An intelligent control method for a network security device

Abstract

This invention provides an intelligent control method for network security devices, relating to the field of network security control technology. The method includes: acquiring raw log data from the network security device; preprocessing the raw log data to obtain categorized logs; extracting and selecting alarm false alarm detection-related features based on prior knowledge of historical alarms related to the network security device; training an alarm detection model and fusing features based on these detection-related features to identify alarm false alarms in the categorized logs; and finely adjusting the false alarm threshold for each type of alarm false alarm. The method involves preprocessing the raw log data to obtain categorized logs; extracting and selecting detection-related features based on prior knowledge of alarms related to the network security device; training an alarm detection model using these features to identify alarm false alarms in the categorized logs; and finally, finely adjusting the false alarm threshold to effectively control the alarm false alarm rate of the network security device.

Description

Technical Field

[0001] This invention relates to the field of network security control technology, and in particular to an intelligent control method for network security devices. Background Technology

[0002] Currently, most network security devices use anomaly detection methods for alarm detection. However, anomaly detection methods inevitably result in false alarms, which not only consume resources and time for processing but also reduce the sensitivity of security analysts to alarms, diverting their attention from dealing with real security threats. Therefore, reducing the high false alarm rate in network security device alarms is crucial.

[0003] Therefore, the present invention provides an intelligent control method for network security devices. Summary of the Invention

[0004] This invention provides an intelligent control method for network security devices, which obtains categorized logs by preprocessing raw log data; secondly, extracts and selects detection-related features based on prior knowledge of alarms related to network security devices; trains an alarm detection model using the detection-related features to identify false alarms in the categorized logs; and finally, finely adjusts the false alarm threshold to effectively control the false alarm rate of network security devices.

[0005] This invention provides an intelligent control method for network security devices, comprising:

[0006] Step 1: Obtain raw log data from network security devices;

[0007] Step 2: Perform data fusion and preprocessing operations on the raw log data to obtain categorized logs;

[0008] Step 3: Match historical alarm prior knowledge related to network security devices from the alarm database, and extract and select alarm false alarm detection related features from the historical alarm prior knowledge;

[0009] Step 4: Based on the detection-related features, train the alarm detection model and fuse features to classify and identify false alarms in the classification logs, and finely adjust the false alarm threshold for each type of false alarm to control the false alarm rate of network security devices.

[0010] Preferably, the log data undergoes data fusion and preprocessing operations to obtain categorized logs, including:

[0011] Step 11: Use a computer to filter and synthesize the obtained raw log data to export valid log data;

[0012] Step 12: Process the exported valid log data according to a standardized format to obtain a unified data format;

[0013] Step 13: Delete two or more data entries with identical feature values ​​in the valid log data and keep only one of them;

[0014] Step 14: Delete or complete missing data in the valid log data;

[0015] Step 15: Use a computer to extract alarm log data from the processed log data and classify it according to time sequence to obtain classified logs.

[0016] Preferably, missing data in valid log data is deleted or filled in, including:

[0017] Extract target cases containing missing values ​​from valid log data and analyze them. If the number of valid values ​​in a target case is less than a preset threshold, then delete the target case.

[0018] If the number of valid values ​​in the target case is greater than or equal to the preset threshold, then all data in the target case are discretized.

[0019] Based on discretized data, a subset of data with high correlation to the attributes of missing data is selected from the valid log data, and a sparse tensor is constructed based on the data subset;

[0020] Using tensor completion methods based on tensor decomposition, dense tensors are constructed and combined with original log data to complete the missing data corresponding to the target case.

[0021] Preferably, prior knowledge of historical alarms related to network security devices is matched from the alarm database, and false alarm detection-related features are extracted and selected from the prior knowledge of historical alarms, including:

[0022] Acquire and merge historical alarm information generated by network security devices within a preset historical time period;

[0023] The historical alarm information is analyzed and processed, and the corresponding prior knowledge of historical alarms is obtained by matching it with the alarm database.

[0024] Based on the network security attack characteristics contained in historical alert information and combined with prior knowledge of historical alerts, multi-dimensional network security variables are obtained.

[0025] Encode all security change values ​​of the network security variables under the corresponding dimension, and obtain the first feature under different dimensions based on the encoding results;

[0026] Based on the feature importance of each primary feature, relevant features for alarm false alarm detection are selected from the alarm-feature database.

[0027] Preferably, based on the feature importance of each first feature, alarm false alarm detection-related features are selected from the alarm-feature database, including:

[0028] Calculate the feature importance of each first feature:

[0029]

[0030] Among them, Z i The value of d represents the feature importance of the i-th first feature, and its range is (0,1); i θ represents the frequency of occurrence of the safety change value corresponding to the i-th first feature within the normal safety change range; i w1 represents the current contribution factor of the i-th first feature, and its value range is (0, θ1); w1 represents the weight coefficient of the network security variable corresponding to the i-th first feature; θ1 represents the standard contribution factor.

[0031] Remove the first feature whose importance exceeds the maximum preset threshold and the first feature whose importance is less than the minimum preset threshold;

[0032] When the remaining result is 0, determine the first number of first features whose feature importance exceeds the maximum preset threshold and the second number of first features whose feature importance is less than the minimum preset threshold;

[0033] Choose the larger quantity from the first and second quantities;

[0034] When the larger quantity is the first quantity, the first feature with the lowest feature importance corresponding to the first quantity is obtained as the remaining feature;

[0035] Otherwise, the first feature with the highest importance corresponding to the second quantity is taken as the remaining feature;

[0036] Select alarm false alarm detection-related features from the alarm-feature database that match the remaining features, and output them.

[0037] When the remaining result is not 0, select the alarm false alarm detection related feature that matches the first feature after removal from the alarm-feature database and output it.

[0038] Preferably, the alarm detection model is trained and features are fused based on detection-related features to classify and identify false alarms in the classification logs, and the false alarm threshold for each type of false alarm is finely adjusted to control the false alarm rate of network security devices, including:

[0039] Historical alarm data from historical alarm information is used as training samples to establish an alarm detection model;

[0040] The detection-related features are input into the alarm detection model for model training, and the detection-related features are fused with the alarm features in the trained alarm detection model to obtain a new detection model and the alarm false alarm category of each fused feature.

[0041] The classification logs are input as experimental samples into the new detection model to obtain the detection value set X = {x} j ,j=1,2,3,…,n};

[0042]

[0043] Where, x j Let x represent the detection value of the new detection model for the j-th experimental sample; n represents the number of experimental samples; x ′ (j-1) Let x represent the detection value of the new detection model for the (j-1)th experimental sample; (j-1) Let y(x) represent the true value of the (j-1)th experimental sample; ′ (j-1) ,x (j-1) ) represents the loss function of the (j-1)th experimental sample; δ represents the detection contribution of the experimental sample to the new detection model; μ1 represents the loss weight coefficient of the experimental sample; μ2 represents the contribution weight coefficient of the experimental sample to the new detection model.

[0044] A normal alarm label is assigned to the experimental samples in the detection value set X whose detection value is less than a preset minimum detection threshold.

[0045] Otherwise, label the corresponding experimental sample with an pending alarm tag and output it as the first sample;

[0046] All fused features are matched and identified with the features of the first sample to obtain the alarm false alarm category corresponding to each first sample;

[0047] The first sample is classified according to the category of false alarm to obtain classified samples. By adjusting the false alarm thresholds of samples of the same type, fine-tuning is achieved, and the adjusted false alarm thresholds are obtained.

[0048] Preferably, all fused features are matched and identified with the features of the first sample to obtain the false alarm category corresponding to each first sample, including:

[0049] The first target feature of each first sample is extracted and similarity analysis is performed with all fused features to obtain the first similarity result;

[0050] Based on the first similarity result, the source of false alarms is selected from the sample corresponding to the first target feature with the highest feature similarity.

[0051] Based on the source of the false alarm, the false alarm category corresponding to the first sample is determined.

[0052] Preferably, fine-tuning is achieved by adjusting the false alarm thresholds for similar samples using threshold normalization, resulting in an adjusted false alarm threshold, including:

[0053] Extract the original false alarm threshold from the false alarm database for each first sample involved in the same type of sample;

[0054] The original false alarm threshold is finely adjusted using an adjustment formula to obtain the adjusted false alarm threshold, as shown in the following formula:

[0055]

[0056] Where L1 represents the corresponding adjusted false alarm threshold; L0 represents the corresponding original false alarm threshold; ρ represents the ratio of the classified samples corresponding to the false alarm category to the total number of the first sample before classification, with a value range of (0,1); α represents the misjudgment factor for the alarm when ρ<0.5; β represents the misjudgment factor for the alarm when ρ≥0.5; and n8 represents the number of classified samples contained in the corresponding sample category.

[0057] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0058] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0059] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0060] Figure 1 This is a flowchart of an intelligent control method for network security devices according to an embodiment of the present invention. Detailed Implementation

[0061] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0062] This invention provides an intelligent control method for network security devices, such as... Figure 1 As shown, it includes:

[0063] Step 1: Obtain raw log data from network security devices;

[0064] Step 2: Perform data fusion and preprocessing operations on the raw log data to obtain categorized logs;

[0065] Step 3: Match historical alarm prior knowledge related to network security devices from the alarm database, and extract and select alarm false alarm detection related features from the historical alarm prior knowledge;

[0066] Step 4: Based on the detection-related features, train the alarm detection model and fuse features to classify and identify false alarms in the classification logs, and finely adjust the false alarm threshold for each type of false alarm to control the false alarm rate of network security devices.

[0067] In this embodiment, raw log data refers to text data generated by events during the operation of network security devices. It is generally automatically captured by the detection tools set by the system. Raw log data is generally related to various alarm programs, alarm types, alarm times, etc.

[0068] In this embodiment, data fusion aims to improve the accuracy and comprehensiveness of the information carried by the data and reduce the uncertainty of the information. It mainly aims to merge the data in the log. For example, if there are data 01, 02, and 03, combining data 01 and 02 together is considered fusion. The preprocessing operations include data normalization, data deduplication, and missing value handling. The classification log is obtained by classifying the alarm log data in the preprocessed log data according to time sequence.

[0069] In this embodiment, the alarm database includes user groups, alarm policies, action policies, and custom resource data; the prior knowledge of historical alarms mainly includes alarm false alarm related characteristics, such as the type of attack that was misjudged, the source of the alarm, and the protocol communication.

[0070] Alarm false alarm detection features refer to the key characteristics of false alarms used to train alarm detection models. For example, key features include time variables, data value variables, category variables, and text variables.

[0071] In this embodiment, feature fusion is used to eliminate redundant information generated by the correlation between different features, thereby ensuring the effectiveness of subsequent decisions; the false alarm threshold refers to the critical value for determining whether an alarm is a false alarm, and is used to determine whether an alarm is a false alarm.

[0072] In this embodiment, false alarms are classified based on alarm source, attack destination address, attack type, protocol communication, request content type, and response content type.

[0073] In this embodiment, the false alarm threshold for each type of alarm is preset, and after fine-tuning, the original false alarm threshold can be changed from a1 to b2, meaning that b2 is more accurate than b1 for subsequent comparisons.

[0074] The beneficial effects of the above technical solution are as follows: firstly, categorized logs are obtained by preprocessing the raw log data; secondly, relevant alarm features are extracted and selected based on prior knowledge of alarms related to network security devices; alarm detection models are trained using these relevant features to identify false alarms in the categorized logs; and finally, the false alarm threshold is finely adjusted to effectively control the false alarm rate of network security devices.

[0075] This invention provides an intelligent control method for network security devices, which performs data fusion and preprocessing operations on the log data to obtain categorized logs, including:

[0076] Step 11: Use a computer to filter and synthesize the obtained raw log data to export valid log data;

[0077] Step 12: Process the exported valid log data according to a standardized format to obtain a unified data format;

[0078] Step 13: Delete two or more data entries with identical feature values ​​in the valid log data and keep only one of them;

[0079] Step 14: Delete or complete missing data in the valid log data;

[0080] Step 15: Use a computer to extract alarm log data from the processed log data and classify it according to time sequence to obtain classified logs.

[0081] In this embodiment, valid log data is obtained by filtering out invalid information and synthesizing and fusing similar information from the original log data.

[0082] In this embodiment, the data standardization format is processed to make the data easier to calculate, avoid numerical problems, and facilitate comprehensive analysis and calculation.

[0083] In this embodiment, the method for handling missing data is mainly to directly delete or supplement it.

[0084] In this embodiment, alarm log data refers to text data generated by alarm events during the operation of network security devices; classification logs are obtained by classifying alarm log data in the preprocessed log data according to time sequence, where time sequence classification means classifying according to the order of a specific time period.

[0085] The beneficial effects of the above technical solution are: data is processed through data fusion, data standardization format processing, data deduplication, and missing data processing; and classified logs are obtained by using computers to classify the processed data according to time sequence, providing data support for subsequent alarm false alarm detection.

[0086] This invention provides an intelligent control method for network security devices, which deletes or completes missing data in valid log data, including:

[0087] Extract target cases containing missing values ​​from valid log data and analyze them. If the number of valid values ​​in a target case is less than a preset threshold, then delete the target case.

[0088] If the number of valid values ​​in the target case is greater than or equal to the preset threshold, then all data in the target case are discretized.

[0089] Based on discretized data, a subset of data with high correlation to the attributes of missing data is selected from the valid log data, and a sparse tensor is constructed based on the data subset;

[0090] Using tensor completion methods based on tensor decomposition, dense tensors are constructed and combined with original log data to complete the missing data corresponding to the target case.

[0091] In this embodiment, the target case actually refers to a unit containing missing values, where missing values ​​refer to the incomplete values ​​of one or more attributes in the existing dataset; valid values ​​refer to the values ​​of one or more complete attributes that can achieve the expected purpose.

[0092] In this embodiment, the preset threshold is pre-set based on the current valid log data.

[0093] In this embodiment, for example, there are target cases 1, 2 and 3, with the number of valid values ​​corresponding to a1, a2 and a3 respectively; since a1 and a2 are less than the preset threshold and a3 is greater than the preset threshold, target cases 1 and 2 are directly deleted; all data values ​​contained in target case 3 are discretized.

[0094] In this embodiment, data discretization refers to reducing the size of the data without changing its relative size, thereby reducing the time and space overhead of subsequent algorithms, improving noise resistance, and having a significant impact on the efficiency of data recovery.

[0095] In this embodiment, a data subset refers to a set of values ​​representing data objects; a sparse tensor is a matrix in which most elements have a value of 0.

[0096] In this embodiment, a tensor is actually a multidimensional array, the purpose of which is to push vectors and matrices to higher dimensions; tensor decomposition is a higher-order generalization of matrix decomposition, which can reduce the loss rate of data structure information to a certain extent; dense tensor refers to a matrix with very few elements having a value of 0, which is mainly constructed using tensor completion methods, where tensor completion methods refer to using existing data details in the tensor to fill in missing data details.

[0097] The beneficial effects of the above technical solution are as follows: discretized data is obtained by discretizing data attributes; a subset of data attributes with high correlation to missing data attributes is obtained based on the discretized data; a sparse tensor is constructed using the data subset; a dense tensor is constructed using the tensor completion method; and finally, combined with the original log data, the missing data corresponding to the target case is effectively completed.

[0098] This invention provides an intelligent control method for network security devices, which matches prior knowledge of historical alarms related to network security devices from an alarm database, and extracts and selects false alarm detection-related features from the prior knowledge of historical alarms, including:

[0099] Acquire and merge historical alarm information generated by network security devices within a preset historical time period;

[0100] The historical alarm information is analyzed and processed, and the corresponding prior knowledge of historical alarms is obtained by matching it with the alarm database.

[0101] Based on the network security attack characteristics contained in historical alert information and combined with prior knowledge of historical alerts, multi-dimensional network security variables are obtained.

[0102] Encode all security change values ​​of the network security variables under the corresponding dimension, and obtain the first feature under different dimensions based on the encoding results;

[0103] For example, if the security change values ​​are 2 1 2 3 4 1 0, then these security change values ​​need to be encoded into symbols that can represent the change values, so as to obtain the features corresponding to the change values ​​in this dimension, such as the features that the device is vulnerable to attack in this dimension.

[0104] Based on the feature importance of each primary feature, relevant features for alarm false alarm detection are selected from the alarm-feature database.

[0105] In this embodiment, the multi-dimensional network security variables include time variables, numerical variables, and text variables; the network security attack characteristics include attack location, attack frequency, and attack time.

[0106] In this embodiment, the security change value refers to the data attribute value corresponding to the network security variable; the encoding method mainly refers to Label encoding, One-Hot encoding and Frequency encoding; the first feature refers to the characteristics of obtaining historical alarm prior knowledge under different dimensions after encoding.

[0107] In this embodiment, feature importance is used for the selection of alarm false alarm detection features and is an indicator to measure the contribution of each first feature to the detection of alarm false alarms; the alarm-feature database mainly includes alarm data and alarm data features, wherein alarm data features include data volume features, data static and dynamic features, data type features, and data timeliness.

[0108] The beneficial effects of the above technical solution are as follows: by merging and processing historical alarm information, corresponding historical alarm prior knowledge is obtained from the alarm database; based on the historical alarm prior knowledge, multi-dimensional network security variables are obtained; by encoding all security change values ​​of the obtained multi-dimensional network security variables, first features under different dimensions are obtained; based on the feature importance of the first features, alarm false alarm detection-related features are screened out, laying the foundation for subsequent training of alarm detection models.

[0109] This invention provides an intelligent control method for network security devices, which selects alarm false alarm detection-related features from an alarm-feature database based on the feature importance of each first feature, including:

[0110] Calculate the feature importance of each first feature:

[0111]

[0112] Among them, Z i The value of d represents the feature importance of the i-th first feature, and its range is (0,1); i θ represents the frequency of occurrence of the safety change value corresponding to the i-th first feature within the normal safety change range; i w1 represents the current contribution factor of the i-th first feature, and its value range is (0, θ1); w1 represents the weight coefficient of the network security variable corresponding to the i-th first feature; θ1 represents the standard contribution factor.

[0113] Remove the first feature whose importance exceeds the maximum preset threshold and the first feature whose importance is less than the minimum preset threshold;

[0114] When the remaining result is 0, determine the first number of first features whose feature importance exceeds the maximum preset threshold and the second number of first features whose feature importance is less than the minimum preset threshold;

[0115] Choose the larger quantity from the first and second quantities;

[0116] When the larger quantity is the first quantity, the first feature with the lowest feature importance corresponding to the first quantity is obtained as the remaining feature;

[0117] Otherwise, the first feature with the highest importance corresponding to the second quantity is taken as the remaining feature;

[0118] Select alarm false alarm detection-related features from the alarm-feature database that match the remaining features, and output them;

[0119] When the remaining result is not 0, select the alarm false alarm detection related feature that matches the first feature after removal from the alarm-feature database and output it.

[0120] In this embodiment, the maximum preset threshold and the minimum preset threshold are set in advance, generally referring to 0.8; the minimum preset threshold generally refers to 0.3.

[0121] In this embodiment, for example, there are first features 1, 2, and 3, with corresponding feature importance values ​​of 0.81, 0.25, and 0.5, respectively. In this case, first features 1 and 2 are directly removed, and alarm false alarm detection related features that match the removed first features 1 and 2 are selected from the alarm-feature database and output.

[0122] In this embodiment, for example, there are first features b1, b2, b3, b4 and b5, with corresponding feature importance values ​​of 0.82, 0.85, 0.91, 0.21 and 0.23 respectively. In this case, the first features b1, b2, b3, b4 and b5 should be removed to determine the remaining result as 0; and the first quantity is 3 and the second quantity is 2.

[0123] At this point, the first quantity is locked, and the first feature b1 with the lowest feature importance corresponding to the first quantity is obtained as the remaining feature. Then, alarm false alarm detection related features that match the remaining feature, i.e. the first feature b1, are selected from the alarm-feature database and output.

[0124] The beneficial effects of the above technical solution are: the feature importance of each first feature is calculated by using the formula; and by combining the maximum preset threshold and the minimum preset threshold, alarm false alarm detection-related features are effectively screened from the first features, laying the foundation for subsequent training of the alarm detection model.

[0125] This invention provides an intelligent control method for network security devices. Based on detection-related features, an alarm detection model is trained and features are fused to classify and identify false alarms in the classification logs. The false alarm threshold for each type of false alarm is then finely adjusted to control the false alarm rate of the network security device. The method includes:

[0126] Historical alarm data from historical alarm information is used as training samples to establish an alarm detection model;

[0127] The detection-related features are input into the alarm detection model for model training, and the detection-related features are fused with the alarm features in the trained alarm detection model to obtain a new detection model and the alarm false alarm category of each fused feature.

[0128] The classification logs are input as experimental samples into the new detection model to obtain the detection value set X = {x} j ,j=1,2,3,…,n};

[0129]

[0130] Where, x j Let x represent the detection value of the new detection model for the j-th experimental sample; n represents the number of experimental samples; x ′ (j-1) Let x represent the detection value of the new detection model for the (j-1)th experimental sample; (j-1) Let y(x) represent the true value of the (j-1)th experimental sample; ′ (j-1) ,x (j-1) ) represents the loss function of the (j-1)th experimental sample; δ represents the detection contribution of the experimental sample to the new detection model; μ1 represents the loss weight coefficient of the experimental sample; μ2 represents the contribution weight coefficient of the experimental sample to the new detection model.

[0131] A normal alarm label is assigned to the experimental samples in the detection value set X whose detection value is less than a preset minimum detection threshold.

[0132] Otherwise, label the corresponding experimental sample with an pending alarm tag and output it as the first sample;

[0133] All fused features are matched and identified with the features of the first sample to obtain the alarm false alarm category corresponding to each first sample;

[0134] The first sample is classified according to the category of false alarm to obtain classified samples. By adjusting the false alarm thresholds of samples of the same type, fine-tuning is achieved, and the adjusted false alarm thresholds are obtained.

[0135] In this embodiment, the historical alarm data includes: historical alarm data source, historical alarm start time, transmission protocol and application protocol of the corresponding historical alarm data, historical attack destination address, attack type, protocol communication, request content type, response content type, historical alarm false alarm label, and historical alarm false alarm data.

[0136] In this embodiment, the alarm detection model is used to detect whether an alarm is a false alarm. The new detection model is obtained by training the alarm detection model using detection-related features and combining them with fusion features. The fusion features are obtained by fusing the detection-related features with the alarm features in the trained alarm detection model using convolution operations. For example, feature 001 in the detection-related features is fused with alarm feature 002 to obtain fusion feature 012.

[0137] In this embodiment, the preset minimum detection threshold is pre-set, typically 0.35.

[0138] In this embodiment, for example, there are experimental samples 1 and 2, with corresponding detection values ​​x1 and x2 of 0.3 and 0.4 respectively. In this case, experimental sample 1 is marked with a normal alarm label, and experimental sample 2 is marked with a pending alarm label.

[0139] In this embodiment, an undetermined alarm refers to an alarm that has the potential to be a false alarm; the first sample refers to an experimental sample whose detection value is greater than a preset minimum detection threshold; the alarm false alarm category is obtained based on the feature recognition of the fused features and the first sample; the classified sample is obtained by classifying the first sample according to the alarm false alarm category.

[0140] In this embodiment, the false alarm threshold is a pre-determined detection threshold used to determine whether an alarm is a false alarm; adjusting the false alarm threshold is a finely adjusted false alarm threshold.

[0141] In this embodiment, This is represented as a fine-tuning function.

[0142] The beneficial effects of the above technical solution are as follows: An alarm detection model is established by using historical alarm data as training samples; the alarm detection model is trained by inputting detection-related features and a new detection model and alarm false alarm categories are obtained using feature fusion technology; several detection values ​​are obtained by inputting classified logs as experimental samples into the new detection model, and alarm type is determined by combining them with a preset minimum threshold, resulting in experimental samples labeled as pending alarms, which are then used as the first samples; the fused features obtained by feature fusion are matched and identified with the features of the first samples to obtain the alarm false alarm category corresponding to the first samples, and then the corresponding false alarm threshold is finely adjusted to control the alarm false alarm rate of network security devices.

[0143] This invention provides an intelligent control method for network security devices, which matches and identifies all fused features with the features of a first sample to obtain the alarm false alarm category corresponding to each first sample, including:

[0144] The first target feature of each first sample is extracted and similarity analysis is performed with all fused features to obtain the first similarity result;

[0145] Based on the first similarity result, the source of false alarms is selected from the sample corresponding to the first target feature with the highest feature similarity.

[0146] Based on the source of the false alarm, the false alarm category corresponding to the first sample is determined.

[0147] In this embodiment, the first target feature refers to a representative characteristic used to describe the first sample.

[0148] In this embodiment, the sources of false alarms include the address of the attack target that was misjudged, the attack type, the alarm source, the protocol communication, the request content type, and the response content type.

[0149] The beneficial effects of the above technical solution are as follows: by performing similarity analysis between the fused features and the features of the first sample, a first similarity result is obtained; based on the first similarity result, the first target feature with the highest similarity to the fused features is taken as the source of false alarms; using the source of false alarms to determine the false alarm category is conducive to accurately and quickly obtaining the corresponding false alarm threshold, and is conducive to controlling the false alarm rate of network security devices.

[0150] This invention provides an intelligent control method for network security devices. By performing threshold normalization adjustment on false alarm thresholds related to similar samples, a refined adjustment is achieved, resulting in an adjusted false alarm threshold. The method includes:

[0151] Extract the original false alarm threshold from the false alarm database for each first sample involved in the same type of sample;

[0152] The original false alarm threshold is finely adjusted using an adjustment formula to obtain the adjusted false alarm threshold, as shown in the following formula:

[0153]

[0154] Where L1 represents the corresponding adjusted false alarm threshold; L0 represents the corresponding original false alarm threshold; ρ represents the ratio of the classified samples corresponding to the false alarm category to the total number of the first sample before classification, with a value range of (0,1); α represents the misjudgment factor for the alarm when ρ<0.5; β represents the misjudgment factor for the alarm when ρ≥0.5; and n8 represents the number of classified samples contained in the corresponding sample category.

[0155] In this embodiment, the alarm false alarm database mainly includes alarm false alarm source, alarm start time, transmission protocol, application protocol and original false alarm threshold, wherein the original false alarm threshold refers to the critical value used to determine whether an alarm is a false alarm.

[0156] The beneficial effects of the above technical solution are: obtaining the corresponding original false alarm threshold based on the type of false alarm; and providing numerical support for controlling the false alarm rate of network security devices by finely adjusting the original false alarm threshold.

[0157] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A smart control method for network security devices, characterized in that, include: Step 1: Obtain raw log data from network security devices; Step 2: Perform data fusion and preprocessing operations on the raw log data to obtain categorized logs; the categorized logs are obtained by classifying the alarm log data in the preprocessed log data according to time sequence; Step 3: Match historical alarm prior knowledge related to network security devices from the alarm database, and extract and select alarm false alarm detection related features from the historical alarm prior knowledge; Step 4: Based on the detection-related features, train the alarm detection model and fuse features to classify and identify false alarms in the classification logs, and finely adjust the false alarm threshold for each type of false alarm to control the false alarm rate of network security devices. Match historical alarm prior knowledge related to network security devices from the alarm database, and extract and select alarm false alarm detection-related features from the historical alarm prior knowledge, including: Acquire and merge historical alarm information generated by network security devices within a preset historical time period; The historical alarm information is analyzed and processed, and the corresponding prior knowledge of historical alarms is obtained by matching it with the alarm database. Based on the network security attack characteristics contained in historical alert information and combined with prior knowledge of historical alerts, multi-dimensional network security variables are obtained. Encode all security change values ​​of the network security variables under the corresponding dimension, and obtain the first feature under different dimensions based on the encoding results; Based on the feature importance of each first feature, select alarm false alarm detection-related features from the alarm-feature database; Based on the feature importance of each primary feature, relevant features for false alarm detection are selected from the alarm-feature database, including: Calculate the feature importance of each first feature: in, Let the feature importance of the i-th first feature be denoted as , and its value range be . ; This represents the frequency of occurrence of the safety change value corresponding to the i-th first feature, which falls within the normal safety change range. Let be the current contribution factor of the i-th first feature, and its value range is . ; This represents the weight coefficient of the cybersecurity variable corresponding to the i-th first feature. 1 represents the standard contribution factor; Remove the first feature whose importance exceeds the maximum preset threshold and the first feature whose importance is less than the minimum preset threshold; When the remaining result is 0, determine the first number of first features whose feature importance exceeds the maximum preset threshold and the second number of first features whose feature importance is less than the minimum preset threshold; Choose the larger quantity from the first and second quantities; When the larger quantity is the first quantity, the first feature with the lowest feature importance corresponding to the first quantity is obtained as the remaining feature; Otherwise, the first feature with the highest importance corresponding to the second quantity is taken as the remaining feature; Select alarm false alarm detection-related features from the alarm-feature database that match the remaining features, and output them. When the remaining result is not 0, select the alarm false alarm detection related feature that matches the first feature after removal from the alarm-feature database and output it.

2. The intelligent control method for network security devices as described in claim 1, characterized in that, The log data is fused and preprocessed to obtain categorized logs, including: Step 11: Use a computer to filter and synthesize the obtained raw log data to export valid log data; Step 12: Process the exported valid log data according to a standardized format to obtain a unified data format; Step 13: Delete two or more data entries with identical feature values ​​in the valid log data and keep only one of them; Step 14: Delete or complete missing data in the valid log data; Step 15: Use a computer to extract alarm log data from the processed log data and classify it according to time sequence to obtain classified logs.

3. The intelligent control method for network security devices as described in claim 2, characterized in that, Missing data in valid log data is deleted or filled in, including: Extract target cases containing missing values ​​from valid log data and analyze them. If the number of valid values ​​in a target case is less than a preset threshold, then delete the target case. If the number of valid values ​​in the target case is greater than or equal to the preset threshold, then all data in the target case are discretized. Based on discretized data, a subset of data with high correlation to the attributes of missing data is selected from the valid log data, and a sparse tensor is constructed based on the data subset; Using tensor completion methods based on tensor decomposition, dense tensors are constructed and combined with original log data to complete the missing data corresponding to the target case.

4. The intelligent control method for network security devices as described in claim 1, characterized in that, Based on the training and feature fusion of detection-related features, the alarm detection model is used to classify and identify false alarms in the classification logs. The false alarm threshold for each type of false alarm is then finely adjusted to control the false alarm rate of network security devices. This includes: Historical alarm data from historical alarm information is used as training samples to establish an alarm detection model; The detection-related features are input into the alarm detection model for model training, and the detection-related features are fused with the alarm features in the trained alarm detection model to obtain a new detection model and the alarm false alarm category of each fused feature. The classification logs were used as experimental samples and input into the new detection model to obtain a set of detection values. ; in, This represents the detection value of the new detection model for the j-th experimental sample; n represents the number of experimental samples. This represents the detection value of the new detection model for the (j-1)th experimental sample; This is represented as the true value of the (j-1)th experimental sample; Let this be the loss function for the (j-1)th experimental sample; This represents the degree of detection contribution of the experimental samples as they are input into the new detection model. This represents the loss weighting coefficient for the experimental samples; This represents the contribution weight coefficient of the experimental samples as they are input into the new detection model. A normal alarm label is assigned to the experimental samples in the detection value set X whose detection value is less than a preset minimum detection threshold. Otherwise, label the corresponding experimental sample with an pending alarm tag and output it as the first sample; All fused features are matched and identified with the features of the first sample to obtain the alarm false alarm category corresponding to each first sample; The first sample is classified according to the category of false alarm to obtain classified samples. By adjusting the false alarm thresholds of samples of the same type, fine-tuning is achieved, and the adjusted false alarm thresholds are obtained.

5. A smart control method for a network security device as described in claim 4, characterized in that, All fused features are matched and identified with the features of the first sample to obtain the false alarm category corresponding to each first sample, including: The first target feature of each first sample is extracted and similarity analysis is performed with all fused features to obtain the first similarity result; Based on the first similarity result, the source of false alarms is selected from the sample corresponding to the first target feature with the highest feature similarity. Based on the source of the false alarm, the false alarm category corresponding to the first sample is determined.

6. A smart control method for a network security device as described in claim 4, characterized in that, Fine-tuning is achieved by normalizing the false alarm thresholds for similar samples, resulting in the adjusted false alarm thresholds, including: Extract the original false alarm threshold from the false alarm database for each first sample involved in the same type of sample; The original false alarm threshold is finely adjusted using an adjustment formula to obtain the adjusted false alarm threshold, as shown in the following formula: Where L1 represents the corresponding adjusted false alarm threshold; L0 represents the corresponding original false alarm threshold; This represents the ratio of the number of samples corresponding to the false alarm category to the total number of samples before classification, with a value range of [missing value]. ; Represented as False alarm factors in various situations; Represented as False alarm factors in various situations; This indicates the number of categorical samples contained in the corresponding sample class.

Images