A security event display method and device

Abstract

The embodiment of the present application provides a security event display method and device, which relates to the field of network technology. The method includes: obtaining each security event to be displayed; determining the initial display order of each security event to be displayed in the security event list; for each security event to be displayed, based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, adjusting the initial display order of the security event to be displayed to obtain the optimized display order of the security event to be displayed in the security event list; displaying each security event to be displayed in the security event list according to the obtained optimized display order. In this way, the processing efficiency of security events can be improved.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a method and device for displaying security events. Background Art

[0002] With the rapid development of network technology, malicious attackers have more and more attack methods and tools, resulting in frequent network attacks. Users can handle security incidents caused by network attacks through network security devices and platforms for managing security incidents.

[0003] For example, the network security device can determine the security events to be processed based on the traffic flow, and then the security event management platform can display the security events to be processed to the user. The user can handle each security event based on the information displayed by the security event management platform. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a security event display method and device, which can effectively guide users to prioritize the security events to be displayed that meet their behavior characteristics, thereby improving the efficiency of security event processing. The specific technical solution is as follows:

[0005] In a first aspect, in order to achieve the above-mentioned purpose, an embodiment of the present application discloses a security event display method, the method comprising:

[0006] Obtain each security event to be displayed;

[0007] Determining an initial display order of the security events to be displayed in the security event list;

[0008] For each security event to be displayed, based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, the initial display order of the security event to be displayed is adjusted to obtain the optimized display order of the security event to be displayed in the security event list;

[0009] The host attention index of the security event to be displayed is determined based on the number of processed security events that are the same as the host concerned by the security event to be displayed; the host concerned by the security event to be displayed represents the host that caused the security event to be displayed; the type attention index of the security event to be displayed is determined based on the number of processed security events of the same event type as the security event to be displayed;

[0010] According to the obtained optimized display order, each security event to be displayed is displayed in the security event list.

[0011] Optionally, for each security event to be displayed, adjusting the initial display order of the security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed to obtain the optimized display order of the security event to be displayed in the security event list includes:

[0012] For each security event to be displayed, obtaining an initial display order value indicating an initial display order of the security event to be displayed;

[0013] Calculate the weighted sum of the initial display order value of the security event to be displayed, the host attention index of the security event to be displayed, and the type attention index of the security event to be displayed, and obtain an optimized display order value representing the optimized display order of the security event to be displayed in the security event list.

[0014] Optionally, before adjusting the initial display order of each security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed to obtain the optimized display order of the security event to be displayed in the security event list, the method further includes:

[0015] For each security event to be displayed, if the source host device and the destination host device of the security event to be displayed are both internal host devices, determining that the host concerned by the security event to be displayed is the source host device;

[0016] If the source host device of the security event to be displayed is an external host device, and the destination host device is an internal host device, then it is determined that the host concerned by the security event to be displayed is the destination host device.

[0017] Optionally, determining an initial display order of the security events to be displayed in the security event list includes:

[0018] Obtain current hot security events;

[0019] For each security event to be displayed, determining a hot security event that matches the security event to be displayed from the hot security events;

[0020] According to the extent of loss caused by the matching popular security events, the initial display order of the security events to be displayed in the security event list is determined.

[0021] Optionally, determining an initial display order of the security events to be displayed in the security event list includes:

[0022] Determine the initial display order of the security events to be displayed in the security event list according to the order of occurrence time;

[0023] or,

[0024] The initial display order of the security events to be displayed in the security event list is determined according to the order of threat levels from high to low.

[0025] In a second aspect, in order to achieve the above-mentioned purpose, an embodiment of the present application discloses a security event display device, the device comprising:

[0026] A module for acquiring security events to be displayed, used for acquiring security events to be displayed;

[0027] An initial display order determination module, used to determine the initial display order of each security event to be displayed in the security event list;

[0028] An optimized display order determination module is used to adjust the initial display order of each security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, so as to obtain the optimized display order of the security event to be displayed in the security event list;

[0029] The host attention index of the security event to be displayed is determined based on the number of processed security events that are the same as the host concerned by the security event to be displayed; the host concerned by the security event to be displayed represents the host that caused the security event to be displayed; the type attention index of the security event to be displayed is determined based on the number of processed security events of the same event type as the security event to be displayed;

[0030] The display module is used to display each security event to be displayed in the security event list according to the obtained optimized display order.

[0031] Optionally, the optimized display order determination module includes:

[0032] An initial display sequence value acquisition submodule, used to acquire, for each security event to be displayed, an initial display sequence value representing an initial display sequence of the security event to be displayed;

[0033] The optimized display order determination submodule is used to calculate the weighted sum of the initial display order value of the security event to be displayed, the host attention index of the security event to be displayed, and the type attention index of the security event to be displayed, and obtain the optimized display order value representing the optimized display order of the security event to be displayed in the security event list.

[0034] Optionally, the device further comprises:

[0035] A host determination module, configured to, for each security event to be displayed, adjust the initial display order of the security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, and before obtaining the optimized display order of the security event to be displayed in the security event list, for each security event to be displayed, if the source host device and the destination host device of the security event to be displayed are both internal host devices, determine that the host concerned by the security event to be displayed is the source host device;

[0036] If the source host device of the security event to be displayed is an external host device, and the destination host device is an internal host device, then it is determined that the host concerned by the security event to be displayed is the destination host device.

[0037] Optionally, the initial display order determination module includes:

[0038] The hot security event acquisition submodule is used to obtain the current hot security events;

[0039] A matching submodule, for determining, for each security event to be displayed, from the various hot security events, a hot security event that matches the security event to be displayed;

[0040] The initial display order determination submodule is used to determine the initial display order of the security events to be displayed in the security event list according to the degree of loss caused by the matching popular security events.

[0041] Optionally, the initial display order determination module is specifically used to determine the initial display order of the security events to be displayed in the security event list according to the order of occurrence time;

[0042] or,

[0043] The initial display order of the security events to be displayed in the security event list is determined according to the order of threat levels from high to low.

[0044] In another aspect of the implementation of the present application, in order to achieve the above-mentioned purpose, the embodiment of the present application further discloses an electronic device, the electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus;

[0045] The memory is used to store computer programs;

[0046] The processor is used to implement the security event display method described in the first aspect when executing the program stored in the memory.

[0047] In another aspect of the implementation of the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the security event display method described in the first aspect above is implemented.

[0048] In another aspect of the implementation of the present application, an embodiment of the present application further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the security event display method described in the first aspect above.

[0049] Beneficial effects of the embodiments of the present application:

[0050] The security event display method provided in the embodiment of the present application obtains each security event to be displayed; determines the initial display order of each security event to be displayed in the security event list; for each security event to be displayed, based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, adjusts the initial display order of the security event to be displayed to obtain the optimized display order of the security event to be displayed in the security event list; wherein the host attention index of the security event to be displayed is: determined based on the number of processed security events that are the same as the host concerned by the security event to be displayed; the host concerned by the security event to be displayed represents the host that caused the security event to be displayed; the type attention index of the security event to be displayed is: determined based on the number of processed security events with the same event type as the security event to be displayed; and each security event to be displayed is displayed in the security event list according to the obtained optimized display order.

[0051] Based on the above processing, the initial display order of security events to be displayed can be optimized in combination with the event type of the processed security events and the concerned host to obtain an optimized display order. Since the processed security events can reflect the behavioral characteristics of the user in handling security events, displaying them based on the optimized display order can effectively guide the user to prioritize the processing of security events to be displayed that meet their behavioral characteristics, thereby improving the processing efficiency of security events.

[0052] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0054] Figure 1A flowchart of a security event display method provided in an embodiment of the present application;

[0055] Figure 2 A flowchart of another security event display method provided in an embodiment of the present application;

[0056] Figure 3 A flowchart of another security event display method provided in an embodiment of the present application;

[0057] Figure 4 A structural diagram of a security event display device provided in an embodiment of the present application;

[0058] Figure 5 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0060] The embodiment of the present application provides a security event display method, which can be applied to an electronic device, and the electronic device can be a platform for managing security events. For example, the electronic device can communicate with a network security device to display a security event determined by the network security device.

[0061] See also Figure 1 , Figure 1 A flowchart of a security event display method provided in an embodiment of the present application, the method may include the following steps:

[0062] S101: Obtain security events to be displayed.

[0063] S102: Determine an initial display order of each security event to be displayed in the security event list.

[0064] S103: For each security event to be displayed, based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, the initial display order of the security event to be displayed is adjusted to obtain the optimized display order of the security event to be displayed in the security event list.

[0065] Among them, the host attention index of the security event to be displayed is determined based on the number of processed security events that are the same as the host of the security event to be displayed; the host of the security event to be displayed represents the host that caused the security event to be displayed; the type attention index of the security event to be displayed is determined based on the number of processed security events of the same event type as the security event to be displayed.

[0066] S104: Displaying each security event to be displayed in the security event list according to the obtained optimized display order.

[0067] The security event display method provided in the embodiment of the present application can optimize the initial display order of the security events to be displayed in combination with the event type of the processed security events and the concerned host to obtain an optimized display order. Since the processed security events can reflect the behavioral characteristics of the user in handling the security events, displaying them based on the optimized display order can effectively guide the user to prioritize the processing of the security events to be displayed that meet their behavioral characteristics, thereby improving the processing efficiency of security events.

[0068] For step S101, each security event to be displayed is the security event that the electronic device currently needs to display. After the electronic device displays each security event, the user can choose to process the displayed security event, or can also choose to ignore the displayed security event. For example, for some false alarm security events, the user can choose to ignore them without processing.

[0069] For step S102, the initial display order indicates the initial display order of each security event to be displayed in the security event list. In one embodiment, the above step S102 may include the following steps:

[0070] The initial display order of each security event to be displayed in the security event list is determined according to the chronological order of occurrence; or, the initial display order of each security event to be displayed in the security event list is determined according to the order of threat level from high to low.

[0071] In one implementation, according to the initial display order, in the security event list, the security events to be displayed that occurred earlier are located before the security events to be displayed that occurred later.

[0072] Based on the above processing, the user can be guided to give priority to the security events that occurred earlier and are to be displayed, so as to ensure the timeliness of the security event processing.

[0073] In another implementation, according to the initial display order, in the security event list, the security events with higher threat levels to be displayed are placed before the security events with lower threat levels to be displayed.

[0074] Among them, the threat level of the security incident can be determined based on the event type of the security incident and the network behavior of the attacked host in the security incident (for example, requesting a mining task, or scanning the host's files).

[0075] In one implementation, the event type of a security event can be represented by the type of virus that triggers the security event. Accordingly, the event type of a security event can include: a security event triggered by a "ransomware virus", a security event triggered by a "mining virus", etc.

[0076] Specifically, the threat level of each event type can be pre-set by a technician, and the threat level of each network behavior can also be pre-set. For example, the threat level can be represented by a numerical value (which can be called a threat level value), and the larger the threat level value, the higher the threat level. Different event types correspond to different threat level values, and different network behaviors correspond to different threat level values.

[0077] Based on the above processing, the user can be guided to prioritize the security events to be displayed that have a higher threat level, so as to reduce the losses caused by the security events.

[0078] In one implementation, statistics may be collected on the event types of the security events to be displayed, and the initial display order may be determined based on the statistical results.

[0079] For example, each security event to be displayed is grouped according to event type to obtain multiple security event groups. According to the initial display order, in the security event list, the security events to be displayed in the security event group containing more security events are located before the security events to be displayed in the security event group containing fewer security events.

[0080] Based on the above processing, the user can be guided to give priority to the security events to be displayed of the event types with higher occurrence frequency, so as to reduce the losses caused by the security events.

[0081] In another implementation, the initial display order can also be determined based on popular security events. Figure 2 ,exist Figure 1 On the basis of, the above step S102 includes the following steps:

[0082] S1021: Obtain current hot security events.

[0083] S1022: For each security event to be displayed, determine a hot security event that matches the security event to be displayed from various hot security events.

[0084] S1023: Determine the initial display order of the security events to be displayed in the security event list according to the degree of loss caused by the matching popular security events.

[0085] In the embodiment of the present application, the hot security events include: hot security events detected within a certain area (for example, security events that cause high losses worldwide). Such security events will change over time.

[0086] For example, event information of popular security events can be found in Table (1).

[0087] Table (1)

[0088] name Hotspot Industry Event related properties Ransomware Top1 Medical Domain name A, IP1 Mining virus Top2 educate Domain name B, IP2

[0089] Each row in Table (1) represents a hot security event. There is also a relative order between the hot security events, which is represented by their respective hotness levels. The hotness level can be determined based on the degree of loss caused by the hot security event, that is, the greater the degree of loss caused, the higher the hotness level. The industry to which it belongs represents the business industry to which the host responsible for the virus attack that triggered the hot security event is responsible. The domain name corresponding to a hot security event represents the domain name of the remote control end of the hot security event, and the IP corresponding to a hot security event represents the IP address of the remote control end of the hot security event.

[0090] In one implementation, for each security event to be displayed, a hot security event matching the security event to be displayed may be determined based on one or more types of event information.

[0091] For example, if matching is performed based on domain names, if the domain name corresponding to a security event to be displayed is domain name A, it can be determined that the hot security event with a hotspot degree of Top 1 in Table (1) matches the security event to be displayed.

[0092] For another example, if matching is performed based on domain name and industry, if the domain name corresponding to a security event to be displayed is domain name B, and the industry to which it belongs is education, then it can be determined that the popular security event with the hottest degree Top2 in Table (2) matches the security event to be displayed.

[0093] After the matching hot security events are determined, the initial display order of the security events to be displayed can be determined based on the hotness of the matching hot security events. Since the hotness is determined based on the loss degree, that is, the initial display order of the security events to be displayed in the security event list is determined according to the loss degree caused by the matching hot security events.

[0094] For example, according to the initial display order, in the security event list, the security events to be displayed that match the popular security events that cause a greater degree of loss are located before the security events to be displayed that match the popular security events that cause a smaller degree of loss.

[0095] Based on the above processing, the user can be guided to give priority to the security events to be displayed that cause greater losses, so as to reduce the losses caused by the security events.

[0096] The method provided in the embodiment of the present application can be combined with external hot security events to determine the optimized display order, so as to display the security events to be displayed to the user, which can effectively guide the user to handle the security events and avoid the user's blind handling without a goal. In addition, since hot security events change over time, it is also possible to dynamically adjust the display order of the security events to be displayed.

[0097] In one embodiment, see Figure 3 ,exist Figure 1 On the basis of, the above step S103 includes the following steps:

[0098] S1031: For each security event to be displayed, obtain an initial display sequence value indicating an initial display sequence of the security event to be displayed.

[0099] S1032: Calculate the weighted sum of the initial display order value of the security event to be displayed, the host attention index of the security event to be displayed, and the type attention index of the security event to be displayed, and obtain an optimized display order value representing the optimized display order of the security event to be displayed in the security event list.

[0100] In one embodiment, the initial display order can be represented by a numerical value (ie, an initial display order value). For example, according to the initial display order, in the security event list, the earlier a security event to be displayed is, the greater the initial display order value of the security event to be displayed is.

[0101] In one implementation, after the initial display order is determined, the initial display order may be specifically quantified, that is, the initial display order value of each security event to be displayed is determined.

[0102] Furthermore, for each security event to be displayed, the weighted sum of the initial display order value, the host attention index, and the type attention index of the security event to be displayed can be calculated as the optimized display order value. By comparing the optimized order values ​​of each security event to be displayed, the display order of each security event to be displayed after optimization (i.e., the optimized display order) can be determined. For example, according to the optimized display order, in the security event list, the larger the optimized display order value of a security event to be displayed, the higher the security event to be displayed is.

[0103] The host attention index can reflect the security events that users prioritize from the dimension of the host that caused the security event. The larger the host attention index corresponding to a security event to be displayed, the more users tend to prioritize the security events caused by the host. Correspondingly, the larger the optimized display order value determined, the more users can be guided to prioritize the security events to be displayed, which can effectively guide users to prioritize the security events to be displayed that meet their behavioral characteristics.

[0104] The type attention index can reflect the security events that users prioritize from the dimension of event types. The larger the type attention index corresponding to a security event to be displayed, the more users tend to prioritize security events of the event type of the security event to be displayed. Correspondingly, the larger the optimized display order value determined, the more users can be guided to prioritize the security event to be displayed, which can effectively guide users to prioritize the security events to be displayed that meet their behavioral characteristics.

[0105] The method provided by the real-time embodiment of the present application can determine the optimized display order in combination with the security events that the user has handled, so as to display the security events to be displayed to the user, which can effectively guide the user to handle the security events and avoid the user's blind handling without a goal. In addition, since the security events that the user has handled change over time, it is also possible to dynamically adjust the display order of the security events to be displayed.

[0106] In one embodiment, before the above step S103, the method may further include the following steps:

[0107] For each security event to be displayed, if the source host device and the destination host device of the security event to be displayed are both internal host devices, then the host concerned by the security event to be displayed is determined to be the source host device; if the source host device of the security event to be displayed is an external host device, and the destination host device is an internal host device, then the host concerned by the security event to be displayed is determined to be the destination host device.

[0108] In the embodiment of the present application, the source host device of the security event is the attacker, and the destination host device is the attacked party.

[0109] If both the source host device and the destination host device are internal host devices, indicating that the security event to be displayed represents an attack initiated between internal host devices, then the main factor causing the security event to be displayed is the internal attacker (for example, the attacker is hijacked), that is, it is the internal attacker that causes the security event to be displayed. Therefore, the source host device is determined to be the host of concern for the security event to be displayed.

[0110] If the source host device is an external host device and the destination host device is an internal host device, it indicates that the security event to be displayed represents an attack launched from the outside to the inside, and the main factor causing the security event to be displayed is the internal attacked party (for example, the attacked party has a vulnerability), that is, the internal attacked party causes the security event to be displayed. Therefore, it is determined that the destination host device is the host of concern for the security event to be displayed.

[0111] It is understandable that the manner of determining the host of concern for processed security events is similar to the manner of determining the host of concern for security events to be displayed.

[0112] Based on the same inventive concept, the present application also provides a security event display device, see Figure 4 , Figure 4 A structural diagram of a security event display device provided in an embodiment of the present application includes:

[0113] The security event acquisition module 401 to be displayed is used to acquire each security event to be displayed;

[0114] An initial display order determination module 402 is used to determine the initial display order of each security event to be displayed in the security event list;

[0115] The optimized display order determination module 403 is used to adjust the initial display order of each security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, so as to obtain the optimized display order of the security event to be displayed in the security event list;

[0116] The host attention index of the security event to be displayed is determined based on the number of processed security events that are the same as the host concerned by the security event to be displayed; the host concerned by the security event to be displayed represents the host that caused the security event to be displayed; the type attention index of the security event to be displayed is determined based on the number of processed security events of the same event type as the security event to be displayed;

[0117] The display module 404 is used to display each security event to be displayed in the security event list according to the obtained optimized display order.

[0118] Optionally, the optimized display order determination module 403 includes:

[0119] An initial display sequence value acquisition submodule, used to acquire, for each security event to be displayed, an initial display sequence value representing an initial display sequence of the security event to be displayed;

[0120] The optimized display order determination submodule is used to calculate the weighted sum of the initial display order value of the security event to be displayed, the host attention index of the security event to be displayed, and the type attention index of the security event to be displayed, and obtain the optimized display order value representing the optimized display order of the security event to be displayed in the security event list.

[0121] Optionally, the device further comprises:

[0122] A host determination module, configured to, for each security event to be displayed, adjust the initial display order of the security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, and before obtaining the optimized display order of the security event to be displayed in the security event list, for each security event to be displayed, if the source host device and the destination host device of the security event to be displayed are both internal host devices, determine that the host concerned by the security event to be displayed is the source host device;

[0123] If the source host device of the security event to be displayed is an external host device, and the destination host device is an internal host device, then it is determined that the host concerned by the security event to be displayed is the destination host device.

[0124] Optionally, the initial display order determination module 402 includes:

[0125] The hot security event acquisition submodule is used to obtain the current hot security events;

[0126] A matching submodule, for determining, for each security event to be displayed, from the various hot security events, a hot security event that matches the security event to be displayed;

[0127] The initial display order determination submodule is used to determine the initial display order of the security events to be displayed in the security event list according to the degree of loss caused by the matching popular security events.

[0128] Optionally, the initial display order determination module is specifically used to determine the initial display order of the security events to be displayed in the security event list according to the order of occurrence time;

[0129] or,

[0130] The initial display order of the security events to be displayed in the security event list is determined according to the order of threat levels from high to low.

[0131] The present application also provides an electronic device, such as Figure 5As shown, it includes a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0132] Memory 503, used for storing computer programs;

[0133] The processor 501 is used to execute the program stored in the memory 503, and implements the following steps:

[0134] Obtain each security event to be displayed;

[0135] Determining an initial display order of the security events to be displayed in the security event list;

[0136] For each security event to be displayed, based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, the initial display order of the security event to be displayed is adjusted to obtain the optimized display order of the security event to be displayed in the security event list;

[0137] The host attention index of the security event to be displayed is determined based on the number of processed security events that are the same as the host concerned by the security event to be displayed; the host concerned by the security event to be displayed represents the host that caused the security event to be displayed; the type attention index of the security event to be displayed is determined based on the number of processed security events of the same event type as the security event to be displayed;

[0138] According to the obtained optimized display order, each security event to be displayed is displayed in the security event list.

[0139] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0140] The communication interface is used for communication between the above electronic device and other devices.

[0141] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0142] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0143] In another embodiment provided in the present application, a computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned security event display methods are implemented.

[0144] In another embodiment provided in the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any of the security event display methods in the above embodiments.

[0145] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0146] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0147] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, computer-readable storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0148] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A security event display method, It is characterized in that The method comprises: Obtain each security event to be displayed; Determining an initial display order of the security events to be displayed in the security event list; For each security event to be displayed, based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, the initial display order of the security event to be displayed is adjusted to obtain the optimized display order of the security event to be displayed in the security event list; The host attention index of the security event to be displayed is determined based on the number of processed security events that are the same as the host concerned by the security event to be displayed; the host concerned by the security event to be displayed represents the host that caused the security event to be displayed; the type attention index of the security event to be displayed is determined based on the number of processed security events of the same event type as the security event to be displayed; According to the obtained optimized display order, each security event to be displayed is displayed in the security event list.

2. The method according to claim 1, It is characterized in that The method of adjusting, for each security event to be displayed, the initial display order of the security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed to obtain the optimized display order of the security event to be displayed in the security event list includes: For each security event to be displayed, obtaining an initial display order value indicating an initial display order of the security event to be displayed; Calculate the weighted sum of the initial display order value of the security event to be displayed, the host attention index of the security event to be displayed, and the type attention index of the security event to be displayed, and obtain an optimized display order value representing the optimized display order of the security event to be displayed in the security event list.

3. The method according to claim 1, It is characterized in that Before adjusting the initial display order of each security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed to obtain the optimized display order of the security event to be displayed in the security event list, the method further includes: For each security event to be displayed, if the source host device and the destination host device of the security event to be displayed are both internal host devices, determining that the host concerned by the security event to be displayed is the source host device; If the source host device of the security event to be displayed is an external host device, and the destination host device is an internal host device, then it is determined that the host concerned by the security event to be displayed is the destination host device.

4. The method according to claim 1, It is characterized in that The determining of the initial display order of the security events to be displayed in the security event list includes: Obtain current hot security events; For each security event to be displayed, determining a hot security event that matches the security event to be displayed from the hot security events; According to the extent of loss caused by the matching popular security events, the initial display order of the security events to be displayed in the security event list is determined.

5. The method according to claim 1, It is characterized in that The determining of the initial display order of the security events to be displayed in the security event list includes: Determine the initial display order of the security events to be displayed in the security event list according to the order of occurrence time; or, The initial display order of the security events to be displayed in the security event list is determined according to the order of threat levels from high to low.

6. A security event display device, It is characterized in that The device comprises: A module for acquiring security events to be displayed, used for acquiring security events to be displayed; An initial display order determination module, used to determine the initial display order of each security event to be displayed in the security event list; An optimized display order determination module is used to adjust the initial display order of each security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, so as to obtain the optimized display order of the security event to be displayed in the security event list; The host attention index of the security event to be displayed is determined based on the number of processed security events that are the same as the host concerned by the security event to be displayed; the host concerned by the security event to be displayed represents the host that caused the security event to be displayed; the type attention index of the security event to be displayed is determined based on the number of processed security events of the same event type as the security event to be displayed; The display module is used to display each security event to be displayed in the security event list according to the obtained optimized display order.

7. The device according to claim 6, It is characterized in that The optimized display order determination module includes: An initial display sequence value acquisition submodule, used to acquire, for each security event to be displayed, an initial display sequence value representing an initial display sequence of the security event to be displayed; The optimized display order determination submodule is used to calculate the weighted sum of the initial display order value of the security event to be displayed, the host attention index of the security event to be displayed, and the type attention index of the security event to be displayed, and obtain the optimized display order value representing the optimized display order of the security event to be displayed in the security event list.

8. The device according to claim 6, It is characterized in that The device also includes: A host determination module, configured to, for each security event to be displayed, adjust the initial display order of the security event to be displayed based on the host attention index of the security event to be displayed and the type attention index of the security event to be displayed, and before obtaining the optimized display order of the security event to be displayed in the security event list, for each security event to be displayed, if the source host device and the destination host device of the security event to be displayed are both internal host devices, determine that the host concerned by the security event to be displayed is the source host device; If the source host device of the security event to be displayed is an external host device, and the destination host device is an internal host device, then it is determined that the host concerned by the security event to be displayed is the destination host device.

9. The device according to claim 6, It is characterized in that The initial display order determination module comprises: The hot security event acquisition submodule is used to obtain the current hot security events; A matching submodule, for determining, for each security event to be displayed, from the various hot security events, a hot security event that matches the security event to be displayed; The initial display order determination submodule is used to determine the initial display order of the security events to be displayed in the security event list according to the degree of loss caused by the matching popular security events.

10. The device according to claim 6, It is characterized in that The initial display order determination module is specifically used to determine the initial display order of the security events to be displayed in the security event list according to the order of occurrence time; or, The initial display order of the security events to be displayed in the security event list is determined according to the order of threat levels from high to low.

Images