Security alarm log noise reduction method, device, equipment and storage medium

Abstract

The present invention provides a method, apparatus, device, and storage medium for reducing the noise of security alarm logs. The method comprises: grouping original alarm logs by a first time window to obtain a first alarm set; grouping the first alarm set by address information and event type to obtain a second alarm set; filtering the second alarm set based on the total number of alarm logs and event rate within the first time window of the second alarm set; for the filtered second alarm set, dividing the first time window by a second time period to form a window time tag sequence; generating an event time tag sequence for each event; merging the event time tag sequences by atomic security events to form a time series set; and generating a reduced noise alarm log based on the time series set. The present invention uses address information and event type as initial grouping conditions and reduces noise in contextual security alarm logs based on time and behavior characteristics, filtering low-risk alarms and retaining high-value information.

Description

Technical Field

[0001] The present invention relates to the field of network and information security, and in particular to a method, device, equipment and storage medium for reducing noise in security alarm logs. Background Art

[0002] Currently, the industry primarily uses two main approaches to reduce the noise of security alert logs: log filtering based on overlay rules and log merging based on statistical aggregation. While existing noise reduction technologies have some effectiveness, they still fall short of meeting the needs of frontline security operations personnel. Specifically, they suffer from the following shortcomings:

[0003] 1) Log filtering based on superposition rules. This method filters existing security alert logs for only specific security event types. This method does not reflect the characteristics of security attack behavior and can easily miss key information for overall security assessment. For example, if only focusing on "remote command execution" alerts, a large number of alert logs such as "web sensitive path scanning" and "SQL injection" will be ignored, making it impossible for security operations personnel to determine the attacker's original intrusion time and method path.

[0004] Log merging based on statistical aggregation. Alarm log contexts with the same attack type are merged. This method can only statistically merge events of the same type and does not correlate or reduce the noise of a large number of related events related to "tool attempts." Security operations personnel must subsequently rely on empirical analysis to filter out a large number of low-risk alerts. For example, "SQLi (SQL injection)" and "CC (Challenge Collapsar) attacks, which use a proxy server to send a large number of seemingly legitimate requests to the victim server)" often appear together, with the former being dominated by numerous blind injection attempts and the latter by numerous complex, anomalous Web / SQL requests.

[0005] Therefore, how to reduce the noise of security alarm logs, filter out a large number of low-risk alarms, and retain high-value information is a technical problem that needs to be solved urgently by those skilled in the art.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present invention, and therefore may include information that does not constitute prior art known to ordinary technicians in this field. Summary of the Invention

[0007] In response to the problems in the prior art, the purpose of the present invention is to provide a security alarm log noise reduction method, device, equipment and storage medium, which overcomes the difficulties of the prior art, reduces the noise of the security alarm log, filters a large number of low-risk alarms, and retains high-value information.

[0008] An embodiment of the present invention provides a method for reducing noise in a security alarm log, comprising:

[0009] Group the original alarm logs according to the first time window to obtain the first alarm set;

[0010] Grouping the first alarm set according to address information and event type to obtain a second alarm set;

[0011] Filtering the second alarm set based on the total number of alarm logs and event rate of the second alarm set within the first time window;

[0012] For the filtered second alarm set:

[0013] Dividing the first time window according to a second time period to form a window time tag sequence;

[0014] Generate a sequence of event time labels for each event;

[0015] According to the atomic security event, the event time tag sequence is merged to form a time series set;

[0016] A noise-reduced alarm log is formed based on the time series set.

[0017] In some embodiments of the present application, the second alarm set generates a first alarm log using the source address, destination address, event type, earliest time tag within the first time window, latest time tag within the first time window, and the number of original alarm logs in the second alarm set as labels.

[0018] In some embodiments of the present application, filtering the second alarm set based on the total number of events and the event rate within the first time window of the second alarm set includes:

[0019] A second alarm set is retained in which the total number of events in the first time window is greater than a first set threshold and the event rate in the first time window is greater than a second set threshold.

[0020] In some embodiments of the present application, the event rate of the second alarm set in the first time window is the total number of events of the second alarm set in the first time window / (the latest time label in the first time window - the earliest time label in the first time window).

[0021] In some embodiments of the present application, forming a noise-reduced alarm log according to the time series set includes:

[0022] When the formed event sequence set is one, generating a denoised alarm log using the source address, destination address, earliest time tag within the first time window, latest time tag within the first time window, and the number of original alarm logs in the first alarm set as labels;

[0023] Set the event type of the de-noised alert log to synthetic tool attack attempt.

[0024] In some embodiments of the present application, forming a noise-reduced alarm log according to the time series set includes:

[0025] Determining whether adjacent time series sets are related based on average event rates of the adjacent time series sets;

[0026] If not, the adjacent time series sets are marked as two independent security events.

[0027] In some embodiments of the present application, the average event rate of the time series set is the average of the event rates of each event time tag sequence in the time series set.

[0028] According to another aspect of the present application, a security alarm log noise reduction device is provided, comprising:

[0029] a first grouping module configured to group the original alarm logs according to a first time window to obtain a first alarm set;

[0030] a second grouping module configured to group the first alarm set according to address information and event type to obtain a second alarm set;

[0031] a screening module configured to screen the second alarm set based on a total number of alarm logs and an event rate of the second alarm set within the first time window;

[0032] a segmentation module configured to segment the first time window according to a second time period for the filtered second alarm set to form a window time tag sequence;

[0033] a first generating module configured to generate an event time tag sequence for each event of the filtered second alarm set;

[0034] a merging module configured to merge the event time tag sequences according to atomic security events to form a time series set;

[0035] The alarm log generation module is configured to generate a noise-reduced alarm log according to the time series set.

[0036] According to another aspect of the present invention, there is also provided a security alarm log noise reduction processing device, comprising:

[0037] processor;

[0038] a memory storing executable instructions for the processor;

[0039] The processor is configured to execute the steps of the security alarm log noise reduction method described above by executing the executable instructions.

[0040] An embodiment of the present invention further provides a computer-readable storage medium for storing a program, which, when executed, implements the steps of the above-mentioned security alarm log noise reduction method.

[0041] Compared with the prior art, the purpose of the present invention is:

[0042] This application uses address information and event type as initial grouping conditions, and implements noise reduction of contextual security alarm logs based on time and behavior characteristics, filtering out a large number of low-risk alarms and retaining high-value information. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Other features, objects and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.

[0044] Figure 1 The figure is a flow chart of an embodiment of the method for reducing noise of security alarm logs of the present invention.

[0045] Figure 2 This is a flow chart of another embodiment of the method for reducing noise in security alarm logs of the present invention.

[0046] Figure 3 This is a flow chart of another embodiment of the method for reducing noise in security alarm logs of the present invention.

[0047] Figure 4 This is a module diagram of an embodiment of the security alarm log noise reduction device of the present invention.

[0048] Figure 5 It is a module diagram of another embodiment of the security alarm log noise reduction device of the present invention.

[0049] Figure 6 It is a structural schematic diagram of the security alarm log noise reduction device of the present invention.

[0050] Figure 7 It is a schematic structural diagram of a computer-readable storage medium according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. Identical reference numerals in the figures represent identical or similar structures, and thus a repeated description thereof will be omitted.

[0052] See also Figure 1 , Figure 1 The flowchart of an embodiment of the method for reducing the noise of security alarm logs of the present invention is as follows. The embodiment of the present invention provides a method for reducing the noise of security alarm logs, comprising the following steps:

[0053] Step S110: grouping the original alarm logs according to the first time window to obtain a first alarm set.

[0054] Specifically, the first time window can be set as needed, for example, it can be set to 5 minutes, 10 minutes, 15 minutes, etc., and this application is not limited to this. Specifically, the original alarm log may include multiple alarm messages, and each alarm message may include a destination address, a source address, an event type, an occurrence time, etc. Therefore, step S110 can group each alarm message according to the occurrence time of the first time window. For example, the alarm messages from 13:00 to 13:15 can be divided into one group; the alarm messages from 13:15 to 13:30 can be divided into one group; the alarm messages from 13:30 to 13:40 can be divided into one group, and so on.

[0055] Step S120: Group the first alarm set according to address information and event type to obtain a second alarm set.

[0056] Specifically, the address information may include a source address and a destination address. Thus, the second alarm set may generate a first alarm log using the alarm log's source address, destination address, event type, earliest time tag within the first time window, latest time tag within the first time window, and the number of original alarm logs in the second alarm set as tags. For example, within the first time window of 13:00-13:15, multiple alarm messages with event type A, source address 128.XXX.XXX.XXX, and destination address 127.XXX.XXX.XXX have the earliest time tag (the time of the earliest alarm message) in the first time window of 13:02 and the latest time tag (the time of the latest alarm message) in the first time window of 13:12. Then, the first alarm log in the first time window of 13:00-13:15 is generated with event type A, source address 128.XXX.XXX.XXX, destination address 127.XXX.XXX.XXX, the earliest time tag in the first time window of 13:02, and the latest time tag in the first time window of 13:12 as tags to generate the first alarm log. The first alarm log is an intermediate alarm log and can be used for other analysis and processing, or can be deleted after noise reduction to the final alarm log. This application is not limited to this.

[0057] Step S130: Filter the second alarm set based on the total number of alarm logs and event rate in the first time window of the second alarm set.

[0058] Step S140: Divide the first time window into the filtered second alarm set according to the second time period to form a window time tag sequence.

[0059] Specifically, the second time period can be set as needed, for example, 5 seconds, 10 seconds, 15 seconds, etc. For a first time window of 15 minutes, when the second time period is 5 seconds, a window time tag sequence {0, 1, 2, ..., 299} formed by 15*60 / 5=300 time tags can be generated.

[0060] Step S150: For each event in the filtered second alarm set, generate an event time tag sequence.

[0061] For example, in the same second alarm set, for an event type of SQL injection, the earliest time tag to the latest time tag of the event in the first time window is 00:01:00 to 00:02:00, and the event time tag sequence is {12, 13, 14, ..., 23}

[0062] Step S160: For the filtered second alarm set, the event time tag sequences are merged according to the atomic security events to form a time series set.

[0063] For example, for the event time tag sequence SQL injection {0, 1, 2, ..., 299}; XSS (cross-site scripting attack) {0, 1, 2, ..., 100}; RCE (remote code execution) {31, 32, ..., 50}; CVE (Common Vulnerabilities & Exposures) attack {401, 402, ..., 502}; file upload attack: {450, 451, ..., 600}, they can be merged into time series set A (SQL injection, XSS, RCE) {0, 1, 2, ..., 299} and time series set B (CVE attack, file upload attack) {401, 402, ..., 600} according to step S160. In other words, step S160 is equivalent to merging multiple consecutive event time tag sequences together.

[0064] Step S170: For the filtered second alarm set, a noise-reduced alarm log is formed according to the time series set.

[0065] The present invention uses address information and event type as initial grouping conditions, and realizes noise reduction of contextual security alarm logs based on time and behavior characteristics, thereby filtering out a large number of low-risk alarms and retaining high-value information.

[0066] See below Figure 2 , Figure 2 This is a flow chart of another embodiment of the method for reducing noise in security alarm logs of the present invention.

[0067] Step S210: grouping the original alarm logs according to the first time window to obtain a first alarm set.

[0068] Step S220: Group the first alarm set according to address information and event type to obtain a second alarm set.

[0069] Step S230: retaining a second alarm set in which the total number of events in the first time window is greater than a first set threshold and the event rate in the first time window is greater than a second set threshold.

[0070] Specifically, the event rate of the second alarm set in the first time window is the total number of events of the second alarm set in the first time window / (latest time label in the first time window-earliest time label in the first time window).

[0071] Specifically, the total number of events in the second alarm set within the first time window, the latest time label within the first time window, and the earliest time label within the first time window can be obtained based on the labels set in the aforementioned first alarm log, thereby facilitating the calculation of the event rate.

[0072] Step S240: Divide the first time window into the filtered second alarm set according to the second time period to form a window time tag sequence.

[0073] Step S250: For each event in the filtered second alarm set, generate an event time tag sequence.

[0074] Step S260: For the filtered second alarm set, the event time tag sequences are merged according to the atomic security events to form a time series set.

[0075] Step S271: When the event sequence set formed is one, a noise-reduced alarm log is generated with the source address, destination address, earliest time tag in the first time window, latest time tag in the first time window, and the number of original alarm logs in the first alarm set as labels.

[0076] Step S272: Set the event type of the de-noised alarm log to a synthetic tool attack attempt.

[0077] Step S273: determining whether adjacent time series sets are related based on the average event rates of the adjacent time series sets.

[0078] Specifically, the average event rate of the time series set is the average value of the event rates of each event time tag sequence in the time series set (which can be calculated according to the above step S230).

[0079] Specifically, if the average event rates v1 and v2 of the adjacent time series sets meet |v1-v2|<=v1*50%, then the security events of the two adjacent time series sets are considered to be continuous.

[0080] If the result of step S273 is no, step S274 is executed: the adjacent (non-continuous) time series sets are marked as two independent security events. If yes, the two adjacent event time tag sequence sets can be further merged.

[0081] See below Figure 3 , Figure 3 This is a flow chart of another embodiment of the method for reducing noise in security alarm logs of the present invention. Figure 3 The original security alarm log 300 is input into step S310 to step S340.

[0082] Step S310: Denoising the security alarm log based on contextual frequent items.

[0083] Specifically, it first groups the original alarm logs according to the first time window, such as 5 / 10 / 15 minutes, etc. Then, the original alarm logs are grouped again by "source IP + target IP + event type". Finally, for the original security alarm log set within the same "source IP + target IP + event type", find the earliest time tag and the latest time tag within the time window by time sorting, and count the total number of all original security alarm logs within the time period. Generate a new log record with "source IP + target IP + event type" + "earliest time tag within the time window" + "latest time tag within the time window" + "total number of original security alarm logs";

[0084] Step S320: Filter the alarm logs based on the total number of events and the rate.

[0085] Specifically, for newly generated log records, the latest time stamp within the time window is used as the upper bound of the event time, and the earliest time stamp within the time window is used as the lower bound of the event time. The event occurrence rate is calculated according to the following formula:

[0086] Total number of original security alert logs / (upper bound of event time - lower bound of event time)

[0087] Next, configure the thresholds. The total number of events within the time window can be set to A1, and the rate threshold can be set to V1. Thresholds can be configured as needed.

[0088] For each new log record, only when the “total number of original security alarm logs” is greater than or equal to A1 and the rate is greater than or equal to V1, will step S330 be entered; otherwise, the process ends.

[0089] Step S330: merging alarm logs based on behavioral characteristics.

[0090] Specifically, first, the time boundary judgment of the security event based on the time tag sequence is performed. This is performed through the following steps:

[0091] The output results of step S320 are grouped by the same "source IP + target IP";

[0092] The unit time window is divided into time windows of every 5 seconds to form a time label sequence;

[0093] Each atomic event type can generate its own time tag sequence through its upper and lower time bounds;

[0094] All time tag sequences are combined to obtain a new time tag sequence set. This time tag sequence set may consist of only one set or multiple sets.

[0095] Then, perform alarm log merging based on behavior rate.

[0096] Specifically, if there is only one set, all security event type fields for "source IP + target IP" are merged into one record. For records with the same "source IP + target IP", a new log record is generated based on "source IP + target IP" + "earliest timestamp of all events in the time window" + "latest timestamp of all events in the time window" + "total number of original security alert logs for all events in the time window", with the "event type" being "synthetic tool attack attempt".

[0097] For the case where there are multiple sets, first, calculate the average rate of atomic security events in each set; in the adjacent merged atomic event sets, take the arithmetic average to obtain the average rates v1 and v2 in the time series set; if two |v1-v2|<=v1*50%, the security events of the two adjacent time series sets are considered to be continuous; otherwise, two independent super-class security events are generated.

[0098] Step S340: Generate a new security alarm log type tag, write it into a new data table, and end the process. The data table fields may include timestamp, source IP, destination IP, destination port, threat level, alarm event type, event description, start time, end time, original event times, and other information.

[0099] Therefore, this application uses a unique alarm log classification method based on the total number and rate of events to distinguish between a large number of low-risk "continuous attack attempts" and potentially high-risk "discrete malicious behaviors"; uses a unique security event time boundary judgment method based on time label sequences to express each atomic security event in the time range, and uses set operations to quickly judge the temporal correlation of each atomic security event, greatly improving performance; finally, uses a unique alarm log merging method based on behavior rate to achieve correlation judgment of discontinuous security event sets, greatly improving alarm noise reduction capabilities.

[0100] Furthermore, this application uses an alarm log classification method based on the total number of events and the rate to achieve preliminary screening of the "tool attempt type" and "manual operation type" security alarm logs, and focuses the noise reduction target on the analysis and processing of the "tool attempt type" security alarm logs; creatively uses the "time label sequence" method to achieve the expression of each atomic security event in the time range, and uses set operations to achieve rapid judgment of the temporal correlation of each atomic security event, greatly improving performance; creatively uses the "behavior average rate" to achieve correlation judgment of discontinuous security event sets, greatly improving the alarm noise reduction capability.

[0101] The above is merely a schematic description of the specific implementation of the present invention, and the present invention is not limited thereto. The splitting, merging, and changes in the execution order of steps, the splitting, merging, and changes in information transmission of modules are all within the scope of protection of the present invention.

[0102] Figure 4 Schematic diagram of a module of an embodiment of the security alarm log noise reduction device of the present invention. Figure 4 As shown, it includes but is not limited to: a first grouping module 410 , a second grouping module 420 , a screening module 430 , a segmentation module 440 , a first generation module 450 , a merging module 460 and an alarm log generation module 470 .

[0103] The first grouping module 410 is configured to group the original alarm log according to the first time window to obtain a first alarm set;

[0104] The second grouping module 420 is configured to group the first alarm set according to address information and event type to obtain a second alarm set;

[0105] The screening module 430 is configured to screen the second alarm set based on the total number of alarm logs and the event rate within the first time window of the second alarm set;

[0106] The segmentation module 440 is configured to segment the first time window according to the second time period for the filtered second alarm set to form a window time tag sequence;

[0107] The first generating module 450 is configured to generate an event time tag sequence for each event of the filtered second alarm set;

[0108] The merging module 460 is configured to merge the event time tag sequences according to the atomic security events to form a time series set;

[0109] The alarm log generation module 470 is configured to form a noise-reduced alarm log according to the set of time series.

[0110] The implementation principles of the above modules are described in the security alarm log noise reduction method and will not be repeated here.

[0111] The security alarm log denoising device of the present invention uses address information and event type as initial grouping conditions, and implements denoising of contextual security alarm logs based on time and behavior characteristics, thereby filtering out a large number of low-risk alarms and retaining high-value information.

[0112] Figure 5 This is a block diagram of another embodiment of the security alarm log noise reduction device of the present invention. The security alarm log noise reduction device 500 of the present invention includes, but is not limited to, a first grouping module 510, a second grouping module 520, a screening module 530, a segmentation module 540, a first generation module 550, a merging module 560, a second generation module 571, a type setting module 572, a determination module 573, and an independent setting module 574.

[0113] The first grouping module 510 is configured to group the original alarm logs according to a first time window to obtain a first alarm set.

[0114] The second grouping module 520 is configured to group the first alarm set according to address information and event type to obtain a second alarm set.

[0115] The screening module 530 is configured to retain the second alarm set for which the total number of events in the first time window is greater than a first set threshold and the event rate in the first time window is greater than a second set threshold.

[0116] The segmentation module 540 is configured to segment the filtered second alarm set into the first time window according to the second time period to form a window time tag sequence.

[0117] The first generating module 550 is configured to generate an event time tag sequence for each event of the filtered second alarm set.

[0118] The merging module 560 is configured to merge the event time tag sequences of the filtered second alarm set according to the atomic security events to form a time series set.

[0119] The second generation module 571 is configured to generate a noise-reduced alarm log using the source address, destination address, earliest time tag within the first time window, latest time tag within the first time window, and the number of original alarm logs in the first alarm set as labels when the event sequence set formed is one.

[0120] The type setting module 572 is configured to set the event type of the denoised alarm log to a synthetic tool attack attempt.

[0121] The determination module 573 is configured to determine whether adjacent time series sets are related according to the average event rates of the adjacent time series sets.

[0122] The independent setting module 574 is configured to mark the adjacent (non-continuous) time series sets as two independent security events when the judgment module 573 judges that the two adjacent event time label sequence sets are not. If so, the two adjacent event time label sequence sets can be further merged.

[0123] The implementation principles of the above modules are described in the security alarm log noise reduction method and will not be repeated here.

[0124] Figure 4 and Figure 5 The security alarm log noise reduction devices 400 and 500 provided by the present invention are shown for illustrative purposes only. Without violating the principles of the present invention, the separation, combination, and addition of modules are all within the scope of protection of the present invention. The security alarm log noise reduction devices 400 and 500 provided by the present invention can be implemented using software, hardware, firmware, plug-ins, or any combination thereof, and the present invention is not limited thereto.

[0125] An embodiment of the present invention further provides a security alarm log noise reduction processing device, comprising a processor and a memory storing executable instructions for the processor. The processor is configured to execute the executable instructions to perform the steps of the security alarm log noise reduction method.

[0126] As shown above, the security alarm log noise reduction processing device of this embodiment of the present invention uses address information and event type as initial grouping conditions, and realizes noise reduction of contextual security alarm logs based on time and behavior characteristics, filtering out a large number of low-risk alarms and retaining high-value information.

[0127] Those skilled in the art will appreciate that various aspects of the present invention may be implemented as systems, methods, or program products. Accordingly, various aspects of the present invention may be implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as "circuits," "modules," or "platforms."

[0128] Figure 6 This is a schematic diagram of the structure of the security alarm log noise reduction processing device of the present invention. Figure 6 An electronic device 600 according to this embodiment of the present invention will be described. Figure 6 The electronic device 600 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0129] like Figure 6As shown, electronic device 600 is implemented as a general-purpose computing device. Components of electronic device 600 may include, but are not limited to, at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different platform components (including storage unit 620 and processing unit 610), and a display unit 640.

[0130] The storage unit stores program codes, which can be executed by the processing unit 610, so that the processing unit 610 performs the steps of various exemplary embodiments of the present invention described in the above-mentioned security alarm log noise reduction method section of this specification. For example, the processing unit 610 can perform the following steps: Figure 1 Follow the steps shown in .

[0131] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0132] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0133] Bus 630 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0134] The electronic device 600 can also communicate with one or more external devices 6001 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 600, and / or any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication can occur via an input / output (I / O) interface 650. Furthermore, the electronic device 600 can communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 660. The network adapter 660 can communicate with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 600, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms.

[0135] An embodiment of the present invention further provides a computer-readable storage medium for storing a program that, when executed, implements the steps of the security alert log noise reduction method. In some possible implementations, various aspects of the present invention may also be implemented as a program product, which includes program code. When the program product is executed on a terminal device, the program code is configured to cause the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the security alert log noise reduction method section above.

[0136] As shown above, the computer-readable storage medium used to perform security alert log noise reduction in this embodiment uses address information and event type as initial grouping conditions, implements noise reduction of contextual security alert logs based on time and behavior characteristics, filters a large number of low-risk alerts, and retains high-value information.

[0137] Figure 7 Schematic diagram of the structure of the computer readable storage medium of the present invention. Figure 7 , a program product 700 for implementing the above-described method according to an embodiment of the present invention is described. The program product 700 may be a portable compact disc read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0138] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0139] Computer-readable storage media may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0140] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0141] In summary, this application uses address information and event type as initial grouping conditions, and implements noise reduction of contextual security alarm logs based on time and behavior characteristics, filtering out a large number of low-risk alarms and retaining high-value information.

[0142] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A method for reducing the noise of security alarm logs, characterized in that: include: Group the original alarm logs according to the first time window to obtain the first alarm set; Grouping the first alarm set according to address information and event type to obtain a second alarm set; Based on the total number of alarm logs and the event rate of the second alarm set in the first time window, the second alarm set is filtered, and the second alarm set is retained, where the total number of events in the first time window is greater than a first set threshold and the event rate in the first time window is greater than a second set threshold. The event rate of the second alarm set in the first time window is equal to the total number of events of the second alarm set in the first time window / (latest time tag in the first time window - earliest time tag in the first time window); For the filtered second alarm set: Dividing the first time window according to a second time period to form a window time tag sequence; Generate a sequence of event time labels for each event; According to the atomic security event, the event time tag sequence is merged to form a time series set; A noise-reduced alarm log is formed based on the time series set.

2. The method for reducing noise in security alarm logs according to claim 1, wherein: The second alarm set generates the first alarm log using the source address, destination address, event type, earliest time tag in the first time window, latest time tag in the first time window, and the number of original alarm logs in the second alarm set as tags.

3. The method for reducing noise in security alarm logs according to claim 1, wherein: The forming of a noise-reduced alarm log according to the time series set includes: When the formed event sequence set is one, generating a denoised alarm log using the source address, destination address, earliest time tag within the first time window, latest time tag within the first time window, and the number of original alarm logs in the first alarm set as labels; Set the event type of the de-noised alert log to synthetic tool attack attempt.

4. The method for reducing noise in security alarm logs according to claim 1, wherein: The forming of a noise-reduced alarm log according to the time series set includes: Determining whether adjacent time series sets are related based on average event rates of the adjacent time series sets; If not, the adjacent time series sets are marked as two independent security events.

5. The method for reducing noise in security alarm logs according to claim 4, wherein: The average event rate of the time series set is the average of the event rates of each event time tag sequence in the time series set.

6. A device for reducing the noise of security alarm logs, characterized in that: include: a first grouping module configured to group the original alarm logs according to a first time window to obtain a first alarm set; a second grouping module configured to group the first alarm set according to address information and event type to obtain a second alarm set; a screening module configured to screen the second alarm set based on the total number of alarm logs and the event rate in the first time window of the second alarm set, retaining the second alarm set for which the total number of events in the first time window is greater than a first set threshold and the event rate in the first time window is greater than a second set threshold, and the event rate of the second alarm set in the first time window is equal to the total number of events of the second alarm set in the first time window / (latest time tag in the first time window-earliest time tag in the first time window); a segmentation module configured to segment the first time window according to a second time period for the filtered second alarm set to form a window time tag sequence; a first generating module configured to generate an event time tag sequence for each event of the filtered second alarm set; a merging module configured to merge the event time tag sequences according to atomic security events to form a time series set; The alarm log generation module is configured to generate a noise-reduced alarm log according to the time series set.

7. A security alarm log noise reduction processing device, characterized in that: include: processor; a memory storing executable instructions for the processor; The processor is configured to execute the steps of the security alarm log noise reduction method according to any one of claims 1 to 5 by executing the executable instructions.

8. A computer-readable storage medium for storing a program, characterized in that: When the program is executed, the steps of the security alarm log noise reduction method described in any one of claims 1 to 5 are implemented.

Images