A log alarm noise reduction method and device based on semantic analysis, electronic equipment and storage medium

Abstract

This invention discloses a log alarm noise reduction method, device, electronic device, and storage medium based on semantic analysis, belonging to the field of network security technology. The method first performs semantic alignment on heterogeneous alarm logs from multiple security devices based on the ECS standard and the MITREATT&CK knowledge base to generate standardized alarms. Then, it extracts and encodes alarm semantic features, network traffic features, and network topology features in parallel to form a multimodal feature set. Finally, the multimodal features are input into a noise reduction model, which performs hierarchical fusion through a two-stage PACF module and uses an edge-confidence-enhanced graph attention network (ECE-GAT) for classification, outputting the discrimination results between real alarms and noise, and their corresponding confidence scores. This invention effectively solves the problems of alarm overload, semantic ambiguity, and noise interference, improving the automation level and analysis efficiency of security operations.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method, apparatus, electronic device, and storage medium for log alarm noise reduction based on semantic analysis. Background Technology

[0002] As enterprise security architectures become increasingly complex, massive amounts of heterogeneous alert logs from multiple security devices, such as firewalls, intrusion detection systems (IDS), and endpoint detection and response (EDR), converge at the Security Operations Center (SOC), leading to severe "alert overload" and "alert fatigue" problems. These alert logs differ significantly in format, fields, and semantics, and are mixed with a large amount of noise such as duplicate alerts and false alarms, making it difficult to detect real attacks in a timely manner.

[0003] Existing technologies have the following limitations: First, in handling heterogeneous alarms, they largely rely on manually pre-defined rules for format standardization, resulting in high maintenance costs and a tendency to introduce semantic biases. Second, at the feature construction level, they are mostly limited to the basic attributes of the alarm itself or a single network traffic quintuple, failing to integrate multi-dimensional information such as alarm semantics, traffic behavior temporal patterns, and network topology, making it difficult to comprehensively depict the complex context of security events. Third, in terms of denoising models, traditional machine learning or simple deep learning models struggle to accurately capture the implicit network topology relationships and complex dependencies between alarm logs, leading to poor denoising accuracy and generalization ability.

[0004] Therefore, there is an urgent need for an intelligent solution that can achieve semantic unification of multi-source heterogeneous alarms, deep fusion of multimodal features, and precise noise reduction using advanced graph neural networks. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a log alarm noise reduction method, device, electronic device and storage medium based on semantic analysis.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] This application provides a first aspect, offering a log alarm noise reduction method based on semantic analysis, including:

[0008] Step S1. Obtain heterogeneous alarm logs from multiple security devices, perform semantic alignment on the heterogeneous alarm logs, and generate standardized alarm logs with unified field definitions and semantics; wherein, semantic alignment is implemented based on the predefined Security Event Standard Pattern (ECS) and Threat Behavior Knowledge Base (MITREATT&CK).

[0009] Step S2. Based on the standardized alarm log, extract and encode multimodal features, including alarm semantic features, network traffic features, and network topology features.

[0010] Step S3. Input the multimodal features into the noise reduction model, which includes a two-stage feature fusion module and a graph neural network classification module, and outputs the discrimination result of whether the alarm is a real alarm or noise and its confidence level.

[0011] Further, in step S2, extracting and encoding multimodal features specifically includes: encoding the text fields in the alarm log using a language model pre-trained in the cybersecurity domain (such as SecureBERT) to obtain alarm semantic features; extracting static and temporal features from the network traffic data associated with the alarm, and encoding them through a self-attention mechanism to obtain network traffic features; wherein, the calculation formula for the self-attention mechanism is:

[0012]

[0013] in , , These are query, key, and value matrices, respectively. is the dimension of the key vector.

[0014] Furthermore, a topology graph is constructed based on the connection relationships between network devices, and a Graph Attention Network (GAT) is used to encode node and edge features to obtain network topology features; wherein, the node update and attention coefficient calculation rules of GAT are as follows:

[0015]

[0016] in, Indicates the first Feature matrix of all nodes in the layer; It is an adjacency matrix The matrix after adding self-connection, It is the identity matrix; yes The degree matrix, whose diagonal elements ; It is the first Layer-trainable weight matrix; ) is a non-linear activation function.

[0017] Furthermore, in step S2, when extracting and encoding the network topology features, a graph attention network is used, and its node feature update and attention coefficient calculation method is as follows:

[0018]

[0019]

[0020] in, Indicates the first Layer nodes eigenvectors; Represents the nodes in the graph The set of neighboring nodes; It is a trainable weight matrix applied to all nodes; It is a trainable single-layer feedforward neural network parameter vector; This represents a vector concatenation operation; Represents a node Its neighboring nodes The normalized attention coefficient; ) is a non-linear activation function.

[0021] Furthermore, in step S3, the graph neural network classification module is an edge-confidence-enhanced graph attention network. When calculating the attention coefficients between nodes, it introduces a scalar bias term obtained from the edge feature mapping. The improved attention coefficients are calculated as follows:

[0022]

[0023] in, Original attention score; For connection nodes With nodes The edge features are calculated using a scalar bias term through a mapping function, which is used to adjust the attention weights based on the semantics or strength of the edges. This design allows node pairs with stronger semantic and logical connections to receive higher attention weights, ultimately outputting classification results and confidence scores.

[0024] Furthermore, the mapping function is a single-layer perceptron.

[0025] Furthermore, the noise reduction model in step S3 performs the following operations:

[0026] First, the multimodal features are fused using the two-stage feature fusion module.

[0027] In the first stage, the alarm semantic features and network traffic features are pre-aligned and adaptively weighted and fused to obtain the first joint feature.

[0028] In the second stage, the first joint feature is pre-aligned with the network topology feature and dynamically fused with auxiliary features to obtain the global fused feature.

[0029] Then, the global fusion features are used as node features to construct a graph structure with alarm events as nodes, and the graph neural network classification module, namely the edge confidence enhanced graph attention network (ECE-GAT), is used for classification.

[0030] Secondly, a log alarm noise reduction device based on semantic analysis is provided, comprising:

[0031] The semantic alignment module is used to perform step S1;

[0032] A multimodal feature encoding module is used to perform step S2;

[0033] The alarm noise reduction module is used to perform step S3.

[0034] Thirdly, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as described in the first aspect.

[0035] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0036] Fifthly, a computer program product is provided, comprising a computer program / instructions, characterized in that the computer program / instructions, when executed by a processor, implement the method described in the first aspect.

[0037] Compared with the prior art, this application has the following beneficial effects:

[0038] This invention proposes a log alarm noise reduction method, device, electronic device, and storage medium based on semantic analysis. This method, through a three-level alignment process between the ECS standard and the ATT&CK knowledge base—namely, parsing, normalization, and semantic matching—fundamentally solves the conflict problems in format, terminology, and semantics of multi-source alarms, providing a high-quality and consistent data foundation for subsequent analysis. It breaks through the limitations of a single data source, creatively integrating features from three modalities: alarm semantics (SecBERT encoding), traffic behavior (self-attention encoding), and network topology (GAT encoding), comprehensively covering the static attributes, dynamic behavior, and environmental context of security events. The proposed PACF two-stage fusion model, through a pre-alignment module, effectively… This solution addresses the challenge of heterogeneous feature fusion. The designed ECE-GAT classification model significantly improves classification accuracy, robustness, and interpretability by introducing an attention mechanism enhanced by edge features and an independent confidence estimation head. The network security alarm big data processed by this solution belongs to a specific application domain, and the correlations between alarms, traffic, and topology mined reflect the natural laws of network attack behavior. At the same time, the algorithm model (such as GAT and self-attention mechanism) has specific technical connections with the internal computing and storage structure of the computer system, optimizing the computational efficiency of feature aggregation and classification, which is an improvement on the internal performance of the computer system. Attached Figure Description

[0039] Figure 1 This is a diagram of a real alarm record.

[0040] Figure 2 This is a schematic diagram of the structure of the attention mechanism.

[0041] Figure 3 This is a schematic diagram of the structure of the self-attention mechanism.

[0042] Figure 4 This is a schematic diagram of the embedding layer structure of the BERT model.

[0043] Figure 5 This is a schematic diagram of the structure of a Generative Convolutional Neural Network (GCN).

[0044] Figure 6 This is a schematic diagram illustrating the calculation of attention coefficients in a Gaussian Attention Network (GAT).

[0045] Figure 7 The overall process of the log alarm noise reduction method based on semantic analysis used in the embodiments of the present invention is shown.

[0046] Figure 8 This is a framework diagram for semantic alignment of heterogeneous alarm logs in an embodiment of the present invention.

[0047] Figure 9 This is a schematic diagram of the semantic matching model used in the embodiments of the present invention.

[0048] Figure 10 This is a structural diagram of multimodal feature extraction and encoding in an embodiment of the present invention.

[0049] Figure 11 This is a general framework diagram of the alarm noise reduction model in this embodiment of the invention.

[0050] Figure 12 This is a structural diagram of the PACF two-stage hierarchical fusion model in an embodiment of the present invention.

[0051] Figure 13 This is a structural diagram of the edge confidence-enhanced graph attention network (ECE-GAT) in an embodiment of the present invention.

[0052] Figure 14 This is a schematic diagram of the components of an electronic device.

[0053] Figure 15 This is a schematic diagram of the composition of a storage medium. Detailed Implementation

[0054] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] Furthermore, in this invention, if an element is said to be fixed to or disposed on another element, the element may be directly disposed on the other element, or there may be an intervening element. When an element is said to be connected to another element, the element may be directly connected to the other element, or there may be an intervening element. The terms vertical, horizontal, left, right, and similar expressions used herein are for illustrative purposes only and do not represent the only possible embodiments.

[0056] This invention provides a method, apparatus, device, and storage medium for log alarm noise reduction based on semantic analysis, aiming to solve the problems of "alarm fatigue" and low operational efficiency caused by massive heterogeneous alarms in security operations centers. The technical solution of this invention is clearly and completely described below with reference to the accompanying drawings.

[0057] Firstly, this application provides a log alarm noise reduction method based on semantic analysis, including:

[0058] Step S1. Obtain heterogeneous alarm logs from multiple security devices, perform semantic alignment on the heterogeneous alarm logs, and generate standardized alarm logs with unified field definitions and semantics; wherein, semantic alignment is implemented based on the predefined Security Event Standard Pattern (ECS) and Threat Behavior Knowledge Base (MITREATT&CK).

[0059] Step S2. Based on the standardized alarm log, extract and encode multimodal features, including alarm semantic features, network traffic features, and network topology features.

[0060] Step S3. Input the multimodal features into the noise reduction model, which includes a two-stage feature fusion module and a graph neural network classification module, and outputs the discrimination result of whether the alarm is a real alarm or noise and its confidence level.

[0061] In this embodiment, the basic method flow of the present invention is as follows: Figure 7 As shown, the core problem it solves is alarm overload and semantic ambiguity caused by multi-source heterogeneous alarm logs in the Security Operations Center (SOC); in a preferred embodiment, as... Figure 8 As shown, this is achieved through the Elastic Common Schema (ECS) standard field system and the MITREATT&CK® threat model knowledge base; the multimodal features are not simply concatenations, but rather a set of complementary features extracted from different data perspectives (modalities), specifically including: 1. semantic features extracted from alarm text descriptions; 2. behavioral sequence features extracted from associated network traffic sessions; 3. topological features extracted from network asset interconnection relationships.

[0062] The noise reduction model is a neural network architecture specifically designed to handle the aforementioned multimodal features. Its core innovation lies in setting up a two-stage feature fusion module responsible for deep feature fusion, and a graph neural network classification module responsible for final discrimination, and outputting classification results with confidence scores, thereby improving the credibility and interpretability of the results.

[0063] In one specific implementation, step S2, extracting and encoding multimodal features, specifically includes: encoding text fields in alarm logs using a language model (such as SecureBERT) pre-trained in the cybersecurity domain to obtain alarm semantic features; extracting static and temporal features from network traffic data associated with alarms, and encoding them through a self-attention mechanism to obtain network traffic features; wherein, the calculation formula for the self-attention mechanism is:

[0064]

[0065] in , , These are query, key, and value matrices, respectively. is the dimension of the key vector.

[0066] In this embodiment, the encoding of network traffic features employs a self-attention mechanism; the advantage of this mechanism is its ability to adaptively capture long-range dependencies and key temporal patterns in traffic data; formula Its core computation is defined; among them, the Q (query), K (key), and V (value) matrices are all obtained by linear transformation of the original traffic feature sequence (such as the time series sequence of packet size and interval); It is the dimension of the key vector, the scaling factor. This is used to prevent the gradient of the Softmax function from vanishing due to an excessively large dot product result; this process enables the model to assign different importance weights to features at different time points in the sequence, thereby encoding more expressive traffic behavior features.

[0067] In one specific implementation, a topology graph is constructed based on the connection relationships between network devices, and a Graph Attention Network (GAT) is used to encode node and edge features to obtain network topology features; wherein, the node update and attention coefficient calculation rules of the GAT are as follows:

[0068]

[0069] in, Indicates the first Feature matrix of all nodes in the layer; It is an adjacency matrix The matrix after adding self-connection, It is the identity matrix; yes The degree matrix, whose diagonal elements ; It is the first Layer-trainable weight matrix; ) is a non-linear activation function.

[0070] Furthermore, in step S2, when extracting and encoding network topology features, a graph attention network (GAT) is used, and its node feature update and attention coefficient calculation methods are as follows:

[0071]

[0072]

[0073] in, Indicates the first Layer nodes eigenvectors; This represents the set of neighboring nodes of node 𝑖 in the graph; It is a trainable weight matrix applied to all nodes; It is a trainable single-layer feedforward neural network parameter vector; This represents a vector concatenation operation; Represents a node Its neighboring nodes The normalized attention coefficient; ) is a non-linear activation function.

[0074] This embodiment illustrates two optional methods for encoding network topology features; corresponding to Graph Convolutional Networks (GCNs), their formulas... This reflects its idea of ​​smoothly aggregating neighborhood information through spectral graph theory; Ã=A+I achieves self-connection by adding an identity matrix I to the adjacency matrix A, ensuring that the node's own features participate in the update; It is the degree matrix of Ã, used for normalization; and These are the node feature matrix and trainable weight matrix of layer l, respectively; Graph Attention Network (GAT) is an improvement on GCN; its core formula is:

[0075] A learnable attention mechanism is introduced; in which, It is a node feature. It is a shared weight matrix. This represents vector concatenation. It is a trainable parameter vector. This mechanism can compute nodes. With each of his neighbors Differential attention coefficients between This enables more refined weighted aggregation of neighborhood information, as shown in the formula. As shown in the figure.

[0076] In one specific implementation, in step S3, the graph neural network classification module employs a graph attention network with enhanced edge confidence. This network introduces a scalar bias term obtained from edge feature mapping when calculating the attention coefficients between nodes. The improved attention coefficients are calculated as follows:

[0077]

[0078] in, Original attention score; For connection nodes With nodes The edge features are calculated using a scalar bias term through a mapping function, which is used to adjust the attention weights based on the semantics or strength of the edges. This design allows node pairs with stronger semantic and logical connections to receive higher attention weights, ultimately outputting classification results and confidence scores. The mapping function is a single-layer perceptron.

[0079] This embodiment defines one of the core innovative modules of the present invention: Edge Confidence Enhanced Graph Attention Network (ECE-GAT); in standard GAT, the attention coefficients... Determined solely by the characteristics of connected nodes; this invention proposes an improved formula. ,in It is a network of connected nodes and The edge features (such as temporal proximity between alarm events, IP association strength, and semantic similarity) are calculated as a scalar bias term using a mapping function; such as Figure 13 As shown, this design allows attention weights to not only focus on the similarity of nodes themselves, but also to explicitly incorporate the strength of the relationships represented by edges, giving the model a stronger ability to perceive the logical connections between alarm events; further, the mapping function is defined as a single-layer perceptron (MLP), a simple and effective implementation for mapping edge feature vectors to scalars. .

[0080] In one specific implementation, the noise reduction model in step S3 performs the following operations:

[0081] First, the multimodal features are fused using the two-stage feature fusion module.

[0082] In the first stage, the alarm semantic features and network traffic features are pre-aligned and adaptively weighted and fused to obtain the first joint feature.

[0083] In the second stage, the first joint feature is pre-aligned with the network topology feature and dynamically fused with auxiliary features to obtain the global fused feature.

[0084] Then, the global fusion features are used as node features to construct a graph structure with alarm events as nodes, and the graph neural network classification module, namely the edge confidence enhanced graph attention network (ECE-GAT), is used for classification.

[0085] This embodiment details the operation flow of the two-stage feature fusion module. Pre-alignment refers to mapping features from different modalities to a semantically similar common subspace through a subnetwork (such as a small projection layer or contrastive learning) before weighted fusion, reducing heterogeneity. "Adaptive weighted fusion" refers to dynamically calculating the fusion weights of each modality's features using an attention mechanism. The first stage focuses on fusing semantically highly correlated alarm and traffic features. The second stage fuses the fusion results from the first stage with topological features representing the environmental context, and introduces auxiliary information such as "temporal features" and "network state" to dynamically adjust the fusion strategy. The introduction of residual connections (such as...) Figure 5 (As shown) This is to prevent the loss of important information in the original features during deep fusion and to ensure the stability of model training.

[0086] Secondly, a log alarm noise reduction device based on semantic analysis is provided, comprising:

[0087] The semantic alignment module is used to acquire heterogeneous alarm logs from multiple security devices, perform semantic alignment on the heterogeneous alarm logs, and generate standardized alarm logs with unified field definitions and semantics; wherein, the semantic alignment is based on a predefined security event standard pattern and threat behavior knowledge base;

[0088] The multimodal feature encoding module is used to extract and encode multimodal features based on the standardized alarm logs. The multimodal features include alarm semantic features, network traffic features, and network topology features.

[0089] The alarm noise reduction module is used to input the multimodal features into the noise reduction model, which includes a two-stage feature fusion module and a graph neural network classification module to output the discrimination result of whether the alarm is a real alarm or noise and its confidence level.

[0090] Example 2

[0091] To make the objectives, technical solutions, and advantages of the present invention clearer, the following description will be taken in conjunction with all accompanying drawings. Figures 1 to 13 This embodiment provides a complete and specific example of implementing the technical solution of the present invention. It describes an intelligent log alarm noise reduction system integrated into an enterprise security operations center (SOC). This system transforms massive amounts of noisy raw security alarms into high-confidence real threat events through an end-to-end automated process.

[0092] like Figure 7As shown, the system's overall process begins with real-time collection of raw alarm logs from various security devices (such as firewalls, intrusion detection systems, and endpoint protection platforms). These logs vary in format, with significant differences in field naming, structure, and semantic descriptions, constituting a typical "multi-source heterogeneous" data source. To address this issue, the system first performs a core preprocessing step: semantic alignment of heterogeneous alarm logs, the detailed framework of which is as follows... Figure 8 As shown. Next, the field normalization stage begins. This stage, based on a predefined mapping rule library, maps field names from different sources to standard ElasticCommonSchema (ECS) fields. Simultaneously, field values ​​are normalized; for example, all timestamps are standardized to ISO8601 format, and text-based risk levels (e.g., "High") are quantified into numerical values ​​(e.g., 8). The crucial semantic alignment stage relies on a security domain knowledge base; system calls, such as... Figure 9 The semantic matching model shown (e.g., built based on the lightweight multilingual MiniLM model) calculates the semantic similarity between alarm descriptions and standardized tactical and technical terms in the MITREATT&CK framework, thereby mapping diverse expressions such as "SQLi" and "database injection" to standard technical IDs such as "T1190:ExploitPublic-FacingApplication", fundamentally eliminating terminological ambiguity, and outputting standardized, semantically consistent alarm event streams in ECS format.

[0093] After semantic alignment is completed, the system enters the multimodal feature extraction and encoding stage, and its parallel processing structure is as follows: Figure 10 As shown. This stage aims to characterize security events from three complementary dimensions: the semantics of the alert itself, the associated network traffic behavior, and the network environment in which it occurs. For the semantic features of the alert, the system selects text fields such as event type (event.type), action (event.action), and original message (message) from standardized alerts, and inputs a SecureBERT model pre-trained on network security corpora (such as vulnerability reports and threat intelligence) and fine-tuned using alert logs from this scenario. This model is based on... Figure 4 The Transformer architecture shown uses its bidirectional self-attention mechanism to deeply understand the contextual semantics of alarm text, outputting a 768-dimensional feature vector as a deep semantic representation of the alarm. Simultaneously, the system associates the alarm's timestamp (@timestamp) and the 5-tuple (source / destination IP, port) with the corresponding network traffic data packet (pcap). Traffic feature encoding consists of two parts: static statistical features (such as session byte count, packet count, TCP flag combinations) and dynamic temporal features (such as the data packet arrival interval time series). Temporal features are encoded using a... Figure 3The self-attention encoder shown (whose core calculations follow the formula) The system processes traffic data to adaptively capture long-range dependencies and abnormal fluctuations. Static features are concatenated with encoded temporal features to form a comprehensive network traffic behavior feature vector. Thirdly, based on a network asset inventory and traffic logs, the system dynamically constructs a network topology graph, where nodes represent network devices identified by IP addresses, and edges represent communication relationships between devices. Node features may include device type (server, workstation), and edge features may include connection status and historical communication frequency. This topology graph is encoded using a graph attention network. Figure 6 As shown, GAT is expressed by the formula:

[0094]

[0095] The attention coefficients between nodes are calculated, allowing the model to distinguish the importance of different neighbors (e.g., connections to core servers have higher weight than connections to ordinary clients), ultimately generating topological feature vectors that reflect the roles and relationships of nodes in the network. Figure 5 The GCN shown is illustrated as another feasible graph coding infrastructure and is presented as an alternative in this embodiment.

[0096] After the above three feature encodings are completed, the system inputs them into the core alarm noise reduction model for fusion and discrimination. The overall architecture of the model is as follows: Figure 11 As shown; the model first performs deep feature fusion through an innovative PACF (Pre-aligned Cross-modal Fusion) two-stage module, the structure of which is detailed in [link to module]. Figure 12 In the first stage, the alarm semantic feature vector and the network traffic feature vector are mapped to a common semantic subspace through a lightweight projection network, and fine-grained pre-alignment is performed through contrastive learning. Then, cross-modal attention weights are calculated for adaptive weighted fusion to generate joint alarm and traffic features. In the second stage, this joint feature is pre-aligned with the network topology features in a similar way, and the temporal context of the event (such as whether it is a working day) is introduced as auxiliary information. The fusion weights are dynamically calculated, and finally, key information is retained through residual connections to output a 256-dimensional global fusion feature vector. This design ensures the effective complementarity and hierarchical integration of multimodal information in a unified semantic space.

[0097] Finally, the system utilizes another core innovation of this invention: Edge Confidence Enhanced Graph Attention Network (ECE-GAT) for classification decisions, the structure of which is as follows: Figure 13As shown; here, each alarm event is regarded as a node in the graph, and its node features are the global fusion features obtained in the previous step; the edges between nodes are constructed according to the correlation of alarm events, and the edge features may include temporal proximity (inverse time difference), IP association strength (whether they are in the same network segment), semantic similarity, etc.; the key improvement of ECE-GAT over standard GAT is that it transforms the edge feature vector into a scalar bias term through a learnable mapping function (such as a single-layer perceptron). This is then superimposed onto the original attention score calculated from the node features. The final attention coefficient is formed above. This mechanism enables the model to consider both the similarity of node features and the strength of logical connections represented by edges when aggregating information, thus more accurately focusing on truly relevant alarm event groups. After message passing and aggregation through multiple layers of ECE-GAT, each node obtains a high-level representation rich in neighborhood context information. This representation is finally fed into a classifier that shares a bottom layer and a dual-branch head: one branch outputs the probability distribution of whether the alarm is a real attack or noise through the Softmax function; the other independent branch outputs a confidence score between 0 and 1 through the Sigmoid function, quantifying the model's certainty in the current classification judgment.

[0098] The entire system is deployed as microservices on an enterprise cloud platform or internal data center. Possible deployment architectures include: Figure 13 As shown, the model is trained using historical labeled data, and the loss function combines classification cross-entropy and feature contrast loss. In actual operation, the system can process alarm streams from the SOC in real time, automatically completing the entire process from semantic alignment and feature extraction to intelligent noise reduction. It also pushes high-confidence, real threat alarms to security analysts, along with their confidence levels as a decision-making reference, thereby greatly alleviating alarm fatigue and improving the automation level and response efficiency of security operations. Figure 2 The underlying principles of the attention mechanism presented provide the necessary background knowledge for understanding the working mechanism of the self-attention encoder and GAT module in this embodiment.

[0099] Example 3

[0100] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0101] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0102] The following reference Figure 14 To describe an electronic device 1400 according to this embodiment of the present invention. Figure 14 The electronic device 1400 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0103] like Figure 14 As shown, the electronic device 1400 is manifested in the form of a general-purpose computing device. The components of the electronic device 1400 may include, but are not limited to: at least one processing unit 1410, at least one storage unit 1420, and a bus 1430 connecting different system components (including storage unit 1420 and processing unit 1410).

[0104] The storage unit stores program code that can be executed by the processing unit 1410, causing the processing unit 1410 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 1410 can perform the following method: Step S1. Integrate heterogeneous alarm logs from different security devices through multi-source device correlation analysis, and perform semantic alignment based on predefined security event standard patterns and threat behavior knowledge bases to generate standardized alarm logs; Step S2. Extract and encode multimodal features, including alarm semantic features, network traffic features, and network topology features; Step S3. Input these features into a noise reduction model, which includes a two-stage feature fusion module and a graph neural network classification module to distinguish between real alarms and noise, and output the corresponding discrimination results and their confidence levels.

[0105] Storage unit 1420 may include readable media in the form of volatile storage units, such as random access memory (RAM) 14201 and / or cache memory 14202, and may further include read-only memory (ROM) 14203.

[0106] Storage unit 1420 may also include a program / utility 14204 having a set (at least one) of program modules 14205, such program modules 14205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0107] Bus 1430 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0108] Electronic device 1400 can also communicate with one or more external devices 1300 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 1400, and / or any device that enables electronic device 1400 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1450. Furthermore, electronic device 1400 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1460. As shown, network adapter 1460 communicates with other modules of electronic device 1400 via bus 1430. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0109] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0110] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0111] refer to Figure 15 As shown, a program product 1500 for implementing the above-described method according to an embodiment of the present invention is described. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0112] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0113] A computer-readable signal medium can be a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium can also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0114] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0115] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Python and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0116] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0117] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A log alarm noise reduction method based on semantic analysis, characterized in that, include: Step S1. Obtain heterogeneous alarm logs from multiple security devices, perform semantic alignment on the heterogeneous alarm logs, and generate standardized alarm logs with unified field definitions and semantics; wherein, the semantic alignment is based on predefined security event standard patterns and threat behavior knowledge base; Step S2. Based on the standardized alarm log, extract and encode multimodal features, including alarm semantic features, network traffic features, and network topology features; Step S3. Input the multimodal features into the noise reduction model, which includes a two-stage feature fusion module and a graph neural network classification module, to output the discrimination result of whether the alarm is a real alarm or noise and its confidence level.

2. The method according to claim 1, characterized in that, In step S2, when extracting and encoding the network traffic features, a temporal self-attention encoder is used, and its calculation method is as follows: ； in, , , These are the query matrix, key matrix, and value matrix obtained by linear transformation of the input feature sequence, respectively. is the dimension of the key vector, used as a scaling factor.

3. The method according to claim 1, characterized in that, In step S2, when extracting and encoding the network topology features, a graph convolutional network is used, and its node feature update rule is as follows: ； in, Indicates the first Feature matrix of all nodes in the layer; It is an adjacency matrix The matrix after adding self-connection, It is the identity matrix; yes The degree matrix, whose diagonal elements ; It is the first Layer-trainable weight matrix; ) is a non-linear activation function.

4. The method according to claim 1, characterized in that, In step S2, when extracting and encoding the network topology features, a graph attention network is used, and the node feature update and attention coefficient calculation methods are as follows: ； ； in, Indicates the first Layer nodes eigenvectors; Represents the nodes in the graph The set of neighboring nodes; It is a trainable weight matrix applied to all nodes; It is a trainable single-layer feedforward neural network parameter vector; This represents a vector concatenation operation; Represents a node Its neighboring nodes The normalized attention coefficient; ) is a non-linear activation function.

5. The method according to claim 4, characterized in that, In step S3, the graph neural network classification module is an edge-confidence-enhanced graph attention network. When calculating the attention coefficients between nodes, it introduces a scalar bias term obtained from the edge feature mapping. The improved attention coefficients are calculated as follows: ； in, The original attention score is calculated according to claim 4; For connection nodes With nodes The edge features are computed through a mapping function to obtain a scalar bias term, which is used to adjust the attention weights based on the semantics or strength of the edges.

6. The method according to claim 5, characterized in that, The mapping function is a single-layer perceptron.

7. The method according to claim 1, characterized in that, The two-stage feature fusion module performs the following operations: In the first stage, the alarm semantic features and the network traffic features are pre-aligned and adaptively weighted and fused to obtain the first joint feature; In the second stage, the first joint feature is pre-aligned with the network topology feature, and the fusion weight is dynamically generated by combining the temporal feature and the network state auxiliary feature. The global fusion feature is obtained through weighted fusion and residual connection.

8. A log alarm noise reduction device based on semantic analysis, characterized in that, include: A semantic alignment module is configured to perform step S1 as described in any one of claims 1 to 7; A multimodal feature encoding module is used to perform step S2 as described in any one of claims 1 to 7; An alarm noise reduction module is used to perform step S3 as described in any one of claims 1 to 7.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.

Images