Alarm merging method, device, electronic device and storage medium

Abstract

The embodiments of the present invention are applicable to the field of computer technology, and provide an alarm merging method, device, electronic device and storage medium, wherein the alarm merging method includes: obtaining alarm information to be merged and terminal behavior tree data; tracing the terminal behavior tree data in a preset direction with the node corresponding to the alarm information to be merged as the starting point; if the target historical node is found in the process of tracing back to the preset direction, the alarm information to be merged and the related nodes in the process of tracing back to the preset direction are all merged into the target historical event, and the tracing is stopped; wherein the target historical node is: corresponding to historical alarm information and the historical alarm information belongs to the target historical event.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an alarm merging method, device, electronic device and storage medium. Background Art

[0002] When analyzing alarm behaviors, related technologies require manual tracing and correlation analysis of alarm behaviors, and when merging alarms, only alarms of the same type are merged. The efficiency of threat assessment is low, and tracing and assessment may even be impossible. Summary of the Invention

[0003] In order to solve the above problems, embodiments of the present invention provide an alarm merging method, device, electronic device, and storage medium.

[0004] The technical solution of the present invention is achieved as follows:

[0005] In a first aspect, an embodiment of the present invention provides an alarm merging method, the method comprising:

[0006] Obtain the alarm information to be merged and the terminal behavior tree data;

[0007] Taking the node corresponding to the alarm information to be merged as the starting point, tracing the terminal behavior tree data in a preset direction;

[0008] If the target historical node is found during the tracing process in the preset direction, the alarm information to be merged and the related nodes during the tracing process in the preset direction are all merged into the target historical event, and the tracing is stopped; wherein, the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the target historical event.

[0009] In the above solution, the preset direction includes upward and downward;

[0010] Accordingly, if the target historical node is found during the tracing process in the preset direction, the alarm information to be merged and the nodes related to the tracing process in the preset direction are all merged into the target historical event, and further tracing is stopped; wherein the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the target historical event, including:

[0011] If the first target historical node is found during the upward tracing process, the alarm information to be merged and the nodes related to the upward tracing process are merged into the first target historical event, and further upward tracing is stopped; wherein the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the first target historical event;

[0012] If a second target historical node is found during the downward tracing process, the alarm information to be merged and the related nodes in the downward tracing process will be merged into the second target historical event, and the downward tracing starting from the second target historical node will be stopped; wherein, the second target historical node is: corresponding to historical alarm information and the historical alarm information belongs to the second target historical event.

[0013] In the above solution, if, during the tracing process in the preset direction, the number of tracing layers reaches the preset number of layers but the target historical node is not encountered, tracing in the preset direction is stopped;

[0014] Correspondingly, if the target historical node is found during the tracing process in the preset direction, the alarm information to be merged and the nodes passed during the tracing process in the preset direction are merged into the target historical event, and further tracing is stopped, including:

[0015] If the target historical node is found before the preset number of layers is reached during the tracing process in the preset direction, the alarm information to be merged and the nodes passed during the tracing process in the preset direction are merged into the target historical event, and tracing is stopped.

[0016] In the above solution, the preset direction includes tracing back to the source;

[0017] Accordingly, if, during the tracing process in the preset direction, the number of tracing layers reaches the preset number of layers but the target historical node is not encountered, tracing in the preset direction is stopped, including:

[0018] If, during the downward tracing process, the number of tracing layers reaches the preset number of downward layers and the second target historical node is still not encountered, the downward tracing is stopped, and the nodes related to the downward tracing and the alarm information to be merged are merged into the same event.

[0019] In the above solution, the preset direction includes upward and downward; the preset number of floors includes a preset upward number of floors and a preset downward number of floors; and the preset downward number of floors is smaller than the preset upward number of floors.

[0020] In the above solution, after the step of obtaining the alarm information to be merged, the method further includes:

[0021] Determine whether there is an alarm that is the same as the alarm information to be merged;

[0022] If they exist, the same alarms are integrated instead of merging the alarms based on the behavior tree data of the source terminal.

[0023] In the above solution, each step is applied on the service side;

[0024] Accordingly, before the step of obtaining the alarm information to be merged and the terminal behavior tree data, the method further includes:

[0025] Receive alarm information from a target terminal and terminal behavior tree data associated with the alarm information.

[0026] In a second aspect, an embodiment of the present invention provides an alarm merging device, the device comprising:

[0027] The acquisition module is used to obtain the alarm information to be merged and the terminal behavior tree data;

[0028] A tracing module, configured to trace the terminal behavior tree data in a preset direction starting from the node corresponding to the alarm information to be merged;

[0029] The merging module is used to merge the alarm information to be merged and the related nodes in the process of tracing back to the preset direction into the target historical event if the target historical node is found in the process of tracing back to the preset direction, and stop tracing back; wherein, the target historical node is: corresponding to historical alarm information and the historical alarm information belongs to the target historical event.

[0030] In a third aspect, an embodiment of the present invention provides an electronic device comprising a processor and a memory, wherein the processor and the memory are connected to each other, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the steps of the alarm merging method provided in the first aspect of the embodiment of the present invention.

[0031] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, comprising: the computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the steps of the alarm merging method provided in the first aspect of the embodiment of the present invention.

[0032] The embodiment of the present invention obtains the alarm information to be merged and the terminal behavior tree data, and traces the terminal behavior tree data in a preset direction with the node corresponding to the alarm information to be merged as the starting point. If the target historical node is found in the process of tracing back to the preset direction, the alarm information to be merged and the related nodes in the process of tracing back to the preset direction are all merged into the target historical event, and the tracing back is stopped; wherein, the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the target historical event. The embodiment of the present invention traces the terminal behavior tree data in a preset direction based on the alarm information to be merged, and merges the alarm information to be merged and the related nodes in the process of tracing back to the preset direction into the target historical event. The node corresponding to the target historical event can present the attack process inside the terminal. Based on the node corresponding to the target historical event, the security engineer can clearly know the process of the attack inside the terminal, which is convenient for threat analysis and problem location. Compared with the existing technology, it saves the manpower cost of manual tracing analysis and improves the efficiency of threat assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a schematic diagram of an implementation flow of an alarm merging method provided by an embodiment of the present invention;

[0034] Figure 2 This is a schematic diagram of the system structure of an alarm merging method provided by an embodiment of the present invention;

[0035] Figure 3 This is a schematic diagram of the structure of terminal behavior tree data provided by an embodiment of the present invention;

[0036] Figure 4 This is a schematic diagram of a storage structure of terminal behavior tree data provided by an embodiment of the present invention;

[0037] Figure 5 This is a schematic diagram of the structure of another terminal behavior tree data provided by an embodiment of the present invention;

[0038] Figure 6 is a schematic diagram of an upward tracing result provided by an embodiment of the present invention;

[0039] Figure 7 This is a schematic diagram of the structure of another terminal behavior tree data provided by an embodiment of the present invention;

[0040] Figure 8 is a schematic diagram of a downward tracing result provided by an embodiment of the present invention;

[0041] Figure 9 This is a schematic diagram of the structure of terminal behavior tree data corresponding to a target historical event provided by an embodiment of the present invention;

[0042] Figure 10This is a schematic diagram of an alarm merging process provided by an embodiment of the present invention;

[0043] Figure 11 Schematic diagram of an alarm merging device provided by an embodiment of the present invention;

[0044] Figure 12 FIG. 1 is a schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0046] Currently, when analyzing alarm behavior, the terminal reports all collected data to the management platform, which then performs data analysis. This solution has the following problems:

[0047] First, the management platform needs to carry a large amount of terminal data and maintain the storage and management of a large amount of data. The management platform needs to be deployed in a cluster mode to support such a large amount of computing power, and the cost of cluster construction is high.

[0048] Second, the terminal places all data processing and analysis on the management platform, which will incur a large amount of analysis costs for non-alarm behaviors.

[0049] 3. The management platform does not correlate and aggregate alarm behaviors, while the actual alarm behaviors are correlated. This requires manual tracing and correlation analysis of the alarm behaviors, which increases the cost of manual analysis and reduces the overall efficiency of threat assessment.

[0050] In view of the shortcomings of the above-mentioned related technologies, an embodiment of the present invention provides an alarm merging method, which can improve the efficiency of threat analysis. In order to illustrate the technical solution of the present invention, a specific embodiment is described below.

[0051] Figure 1 This is a schematic diagram of an implementation flow of an alarm merging method provided by an embodiment of the present invention. The execution subject of the alarm merging method is an electronic device, which includes a desktop computer, a laptop computer, and a server. The server can be a physical device or a virtualized device deployed in the cloud. Figure 1 , alarm merging methods include:

[0052] S101: Obtain the alarm information to be merged and the terminal behavior tree data.

[0053] The alarm information to be merged can be alarm information generated by the electronic device itself or received from a terminal. Alarm information can be alarm logs generated by network security products such as antivirus software and firewalls when they detect alarming behavior. Alarming behaviors include data tampering, data forgery, and denial of service. Alarm information to be merged can be alarm information generated at the current time or within a historical time period.

[0054] In this embodiment of the present invention, terminal behavior tree data may be historical terminal behavior data associated with the alarm information to be merged. A terminal behavior tree (BT) is a tree structure consisting of nodes and edges. Nodes in the BT correspond to behavior execution targets, and edges correspond to specific behaviors between two nodes.

[0055] In one embodiment, the present invention is applied on the service side;

[0056] Accordingly, before the step of obtaining the alarm information to be merged and the terminal behavior tree data, the method further includes:

[0057] Receive alarm information from a target terminal and terminal behavior tree data associated with the alarm information.

[0058] Figure 2 This is a schematic diagram of the system structure of an alarm merging method provided by an embodiment of the present invention. Figure 2 The management platform in the service side corresponds to the management platform. The management platform can connect to multiple terminals, receive the alarm information of the terminals, and the terminal behavior tree data associated with the alarm information, and merge the alarm information.

[0059] In an embodiment of the present invention, the alarm detection engine is deployed on the terminal side, and the terminal detects alarm behaviors. When the terminal detects an alarm behavior, it traces the alarm behavior data, searches for historical behavior data associated with the alarm behavior, and integrates the data to obtain the terminal behavior tree data corresponding to the alarm behavior. For example, a process A in the terminal accesses folder B and then creates file C in folder B. If the behavior "creating file C in folder B" triggers an alarm, the data corresponding to the historical behavior "process A accessing folder B" associated with the alarm behavior becomes the associated terminal behavior tree data.

[0060] In this embodiment of the present invention, the alarm detection engine is deployed on the terminal. The terminal detects alarm behaviors and conducts targeted data tracing and ultimately reports only historical behavior data related to the alarm behavior, reducing data bandwidth and data processing requirements of the management platform. Therefore, the management platform does not need to be deployed in a clustered manner, reducing deployment and maintenance costs.

[0061] S102 : Starting from the node (such as the parent node, or the node itself) corresponding to the alarm information to be merged, the terminal behavior tree data is traced back in a preset direction.

[0062] In the embodiment of the present invention, the preset direction includes upward and / or downward. The present application can choose to trace the terminal behavior tree data upward, or downward, or simultaneously.

[0063] In one embodiment, the terminal behavior tree data is stored in an "edge + point" structure, splitting the terminal behavior tree data into multiple "two points and one side". The edges store parent-child node information and parent-child relationships, and the nodes store detailed information about the nodes. Figure 3 , Figure 3 This is a schematic diagram of the structure of a terminal behavior tree data provided by an embodiment of the present invention. The proc_A node is connected to the proc_B node, indicating that process A created process B. The proc_B node is connected to the DNS_D node, indicating that process B accessed the DNS, triggering an alarm. Figure 3 The storage format of the terminal behavior tree data is as follows Figure 4 As shown, the edge information of the terminal behavior tree data is stored in the edge set, and the node information of the terminal behavior tree data is stored in the node set. Node sets are divided into process node sets and DNS node sets, and the node information of different types of nodes is stored in the corresponding node set.

[0064] The terminal behavior tree data is a tree structure containing nodes and edges. Alarm behaviors correspond to nodes in the tree structure. The line between two nodes is called an edge, and an edge corresponds to a specific behavior between behavior nodes. For example, Figure 3 In the example, the edge between nodes A and B represents the action "Process A creates Process B." Nodes A and B have a parent-child relationship: A is the parent of B, and B is the child of A. A is the grandparent of C and D, and B is the common parent of C and D, making C and D the children of B. The parent-child relationships for other nodes can be deduced in the same way.

[0065] Determine the node corresponding to the alarm information to be merged in the terminal behavior tree data, such as the node corresponding to the alarm information to be merged Figure 3 The behavior in the terminal behavior tree is "proc_A-proc_B", then the corresponding node of the alarm information to be merged in the terminal behavior tree data is Figure 3 Node A in the . Starting from Node A, trace the terminal behavior tree data in the preset direction.

[0066] S103, if the target historical node is found during the tracing process in the preset direction, the alarm information to be merged and the related nodes during the tracing process in the preset direction are merged into the target historical event, and the tracing process is stopped; wherein, the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the target historical event.

[0067] All nodes corresponding to a target historical event can demonstrate the attack process within the terminal. The terminal behavior tree data may correspond to multiple target historical events. Not all data in the terminal behavior tree data belongs to the same target historical event; some data may also belong to other target historical events. Therefore, it is necessary to select data belonging to the same target historical event from the terminal behavior tree data. This process is called tracing.

[0068] In one embodiment, the preset direction includes upward and downward. Accordingly, if a target historical node is found during the tracing process in the preset direction, the alarm information to be merged and the nodes related to the tracing process in the preset direction are merged into the target historical event, and further tracing is stopped. The target historical node is: a node that has historical alarm information corresponding to it and the historical alarm information belongs to the target historical event, including:

[0069] If the first target historical node is found during the upward tracing process, the alarm information to be merged and the nodes related to the upward tracing process are merged into the first target historical event, and further upward tracing is stopped; wherein the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the first target historical event;

[0070] If a second target historical node is found during the downward tracing process, the alarm information to be merged and the related nodes in the downward tracing process will be merged into the second target historical event, and the downward tracing starting from the second target historical node will be stopped; wherein, the second target historical node is: corresponding to historical alarm information and the historical alarm information belongs to the second target historical event.

[0071] If it belongs to both the first target historical event and the second target historical event, the first target historical event and the second target historical event are merged into one large event.

[0072] Behavior tree data is a multi-layer tree structure, each layer contains at least one node. For example, the structure of a terminal behavior tree data is as follows Figure 5 As shown, the current alarm behavior corresponds to Figure 5If the node corresponding to the alarm information to be merged is proc_C, then proc_C and DNS_E are both children of proc_B and are on the same layer. proc_G and DNS_D are both children of proc_C and are on the same layer. Start from proc_C and trace back in the preset direction to find the target historical node.

[0073] Starting from the node corresponding to the alarm information to be merged, the terminal behavior tree data is traced upward. Figure 5 For example, starting from the proc_C node, the terminal behavior tree data is traced upward to find the first target historical node. The historical alarm information corresponding to the first target historical node belongs to the first target historical event. In one embodiment, if the node found has a parent-child relationship or a grandparent-grandchild relationship with the proc_C node, and the node found has historical alarm information, then the node found is determined to be the first target historical node. For example, Figure 5 In the example, proc_B is the parent node of proc_C. If proc_B corresponds to a node with an alarm (an alarm indicates historical alarm information), then proc_B is determined to be the first target historical node. If proc_B does not have a corresponding alarm, the upward tracing process continues. proc_A is the grandparent node of proc_C. If proc_A corresponds to an alarm, then proc_A is determined to be the first target historical node. If proc_A does not have a corresponding alarm, the above logic continues to trace the terminal behavior tree data upward until the first target historical node is found.

[0074] by Figure 5 For example, the node corresponding to the alarm information to be merged is proc_C node, and the terminal behavior tree data is traced upward from proc_C node. The result of the first upward tracing is as follows Figure 6 As shown in the left figure in the figure, the result of the second upward tracing is as follows Figure 6 As shown in the right figure, since the proc_B node corresponds to the alarm behavior, the proc_B node is the first target historical node.

[0075] The reason for stopping upward tracing at proc_B is that if historical alarm information is found corresponding to proc_B during upward tracing, it can be determined that upward tracing has already been performed based on proc_B. Therefore, by stopping upward tracing at proc_B, all previous tracing results based on proc_B can be directly merged into the first target historical event. In other embodiments, upward tracing can also be continued, but this will increase the workload of the management platform, and if the number of tracing layers is too large, it will affect the data processing efficiency of the management platform.

[0076] Because all processes of the system are initiated by the underlying process of the system, if the first target historical node is not restricted, it will eventually be traced back to the node corresponding to the underlying process of the system, which will cause a large amount of irrelevant alarm information to be merged into the same target historical event. In order to prevent them from being associated with the underlying process of the system, in one embodiment, when tracing back upwards, if the application traces back to multiple alarm behaviors, and the multiple alarm behaviors have a common parent node or grandparent node, then the common parent node or grandparent node must correspond to the alarm behavior in order to merge the multiple alarm behaviors into one target historical event. Reference Figure 7 , Figure 7 proc5-file1 and proc7-dns2 correspond to two alarm behaviors respectively. Although they are in the same terminal behavior tree data, their common grandparent node (proc3 node) does not have a corresponding alarm behavior. Therefore, proc5-file1 and proc7-dns2 do not belong to the same target historical event, and the historical alarm information corresponding to proc5-file1 and proc7-dns2 cannot be merged into the same target historical event.

[0077] Starting from the node corresponding to the alarm information to be merged, the terminal behavior tree data is traced downward. The downward tracing can be for all child nodes. The relevant nodes in the downward tracing process can refer to each child node passed through, and can further include the child nodes corresponding to each child node in the tracing process. This application can also limit the number of tracing layers of the child nodes corresponding to each child node.

[0078] by Figure 5 For example, we start tracing back the terminal behavior tree data from the proc_C node and look for the second target history node. The historical alarm information corresponding to the second target history node belongs to the second target history event. The result of tracing back is as follows: Figure 8As shown, since proc_I corresponds to an alarm behavior (corresponding to historical alarm information), it becomes the second target historical node, and downward tracing from the second target historical node ends. It should be understood that this assumes that proc_C-proc_G do not correspond to an alarm behavior. If proc_C-proc_G do correspond to an alarm behavior, then the tracing ends at the first downward tracing.

[0079] This application incorporates all nodes passed through in the traceability process into the target historical event. Because in a target historical event, not all data are alarm data, for example, Figure 5 In the example, proc_C accessing DNS_D is the direct cause of the alarm, while proc_A creating proc_B and proc_B creating proc_C are the primary causes of the alarm. Without proc_A creating proc_B and proc_B creating proc_C, proc_C accessing DNS_D would not have occurred. These are all causes of the alarm and constitute a target historical event. Submitting all data corresponding to these target historical events to security analysts facilitates threat analysis and provides more accurate results.

[0080] In one embodiment, upward tracing and downward tracing are performed simultaneously. If the alarm information to be merged is traced upward to be merged into a first target historical event, and the alarm information to be merged is traced downward to be merged into a second target historical event, the first target historical event is merged into the second target historical event to form a large target historical event.

[0081] In one embodiment, if, during the tracing process in the preset direction, the number of tracing layers reaches a preset number and the target historical node is not encountered, tracing in the preset direction is stopped;

[0082] Correspondingly, if the target historical node is found during the tracing process in the preset direction, the alarm information to be merged and the nodes passed during the tracing process in the preset direction are merged into the target historical event, and further tracing is stopped, including:

[0083] If the target historical node is found before the preset number of layers is reached during the tracing process in the preset direction, the alarm information to be merged and the nodes passed during the tracing process in the preset direction are merged into the target historical event, and tracing is stopped.

[0084] In an embodiment of the present invention, this application limits the maximum number of traceability levels. If the target historical node is not found after reaching the preset number of levels, the tracing is stopped, and the alarm information to be merged and the related nodes in the tracing process are all merged into the target historical event; if the target historical node is found before reaching the preset number of levels, the tracing is stopped, and the alarm information to be merged and the related nodes in the tracing process are all merged into the target historical event.

[0085] In one embodiment, the preset direction includes tracing back downwards; accordingly, if, during the tracing back in the preset direction, the number of tracing back layers reaches a preset number of layers and the target historical node is not encountered, stopping tracing back in the preset direction includes:

[0086] If, during the downward tracing process, the number of tracing layers reaches the preset number of downward layers and the second target historical node is still not encountered, the downward tracing is stopped, and the nodes related to the downward tracing and the alarm information to be merged are merged into the same event.

[0087] In practical applications, there may be multiple traceback paths, such as Figure 7 In the example, there are three downward tracing paths based on the proc_G node: proc_G-proc_I-DNS_J, proc_G-proc_H-proc_K, and proc_G-proc_H-proc_L. Tracing back to the proc_G node is done separately. If the number of traceback layers on each traceback path reaches the preset number of layers without encountering the second target historical node, the downward tracing stops. The alarm information to be merged and the nodes related to the downward tracing on the three traceback paths are merged into a single event.

[0088] In one embodiment, the preset direction includes upward and downward; the preset number of layers includes a preset upward number of layers and a preset downward number of layers; and the preset downward number of layers is smaller than the preset upward number of layers.

[0089] For example, the preset downward number is 3, and the preset upward number is 10.

[0090] The number of upward tracing layers is greater than the number of downward tracing layers. This is because the endpoint behavior tree data is a tree-like structure, and the workload of tracing downward is much greater than tracing upward. For example, if the current layer has 10 nodes, and each of these 10 nodes corresponds to 10 nodes in the next layer, then the next layer has 100 nodes. Tracing downward too many layers increases the workload exponentially, reducing the computing performance of electronic devices and affecting the efficiency of threat assessment. However, when tracing upward, the workload decreases with each layer, allowing for more layers of tracing.

[0091] refer to Figure 9 , Figure 9This is a schematic diagram of the structure of terminal behavior tree data corresponding to a target historical event provided by an embodiment of the present invention. Figure 9 Yes Figure 5 The terminal behavior tree data shown here is the tracing result of both upward and downward tracing. Figure 9 All nodes in belong to one target historical event. Figure 9 compared to Figure 5 The missing edge proc_I-DNS_J is because proc_I-DNS_J does not have a corresponding alarm behavior, so the alarm information corresponding to proc_I-DNS_J is not incorporated into the target historical event. However, the nodes proc_A and DNS_F, which are not part of this traceback process, are incorporated into the target historical event because proc_A-DNS_F has a corresponding alarm behavior. The proc_A node has been traced before and is already a node belonging to the target historical event. During this traceback, proc_A is found to be associated with the target historical event, so the proc_A and DNS_F nodes are also incorporated into the target historical event.

[0092] The embodiment of the present invention obtains the alarm information to be merged and the terminal behavior tree data, and traces the terminal behavior tree data in a preset direction with the node corresponding to the alarm information to be merged as the starting point. If the target historical node is found in the process of tracing back to the preset direction, the alarm information to be merged and the related nodes in the process of tracing back to the preset direction are all merged into the target historical event, and the tracing back is stopped; wherein, the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the target historical event. The embodiment of the present invention traces the terminal behavior tree data in a preset direction based on the alarm information to be merged, and merges the alarm information to be merged and the related nodes in the process of tracing back to the preset direction into the target historical event. The node corresponding to the target historical event can present the attack process inside the terminal. Based on the node corresponding to the target historical event, the security engineer can clearly know the process of the attack inside the terminal, which is convenient for threat analysis and problem location. Compared with the existing technology, it saves the manpower cost of manual tracing analysis and improves the efficiency of threat assessment.

[0093] In one embodiment, after the step of obtaining the alarm information to be merged, the method further includes:

[0094] Determine whether there is an alarm that is the same as the alarm information to be merged;

[0095] If they exist, the same alarms are integrated instead of merging the alarms based on the behavior tree data of the source terminal.

[0096] In actual applications, the alarm information is stored in a database. After the step of obtaining the alarm information to be merged, the present application determines whether there is alarm information in the database that is identical to the alarm information to be merged.

[0097] Here, the criterion for determining whether an alarm is identical is that the same alarm is triggered within the lifecycle of the same process. For example, if the alarm behavior "Process A creates file C in folder B" occurs twice within the lifecycle of the same process, then these two alarm behaviors are considered identical.

[0098] In practical applications, the process path, process creation time, and process identifier (PID) can be used to determine whether they are the same process. A PID is a unique process identifier assigned randomly by the system during runtime and does not represent a specific process. While running, the PID identifier remains unchanged. However, if a program is terminated and then re-run, the PID identifier is recycled by the system and may be assigned to a newly running program. If the PID is the same and the PID assignment time is also the same, it can be determined to be the same process.

[0099] If there is an alarm that is identical to the alarm information to be merged, the identical alarm will be integrated.

[0100] Here, the same alarms are integrated, including counting the number of occurrences and the time of occurrence of the same alarms.

[0101] In the database, only one copy of the same alarm information is stored, and each time a new alarm occurs, the number of occurrences and the time of occurrence of the same alarm are counted. If the same alarm is found, the number of occurrences of the same alarm is increased by 1, and the time of occurrence of the same alarm is written.

[0102] Consolidating identical alerts can avoid the "alert flood" phenomenon. For example, a mining virus might periodically access a malicious domain, triggering an alert. If identical alerts are not consolidated, multiple identical alerts will appear, triggering an "alert flood." This can mask other alerts, making it difficult for security personnel to pinpoint the root cause during threat analysis. Consolidating identical alerts, however, provides a visual display of the number and time of alert occurrence, reducing the "alert flood" phenomenon and facilitating threat analysis and problem location without the risk of other alerts being masked.

[0103] In one embodiment, after acquiring the terminal behavior tree data, the terminal behavior tree data is stored in a settings database. Because the terminal behavior tree data corresponding to different alarms may contain some identical data, this application deduplicates identical terminal behavior tree data in the settings database before storing the terminal behavior tree data in the settings database. Identical terminal behavior tree data is only stored in one copy in the settings database, preventing data redundancy that wastes disk space and affects computing performance.

[0104] refer to Figure 10 , Figure 10 This is a schematic diagram of an alarm merging process provided by an embodiment of the present invention. The alarm merging process begins with receiving the alarm information to be merged and the terminal behavior tree data from the terminal. The alarm merging process includes:

[0105] The first step is to integrate the same alarms.

[0106] Newly reported alarms to be merged are compared with existing alarms in the management platform to determine if they are identical. If so, they are consolidated, and the number and time of occurrence of identical alarms are counted. Identical alarms are defined as identical if they occur within the same process lifecycle. For details, refer to the above embodiments and are not repeated here.

[0107] The integration of identical alarms can avoid the occurrence of an "alarm flood." For example, a mining virus may trigger an alarm by accessing a malicious domain name at regular intervals. If these alarms are not integrated, multiple identical alarms may appear. For security personnel conducting threat analysis, this may cause other alarms to be obscured by the "alarm flood." However, after integrating identical alarms, an intuitive display of the number of alarm triggers and the time interval can be provided without the risk of obscuring other alarms.

[0108] The second step is to remove duplicate traceability data and store them in the database.

[0109] Traceability data refers to the terminal behavior tree data corresponding to the alarm behavior. After receiving the terminal behavior tree data, the management platform stores it in the database. Because different alarm behaviors may have the same terminal behavior tree data, the management platform deduplicates the same terminal behavior tree data to prevent excessive data redundancy, which wastes disk space and affects computing performance.

[0110] The third step is to merge and integrate different alarms.

[0111] If the previously merged alarms are successful, there's no need to trace back the terminal behavior tree data for alarm merging. If the merge fails, the terminal behavior tree data is traced back in the preset direction, starting from the node corresponding to the alarm to be merged. The alarm to be merged and any related nodes during the tracing process are merged into the target historical event. The specific tracing process can be found in the description of the previous embodiment and will not be repeated here.

[0112] By analyzing the nodes corresponding to the target's historical events, security engineers can understand the attack process within the terminal, facilitating threat analysis and problem location. Compared with existing technologies, this saves the labor cost of manual tracing and analysis, and improves the efficiency of threat assessment.

[0113] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0114] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0115] It should be noted that the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0116] In addition, in the embodiments of the present invention, “first”, “second”, etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0117] refer to Figure 11 , Figure 11 FIG. 1 is a schematic diagram of an alarm merging device provided by an embodiment of the present invention. Figure 11 As shown, the device includes: an acquisition module, a tracing module and a merging module.

[0118] The acquisition module is used to obtain the alarm information to be merged and the terminal behavior tree data;

[0119] A tracing module, configured to trace the terminal behavior tree data in a preset direction starting from the node corresponding to the alarm information to be merged;

[0120] The merging module is used to merge the alarm information to be merged and the related nodes in the process of tracing back to the preset direction into the target historical event if the target historical node is found in the process of tracing back to the preset direction, and stop tracing back; wherein, the target historical node is: corresponding to historical alarm information and the historical alarm information belongs to the target historical event.

[0121] In one embodiment, the preset direction includes upward and downward; and the merging module is configured to:

[0122] If the first target historical node is found during the upward tracing process, the alarm information to be merged and the nodes related to the upward tracing process are merged into the first target historical event, and further upward tracing is stopped; wherein the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the first target historical event;

[0123] If a second target historical node is found during the downward tracing process, the alarm information to be merged and the related nodes in the downward tracing process will be merged into the second target historical event, and the downward tracing starting from the second target historical node will be stopped; wherein, the second target historical node is: corresponding to historical alarm information and the historical alarm information belongs to the second target historical event.

[0124] In one embodiment, the apparatus further comprises:

[0125] A stopping module is configured to stop tracing in the preset direction if the target historical node is not encountered after the number of tracing layers reaches a preset number during the tracing process in the preset direction;

[0126] Accordingly, the merging module is further configured to:

[0127] If the target historical node is found before the preset number of layers is reached during the tracing process in the preset direction, the alarm information to be merged and the nodes passed during the tracing process in the preset direction are merged into the target historical event, and tracing is stopped.

[0128] In one embodiment, the preset direction includes tracing back to the source;

[0129] Accordingly, the merging module is further configured to:

[0130] If, during the downward tracing process, the number of tracing layers reaches the preset number of downward layers and the second target historical node is still not encountered, the downward tracing is stopped, and the nodes related to the downward tracing and the alarm information to be merged are merged into the same event.

[0131] In one embodiment, the preset direction includes upward and downward; the preset number of layers includes a preset upward number of layers and a preset downward number of layers; and the preset downward number of layers is smaller than the preset upward number of layers.

[0132] In one embodiment, the apparatus further comprises:

[0133] A judgment module, used to judge whether there is an alarm that is the same as the alarm information to be merged;

[0134] The integration module is used to integrate the same alarms if they exist, rather than merging the alarms based on the behavior tree data of the tracing terminal.

[0135] In one embodiment, each of the above devices is applied on the service side;

[0136] Accordingly, the device further comprises:

[0137] The receiving module is used to receive alarm information and terminal behavior tree data associated with the alarm information from the target terminal.

[0138] In actual application, the acquisition module, tracing module and merging module can be implemented through a processor in an electronic device, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA).

[0139] It should be noted that the alarm merging device provided in the above embodiment only uses the division of the above modules as an example to illustrate the alarm merging. In actual applications, the above processing can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different modules to complete all or part of the processing described above. In addition, the alarm merging device provided in the above embodiment and the alarm merging method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0140] The alarm merging device can be in the form of an image file. After the image file is executed, it can be run in the form of a container or a virtual machine to implement the alarm merging method described in this application. Of course, it is not limited to the image file format. Any software form that can implement the alarm merging method described in this application is within the scope of protection of this application.

[0141] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an electronic device. Figure 12This is a schematic diagram of the hardware structure of the electronic device according to the embodiment of the present application. Figure 12 As shown, the electronic equipment includes:

[0142] Communication interface, capable of exchanging information with other devices such as network equipment;

[0143] The processor is connected to the communication interface to implement information exchange with other devices and is used to execute the methods provided by one or more technical solutions on the electronic device side when running a computer program. The computer program is stored in the memory.

[0144] Of course, in actual applications, the various components in the electronic device are coupled together through a bus system. It is understood that the bus system is used to achieve connection and communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 12 Various buses are labeled as bus systems.

[0145] The electronic devices described above can be clustered, such as in the form of a cloud computing platform. A cloud computing platform is a service model that uses computing virtualization, network virtualization, and storage virtualization technologies to organize the physical hardware resources of multiple independent servers into pooled resources. It is a software-defined resource architecture based on the development of virtualization technology, providing resource capabilities in the form of virtual machines and containers. By eliminating the fixed relationship between hardware and operating systems and relying on network connectivity to unify resource scheduling and then provide the required virtual resources and services, it represents a new IT and software delivery model characterized by flexibility, elasticity, distribution, multi-tenancy, and on-demand nature.

[0146] The current cloud computing platform supports several service models:

[0147] SaaS (Software as a Service): Cloud computing platform users do not need to purchase software, but instead rent software deployed on the cloud computing platform. Users do not need to maintain the software, and the software service provider will fully manage and maintain the software.

[0148] PaaS (Platform as a Service): Cloud computing platform users (usually software developers in this case) can build new applications or extend existing applications on the cloud computing platform's infrastructure without having to purchase development, quality control, or production servers.

[0149] IaaS (Infrastructure as a Service): Cloud computing platforms provide data centers, infrastructure hardware, and software resources through the Internet. Cloud computing platforms under the IaaS model can provide servers, operating systems, disk storage, databases, and / or information resources.

[0150] The memory in the embodiments of the present application is used to store various types of data to support the operation of the electronic device. Examples of such data include: any computer program used to operate on the electronic device.

[0151] It is understood that the memory can be volatile memory or non-volatile memory, or can include both volatile and non-volatile memory. Among them, non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disk, or compact disc read-only memory (CD-ROM); magnetic surface memory can be magnetic disk memory or magnetic tape memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0152] The methods disclosed in the above embodiments of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, the steps of the above methods can be completed by hardware integrated logic circuits in the processor or instructions in software form. The above processor may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in a memory. The processor reads the program in the memory and completes the steps of the above methods in combination with its hardware.

[0153] Optionally, when the processor executes the program, it implements the corresponding processes implemented by the electronic device in each method of the embodiments of the present application, which will not be described here for the sake of brevity.

[0154] In an exemplary embodiment, the present application also provides a storage medium, namely, a computer storage medium, specifically a computer-readable storage medium, including, for example, a first memory storing a computer program, wherein the computer program can be executed by a processor of an electronic device to perform the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed devices, electronic devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0156] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0157] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0158] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, ROM, RAM, disks or optical disks, etc. Various media that can store program codes.

[0159] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0160] It should be noted that the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0161] In addition, in the examples of this application, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0162] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An alarm merging method, characterized in that: include: Obtain the alarm information to be merged and the terminal behavior tree data; The terminal behavior tree data includes terminal historical behavior data associated with the alarm information to be merged; Taking the node corresponding to the alarm information to be merged as the starting point, tracing the terminal behavior tree data in a preset direction; If, in the process of tracing back to the preset direction, the target historical node is found before the preset number of layers is reached, the alarm information to be merged and the nodes related to the process of tracing back to the preset direction are all merged into the target historical event, and tracing back is stopped; if, in the process of tracing back to the preset direction, the target historical node is not encountered after the number of tracing back layers reaches the preset number of layers, tracing back to the preset direction is stopped; wherein, the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the target historical event; the preset direction includes upward and downward; the preset number of layers includes the preset upward number of layers and the preset downward number of layers; The preset number of downward layers is smaller than the preset number of upward layers.

2. The alarm merging method according to claim 1, wherein: The preset direction includes upward and downward; Accordingly, if the target historical node is found during the tracing process in the preset direction, the alarm information to be merged and the nodes related to the tracing process in the preset direction are all merged into the target historical event, and further tracing is stopped; wherein the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the target historical event, including: If the first target historical node is found during the upward tracing process, the alarm information to be merged and the nodes related to the upward tracing process are merged into the first target historical event, and further upward tracing is stopped; wherein the target historical node is: corresponding to the historical alarm information and the historical alarm information belongs to the first target historical event; If a second target historical node is found during the downward tracing process, the alarm information to be merged and the related nodes in the downward tracing process will be merged into the second target historical event, and the downward tracing starting from the second target historical node will be stopped; wherein, the second target historical node is: corresponding to historical alarm information and the historical alarm information belongs to the second target historical event.

3. The alarm merging method according to claim 1, wherein: The preset direction includes tracing back to the source; Accordingly, if, during the tracing process in the preset direction, the number of tracing layers reaches the preset number of layers but the target historical node is not encountered, tracing in the preset direction is stopped, including: If, during the downward tracing process, the number of tracing layers reaches the preset number of downward layers and the second target historical node is still not encountered, the downward tracing is stopped, and the nodes related to the downward tracing and the alarm information to be merged are merged into the same event.

4. The alarm merging method according to claim 1, wherein: After the step of obtaining the alarm information to be merged, the method further includes: Determine whether there is an alarm that is the same as the alarm information to be merged; If they exist, the same alarms are integrated instead of merging the alarms based on the behavior tree data of the source terminal.

5. The alarm merging method according to any one of claims 1 to 4, characterized in that: Each step is applied on the service side; Accordingly, before the step of obtaining the alarm information to be merged and the terminal behavior tree data, the method further includes: Receive alarm information from a target terminal and terminal behavior tree data associated with the alarm information.

6. An alarm merging device, characterized in that: include: The acquisition module is used to obtain the alarm information to be merged and the terminal behavior tree data; The terminal behavior tree data includes terminal historical behavior data associated with the alarm information to be merged; A tracing module, configured to trace the terminal behavior tree data in a preset direction starting from the node corresponding to the alarm information to be merged; The merging module is configured to: if, during the process of tracing back to the preset direction, the target historical node is found before the preset number of layers is reached, then merge the alarm information to be merged and the nodes related to the process of tracing back to the preset direction into the target historical event, and stop tracing back; if, during the process of tracing back to the preset direction, the target historical node is not encountered after the number of tracing back layers reaches the preset number of layers, then stop tracing back to the preset direction; wherein, the target historical node is: corresponding to historical alarm information and the historical alarm information belongs to the target historical event; the preset direction includes upward and downward; the preset number of layers includes a preset upward number of layers and a preset downward number of layers; The preset number of downward layers is smaller than the preset number of upward layers.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the alarm merging method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the alarm merging method according to any one of claims 1 to 5.

Images