Alarm processing method, system, device and storage medium

Abstract

The present invention provides an alarm processing method, system, device and storage medium, wherein the method comprises: grouping the original alarm according to the IP pairs composed of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one, calculating the information entropy of the original alarm in each group, and aggregating the original alarms with similarity greater than the target value into super alarms according to the similarity between the information entropies, wherein the information entropy includes one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy. The present invention aggregates the groups according to the information entropy of the original alarms on the basis of grouping the IP pairs composed of the source IP address and the destination IP address, and the original alarms with similar information entropy are aggregated into super alarms, which significantly reduces the number of original alarms and improves the user experience.

Description

Background Art

[0002] In telecommunications networks, cyber attacks refer to attacks on the hardware, software and data in the network system by exploiting vulnerabilities and security flaws in the network. Therefore, a large number of network security protection devices are deployed in the network to deal with cyber attacks, and a large number of redundant alarm logs are generated.

[0003] In telecommunications networks, management services and operations generate massive amounts of alarm data every day. Traditional alarm processing methods rely on manpower, resulting in heavy monitoring workload and high manual load.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present invention, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] In view of the problems in the prior art, the purpose of the present invention is to provide an alarm processing method, system, device and storage medium, which overcomes the difficulties of the prior art and can aggregate the groups according to the information entropy of the original alarms on the basis of grouping the IP pairs composed of the source IP address and the destination IP address. The original alarms with similar information entropy are aggregated into super alarms, which significantly reduces the number of original alarms and reduces the workload of operation and maintenance personnel. Moreover, the aggregated super alarms aggregate the alarms more finely and provide processing priorities, which provides a predictable solution for the subsequent operation and maintenance personnel to accurately respond to the alarm logs. The embodiments of the present invention can improve the user experience.

[0006] An embodiment of the present invention provides an alarm processing method, comprising the following steps:

[0007] Get the original alerts generated for network access events;

[0008] The original alarm is grouped according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

[0009] The information entropy is calculated for the original alarms in each group, and the original alarms with similarity greater than the target value are aggregated into super alarms according to the similarity between the information entropies. The information entropy includes one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy.

[0010] Optionally, the alarm processing method further includes:

[0011] The multivariate information entropy is calculated for the super alarm in each group, and the processing priority is configured for the super alarm according to the multivariate information entropy.

[0012] Optionally, before calculating the information entropy of the original alarm in each group, the alarm processing method further includes:

[0013] Aggregate the original alarms of each group into multiple time clusters according to the alarm time information;

[0014] The information entropy is calculated for the original alarms in each group, and the original alarms with similarity greater than the target value are aggregated into super alarms according to the similarity between the information entropies, including:

[0015] The information entropy is calculated for each time cluster in each group, and the time clusters with information entropy similarity greater than a threshold are aggregated into super alarms according to the information entropy similarity between the time clusters.

[0016] Optionally, information entropy is calculated for each time cluster in each group, including:

[0017] The IP pairs are grouped into one-to-one single-source single-destination attributes, and the content entropy, time entropy and port entropy are calculated for each time cluster.

[0018] Optionally, information entropy is calculated for each time cluster in each group, including:

[0019] The single-source multi-destination attribute grouping of IP pairs is one-to-many, and the destination IP entropy, time entropy and port entropy are calculated for each time cluster.

[0020] Optionally, information entropy is calculated for each time cluster in each group, including:

[0021] The IP pairs are grouped into multiple sources and single destinations, and the source IP entropy, time entropy and port entropy are calculated for each time cluster.

[0022] Optionally, calculating the information entropy for each time cluster in each group, and aggregating the time clusters whose information entropy similarity is greater than a threshold into an over-alarm according to the information entropy similarity between the time clusters, including:

[0023] For each group, the mean square error between the information entropies of each time cluster is calculated, the information entropy similarity is obtained based on the mean square error, and the time clusters whose mean square error is not greater than the set threshold are aggregated into over-alarm.

[0024] Optionally, the mean square error between the information entropies of each time cluster is calculated, including:

[0025] For each group, the mean square error between the information entropies of each time cluster whose time difference is not greater than the time threshold is calculated.

[0026] An embodiment of the present invention further provides an alarm processing system for implementing the above-mentioned alarm processing method, and the alarm processing system includes:

[0027] An original alarm acquisition module is used to acquire the original alarm generated by the network access event;

[0028] A grouping module groups the original alarm according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

[0029] The super alarm aggregation module calculates the information entropy of the original alarm in each group, and aggregates the original alarms with similarity greater than the target value into super alarms according to the similarity between the information entropies. The information entropy includes one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy.

[0030] An embodiment of the present invention further provides an alarm processing device, comprising:

[0031] processor;

[0032] a memory in which executable instructions for the processor are stored;

[0033] Wherein, the processor is configured to perform the steps of the above-mentioned alarm processing method by executing executable instructions.

[0034] An embodiment of the present invention further provides a computer-readable storage medium for storing a program, which implements the steps of the above-mentioned alarm processing method when executed.

[0035] The purpose of the present invention is to provide an alarm processing method, system, device and storage medium, by grouping the original alarms according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which they belong, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one, calculating the information entropy of the original alarms in each group, and aggregating the original alarms with similarity greater than a target value into super alarms according to the similarity between the information entropies, wherein the information entropy includes one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy.

[0036] The embodiment of the present invention aggregates the groups according to the information entropy of the original alarms based on the grouping of IP pairs composed of source IP addresses and destination IP addresses. The original alarms with similar information entropy are aggregated into super alarms, which significantly reduces the number of original alarms and reduces the workload of operation and maintenance personnel. Moreover, the aggregated super alarms aggregate the alarms more finely and provide processing priorities, which provides a predictable solution for the subsequent operation and maintenance personnel to accurately respond to the alarm logs. The embodiment of the present invention can improve the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Other features, objectives and advantages of the present invention will become more apparent from a reading of the detailed description of non-limiting embodiments made with reference to the following accompanying drawings.

[0038] Figure 1 It is a flow chart of one embodiment of the alarm processing method provided by the present invention;

[0039] Figure 2 is a flow chart of a second embodiment of the alarm processing method provided by the present invention;

[0040] Figure 3 is a flow chart of the third embodiment of the alarm processing method provided by the present invention;

[0041] Figure 4 It is a system analysis architecture diagram of the alarm processing method provided by the present invention;

[0042] Figure 5 It is a module diagram of one embodiment of the alarm processing system of the present invention;

[0043] Figure 6 It is a module diagram of the second embodiment of the alarm processing system of the present invention;

[0044] Figure 7 It is a module diagram of the third embodiment of the alarm processing system of the present invention;

[0045] Figure 8 It is a schematic diagram of the operation of the alarm processing system of the present invention. DETAILED DESCRIPTION

[0046] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the embodiments set forth herein. Instead, these embodiments are provided to make the present invention comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art.

[0047] The accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware forwarding modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0048] In addition, the processes shown in the accompanying drawings are only exemplary and do not necessarily include all the steps. For example, some steps can be decomposed, some steps can be combined or partially combined, and the actual execution order may change according to the actual situation. The words "first", "second" and similar words used in the specific description do not indicate any order, quantity or importance, but are only used to distinguish different components. It should be noted that the embodiments of the present invention and the features in different embodiments can be combined with each other without conflict.

[0049] Figure 1 FIG. 1 is a flow chart of an embodiment of the alarm processing method of the present invention. Figure 1 As shown, an embodiment of the present invention provides an alarm processing method, comprising the following steps:

[0050] Step 110: Obtaining the original alarm generated for the network access event;

[0051] Step 120: Grouping the original alarm according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many, or many-to-one;

[0052] Step 130: Calculate information entropy for the original alarms in each group, and aggregate the original alarms with similarity greater than the target value into super alarms according to the similarity between the information entropies. The information entropy includes one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy.

[0053] The embodiment of the present invention aggregates the groups according to the information entropy of the original alarms based on the grouping of IP pairs composed of source IP addresses and destination IP addresses. The original alarms with similar information entropy are aggregated into super alarms, which significantly reduces the number of original alarms and reduces the workload of operation and maintenance personnel. Moreover, the aggregated super alarms aggregate the alarms more finely and provide processing priorities, which provides a predictable solution for the subsequent operation and maintenance personnel to accurately respond to the alarm logs. The embodiment of the present invention can improve the user experience.

[0054] In the embodiment of the present invention, the original alarm collected within a certain time interval can be obtained from the database. The original alarm is generated by the network security device when performing security detection on the network access event. The embodiment of the present invention does not limit the type of the original alarm.

[0055] In the embodiment of the present invention, when the original alarm is aggregated and grouped according to the IP pair of the network access event to which it belongs, one or more groups can be obtained. For example, there are roughly three groups, namely, a single-source single-destination group based on a one-to-one IP pair, a single-source multi-destination group based on a one-to-many IP pair, and a multi-source single-destination group based on a many-to-one IP pair.

[0056] In a single-source single-destination group, a source IP address in a network access event to which each original alarm belongs points to a destination IP address.

[0057] In a single-source multi-destination group, in the network access event to which each original alarm belongs, one source IP address points to multiple destination IP addresses.

[0058] In a multi-source single-destination group, in the network access event to which each original alarm belongs, multiple source IP addresses point to the same destination IP address.

[0059] The original alarms are aggregated and grouped based on IP, which is the first aggregation grouping.

[0060] Figure 2 This is a flowchart of an alarm processing method provided by an optional embodiment of the present invention, refer to Figure 2 , this method specifically comprises the following steps:

[0061] Step 210: Obtaining the original alarm generated for the network access event;

[0062] Step 220: Grouping the original alarm according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many, or many-to-one;

[0063] Step 230: Calculate the information entropy of the original alarms in each group, and aggregate the original alarms with similarity greater than the target value into super alarms according to the similarity between the information entropies. The information entropy includes one or more of content entropy, source IP address entropy, destination IP address entropy, time entropy and port entropy.

[0064] Step 240: Calculate the multivariate information entropy for the super alarm in each group, and

[0065] In this embodiment, multivariate information entropy is calculated for the super alarms in each group, and the joint probability distribution of multiple information entropies is obtained, and the super alarms of each group are prioritized using the joint probability distribution. The embodiment of the present invention can determine the processing priority according to the multivariate information entropy of the super alarm, realize the priority treatment of high-risk super alarms, and improve the efficiency of alarm processing.

[0066] In an alternative embodiment, reference Figure 3 , Figure 3 This is a flowchart of an alarm processing method according to another embodiment of the present invention. The method specifically comprises the following steps:

[0067] Step 310: Obtaining the original alarm generated for the network access event;

[0068] Step 320: Grouping the original alarm according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many, or many-to-one;

[0069] Step 330: Aggregate each group of original alarms into multiple time clusters according to alarm time information;

[0070] Step 340: Calculate information entropy for each time cluster in each group, and aggregate time clusters whose information entropy similarity is greater than a threshold into super alarms according to the information entropy similarity between the time clusters, where the information entropy includes one or more of content entropy, source IP address entropy, destination IP address entropy, time entropy, and port entropy;

[0071] Step 350: Calculate the multivariate information entropy for the super alarm in each group, and configure a processing priority for the super alarm according to the multivariate information entropy.

[0072] In this embodiment, each group is aggregated for the first time to obtain a time cluster, and each time cluster is aggregated for the second time according to the similarity of information entropy. The two aggregations further improve the aggregation degree and accuracy of the original alarm, and reduce the difficulty of subsequent operation and maintenance personnel in handling the alarm.

[0073] Here, in information theory, entropy is the average amount of information contained in each message, also known as information entropy, source entropy, and average self-information. Here, "message" represents an event, sample, or feature from a distribution or data stream, and entropy is understood as a measure of uncertainty rather than a measure of certainty, because the more random the source, the greater the entropy.

[0074] Information entropy is classified into content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy.

[0075] Content entropy represents the intensity of change of attack methods within a time cluster, time entropy represents the intensity of change of time intervals between adjacent attacks within a time cluster, port entropy represents the intensity of change of destination ports within a time cluster, and source IP / destination IP entropy represents the intensity of change of source IP / destination IP within a time cluster.

[0076] In an optional embodiment, calculating information entropy for each time cluster in each group includes:

[0077] The IP pairs are grouped into one-to-one single-source single-destination attributes, and the content entropy, time entropy and port entropy are calculated for each time cluster.

[0078] In the single-source single-destination attribute grouping, the change intensity of the source IP address and the destination IP address is small, while the content entropy, time entropy and port entropy are more distinguishing.

[0079] In an optional embodiment, calculating information entropy for each time cluster in each group includes:

[0080] The single-source multi-destination attribute grouping of IP pairs is one-to-many, and the destination IP entropy, time entropy and port entropy are calculated for each time cluster.

[0081] In the single-source multi-destination attribute grouping, the destination IP address is variable, so the destination IP entropy, time entropy and port entropy are calculated.

[0082] In an optional embodiment, calculating information entropy for each time cluster in each group includes:

[0083] The IP pairs are grouped into multiple sources and single destinations, and the source IP entropy, time entropy and port entropy are calculated for each time cluster.

[0084] In the multi-source single-destination attribute grouping, the source IP address is variable, so the source IP entropy, time entropy and port entropy are calculated.

[0085] In an optional embodiment, information entropy is calculated for each time cluster in each group, and time clusters with information entropy similarity greater than a threshold are aggregated into an over-alarm according to information entropy similarity between time clusters, including:

[0086] For each group, the mean square error between the information entropies of each time cluster is calculated, the information entropy similarity is obtained based on the mean square error, and the time clusters whose mean square error is not greater than the set threshold are aggregated into over-alarm.

[0087] In this embodiment, the information entropy similarity is characterized by the mean square error. Time clusters with high information entropy similarity are considered to have similar characteristics and can be aggregated into a super alarm for unified processing.

[0088] In an optional embodiment, calculating the mean square error between the information entropies of each time cluster includes:

[0089] For each group, the mean square error between the information entropies of each time cluster whose time difference is not greater than the time threshold is calculated.

[0090] Figure 4 This is a schematic diagram of the principle architecture of an alarm processing method of a specific embodiment provided by the present invention. This method summarizes three attribute groups of the original alarm by comprehensively analyzing the alarm type, source IP address, destination IP address, and time interval, and performs two-level aggregation and priority processing on the three attribute groups.

[0091] Among them, attribute group 1 is an attack from a single source IP address to a single destination IP address;

[0092] Attribute group 2 is attacks from multiple source IP addresses to a single destination IP address;

[0093] Attribute group 3 is an attack from a single source IP address to multiple destination IP addresses.

[0094] Perform first-level aggregation to aggregate the continuous attacks of the three attribute groups within a time window no greater than the aggregation window (such as 4 hours or other time intervals) into time clusters, and the time interval between adjacent time clusters is greater than the density window (such as 10 minutes).

[0095] Specifically, multiple attack methods of attribute group 1 within the aggregation window are aggregated into a time cluster, and single attack methods of attribute group 2 and attribute group 3 within the aggregation window are aggregated into a time cluster.

[0096] Next, the mean square error is calculated for the time clusters with similar time in the three attribute groups, and the time clusters with mean square error less than the preset threshold are aggregated into an over-alarm (secondary aggregation).

[0097] For all IP pairs in attribute group 1, the content entropy, time entropy and port entropy are calculated for multiple time clusters in the aggregation window, and the time clusters A with mean square error below the threshold are aggregated. 1 , generating super alarm B 1 .

[0098] The content entropy calculation formula is:

[0099] The time entropy calculation formula is:

[0100] The port entropy calculation formula is:

[0101] The formula for calculating the mean square error is:

[0102] MSE k The time clusters <δ are aggregated into super alarm B k .

[0103] The time cluster A 1 , A 2 , A 3 Represents the data sets of three attribute groups 1, 2 and 3 in the density window respectively;

[0104] m i 、s i d i ,t i 、p i They represent different attack methods, source IP addresses, destination IP addresses, time, and ports in the time cluster respectively;

[0105] Super Alarm B 1 , B 2 , B 3They represent the super alarm sets after the time clusters in the three attribute groups are aggregated;

[0106] k refers to a certain attribute group, and the above mean square error formula MSE is used for attribute group 1. k The mean square error is calculated, which reflects the difference or similarity of information entropy between time clusters.

[0107] Calculate the source IP entropy, time entropy and port entropy for all IP pairs in attribute group 2 in multiple time clusters within the aggregation window, and aggregate the time clusters A whose mean square error is lower than the threshold. 2 , generating super alarm B 2 .

[0108] The calculation formula of source IP entropy is:

[0109] For all IP pairs in attribute group 3, the destination IP entropy, time entropy and port entropy are calculated for multiple time clusters in the aggregation window, and the time cluster A with the mean square error lower than the threshold is aggregated. 3 , generating super alarm B 3 .

[0110] Content entropy represents the intensity of change of attack methods within a time cluster, time entropy represents the intensity of change of time intervals between adjacent attacks within a time cluster, port entropy represents the intensity of change of destination ports within a time cluster, and source IP / destination IP entropy represents the intensity of change of source IP / destination IP within a time cluster.

[0111] In the three attribute groups, the multivariate information entropy of all super alarms in each group is calculated separately, and the values ​​of the multivariate information entropy are sorted in each group for priority handling by operation and maintenance personnel.

[0112] In an optional embodiment of the present invention, when setting the processing priority, the processing priority is attribute group 1>attribute group 2>attribute group 3, and multivariate information entropy is calculated for each super alarm in the three attribute groups respectively, and priority is sorted within the group.

[0113] Among them, the formula for calculating multivariate information entropy is:

[0114]

[0115] Among them, H i Representative (X i,k ,Y i,k ,Z i,k ) Discrete joint distribution counts, k = 1, 2, 3.

[0116] The embodiment of the present invention uses information entropy for secondary aggregation, aggregates similar time clusters into super alarms, and uses multivariate information entropy for priority sorting.

[0117] Figure 5 FIG. 1 is a schematic diagram of a module of an embodiment of the alarm processing system of the present invention. Figure 5 As shown, including but not limited to:

[0118] The original alarm acquisition module 510 acquires the original alarm generated for the network access event;

[0119] A grouping module 520 groups the original alarm according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one;

[0120] The super alarm aggregation module 530 calculates the information entropy of the original alarm in each group, and aggregates the original alarms with similarity greater than the target value into super alarms according to the similarity between the information entropies. The information entropy includes one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy.

[0121] For the implementation principle of the above modules, please refer to the relevant introduction in the alarm processing method, which will not be repeated here.

[0122] The alarm processing system of the present invention is based on grouping IP pairs composed of source IP addresses and destination IP addresses, and aggregates the groups according to the information entropy of the original alarms. The original alarms with similar information entropy are aggregated into super alarms, which significantly reduces the number of original alarms and reduces the workload of operation and maintenance personnel. Moreover, the aggregated super alarms aggregate the alarms more finely and provide processing priorities, which provides a predictable solution for the subsequent accurate response of the operation and maintenance personnel to the alarm log. The embodiments of the present invention can improve the user experience.

[0123] Optionally, with Figure 5 compared to, Figure 6 The alarm processing system may further include:

[0124] The priority configuration module 610 calculates the multivariate information entropy for the super alarm in each group, and configures the processing priority for the super alarm according to the multivariate information entropy.

[0125] Optionally, with Figure 5 compared to, Figure 7 The alarm processing system may further include:

[0126] The time cluster aggregation module 710 aggregates the original alarms of each group into multiple time clusters according to the alarm time information before calculating the information entropy of the original alarms in each group;

[0127] The super alarm aggregation module 720 is specifically used for:

[0128] The information entropy is calculated for each time cluster in each group, and the time clusters with information entropy similarity greater than a threshold are aggregated into super alarms according to the information entropy similarity between the time clusters.

[0129] Optionally, the super alarm aggregation module 720 is further configured to:

[0130] The IP pairs are grouped into one-to-one single-source single-destination attributes, and the content entropy, time entropy and port entropy are calculated for each time cluster.

[0131] Optionally, the super alarm aggregation module 720 is further configured to:

[0132] The single-source multi-destination attribute grouping of IP pairs is one-to-many, and the destination IP entropy, time entropy and port entropy are calculated for each time cluster.

[0133] Optionally, the super alarm aggregation module 720 is further configured to:

[0134] The IP pairs are grouped into multiple sources and single destinations, and the source IP entropy, time entropy and port entropy are calculated for each time cluster.

[0135] Optionally, the super alarm aggregation module 720 is further configured to:

[0136] For each group, the mean square error between the information entropies of each time cluster is calculated, the information entropy similarity is obtained based on the mean square error, and the time clusters whose mean square error is not greater than the set threshold are aggregated into over-alarm.

[0137] Optionally, the super alarm aggregation module 720 is further configured to:

[0138] For each group, the mean square error between the information entropies of each time cluster whose time difference is not greater than the time threshold is calculated.

[0139] The embodiment of the present invention further provides an alarm processing device, comprising a processor and a memory, wherein executable instructions of the processor are stored, wherein the processor is configured to execute the steps of the alarm processing method by executing the executable instructions.

[0140] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as systems, methods or program products. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits", "modules" or "platforms".

[0141] Figure 8 This is a schematic diagram of the structure of the alarm processing device of the present invention. Figure 8 An electronic device 800 according to this embodiment of the present invention will be described. Figure 8 The electronic device 800 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0142] like Figure 8 As shown, the electronic device 800 is in the form of a general computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different platform components (including the storage unit 820 and the processing unit 810), a display unit 840, etc.

[0143] The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 executes the steps of various exemplary embodiments of the present invention described in the above alarm processing method section of this specification. For example, the processing unit 810 can execute the following steps: Figure 1-3 Follow the steps shown in .

[0144] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 821 and / or a cache memory unit 822 , and may further include a read-only memory unit (ROM) 823 .

[0145] The storage unit 820 may also include a program / utility 824 having a set (at least one) of program modules 825, such program modules 825 including but not limited to: a processing system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0146] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0147] The electronic device 800 may also communicate with one or more external devices 870 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 800, and / or any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 850.

[0148] Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 860. The network adapter 860 may communicate with other modules of the electronic device 800 via the bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms.

[0149] The embodiment of the present invention also provides a computer-readable storage medium for storing a program, and the steps of the alarm processing method are implemented when the program is executed. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps of various exemplary embodiments of the present invention described in the above alarm processing method section of this specification.

[0150] The program product for implementing the above method according to an embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0151] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0152] Computer readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program codes contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0153] Program code for performing the processes of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0154] In summary, the purpose of the present invention is to provide an alarm processing method, system, device and storage medium, which can aggregate the groups according to the information entropy of the original alarms on the basis of grouping the IP pairs composed of the source IP address and the destination IP address, and the original alarms with similar information entropy are aggregated into super alarms, which significantly reduces the number of original alarms and reduces the workload of operation and maintenance personnel. Moreover, the aggregated super alarms aggregate the alarms more finely and provide processing priorities, which provides a predictable solution for the subsequent accurate response of the operation and maintenance personnel to the alarm logs. The embodiments of the present invention can improve the user experience.

[0155] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. An alarm processing method, It is characterized in that include: Get the original alerts generated for network access events; The original alarm is grouped according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which it belongs, wherein the IP pair of each group is one-to-one, one-to-many, or many-to-one; Aggregate the original alarms of each group into multiple time clusters according to the alarm time information; Calculate information entropy for the original alarms in each group, and aggregate the original alarms whose similarity is greater than a target value into super alarms according to the similarity between the information entropies, wherein the information entropy includes one or more of content entropy, source IP address entropy, destination IP address entropy, time entropy and port entropy; The calculating of information entropy for the original alarms in each group, and aggregating the original alarms with similarity greater than a target value into super alarms according to the similarity between the information entropies, includes: Calculating information entropy for each time cluster in each group, and aggregating time clusters whose information entropy similarity is greater than a threshold into an over-alarm according to the information entropy similarity between the time clusters; The calculating of information entropy for each time cluster in each group includes: The IP pairs are grouped into one-to-one single-source single-destination attributes, and the content entropy, time entropy and port entropy are calculated for each time cluster; The IP pairs are grouped into one-to-many single-source multi-destination attributes, and the destination IP entropy, time entropy and port entropy are calculated for each time cluster; The IP pairs are grouped into multiple-source single-destination attributes of many-to-one, and the source IP address entropy, time entropy and port entropy are calculated for each time cluster.

2. The alarm processing method according to claim 1, It is characterized in that The alarm processing method further includes: A multivariate information entropy is calculated for the super alarm in each group, and a processing priority is configured for the super alarm according to the multivariate information entropy.

3. The alarm processing method according to claim 1, It is characterized in that The calculating of information entropy for each time cluster in each group, and aggregating time clusters whose information entropy similarity is greater than a threshold into an over-alarm according to the information entropy similarity between the time clusters, comprises: For each group, the mean square error between the information entropies of the time clusters is calculated, the information entropy similarity is obtained based on the mean square error, and the time clusters whose mean square errors are not greater than a set threshold are aggregated into an over-alarm.

4. The alarm processing method according to claim 3, It is characterized in that The calculating the mean square error between the information entropies of the time clusters includes: For each group, the mean square error between the information entropies of each time cluster whose time difference is not greater than the time threshold is calculated.

5. An alarm processing system, It is characterized in that include: An original alarm acquisition module is used to acquire the original alarm generated by the network access event; A grouping module, which groups the original alarm according to the IP pairs consisting of the source IP address and the destination IP address of the network access event to which it belongs, and aggregates the original alarm of each group into multiple time clusters according to the alarm time information, wherein the IP pair of each group is one-to-one, one-to-many or many-to-one; The super alarm aggregation module calculates the information entropy of the original alarm in each group, and aggregates the original alarms whose similarity is greater than the target value into super alarms according to the similarity between the information entropies, wherein the information entropy includes one or more of content entropy, source IP address entropy, destination IP entropy, time entropy and port entropy; The super alarm aggregation module is specifically used for: Calculating information entropy for each time cluster in each group, and aggregating time clusters whose information entropy similarity is greater than a threshold into an over-alarm according to the information entropy similarity between the time clusters; The information entropy is calculated for each time cluster in each group, including: The IP pairs are grouped into one-to-one single-source single-destination attributes, and the content entropy, time entropy and port entropy are calculated for each time cluster; The IP pairs are grouped into one-to-many single-source multi-destination attributes, and the destination IP entropy, time entropy and port entropy are calculated for each time cluster; The IP pairs are grouped into multiple-source single-destination attributes in which the IP pairs are many-to-one, and the source IP address entropy, time entropy and port entropy are calculated for each time cluster.

6. An alarm processing device, It is characterized in that include: processor; a memory storing executable instructions of the processor; Wherein, the processor is configured to execute the steps of the alarm processing method described in any one of claims 1 to 4 by executing the executable instructions.

7. A computer-readable storage medium for storing a program, It is characterized in that When the program is executed by a processor, the steps of the alarm processing method according to any one of claims 1 to 4 are implemented.

Images