A global event element extraction method for supervision

Abstract

The present invention discloses a global event element extraction method for supervision, which belongs to the field of network security technology and includes the following steps: S1, establishing a rule base for dynamically configuring threat alarm log classification and event classification mapping; S2, extracting alarms associated with security events from alarm assets in different regions, different industries, and different units; S3, associating security event alarm logs with specific assets and information systems; S4, determining the weights of alarms with different event association rules; S5, extracting event-associated asset alarm scores and asset importance information, and calculating the overall risk of the event as an event classification element; S6, generating a situation indicator element for the security event. The present invention can provide reliable basic data support for regulatory authorities to carry out research, reasoning, and emergency command work in cross-industry and cross-regional cyberspace.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a supervision-oriented global event element extraction method. Background Art

[0002] Cybersecurity regulatory authorities are responsible for coordinating the handling of cross-regional and cross-industry security incidents. They must comprehensively assess key indicators of cybersecurity incidents, including their level, type, impact, and scope, in accordance with the National Cybersecurity Incident Response Plan and relevant national standards. This assessment relies on accurately extracting fundamental event elements from global alert information, conducting in-depth assessments based on these elements, and completing comprehensive assessments to support relevant national regulatory authorities in carrying out cybersecurity notification and early warning, emergency coordination, and information sharing. Scientific global event element extraction technology is one of the core technologies for assessment and analysis. The method used to extract event elements and the quality of the extracted data will determine the reliability of the subsequent assessment results.

[0003] Currently available data extraction technologies are mainly aimed at single-point local area networks, and the output results are not sufficient to support security incident analysis and judgment in a global network environment. Summary of the Invention

[0004] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide a global event element extraction method for supervision, which extracts effective information from global and massive alarms to facilitate the subsequent accurate grading, classification and situation assessment of network security incidents, and provide reliable basic data support for regulatory authorities to carry out research, reasoning and emergency command work in cross-industry and cross-regional cyberspace fields.

[0005] The object of the present invention is achieved through the following solutions:

[0006] A global event element extraction method for supervision, comprising the steps of:

[0007] S1, establish a rule base for dynamically configuring the mapping between threat alarm log classification and event classification, and identify the event type associated with the threat alarm log based on the rules;

[0008] S2, extracting alarms associated with security events from alarm assets in different regions, industries, and units using the event rules configured in step S1;

[0009] S3, according to different security incident types, associates security incident alarm logs with specific assets and information systems, and generates associated assets and information systems of the units affected by the incident;

[0010] S4, determines the weights of alarms with different event association rules based on the information entropy weight method;

[0011] S5, extract the asset alarm score and asset importance information associated with the event, and calculate the overall risk of the event as the event classification factor;

[0012] S6, extracts indicators such as security incident-related enterprises, attack target milestones, abnormal mutations in the number of attack event alerts, abnormal mutations in the number of affected assets, affected industries, regional scope, and number of affected users, and generates situation indicator elements for security incidents.

[0013] Furthermore, in step S1, the sub-steps are included:

[0014] S11, initialization of mapping rule base construction: With the support of experts, select the field information related to the type description in the threat log and map it with the classification field information in the national standard to form a mapping rule base for event classification and threat alert rules;

[0015] S12, initialization, construction and update of the mapping rule library: new event alarm mapping rules discovered across regions, industries and units are added to the alarm group of the corresponding event.

[0016] Furthermore, in step S4, the sub-steps are included:

[0017] S41, selecting asset-related alarm data within a period T of a security event, assuming that the total number of assets associated with the alarm within the period T is n, and the total number of alarm indicators associated with the event within the period T is m, and counting the number of alarms generated by the asset;

[0018] S42, data normalization, normalizing the number of alarms for the assets under the alarm indicator according to the following formula;

[0019]

[0020] x ij is the number of alarms for the i-th asset at the j-th indicator, x j is the number of alarms under the jth indicator;

[0021] S43, calculate the proportion p of the i-th asset in the j-th alarm indicator associated with the event ij :

[0022]

[0023] y ij is the normalized value of the number of alarms under the jth alarm indicator of the i-th asset;

[0024] S44, calculate the entropy value e of the jth alarm indicator according to the proportion j :

[0025]

[0026] k=1 / ln(n)>0.Satisfy e j ≥0;

[0027] S45, calculate the information entropy redundancy d of the j-th alarm indicator j :

[0028] d j =1-e j , j = 1, 2, ..., m;

[0029] S46, calculate the weight w of each alarm indicator in period T according to the information entropy redundancy j :

[0030]

[0031] Furthermore, in step S5, the sub-steps are included:

[0032] S51, calculate the event alarm score s of the asset i :

[0033]

[0034] w j is the weight of the jth alarm indicator in the latest T period, y ij is the normalized value of the jth alarm indicator of the i-th asset;

[0035] S52, calculate the overall risk score of the event based on the different asset importance levels:

[0036] According to the importance of different asset levels, the maximum value of the asset importance score is used for normalization calculation to obtain the overall risk score L of the security incident:

[0037]

[0038] Where: g i is the importance score of the i-th asset, G is the maximum asset importance score, and S is the maximum event alarm score.

[0039] Furthermore, in step S6, the indicator extraction of the attack target milestone is specifically to mark the milestones of a certain event according to the changes of units, industries, and regions when different units, industries, and regions appear;

[0040] The indicators for abnormal mutations in the number of attack event alarms and the number of affected assets are specifically extracted by using the 3sigma model to identify abnormal mutations in the number of event alarms and the number of affected assets within period T:

[0041] Let 0 be the starting time of identifying the sudden change in the number of alarms within the period T, T′ be the last time of identifying the sudden change in the number of alarms within the period T, and T′>2, n i is the number of alarms at time i, and:

[0042] Δx i =n i -n i-1 , i=1,2,3,…,T′

[0043] Statistics Δx i The mean μ and variance σ of :

[0044]

[0045]

[0046] If Δx i >μ+3σ, then the i-th moment is identified as the moment of sudden change in the number of alarms;

[0047] T″ is the last moment in period T to identify the mutation affecting the asset quantity and T″>2, a i is the amount of assets at the i-th moment, and:

[0048] Δx i =a i -a i-1 , i=1,2,3,…,T″

[0049] Statistics Δx i The mean μ and variance σ of :

[0050]

[0051]

[0052] If Δx i >μ+3σ, then the i-th moment is identified as the moment of mutation that affects the amount of assets;

[0053] The index extraction of the security incident-related enterprises is specifically designed to design the following enterprise impact range index calculation formula:

[0054]

[0055] C represents the enterprise's influence range indicator, C i Indicates whether the i-th enterprise is affected, and:

[0056]

[0057] c represents the number of all companies within the regulatory scope;

[0058] The regional scope index extraction is specifically designed to design the following regional impact scope index calculation formula:

[0059]

[0060] R represents the regional impact range indicator, R i Indicates whether the i-th region is affected;

[0061]

[0062] r represents the total number of all regions within the regulatory scope;

[0063] The extraction of the index affecting the industry is specifically designed to design the following industry impact range index calculation formula:

[0064]

[0065] H represents the industry impact range indicator, H i Indicates whether the i-th industry is affected;

[0066]

[0067] h represents the total number of industries under regulatory scope;

[0068] The extraction of the index affecting the number of users is specifically to design the following calculation formula for the number of affected users:

[0069]

[0070] U represents the number of affected users. i represents the number of users of the i-th network and information system services within the regulatory scope, and u represents the number of affected networks and information systems within the regulatory scope.

[0071] Furthermore, step S1 includes the following sub-steps: event detailed information extraction: extracting specific detailed information supporting event classification based on different types of events.

[0072] The beneficial effects of the present invention are:

[0073] The present invention extracts effective information from global, massive alerts to facilitate subsequent accurate grading, classification, and situation assessment of network security incidents. The extracted elemental information can be used in computational processes such as grading, analysis, and decision-making recommendations for network security incidents, thereby providing reliable basic data support for regulatory authorities to conduct analysis, reasoning, and emergency command work in cross-industry and cross-regional cyberspace. In specific embodiments, at least the following technical problems are solved:

[0074] 1. Implemented the configuration of event type identification rules based on dynamic configuration rule group policy. It extracts security event types and subtypes from multi-source heterogeneous alarm logs or other security data from different units, and extracts event details and other event classification elements based on different event types.

[0075] 2. Based on an adaptive information entropy weight calculation method, it dynamically evaluates the impact weight of network security incident-related alarms on security incidents across regions, industries, and units. It also calculates the security incident risk score as a grading factor based on the importance of the assets associated with the alarm logs.

[0076] 3. Based on spatiotemporal trend analysis, it can identify important attack milestones, abnormal changes in the number of attack event alarms, abnormal changes in the number of affected assets, affected areas, affected industries, involved units and other situation assessment elements. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0078] Figure 1 is an overall flow chart of the method according to an embodiment of the present invention;

[0079] Figure 2 This is a flow chart of calculating the alarm indicator weight using information entropy redundancy in an embodiment of the present invention. DETAILED DESCRIPTION

[0080] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0081] The following is based on the attached Figures 1 and 2 , the technical problems solved by the present invention, technical concepts, working principles, effects and working processes are further described in detail.

[0082] With the introduction of policies and regulations such as the "Cybersecurity Law" and the "Regulations on the Security Protection of Critical Information Infrastructure", cybersecurity regulatory departments in various fields need to conduct comprehensive supervision and governance of the cybersecurity space under their jurisdiction in accordance with laws and regulations. They need to conduct comprehensive analysis and all-round perception of cybersecurity incidents occurring within their jurisdiction from different levels, dimensions, and perspectives, and carry out cross-regional and cross-departmental emergency response work in a timely manner.

[0083] In the process of solving the above problems, the present invention discovered the following technical problems: the vast majority of current network security technologies are enterprise-oriented, or oriented to the alarm level in local networks, rather than to the network security event level from a global perspective. Their main task is to collect security elements of the enterprise's internal network to comprehensively analyze the threats faced by the enterprise and to achieve active defense against threats as much as possible. Such technologies cannot meet the needs of regulatory authorities to analyze and judge security incidents from macro, cross-network, and cross-domain perspectives. Based on this, our unit proposes a global security event element extraction technology for supervision, which supports the extraction of effective event element data from multi-source heterogeneous alarm information across industries, regions, and units, including grading basic data, classification basic data, and situation basic data, to support subsequent analysis and reasoning, intelligent decision-making, emergency coordination, and information sharing processes, effectively assisting national regulatory authorities to better carry out cyberspace governance and promote a clean cyberspace.

[0084] Based on the above, the embodiments of the present invention provide the following specific technical solutions in specific applications.

[0085] A global event factor extraction method for supervision is described in detail below. The specific steps are as follows (step 1 is to extract classification factors, steps 2 to 5 are to extract grading factors, and step 6 is to extract situation factors).

[0086] Step 1: Dynamically configure security event rule mapping

[0087] Event classification element extraction uses preset event type identification rules to extract the type description field information and event details association columns corresponding to the event type from reported threat alarm logs or other security log resources, and classify them according to the event types in national standards.

[0088] The event alarm rule mapping library is shown in Table 1. It includes fields such as the alarm rule ID selected by experts, the name and description of the alarm rule, the Chinese description, the rule description, and the field name of the event detailed information extracted.

[0089] Table 1: Event alarm rule mapping library

[0090]

[0091] In this step 1, the focus is on establishing a rule base for dynamically configuring the mapping between threat alarm log classification and event classification, and identifying event types associated with threat alarm logs based on rules, including rule initialization and rule update.

[0092] Initial construction of the mapping rule library: With the business support of experts, the field information about the type description in the threat log is selected and mapped with the classification field information in the national standard to form a mapping rule library for event classification and threat alarm rules.

[0093] Initialization and construction update of the mapping rule library: New event alarm mapping rules discovered across regions, industries, and units are added to the alarm group of the corresponding event.

[0094] Event Detail Extraction: Extracts detailed information specific to each event type. For example, extracts the associated MD5 value from the threat log for file virus types, extracts the CVE number for vulnerability-related security events, and extracts the attacking organization from the associated threat intelligence for APT attacks.

[0095] Step 2: Use the event rules configured in Step 1 to extract security event-related alarms from alarm assets in different regions, industries, and units.

[0096] Step 3: Based on different security incident types, associate the security incident alarm log with specific assets and information systems to generate the associated assets and information systems of the unit affected by the incident.

[0097] Step 4: Determine the weights of alerts with different event association rules based on the information entropy weight method. This includes the following sub-steps:

[0098] Step 1: Select asset-related alarm data within a T period of a security event and count the number of alarms generated by the asset;

[0099] Step 2: Data normalization: normalize the number of alarms for the assets under the alarm indicator;

[0100] Step 3: Calculate the alarm proportion of different assets under each alarm indicator;

[0101] Step 4, calculate the entropy value of each indicator according to the proportion;

[0102] Step 5: Calculate the information entropy redundancy of each alarm indicator;

[0103] Step 6: Calculate the weight of each indicator based on the information entropy redundancy. For example, the calculation of the alarm indicator weight j is described below, which includes the following sub-steps:

[0104] 1) Select the asset-related alarm data within a period T of a security event. Let the total number of assets associated with the alarm within the period T be n, and the total number of alarm indicators associated with the event within the period T be m;

[0105] 2) Design the following normalization formula:

[0106]

[0107] x ij is the number of alarms for the i-th asset at the j-th indicator, x j is the number of alarms under the jth indicator;

[0108] 3) Design the following formula to calculate the proportion p of the i-th asset in the j-th alarm indicator associated with the event: ij :

[0109]

[0110] y ij It is the normalized value of the number of alarms under the j-th alarm indicator of the i-th asset.

[0111] 4) Design the following formula to calculate the entropy value e of the jth alarm indicator j :

[0112]

[0113] k=1 / ln(n)>0.Satisfy e j ≥0.

[0114] 5) Design the following formula to calculate the information entropy redundancy d of the jth alarm indicator j :

[0115] d j =1-e j , j = 1, 2, ..., m

[0116] 6) Design the following formula to calculate the weight w of each alarm indicator in the T period j :

[0117]

[0118] Step 5: Extract information such as the asset alarm score and asset importance associated with the event, and calculate the overall risk of the event as the event classification factor. This includes the following sub-steps:

[0119] 1) Calculate the asset's event alarm score s i

[0120]

[0121] w j is the weight of the jth alarm indicator in the latest T period, y ij is the normalized value of the jth alarm indicator of the i-th asset.

[0122] 2) Calculate the overall risk score of the event based on the different asset importance levels:

[0123] According to the importance of different asset levels, the maximum value of the asset importance score is used for normalization calculation to obtain the overall risk score L of the security incident:

[0124]

[0125] Where: g i is the importance score of the i-th asset, G is the maximum asset importance score, and S is the maximum event alarm score.

[0126] Table 2 Asset Importance Assignment Table

[0127] Asset importance Importance score unimportant 1 generally 2 ordinary 3 important 4 Very important 5

[0128] Step 6: Extract indicators such as security incident-related enterprises, attack target milestones, abnormal mutations in the number of attack event alerts, abnormal mutations in the number of affected assets, affected industries, regional scope, and number of affected users to generate security incident situation indicator elements. This includes the following sub-steps:

[0129] 1) For a certain event: Attack target milestone: According to the changes in units, industries, and regions, milestones are marked when different units, industries, and regions appear.

[0130] 2) Identification of abnormal changes in the number of attack event alarms and the number of affected assets: Use the 3sigma model to identify abnormal changes in the number of event alarms and the number of affected assets within period T.

[0131] Let 0 be the starting time of identifying the sudden change in the number of alarms within the period T, T′ be the last time of identifying the sudden change in the number of alarms within the period T, and T′>2, n i is the number of alarms at the i-th moment,

[0132] Δx i =n i -n i-1 , i=1,2,3,…,T′

[0133] Statistics Δx i The mean μ and variance σ of :

[0134]

[0135]

[0136] If Δx i >μ+3σ, then the i-th moment is identified as the moment of sudden change in the number of alarms;

[0137] T″ is the last moment in period T to identify the mutation affecting the asset quantity and T″>2, a i is the amount of assets at time i, Δx i =a i -a i-1 , i=1,2,3,…,T″

[0138] Statistics Δx i The mean μ and variance σ of :

[0139]

[0140]

[0141] If Δx i >μ+3σ, then the i-th moment is identified as the moment of sudden change that affects the number of assets. 3) Design the following formula to calculate the enterprise impact range index:

[0142]

[0143] C represents the enterprise's influence range indicator, C i Indicates whether the i-th enterprise is affected;

[0144]

[0145] c represents the number of all companies under supervision.

[0146] 4) Design the following formula to calculate the regional impact range index:

[0147]

[0148] R represents the regional impact range indicator, R i Indicates whether the i-th region is affected;

[0149]

[0150] r represents the total number of all regions under supervision.

[0151] 5) Design the following formula to calculate the industry impact range index:

[0152]

[0153] H represents the industry impact range indicator; H i : Whether the i-th industry is affected;

[0154]

[0155] h represents the total number of industries under supervision.

[0156] 6) Design the following formula to calculate the number of affected users:

[0157]

[0158] Among them, U represents the number of affected users; U i represents the number of users served by the ith network and information system within the regulatory scope; u represents the number of affected networks and information systems within the regulatory scope.

[0159] In an embodiment of the present invention, the extracted element information is used in calculation processes such as network security incident classification, analysis and decision-making recommendation, thereby providing reliable basic data support for regulatory authorities to carry out analysis and reasoning and emergency command work in cross-industry and cross-regional cyberspace fields.

[0160] Example 1: A global event element extraction method for supervision, comprising the steps of:

[0161] S1, establish a rule base for dynamically configuring the mapping between threat alarm log classification and event classification, and identify the event type associated with the threat alarm log based on the rules;

[0162] S2, extracting alarms associated with security events from alarm assets in different regions, industries, and units using the event rules configured in step S1;

[0163] S3, according to different security incident types, associates security incident alarm logs with specific assets and information systems, and generates associated assets and information systems of the units affected by the incident;

[0164] S4, determines the weights of alarms with different event association rules based on the information entropy weight method;

[0165] S5, extract the asset alarm score and asset importance information associated with the event, and calculate the overall risk of the event as the event classification factor;

[0166] S6, extracts indicators such as security incident-related enterprises, attack target milestones, abnormal mutations in the number of attack event alerts, abnormal mutations in the number of affected assets, affected industries, regional scope, and number of affected users, and generates situation indicator elements for security incidents.

[0167] Example 2: Based on Example 1, step S1 includes the following sub-steps:

[0168] S11, initialization of mapping rule base construction: With the support of experts, select the field information related to the type description in the threat log and map it with the classification field information in the national standard to form a mapping rule base for event classification and threat alert rules;

[0169] S12, initialization, construction and update of the mapping rule library: new event alarm mapping rules discovered across regions, industries and units are added to the alarm group of the corresponding event.

[0170] Example 3: Based on Example 1, in step S4, the following sub-steps are included:

[0171] S41, selecting asset-related alarm data within a period T of a security event, assuming that the total number of assets associated with the alarm within the period T is n, and the total number of alarm indicators associated with the event within the period T is m, and counting the number of alarms generated by the asset;

[0172] S42, data normalization, normalizing the number of alarms for the assets under the alarm indicator according to the following formula;

[0173]

[0174] x ij is the number of alarms for the i-th asset at the j-th indicator, x j is the number of alarms under the jth indicator;

[0175] S43, calculate the proportion p of the i-th asset in the j-th alarm indicator associated with the event ij :

[0176]

[0177] y ij is the normalized value of the number of alarms under the jth alarm indicator of the i-th asset;

[0178] S44, calculate the entropy value e of the jth alarm indicator according to the proportion j :

[0179]

[0180] k=1 / ln(n)>0.Satisfy e j ≥0;

[0181] S45, calculate the information entropy redundancy d of the j-th alarm indicator j :

[0182] d j =1-e j , j = 1, 2, ..., m;

[0183] S46, calculate the weight w of each alarm indicator in period T according to the information entropy redundancy j :

[0184]

[0185] Example 4: Based on Example 1, in step S5, the following sub-steps are included:

[0186] S51, calculate the event alarm score s of the asset i :

[0187]

[0188] w j is the weight of the jth alarm indicator in the latest T period, y ij is the normalized value of the jth alarm indicator of the i-th asset;

[0189] S52, calculate the overall risk score of the event based on the different asset importance levels:

[0190] According to the importance of different asset levels, the maximum value of the asset importance score is used for normalization calculation to obtain the overall risk score L of the security incident:

[0191]

[0192] Where: g i is the importance score of the i-th asset, G is the maximum asset importance score, and S is the maximum event alarm score.

[0193] Example 5: Based on Example 1, in step S6, the indicator extraction of the attack target milestone is specifically: for a certain event, when different units, industries, and regions appear, milestones are marked;

[0194] The indicators for abnormal mutations in the number of attack event alarms and the number of affected assets are specifically extracted by using the 3sigma model to identify abnormal mutations in the number of event alarms and the number of affected assets within period T:

[0195] Let 0 be the starting time of identifying the sudden change in the number of alarms within the period T, T′ be the last time of identifying the sudden change in the number of alarms within the period T, and T′>2, n i is the number of alarms at time i, and:

[0196] Δx i =n i -n i-1 , i=1,2,3,…,T′

[0197] Statistics Δx i The mean μ and variance σ of :

[0198]

[0199]

[0200] If Δx i >μ+3σ, then the i-th moment is identified as the moment of sudden change in the number of alarms;

[0201] T″ is the last moment in period T to identify the mutation affecting the asset quantity and T″>2, a i is the amount of assets at the i-th moment, and:

[0202] Δx i =a i -a i-1 , i=1,2,3,…,T″

[0203] Statistics Δx i The mean μ and variance σ of :

[0204]

[0205]

[0206] If Δx i >μ+3σ, then the i-th moment is identified as the moment of mutation that affects the amount of assets;

[0207] The index extraction of the security incident-related enterprises is specifically designed to design the following enterprise impact range index calculation formula:

[0208]

[0209] C represents the enterprise's influence range indicator, C i Indicates whether the i-th enterprise is affected, and:

[0210]

[0211] c represents the number of all companies within the regulatory scope;

[0212] The regional scope index extraction is specifically designed to design the following regional impact scope index calculation formula:

[0213]

[0214] R represents the regional impact range indicator, R i Indicates whether the i-th region is affected;

[0215]

[0216] r represents the total number of all regions within the regulatory scope;

[0217] The extraction of the index affecting the industry is specifically designed to design the following industry impact range index calculation formula:

[0218]

[0219] H represents the industry impact range indicator, H i Indicates whether the i-th industry is affected;

[0220]

[0221] h represents the total number of industries under regulatory scope;

[0222] The extraction of the index affecting the number of users is specifically to design the following calculation formula for the number of affected users:

[0223]

[0224] U represents the number of affected users. i represents the number of users of the i-th network and information system services within the regulatory scope, and u represents the number of affected networks and information systems within the regulatory scope.

[0225] Example 6: Based on Example 1, step S1 includes the following sub-steps: event detailed information extraction: extracting specific detailed information supporting event classification based on different types of events.

[0226] If the functions of the present invention are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, and all or part of the steps of the methods described in each embodiment of the present invention are executed in a computer device (which can be a personal computer, server, or network device, etc.) and corresponding software. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard disk, or an optical disk. The test or actual data in the program implementation is stored in a read-only memory (RAM), a random access memory (RAM), etc.

Claims

1. A global event element extraction method for supervision, characterized by: Including steps: S1, establish a rule base for dynamically configuring the mapping between threat alarm log classification and event classification, and identify the event type associated with the threat alarm log based on the rules; S2, extracting alarms associated with security events from alarm assets in different regions, industries, and units using the event rules configured in step S1; S3, according to different security incident types, associates security incident alarm logs with specific assets and information systems, and generates associated assets and information systems of the units affected by the incident; S4, determines the weights of alarms with different event association rules based on the information entropy weight method; In step S4, the sub-steps are included: S41, selecting asset-related alarm data within a period T of a security event, assuming that the total number of assets associated with the alarm within the period T is n, and the total number of alarm indicators associated with the event within the period T is m, and counting the number of alarms generated by the asset; S42, data normalization, normalizing the number of alarms for the assets under the alarm indicator according to the following formula; is the number of alarms for the i-th asset at the j-th indicator, is the number of alarms under the jth indicator; S43, calculate the proportion of the i-th asset to the j-th alarm indicator associated with the event : is the normalized value of the number of alarms under the jth alarm indicator of the i-th asset; S44, calculate the entropy value of the jth alarm indicator according to the proportion : .satisfy ; S45, calculate the information entropy redundancy of the j-th alarm indicator : ； S46, calculate the weight of each alarm indicator in the T period according to the information entropy redundancy : ; S5, extract the asset alarm score and asset importance information associated with the event, and calculate the overall risk of the event as the event classification factor; S6, extracts indicators such as security incident-related enterprises, attack target milestones, abnormal mutations in the number of attack event alerts, abnormal mutations in the number of affected assets, affected industries, regional scope, and number of affected users, and generates situation indicator elements for security incidents.

2. A global event element extraction method for supervision according to claim 1, characterized in that: In step S1, the sub-steps are included: S11, initialization of mapping rule base construction: With the support of experts, select the field information related to the type description in the threat log and map it with the classification field information in the national standard to form a mapping rule base for event classification and threat alert rules; S12, initialization, construction and update of the mapping rule library: new event alarm mapping rules discovered across regions, industries and units are added to the alarm group of the corresponding event.

3. The method for extracting global event elements for supervision according to claim 1, characterized in that: In step S5, the sub-steps are included: S51, calculate the event alarm score of the asset : is the weight of the jth alarm indicator in the latest T period, is the normalized value of the jth alarm indicator of the i-th asset; S52, calculate the overall risk score of the event based on the different asset importance levels: According to the importance of different asset levels, the maximum value of the asset importance score is used for normalization calculation to obtain the overall risk score of the security incident. : in: is the importance score of the i-th asset, is the maximum value of the asset importance score, The maximum value of the event alarm score.

4. The method for extracting global event elements for supervision according to claim 1, characterized in that: In step S6, The indicator extraction of the attack target milestone is specifically to mark the milestones of a certain event according to the changes of units, industries, and regions when different units, industries, and regions appear; The indicators for abnormal mutations in the number of attack event alarms and the number of affected assets are specifically extracted by using the 3sigma model to identify abnormal mutations in the number of event alarms and the number of affected assets within period T: Let 0 be the starting time of identifying the sudden change in the number of alarms within period T, The last moment when the number of alarms changes suddenly within the period T. , is the number of alarms at time i, and: statistics The mean ,variance : ， if , then the i-th moment is identified as the moment of sudden change in the number of alarms; Identify the last moment in period T that affects the sudden change in asset quantity and , is the amount of assets at the i-th moment, and: statistics The mean ,variance : ， if , then the i-th moment is identified as the mutation moment that affects the amount of assets; The index extraction of the security incident-related enterprises is specifically designed to design the following enterprise impact range index calculation formula: Indicates the enterprise's scope of influence indicator, Indicates the Whether the enterprise is affected and: Indicates the number of all companies within the regulatory scope; The regional scope index extraction is specifically designed to design the following regional impact scope index calculation formula: represents the regional impact range indicator, Indicates the whether the area is affected; Indicates the total number of all areas under supervision; The extraction of the index affecting the industry is specifically designed to design the following industry impact range index calculation formula: represents the industry impact range indicator, Indicates the Whether the industry is affected; Indicates the total number of industries under regulatory scope; The extraction of the index affecting the number of users is specifically to design the following calculation formula for the number of affected users: Indicates the number of affected users. Indicates the regulatory scope Number of users of network and information system services, Indicates the number of affected networks and information systems within the regulatory scope.

5. The method for extracting global event elements for supervision according to claim 2, characterized in that: In step S1, the sub-steps are included: event detailed information extraction: extracting specific detailed information supporting event classification based on different types of events.

Images