An alarm identification method, device and related equipment

Abstract

The application discloses an alarm identification method, comprising: obtaining alarm data corresponding to a target alarm type, wherein the alarm data comprises a first time dimension sequence and a second time dimension sequence; dividing the first time dimension sequence into a plurality of first sub-sequences and the second time dimension sequence into a plurality of second sub-sequences according to each division parameter in a preset division parameter interval; for each division result corresponding to each division parameter, calculating the similarity between the first sub-sequences and the second sub-sequences in the same order position by using a dynamic time warping algorithm; and determining an alarm identification result according to all the similarities corresponding to all the division parameters. The technical solution provided by the application can realize more accurate alarm identification, and effectively reduce the false alarm rate by filtering out false alarms. The application also discloses an alarm identification device, system and computer readable storage medium, which have the above beneficial effects.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an alarm identification method, an alarm identification device, a system, and a computer-readable storage medium. Background Technology

[0002] During operation, security equipment generates a massive number of alerts daily through its detection engine. These alerts involve numerous entities, making it difficult for security operations personnel to identify genuine attacks and significantly increasing the challenge of uncovering real attacks, thus posing security risks to customers. Therefore, eliminating security alerts caused by periodic false alarms from massive alert logs is highly valuable, effectively reducing the false alarm rate in subsequent stages of detecting compromised hosts and hacker attack chains.

[0003] Traditional periodic alarm reduction techniques mostly use Euclidean distance. However, this method requires the time series used to calculate the Euclidean distance to be of equal length, meaning it can only detect time series data of exactly the same length. In practical applications, this can lead to many missed detections. For example, if an alarm in a periodic time series shifts, its Euclidean distance cannot be calculated, resulting in a missed detection. Similarly, it is impossible to calculate the Euclidean distance between two time series data of different lengths, also resulting in a missed detection.

[0004] Therefore, how to achieve more accurate alarm identification and filter out false alarms to effectively reduce the false alarm rate is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide an alarm identification method that can achieve more accurate alarm identification and filter out false alarms to effectively reduce the false alarm rate. Another purpose of this application is to provide an alarm identification device, system and computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0006] Firstly, this application provides an alarm identification method, including:

[0007] Obtain alarm data corresponding to the target alarm type, wherein the alarm data includes a first time dimension sequence and a second time dimension sequence;

[0008] Based on each partitioning parameter within the preset partitioning parameter range, the first time dimension sequence is divided into multiple first subsequences, and the second time dimension sequence is divided into multiple second subsequences;

[0009] For each partitioning parameter, the similarity between the first subsequence and the second subsequence that are in the same order position is calculated using the dynamic time warping algorithm.

[0010] The alarm recognition result is determined based on the similarity scores corresponding to all the division parameters.

[0011] Preferably, before dividing the first time-dimensional sequence into multiple first subsequences according to each division parameter within a preset division parameter range, and before dividing the second time-dimensional sequence into multiple second subsequences, the method further includes:

[0012] Obtain the attack status of each alarm data in the first time dimension sequence and the second time dimension sequence;

[0013] Based on the attack states, the alarm data in the first time dimension sequence and the second time dimension sequence are standardized to obtain a first standardized sequence and a second standardized sequence.

[0014] Accordingly, the step of dividing the first time-dimension sequence into multiple first subsequences and the second time-dimension sequence into multiple second subsequences according to each division parameter within a preset division parameter range includes:

[0015] Based on each of the predetermined division parameters within the preset division parameter range, the first standardized sequence is divided into multiple first subsequences, and the second standardized sequence is divided into multiple second subsequences.

[0016] Preferably, obtaining the attack status of each alarm data in the first time dimension sequence and the second time dimension sequence includes:

[0017] Statistically analyze the traffic data corresponding to each alarm data in the first time dimension sequence and the second time dimension sequence;

[0018] The attack status of each of the traffic data is obtained by using preset attack identification rules.

[0019] Preferably, the step of standardizing the alarm data in the first time-dimension sequence and the second time-dimension sequence according to each of the attack states to obtain a first standardized sequence and a second standardized sequence includes:

[0020] When the attack status is "attack has occurred", the alarm data corresponding to the attack status is replaced with the first flag value;

[0021] When the attack status is "no attack has occurred", the alarm data corresponding to the attack status is replaced with the second flag value;

[0022] A first standardized sequence corresponding to the first time dimension sequence and a second standardized sequence corresponding to the second time dimension sequence are generated based on the first flag value and the second flag value.

[0023] Preferably, the step of dividing the first time-dimension sequence into multiple first subsequences and the second time-dimension sequence into multiple second subsequences according to each division parameter within a preset division parameter range includes:

[0024] Within the preset partitioning parameter range, the partitioning parameters are obtained in descending order of traversal.

[0025] According to the division parameters, the first time dimension sequence is divided into multiple first subsequences, and the second time dimension sequence is divided into multiple second subsequences.

[0026] Preferably, determining the alarm recognition result based on the similarity corresponding to all the partitioning parameters includes:

[0027] When all the similarities do not exceed the preset threshold, the alarm of the target alarm type is determined to be a normal alarm;

[0028] When any of the aforementioned similarities exceeds the preset threshold, the alarm of the target alarm type is determined to be a false alarm.

[0029] Preferably, obtaining the alarm data corresponding to the target alarm type includes:

[0030] Obtain preset collection rules;

[0031] The target device and the target alarm type are determined according to the preset acquisition rules;

[0032] The alarm data corresponding to the target alarm type is collected in the target device.

[0033] Secondly, this application also discloses an alarm identification device, comprising:

[0034] The acquisition module is used to acquire alarm data corresponding to the target alarm type, wherein the alarm data includes a first time dimension sequence and a second time dimension sequence;

[0035] The partitioning module is used to partition the first time dimension sequence into multiple first subsequences and the second time dimension sequence into multiple second subsequences according to each partitioning parameter within a preset partitioning parameter range.

[0036] The calculation module is used to calculate the similarity between the first subsequence and the second subsequence that are in the same order position for each of the partitioning parameters using the dynamic time warping algorithm.

[0037] The identification module is used to determine the alarm identification result based on the similarity corresponding to all the division parameters.

[0038] Thirdly, this application also discloses an alarm identification system, including:

[0039] Memory, used to store computer programs;

[0040] A processor, used to implement any of the alarm identification methods described above when executing the computer program.

[0041] Fourthly, this application also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the alarm identification methods described above.

[0042] This application provides an alarm identification method, comprising: acquiring alarm data corresponding to a target alarm type, the alarm data including a first time dimension sequence and a second time dimension sequence; dividing the first time dimension sequence into multiple first sub-sequences and the second time dimension sequence into multiple second sub-sequences according to each division parameter within a preset division parameter range; calculating the similarity between the first sub-sequences and second sub-sequences in the same order position using a dynamic time warping algorithm for each division result corresponding to the division parameter; and determining the alarm identification result based on all the similarities corresponding to all the division parameters.

[0043] As can be seen, the alarm identification method provided in this application first collects alarm data of the alarm type to be identified (i.e., the target alarm type) to obtain data sequences of different time dimensions, namely the first time dimension sequence and the second time dimension sequence. Then, the two are divided according to different sequence division parameters, and the similarity between each pair of subsequences is calculated sequentially using the dynamic time warping algorithm. Finally, based on all the similarity calculation results, it is determined whether the alarm of the target alarm type is a false alarm, thereby realizing alarm identification. It can be seen that this implementation method detects the periodic patterns existing in the alarm data based on the dynamic time warping algorithm, which can accurately detect periodic false alarms, reduce the number of alarms, and thus effectively reduce the false alarm rate.

[0044] The alarm identification device, system, and computer-readable storage medium provided in this application all have the aforementioned beneficial effects, which will not be elaborated further here. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the prior art and the embodiments of this application, the accompanying drawings used in the description of the prior art and the embodiments of this application will be briefly introduced below. Of course, the accompanying drawings described below with respect to the embodiments of this application are only a part of the embodiments in this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort, and such other drawings also fall within the protection scope of this application.

[0046] Figure 1 A flowchart illustrating an alarm identification method provided in this application;

[0047] Figure 2 A schematic diagram of the structure of an alarm identification device provided in this application;

[0048] Figure 3 This is a schematic diagram of the structure of an alarm identification system provided in this application. Detailed Implementation

[0049] The core of this application is to provide an alarm identification method that can achieve more accurate alarm identification and filter out false alarms to effectively reduce the false alarm rate. Another core aspect of this application is to provide an alarm identification device, system, and computer-readable storage medium, which also have the above-mentioned beneficial effects.

[0050] To provide a clearer and more complete description of the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0051] This application provides an alarm identification method.

[0052] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating an alarm identification method provided in this application. The alarm identification method may include the following steps S101 to S104.

[0053] S101: Obtain the alarm data corresponding to the target alarm type. The alarm data includes the first time dimension sequence and the second time dimension sequence.

[0054] This step aims to acquire alarm data for alarm identification. It should be noted that the alarm identification method provided in this application is primarily used to identify whether alarms occurring in relevant devices are genuine alarms, thus avoiding false alarms. Therefore, the alarm data acquired in this step is the alarm data corresponding to the target alarm type. The target alarm type refers to the alarm type to be identified, which is preset by the user according to actual identification needs, to determine whether alarms of the target alarm type are genuine alarms.

[0055] Furthermore, the alarm data includes data sequences with different time dimensions, namely the first time dimension sequence and the second time dimension sequence mentioned above. This means that during the statistical analysis of alarm data, data can be collected according to different time dimensions. For example, alarm data can be acquired using "days" as the statistical unit to obtain the first time dimension sequence, i.e., an N-day data sequence, and alarm data can be acquired using "hours" as the statistical unit to obtain the second time dimension sequence, i.e., an N-hour data sequence. The value of N can be set according to the actual situation. In summary, the first and second time dimension sequences have different time dimensions, which facilitates determining the alarm identification result by calculating the similarity between the two data sequences with different time dimensions.

[0056] In one embodiment of this application, obtaining the alarm data corresponding to the target alarm type may include the following steps:

[0057] Obtain preset collection rules;

[0058] The target device and target alarm type are determined according to the preset data collection rules;

[0059] Collect alarm data corresponding to the target alarm type from the target device.

[0060] This application provides a method for acquiring alarm data. Specifically, the user can pre-set data statistics rules according to actual needs, namely the aforementioned preset collection rules. These preset collection rules include relevant information about the target device to be statistically analyzed (such as IP address, device ID, etc.) and the target alarm type to be identified. Therefore, the target device and target alarm type can be determined based on the received preset collection rules, facilitating the collection of alarm data corresponding to the target alarm type from the target device. The target device can be a local device or any other device that communicates with the local device. It is understood that the larger the amount of alarm data in the data sequence, the more helpful it is to discover the periodic patterns of the alarm data, thereby ensuring the accuracy of the alarm identification results. Therefore, the number of target devices can be multiple.

[0061] S102: Based on each partition parameter within the preset partition parameter range, divide the first time dimension sequence into multiple first subsequences and the second time dimension sequence into multiple second subsequences.

[0062] This step aims to partition the data sequence. Specifically, a partitioning parameter range can be preset, namely the aforementioned preset partitioning parameter range. This preset partitioning parameter range contains multiple partitioning parameters. During the data sequence partitioning process, the data sequence is partitioned once according to each partitioning parameter. Each partitioning parameter can divide the first time dimension sequence into multiple first subsequences and the second time dimension sequence into multiple second subsequences.

[0063] For example, suppose the first time-dimension sequence A is (a1, a2, a3, a4, a5, a6, a7, a8, a9, a10), and the second time-dimension sequence B is (b1, b2, b3, b4, b5, b6, b7, b8, b9, b10), with a preset partitioning parameter interval of (3, 4, 5), then:

[0064] (1) Divide the data sequence according to partitioning parameter 3:

[0065] The partitioning result of A is: (a1, a2, a3), (a4, a5, a6), (a7, a8, a9), (a10);

[0066] The partitioning result of B is: (b1, b2, b3), (b4, b5, b6), (b7, b8, b9), (b10).

[0067] (2) Divide the data sequence according to partitioning parameter 4:

[0068] The partitioning result of A is: (a1, a2, a3, a4), (a5, a6, a7, a8), (a9, a10);

[0069] The partitioning result of B is: (b1, b2, b3, b4), (b5, b6, b7, b8), (b9, b10).

[0070] (3) Divide the data sequence according to partitioning parameter 5:

[0071] The partitioning result of A is: (a1, a2, a3, a4, a5), (a6, a7, a8, a9, a10);

[0072] The partitioning result of B is: (b1, b2, b3, b4, b5), (b6, b7, b8, b9, b10).

[0073] S103: For each partitioning parameter, calculate the similarity between the first and second subsequences that are in the same order using the dynamic time warping algorithm.

[0074] This step aims to calculate the similarity between subsequences. For the partitioning result of each partitioning parameter within the preset partitioning parameter range, the similarity between the first and second subsequences that are in the same order position can be calculated using the dynamic time warping algorithm. Here, the order position refers to the order of a certain subsequence among all subsequences after the data sequence partitioning is completed. Referring to the example above, for the partitioning result of partitioning parameter 3, the similarity between (a1, a2, a3) and (b1, b2, b3), (a4, a5, a6) and (b4, b5, b6), (a7, a8, a9) and (b7, b8, b9), and (a10) and (b10) can be calculated respectively; for the partitioning result of partitioning parameter 4, the similarity between (a1, a2, a3, a4) and (b1, b2, b6) can be calculated respectively. The similarity between (a1, a2, a3, a4, a5) and (b1, b2, b3, b4, b5), and the similarity between (a9, a10) and (b9, b10) can be calculated for the partitioning result of partitioning parameter 4.

[0075] Among them, the Dynamic Time Warping (DTW) algorithm can calculate the similarity between two time series, and is especially suitable for time series of different lengths and rhythms, with strong periodicity detection capabilities.

[0076] S104: Determine the alarm recognition result based on all similarities corresponding to all segmentation parameters.

[0077] This step aims to determine the alarm identification result. After obtaining all similarities corresponding to all segmentation parameters, the final alarm identification result can be determined based on the value of each similarity. This process can be achieved through threshold judgment. Furthermore, the alarm identification result determines whether the alarm of the target alarm type is a false alarm. For example, when all similarity values ​​meet a pre-set threshold condition, the alarm can be determined to be a false alarm; otherwise, it is a true alarm. False alarms can then be eliminated to reduce the number of alarms and effectively lower the false alarm rate.

[0078] In one possible implementation, determining the alarm identification result based on all similarities corresponding to all partitioning parameters can include the following steps:

[0079] When all similarities do not exceed the preset threshold, the alarm that determines the target alarm type is a normal alarm;

[0080] When any similarity exceeds a preset threshold, the alarm type of the target alarm is determined to be a false alarm.

[0081] This application provides a method for determining alarm identification results. Specifically, a threshold condition can be preset, namely the aforementioned preset threshold. Then, all similarities are compared with the preset threshold. If all similarities do not exceed the preset threshold, that is, the values ​​of all similarities are relatively low, it indicates that the first time dimension sequence and the second time dimension sequence do not have a periodic pattern. In this case, the alarm of the target alarm type can be determined as a normal alarm, and it does not need to be eliminated. Conversely, if any similarity exceeds the preset threshold, that is, there is a high similarity value, it indicates that the first time dimension sequence and the second time dimension sequence have a periodic pattern. In this case, the alarm of the target alarm type can be determined as a false alarm, and it can be eliminated. The value of the preset threshold does not affect the implementation of this technical solution and can be set by technicians according to the actual situation. This application does not limit it in this regard.

[0082] As can be seen, the alarm identification method provided in this application first collects alarm data of the alarm type to be identified (i.e., the target alarm type) to obtain data sequences of different time dimensions, namely the first time dimension sequence and the second time dimension sequence. Then, the two are divided according to different sequence division parameters, and the similarity between each pair of subsequences is calculated sequentially using the dynamic time warping algorithm. Finally, based on all the similarity calculation results, it is determined whether the alarm of the target alarm type is a false alarm, thereby realizing alarm identification. It can be seen that this implementation method detects the periodic patterns existing in the alarm data based on the dynamic time warping algorithm, which can accurately detect periodic false alarms, reduce the number of alarms, and thus effectively reduce the false alarm rate.

[0083] In one embodiment of this application, before dividing the first time dimension sequence into multiple first subsequences according to each of the preset division parameter intervals, and before dividing the second time dimension sequence into multiple second subsequences, the following steps may be included:

[0084] Obtain the attack status of each alarm data in the first and second time dimension sequences;

[0085] Based on each attack state, the alarm data in the first time dimension sequence and the second time dimension sequence are standardized to obtain the first standardized sequence and the second standardized sequence.

[0086] Accordingly, the above-mentioned division of the first time dimension sequence into multiple first subsequences and the second time dimension sequence into multiple second subsequences according to each division parameter within the preset division parameter interval may include: dividing the first standardized sequence into multiple first subsequences and the second standardized sequence into multiple second subsequences according to each division parameter within the preset division parameter interval.

[0087] The alarm identification method provided in this application embodiment can further perform standardization processing on the first time dimension sequence and the second time dimension sequence to facilitate subsequent similarity calculation. Specifically, after obtaining the alarm data corresponding to the target alarm type, before sub-sequence division of the first time dimension sequence and the second time dimension sequence using various division parameters within a preset division parameter range, for each alarm data in the first time dimension sequence and the second time dimension sequence, the alarm data can first be standardized according to the attack state corresponding to the alarm data, thereby obtaining a first standardized sequence after standardization of the first time dimension sequence and a second standardized sequence after standardization of the second time dimension sequence. Therefore, in the subsequent sub-sequence division, each division parameter within the preset division parameter range is used to divide the first standardized sequence into multiple first sub-sequences and the second standardized sequence into multiple second sub-sequences.

[0088] In one embodiment of this application, obtaining the attack status of each alarm data in the first time dimension sequence and the second time dimension sequence may include the following steps:

[0089] Statistically analyze the traffic data corresponding to each alarm data in the first and second time dimension sequences;

[0090] By using preset attack identification rules, each traffic data is identified to obtain the attack status of each alarm data.

[0091] This application provides a method for identifying the attack status corresponding to alarm data. This process can be implemented based on pre-defined attack identification rules, including but not limited to attack identification algorithms, neural network models, and feature information matching methods. It is understood that general alarm data only includes alarm prompts, and accurate attack identification results cannot be obtained solely based on this alarm data. Therefore, traffic data corresponding to each alarm data in a first and second time-dimension sequence can be obtained first. This traffic data mainly refers to the relevant data information generated by the target device during actual operation, and this data information generates alarm data. Thus, the traffic data corresponding to each alarm data can be sequentially identified using pre-defined attack identification rules to obtain the corresponding attack status. Here, the attack status refers to whether a network attack exists in the corresponding traffic data. Clearly, attack status identification based on traffic data has higher accuracy and can further ensure the accuracy of the alarm identification results.

[0092] In one embodiment of this application, the above-mentioned standardization processing of alarm data in the first time dimension sequence and the second time dimension sequence according to each attack state to obtain a first standardized sequence and a second standardized sequence may include the following steps:

[0093] When the attack status is "attack has occurred", the alarm data corresponding to the attack status will be replaced with the first flag value;

[0094] When the attack status is "no attack has occurred", the alarm data corresponding to the attack status will be replaced with the second flag value.

[0095] A first standardized sequence corresponding to the first time dimension sequence and a second standardized sequence corresponding to the second time dimension sequence are generated based on the first and second flag values.

[0096] This application provides a specific implementation method for standardization processing. Specifically, alarm data can be replaced with corresponding flag values ​​based on the attack status identification result. For example, if the attack status identification result indicates a network attack has occurred, the corresponding alarm data can be replaced with a first flag value; if the attack status identification result indicates no network attack has occurred, the corresponding alarm data can be replaced with a second flag value. This yields a first standardized sequence corresponding to the first time dimension sequence and a second standardized sequence corresponding to the second time dimension sequence. For instance, if the first flag value is set to 1 and the second flag value is set to 0, the resulting first and second standardized sequences are simple 0-1 sequences. Clearly, this implementation method facilitates subsequent subsequence similarity calculations and helps improve computational efficiency.

[0097] In one embodiment of this application, dividing the first time-dimensional sequence into multiple first sub-sequences and the second time-dimensional sequence into multiple second sub-sequences according to each of the preset division parameter intervals may include the following steps:

[0098] Within the preset partitioning parameter range, the partitioning parameters are obtained in descending order of traversal.

[0099] Based on the various partitioning parameters, the first time dimension sequence is divided into multiple first subsequences, and the second time dimension sequence is divided into multiple second subsequences.

[0100] As described above, the preset partitioning parameter range contains multiple partitioning parameters for subsequence partitioning. When reading partitioning parameters from the preset partitioning parameter range, they can be traversed and read in descending order, and then the subsequence partitioning operation is performed based on the read partitioning parameters. Of course, the above traversal order is only one implementation method provided by the embodiments of this application, and is not unique. It can also be traversed and read in ascending order, and this application does not limit this. Of course, to improve the reading efficiency of partitioning parameters, the partitioning parameters can also be pre-arranged in descending or ascending order within the preset partitioning parameter range. Thus, direct reading can achieve the acquisition of partitioning parameters in descending order and then the execution of subsequence partitioning operation.

[0101] This application also provides an alarm identification device, please refer to... Figure 2 , Figure 2 This is a schematic diagram of an alarm identification device provided in this application. The alarm identification device may include:

[0102] Module 1 is used to acquire alarm data corresponding to the target alarm type. The alarm data includes a first time dimension sequence and a second time dimension sequence.

[0103] The partitioning module 2 is used to partition the first time dimension sequence into multiple first subsequences and the second time dimension sequence into multiple second subsequences according to each partitioning parameter within the preset partitioning parameter range.

[0104] Calculation module 3 is used to calculate the similarity between the first subsequence and the second subsequence that are in the same order position for each partitioning parameter using the dynamic time warping algorithm.

[0105] The identification module 4 is used to determine the alarm identification result based on the similarity of all the division parameters.

[0106] As can be seen, the alarm identification device provided in this application first collects alarm data of the alarm type to be identified (i.e., the target alarm type) to obtain data sequences of different time dimensions, namely the first time dimension sequence and the second time dimension sequence. Then, the two are divided according to different sequence division parameters, and the similarity between each two sub-sequences is calculated sequentially using the dynamic time warping algorithm. Finally, based on all the similarity calculation results, it is determined whether the alarm of the target alarm type is a false alarm, thereby realizing alarm identification. It can be seen that this implementation method detects the periodic patterns existing in the alarm data based on the dynamic time warping algorithm, which can accurately detect periodic false alarms, reduce the number of alarms, and thus effectively reduce the false alarm rate.

[0107] In one embodiment of this application, the alarm identification device may further include a standardization module, used to obtain the attack status of each alarm data in the first time dimension sequence and the second time dimension sequence before dividing the first time dimension sequence into multiple first subsequences according to each division parameter within the preset division parameter range and dividing the second time dimension sequence into multiple second subsequences; and to perform standardization processing on each alarm data in the first time dimension sequence and the second time dimension sequence according to each attack status to obtain a first standardized sequence and a second standardized sequence.

[0108] Accordingly, the above-mentioned partitioning module 2 can be specifically used to partition the first standardized sequence into multiple first subsequences and the second standardized sequence into multiple second subsequences according to each partitioning parameter within the preset partitioning parameter range.

[0109] In one embodiment of this application, the above-mentioned standardization module can be specifically used to statistically analyze the traffic data corresponding to each alarm data in the first time dimension sequence and the second time dimension sequence; and to identify each traffic data using preset attack identification rules to obtain the attack status of each alarm data.

[0110] In one embodiment of this application, the standardization module can be specifically used to replace the alarm data corresponding to the attack state with a first flag value when the attack state is "attack has occurred"; replace the alarm data corresponding to the attack state with a second flag value when the attack state is "no attack has occurred"; and generate a first standardized sequence corresponding to the first time dimension sequence and a second standardized sequence corresponding to the second time dimension sequence based on the first flag value and the second flag value.

[0111] In one embodiment of this application, the division module 2 can be specifically used to obtain the division parameters in descending order within a preset division parameter range; and to divide the first time dimension sequence into multiple first subsequences and the second time dimension sequence into multiple second subsequences according to each division parameter.

[0112] In one embodiment of this application, the identification module 4 can be specifically used to determine that the alarm of the target alarm type is a normal alarm when all similarities do not exceed a preset threshold; and to determine that the alarm of the target alarm type is a false alarm when any similarity exceeds the preset threshold.

[0113] In one embodiment of this application, the acquisition module 1 described above may be specifically used to acquire preset acquisition rules; determine the target device and target alarm type according to the preset acquisition rules; and acquire alarm data corresponding to the target alarm type in the target device.

[0114] For a description of the device provided in this application, please refer to the above method embodiments; further details will not be provided here.

[0115] This application also provides an alarm identification system; please refer to [reference needed]. Figure 3 , Figure 3 This is a schematic diagram of an alarm identification system provided in this application. The alarm identification system may include:

[0116] Memory, used to store computer programs;

[0117] A processor, used to execute computer programs, can implement the steps of any of the alarm identification methods described above.

[0118] like Figure 3 The diagram shown illustrates the structural composition of an alarm identification system. The system may include a processor 10, a memory 11, a communication interface 12, and a communication bus 13. The processor 10, memory 11, and communication interface 12 all communicate with each other via the communication bus 13.

[0119] In this embodiment, the processor 10 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic devices.

[0120] The processor 10 can call the program stored in the memory 11. Specifically, the processor 10 can execute the operations in the embodiment of the alarm identification method.

[0121] The memory 11 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment, the memory 11 stores at least a program for implementing the following functions:

[0122] Obtain the alarm data corresponding to the target alarm type. The alarm data includes a first time dimension sequence and a second time dimension sequence.

[0123] Based on each partition parameter within the preset partition parameter range, the first time dimension sequence is divided into multiple first subsequences, and the second time dimension sequence is divided into multiple second subsequences.

[0124] For each partitioning parameter, the similarity between the first and second subsequences that are in the same order position is calculated using the dynamic time warping algorithm.

[0125] The alarm identification result is determined based on the similarity of all the parameters.

[0126] In one possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0127] In addition, memory 11 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0128] Communication interface 12 can be an interface for the communication module, used to connect with other devices or systems.

[0129] Of course, it should be noted that, Figure 3 The structure shown does not constitute a limitation on the alarm identification system in the embodiments of this application. In practical applications, the alarm identification system may include more than Figure 3 More or fewer components as shown, or combinations of certain components.

[0130] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps of any of the alarm identification methods described above.

[0131] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0133] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0134] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0135] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0136] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. An alarm identification method, characterized in that, include: Obtain alarm data corresponding to the target alarm type, wherein the alarm data includes a first time dimension sequence and a second time dimension sequence; the first time dimension sequence is obtained by dividing the alarm data according to the first time dimension, and the second time dimension sequence is obtained by dividing the alarm data according to the second time dimension; Based on each partitioning parameter within a preset partitioning parameter range, the first time dimension sequence is divided into multiple first subsequences, and the second time dimension sequence is divided into multiple second subsequences; the sequence lengths of each first subsequence and each second subsequence obtained based on the same partitioning parameter are the same; For each partitioning parameter, the similarity between the first subsequence and the second subsequence that are in the same order position is calculated using the dynamic time warping algorithm. Determine whether the alarm of the target alarm type is a periodic false alarm based on all the similarities corresponding to all the division parameters; The method further includes, before dividing the first time dimension sequence into multiple first subsequences according to each division parameter within a preset division parameter range, and dividing the second time dimension sequence into multiple second subsequences, the following steps are taken: 1) statistically analyzing the traffic data corresponding to each alarm data in the first and second time dimension sequences; 2) identifying each traffic data using preset attack identification rules to obtain the attack status of each alarm data; 3) replacing the alarm data corresponding to the attack status with a first flag value when the attack status is "attack has occurred"; 4) replacing the alarm data corresponding to the attack status with a second flag value when the attack status is "no attack has occurred"; and 5) generating a first standardized sequence corresponding to the first time dimension sequence and a second standardized sequence corresponding to the second time dimension sequence based on the first flag value and the second flag value. Accordingly, the step of dividing the first time dimension sequence into multiple first sub-sequences and the second time dimension sequence into multiple second sub-sequences according to each of the division parameters within the preset division parameter interval includes: dividing the first standardized sequence into multiple first sub-sequences and the second standardized sequence into multiple second sub-sequences according to each of the division parameters within the preset division parameter interval.

2. The alarm identification method according to claim 1, characterized in that, The step of dividing the first time-dimensional sequence into multiple first sub-sequences and the second time-dimensional sequence into multiple second sub-sequences according to each division parameter within a preset division parameter range includes: Within the preset partitioning parameter range, the partitioning parameters are obtained in descending order of traversal. According to the division parameters, the first time dimension sequence is divided into multiple first subsequences, and the second time dimension sequence is divided into multiple second subsequences.

3. The alarm identification method according to claim 1, characterized in that, The step of determining the alarm identification result based on the similarity corresponding to all the division parameters includes: When all the similarities do not exceed the preset threshold, the alarm of the target alarm type is determined to be a normal alarm; When any of the aforementioned similarities exceeds the preset threshold, the alarm of the target alarm type is determined to be a false alarm.

4. The alarm identification method according to claim 1, characterized in that, The acquisition of alarm data corresponding to the target alarm type includes: Obtain preset collection rules; The target device and the target alarm type are determined according to the preset acquisition rules; The alarm data corresponding to the target alarm type is collected in the target device.

5. An alarm identification device, characterized in that, include: The acquisition module is used to acquire alarm data corresponding to the target alarm type. The alarm data includes a first time dimension sequence and a second time dimension sequence. The first time dimension sequence is obtained by dividing the alarm data according to the first time dimension, and the second time dimension sequence is obtained by dividing the alarm data according to the second time dimension. The partitioning module is used to partition the first time dimension sequence into multiple first subsequences and the second time dimension sequence into multiple second subsequences according to each partitioning parameter within a preset partitioning parameter range; the sequence lengths of each first subsequence and each second subsequence obtained based on the same partitioning parameter are the same; The calculation module is used to calculate the similarity between the first subsequence and the second subsequence that are in the same order position for each of the partitioning parameters using the dynamic time warping algorithm. The identification module is used to determine the alarm identification result based on all the similarities corresponding to all the division parameters; The device further includes a standardization module, used to: before dividing the first time dimension sequence into multiple first subsequences according to each division parameter within a preset division parameter range, and dividing the second time dimension sequence into multiple second subsequences, statistically analyze the traffic data corresponding to each alarm data in the first time dimension sequence and the second time dimension sequence; identify each traffic data using a preset attack identification rule to obtain the attack status of each alarm data; and when the attack status is "attack has occurred," replace the alarm data corresponding to the attack status with a first flag value. When the attack state is no attack, the alarm data corresponding to the attack state is replaced with the second flag value; a first standardized sequence corresponding to the first time dimension sequence and a second standardized sequence corresponding to the second time dimension sequence are generated based on the first flag value and the second flag value. Accordingly, the partitioning module is specifically used to partition the first standardized sequence into multiple first subsequences and the second standardized sequence into multiple second subsequences according to each of the partitioning parameters within the preset partitioning parameter range.

6. An alarm identification system, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the alarm identification method as described in any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the alarm identification method as described in any one of claims 1 to 4.

Images