; edge types can include access relationships, attack relationships, and similarity relationships. The association algorithm can include anomaly subgraph detection based on graph neural networks. Application scenarios can include: APT attack chain reconstruction; attacker profiling; and early detection of zero-day vulnerabilities. The "0" in "0day" refers to the number of days since the vulnerability was publicly disclosed or a patch was released.

[0168] 8. Storage Decision Agent: Determines the value of alarm storage and optimizes the quality of the knowledge base.

[0169] The storage decision agent is used to determine whether an alert that has undergone analysis has storage value. The criteria for this determination include: whether it is a real attack or a high-value false alarm; whether it has value for training, tracing, or auditing; and whether it highly overlaps with existing samples.

[0170] The processing results include: if storage is required, write it to the alarm database or knowledge base; if storage is not required, discard it directly or archive it with low priority.

[0171] 9. Feedback Learning Agent: Continuously optimizes judgment strategies based on human confirmation results.

[0172] The feedback learning agent employs a multi-objective optimization framework to automatically optimize the judgment strategy. Optimization objectives include at least one of the following: maximizing judgment accuracy, minimizing human intervention, minimizing judgment delay, and maximizing evidence quality. Training data includes: manually verified judgment results, detailed analysis of misjudgment cases, and high-quality data from the alert database or knowledge base. Update strategies include: weekly incremental training of the routing decision model, monthly updates to the knowledge base of each review agent, and quarterly reconstruction of the LLM prompt template.

[0173] The agents communicate with each other via standardized JSON data, forming a pluggable and scalable analysis chain. The analysis by the agent refers to the automated cognitive process by which the agent analyzes, reasons, judges, and forms decision conclusions from information.

[0174] This application achieves the following through a specialized division of labor and collaborative decision-making mechanism: standardized cleaning and structuring of alarm data; preliminary semantic analysis based on a large language model; intelligent routing and professional verification according to the analysis type; in-depth evidence completion through tool calls; output of highly consistent and reliable analysis results; and construction of a sustainably evolving alarm knowledge and sample system. It can address issues including: instability of single models; high false alarm rates; uninterpretable analysis results; difficulty in quantifying alarm value; and lack of continuous system evolution capabilities. By introducing a multi-agent collaborative mechanism, dynamic routing strategy, evidence-driven analysis model, and feedback learning mechanism, an interpretable, verifiable, and sustainably optimizable automated Web alarm analysis system is achieved. This application employs an explicit chain of evidence, requiring each analysis step to provide verifiable evidence, rather than merely outputting conclusions.

[0175] This application has at least the following advantages: multi-agent collaborative judgment significantly reduces the risk of misjudgment by a single model; the judgment process is interpretable and verifiable, meeting the needs of security auditing; the judgment logic is highly modular, making it easy to expand to new attack types; it supports tool enhancement and knowledge evolution, and the system has continuous learning capabilities; it reduces the cost of manual judgment in the SOC (Security Operations Center) and improves overall operational efficiency.

[0176] This application standardizes multi-source heterogeneous Web security alert logs through a data cleaning agent; utilizes a semantic preliminary judgment agent based on a large language model for initial analysis, generating attack intent analysis and evidence chains; a dynamic routing decision agent intelligently routes alerts based on the preliminary judgment results; a cluster of different types of verification and judgment agents performs professional in-depth verification of alerts; an evidence fusion and consistency judgment agent integrates the multi-source judgment results; and finally, a risk scoring agent and a storage decision agent output the final judgment conclusion and risk quantification value. This application adopts a multi-agent collaborative architecture, solving problems such as high false alarm rates, uninterpretable judgment results, and lack of continuous evolution capabilities in related technologies. It achieves a highly accurate, verifiable, and interpretable automated Web security alert judgment system, significantly reducing the manual judgment costs of security operations centers.

[0177] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0178] Based on the same inventive concept, this application also provides an alarm analysis device for implementing the alarm analysis method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more alarm analysis device embodiments provided below can be found in the limitations of the alarm analysis method described above, and will not be repeated here.

[0179] In one exemplary embodiment, such as Figure 4 As shown, an alarm analysis device is provided, including: an alarm acquisition module 402, a first analysis module 404, a strategy filtering module 406, a second analysis module 408, and a judgment result acquisition module 410, wherein:

[0180] The alarm acquisition module 402 is used to acquire attack alarm information, which indicates that an attack has been suspected to be detected.

[0181] The first analysis module 404 is used to analyze the attack alarm information, obtain the confidence level of the attack alarm information, and obtain the first alarm judgment result of the attack alarm information. The first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a review strategy.

[0182] The strategy filtering module 406 is used to determine the target review strategy from the review strategies corresponding to various alarm judgment results based on confidence level.

[0183] The second analysis module 408 is used to analyze the attack alarm information using the target verification strategy to obtain the second alarm judgment result of the attack alarm information.

[0184] The judgment result acquisition module 410 is used to combine the first alarm judgment result and the second alarm judgment result to determine the alarm analysis result of the attack alarm information.

[0185] In some embodiments, the first analysis module 404 is further configured to determine the information completeness of the attack alarm information; determine the information matching degree of the attack alarm information, wherein the information matching degree reflects the degree of matching between different pieces of information in the attack alarm information; and determine the confidence level of the attack alarm information based on the information completeness and the information matching degree.

[0186] In some embodiments, the alarm acquisition module 402 is further configured to acquire attack alarm logs, map the fields in the attack alarm logs to standardized fields in a standardized field set, and obtain attack alarm information; the first analysis module 404 is further configured to determine the information completeness of the attack alarm information by utilizing the proportion of standardized fields with corresponding field values ​​in the attack alarm information.

[0187] In some embodiments, the strategy filtering module 406 is further configured to determine the review probability of each review strategy based on the accuracy and confidence of the review strategy; and to determine the review strategy as the target review strategy if the review probability of the review strategy is greater than the probability threshold.

[0188] In some embodiments, the strategy screening module 406 is further configured to fuse the accuracy and confidence of the review strategy to obtain the fusion result corresponding to the review strategy; and determine the review probability of the review strategy based on the proportion of the fusion result corresponding to the review strategy in the fusion results corresponding to multiple review strategies respectively.

[0189] In some embodiments, there are at least two target review strategies, and the device is further configured to determine that each target review strategy is a second alarm judgment result generated by the attack alarm information; for each alarm judgment result, determine the matching target review strategy corresponding to the alarm judgment result, and the second alarm judgment result generated by the matching target review strategy is consistent with the alarm judgment result; generate a result score corresponding to the alarm judgment result based on the confidence level of the matching target review strategy under the attack alarm information; and output a manual review prompt message when it is determined that the conditions for manual review are met based on the result scores corresponding to the multiple alarm judgment results respectively.

[0190] In some embodiments, the alarm analysis results are generated using an alarm analysis model; the apparatus is further configured to acquire processing evaluation information of the alarm analysis model for attack alarm information, the processing evaluation information including at least one of efficiency evaluation value, consistency evaluation value and evidence reliability evaluation value; and adjust the alarm analysis model based on at least one of the efficiency evaluation value, consistency evaluation value and evidence reliability evaluation value.

[0191] In some embodiments, the device is further configured to acquire alarm analysis results corresponding to attack alarm information, the alarm analysis results including target alarm judgment results and judgment basis content, the judgment basis content including multiple pieces of evidence on which the target alarm judgment result is based; acquire the credibility weights corresponding to the multiple pieces of evidence respectively, the credibility weights being determined according to the source of the corresponding evidence; acquire the confidence levels corresponding to the multiple pieces of evidence respectively; and determine the confidence level of the judgment basis content based on the credibility weights corresponding to the multiple pieces of evidence and the confidence levels corresponding to the multiple pieces of evidence respectively.

[0192] Each module in the aforementioned alarm analysis device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0193] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, the computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores at least some of the data involved in the alarm analysis method. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements an alarm analysis method.

[0194] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an alarm analysis method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0195] Those skilled in the art will understand that Figure 5 and Figure 6The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0196] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0197] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0198] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0199] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0200] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0201] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0202] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An alarm analysis method, characterized in that, The method includes: Acquire attack alert information, wherein the attack alert information indicates that an attack has been suspected to be detected; The attack alarm information is analyzed to obtain the confidence level of the attack alarm information and to obtain a first alarm judgment result of the attack alarm information. The first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a review strategy. The confidence level is generated based on the information completeness and information matching degree of the attack alarm information. The information matching degree includes at least one of attack semantic matching degree and response feature matching degree. The attack semantic matching degree refers to the degree of matching between the attack payload in the attack alarm information and the attack type in the attack alarm information. The response feature matching degree refers to the degree of matching between the attack payload and the attack response content in the attack alarm information. For each review strategy, the accuracy and confidence of the review strategy are fused to obtain the fusion result corresponding to the review strategy. Based on the proportion of the fusion result corresponding to the review strategy in the fusion results corresponding to each review strategy, the review probability of the review strategy is determined. If the review probability of the review strategy is greater than the probability threshold, the review strategy is determined as the target review strategy. The review probability is positively correlated with the proportion. The fusion includes at least one of weighted operation, product operation, or exponential operation. The attack alarm information is analyzed using the target verification strategy to obtain a second alarm judgment result for the attack alarm information; Based on the first alarm judgment result and the second alarm judgment result, the alarm analysis result of the attack alarm information is determined; Each of the at least two target review strategies is identified as a second alarm judgment result generated by the attack alarm information. For each alarm judgment result, a matching target review strategy is determined, wherein the second alarm judgment result generated by the matching target review strategy is consistent with the alarm judgment result. Based on the confidence level of the matching target review strategy under the attack alarm information, a result score corresponding to the alarm judgment result is generated. If the result scores corresponding to the various alarm judgment results are determined to meet the conditions for manual review, a manual review prompt message is output.

2. The method according to claim 1, characterized in that, The attack payload is used to reflect the attacker's malicious intent and attack methods; the attack response content is used to characterize the response or action performed in response to the attack.

3. The method according to claim 1, characterized in that, The acquisition of attack alert information includes: Obtain the attack alarm log, map the fields in the attack alarm log to the standardized fields in the standardized field set, and obtain the attack alarm information; Determining the completeness of the attack alert information includes: The completeness of the attack alarm information is determined by the proportion of standardized fields with corresponding field values ​​in the attack alarm information.

4. The method according to any one of claims 1 to 3, characterized in that, The second alarm judgment result is one of the multiple alarm judgment results.

5. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Determine the maximum and second maximum result scores from the result scores corresponding to the various alarm judgment results; If the difference between the maximum result score and the second maximum result score is less than the target threshold, it is determined that the conditions for manual review are met.

6. The method according to any one of claims 1 to 3, characterized in that, The manual review prompt is used to prompt manual review of attack alarm information or attack alarm logs corresponding to attack alarm information.

7. The method according to any one of claims 1 to 3, characterized in that, The alarm analysis results are generated using an alarm analysis model; the method further includes: Obtain the processing evaluation information of the alarm analysis model for the attack alarm information, wherein the processing evaluation information includes at least one of efficiency evaluation value, consistency evaluation value, and evidence reliability evaluation value; The alarm analysis model is adjusted based on at least one of the efficiency assessment value, the consistency assessment value, and the evidence reliability assessment value.

8. The method according to any one of claims 1 to 3, characterized in that, The alarm analysis result includes the target alarm judgment result and the judgment basis. The judgment basis includes multiple pieces of evidence on which the target alarm judgment result is based. The target alarm judgment result is either the first alarm judgment result or the second alarm judgment result. Obtain the credibility weights corresponding to the multiple pieces of evidence, wherein the credibility weights are determined based on the source of the corresponding evidence; Obtain the confidence levels corresponding to each of the aforementioned pieces of evidence; The confidence level of the content of the judgment basis is determined based on the credibility weights and confidence levels of the multiple pieces of evidence.

9. An alarm analysis device, characterized in that, The device includes: The alarm acquisition module is used to acquire attack alarm information, which indicates that an attack has been suspected to be detected. The first analysis module is used to analyze the attack alarm information, obtain the confidence level of the attack alarm information, and obtain a first alarm judgment result of the attack alarm information. The first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a review strategy. The confidence level is generated based on the information completeness and information matching degree of the attack alarm information. The information matching degree includes at least one of attack semantic matching degree and response feature matching degree. The attack semantic matching degree refers to the degree of matching between the attack payload in the attack alarm information and the attack type in the attack alarm information. The response feature matching degree refers to the degree of matching between the attack payload and the attack response content in the attack alarm information. The strategy screening module is used to fuse the accuracy and confidence of each review strategy to obtain the fusion result corresponding to the review strategy. Based on the proportion of the fusion result corresponding to the review strategy in the fusion results corresponding to each review strategy, the review probability of the review strategy is determined. If the review probability of the review strategy is greater than the probability threshold, the review strategy is determined as the target review strategy. The review probability is positively correlated with the proportion. The fusion includes at least one of weighted operation, product operation, or exponential operation. The second analysis module is used to analyze the attack alarm information using the target verification strategy to obtain a second alarm judgment result of the attack alarm information; The judgment result acquisition module is used to determine the alarm analysis result of the attack alarm information based on the first alarm judgment result and the second alarm judgment result; The device is further configured to: determine that each of the at least two target review strategies is a second alarm judgment result generated by the attack alarm information; for each alarm judgment result, determine a matching target review strategy corresponding to the alarm judgment result, wherein the second alarm judgment result generated by the matching target review strategy is consistent with the alarm judgment result; generate a result score corresponding to the alarm judgment result based on the confidence level of the matching target review strategy under the attack alarm information; and output a manual review prompt message when the conditions for manual review are met based on the result scores corresponding to the various alarm judgment results.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images