A method and system for mining the relevance of alarm data

Abstract

The present invention provides a method and system for mining the relevance of alarm data. The method includes: obtaining historical alarm data of network devices and obtaining the corresponding alarm types and text summaries, and obtaining the text summaries of the to-be-processed alarm data for a preset time period; comparing the text summaries of the to-be-processed alarm data with the historical alarm data to obtain quasi-target historical alarm data; performing grid division and frequency comparison on the quasi-target historical alarm data and the to-be-processed alarm data to obtain the to-be-analyzed alarm data and the target historical alarm data; determining the alarm type of the to-be-analyzed alarm data according to the alarm type of the target historical alarm data, and sending the alarm type to the corresponding network device for correlation mining operations. The present invention performs data relevance mining on current alarm data through a secondary comparison method based on historical alarm data, which can improve the mining accuracy and mining accuracy of alarm data relevance.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial information security, and particularly to a method and system for mining the correlation of alarm data. Background Art

[0002] With the gradual increase of network devices and security devices in industrial control enterprises, it has become increasingly difficult for operation and maintenance personnel to cope with the complex usage environment and the increasingly severe challenges of industrial information security. This further easily leads to untimely adjustment of security policies, thus making the system face relatively high security risks.

[0003] During the process of industrial information transmission, it is necessary to prevent illegal personnel from stealing information by using system and hardware vulnerabilities and conducting activities harmful to the enterprise. However, with the increase in log alarm data, the system will collect more and more alarm data. However, further analysis of similar and correlated alarm data is an important prerequisite for accurately analyzing security incident events. But currently, there is no better processing method to accurately mine the correlation of alarm data. Summary of the Invention

[0004] Therefore, the technical problem to be solved by the present invention is to overcome the defect of mining the correlation of alarm data in the prior art, so as to provide a method and system for mining the correlation of alarm data, which can mine the data correlation of a large number of current alarm data based on historical alarm data, and mine the correlation of the alarm data to be processed through a secondary comparison method, and can improve the mining accuracy and mining accuracy of the correlation of alarm data.

[0005] The technical solution of the present invention to solve the above technical problems is as follows:

[0006] In a first aspect, the present invention provides a method for mining the correlation of alarm data, including the following steps:

[0007] Obtain a preset number of historical alarm data of network devices, and obtain the alarm type and text summary of each historical alarm data through preprocessing. Obtain the alarm data to be processed in a preset time period, and obtain the text summary of the alarm data to be processed by means of keyword extraction;

[0008] Compare the text summary of the alarm data to be processed with the text summary of the historical alarm data, and use the historical alarm data that meets the first preset condition as the quasi-target historical alarm data;

[0009] Perform grid division and frequency comparison on the quasi-target historical alarm data and the to-be-processed alarm data based on the time distribution characteristics, and use the to-be-processed alarm data that meets the second preset condition as the to-be-analyzed alarm data, and use the quasi-target historical alarm data corresponding to the to-be-analyzed alarm data as the target historical alarm data;

[0010] Determine the alarm type of the to-be-analyzed alarm data according to the alarm type of the target historical alarm data, and send the alarm type to the corresponding network device for the associated mining operation of the current to-be-analyzed alarm data.

[0011] The method for mining the relevance of alarm data provided by the embodiments of the present invention first obtains the alarm data and text summary of historical alarm data, and obtains the text summary of the current to-be-processed alarm data by means of keyword extraction, and compares the text summaries of the two. Secondly, based on the time distribution characteristics, grid division and frequency comparison are performed on the historical alarm data and the to-be-processed alarm data after successful similarity comparison. Finally, the alarm type of the to-be-processed alarm data is determined according to the alarm type of the historical alarm data after successful frequency comparison, and is sent to the corresponding network device for the associated mining operation. The present invention mines the data relevance of a large number of current alarm data based on historical alarm data, and mines the relevance of the to-be-processed alarm data through a secondary comparison method, which can improve the mining accuracy and mining accuracy of the alarm data relevance, quickly discover major vulnerabilities and risks in industrial control security, and provide comprehensive early warning notification information for subsequent emergency response.

[0012] Optionally, the network device includes at least one of an industrial control computer with a built-in gateway, a switch, and a routing device; the text summary includes the alarm data size, the packet content of the alarm data, the packet source address, the packet target address, and the alarm code.

[0013] The present invention collects the historical alarm data generated by all network devices as samples for comparison, which can maximize the enrichment of the sample types and provide a more comprehensive comparison sample for the subsequent association of the current to-be-processed alarm data. In addition, after processing the historical alarm data, the present invention obtains its alarm data text summary, including the alarm data size, the packet content of the alarm data, the packet source address, the packet target address, and the alarm code, which comprehensively covers various characteristic data of the alarm data and can make the mining of the relevance of the current to-be-processed alarm data more comprehensive and accurate.

[0014] Optionally, the first preset condition includes that the similarity between the text summary of the to-be-processed alarm data and the text summary of the historical alarm data is greater than a preset similarity threshold.

[0015] The present invention first implements data correlation analysis processing on the log content of a large amount of current alarm data based on a historical alarm data set. The main processing object is the text summary of the alarm data. Since the text summary of the alarm data has a high reference value for data correlation, it can ensure the reliability of correlation mining. The present invention screens historical alarm data with a large similarity to the text summary of the alarm data to be processed by presetting a similarity threshold, which can not only mine data with a relatively high correlation to a certain extent but also reduce the data volume for the next frequency comparison in terms of time distribution characteristics.

[0016] Optionally, the process of grid division and frequency comparison includes: performing time grid division on the quasi-target historical alarm data at a preset time interval to generate a first sub-time grid; performing time grid division on the alarm data to be processed at the preset time interval to generate a second sub-time grid; obtaining the occurrence frequencies of the alarm data within the first sub-time grid and the occurrence frequencies of the alarm data within the second sub-time grid and comparing them.

[0017] The present invention designs a secondary comparison method. Based on the text summary similarity comparison, grid division is performed according to the time distribution characteristics of the historical alarm data and the alarm data to be processed, and the time interval of each time grid is the same. By comparing the occurrence frequencies of the alarm data within the sub-time grids divided for both, the correlation in the time dimension between the two is mined, which can improve the mining accuracy and mining accuracy of the associated alarm data.

[0018] Optionally, the second preset condition includes: simultaneously satisfying the first sub-condition, the second sub-condition, and the third sub-condition; the first sub-condition represents that the difference between the occurrence frequency of the alarm data within the first sub-time grid and the occurrence frequency of the alarm data within the second sub-time grid is less than a second preset threshold; the second sub-condition represents that the similarity between the time distribution characteristics of the adjacent alarm data occurrence intervals within the first sub-time grid and the time distribution characteristics of the adjacent alarm data occurrence intervals within the second sub-time grid is greater than a third preset threshold; the third sub-condition represents that the first sub-time grid is continuous in time sequence.

[0019] The present invention sets three sub-conditions, and only when the frequency comparison process simultaneously satisfies the three sub-conditions is it determined that the comparison is successful. More reference-worthy historical alarm data can be accurately screened out, which means that there is a time-dimensional correlation between the alarm data to be processed and the screened historical alarm data, and the accuracy of correlation mining can be improved.

[0020] Optionally, the process of determining the alarm type of the to-be-initial-analyzed alarm data according to the alarm type of the target historical alarm data includes: obtaining the alarm types of each piece of the target historical alarm data; when the alarm types of each piece of the target historical alarm data are the same, then the alarm type is the alarm type of the initial-analyzed alarm data; when the alarm types of at least one piece of the target historical alarm data are different, then filter out the first sub-time grids with different alarm types for grid division or discard them.

[0021] After the present invention performs text abstract similarity comparison and alarm data occurrence frequency comparison, it will also determine the alarm type of the currently compared successful historical alarm data. If the alarm types of multiple historical alarm data are the same, then it is determined that this alarm type is the alarm type of the to-be-processed alarm data. If there are differences, further processing is performed, further improving the accuracy and precision of relevance mining.

[0022] Optionally, the process of filtering out the first sub-time grids with different alarm types for grid division or discard them includes: calculating the proportion of the first sub-time grids with different alarm types filtered out in all the first sub-time grids; when the proportion is greater than a preset proportion threshold, adjust the preset time interval and perform grid division and frequency comparison on the first sub-time grids with different alarm types; when the proportion is less than the preset proportion threshold, discard the first sub-time grids with different alarm types.

[0023] By judging the proportion of the sub-time grids with different alarm types filtered out in all the sub-time grids, and selecting more refined grid division and frequency comparison or directly discarding according to the proportion size, the present invention can improve the accuracy and precision of relevance mining.

[0024] In a second aspect, an embodiment of the present invention provides a mining system for alarm data relevance, and the system includes:

[0025] A data acquisition module, configured to acquire a preset number of historical alarm data of a network device, and obtain the alarm type and text abstract of each piece of historical alarm data through preprocessing, acquire the to-be-processed alarm data of a preset time period, and obtain the text abstract of the to-be-processed alarm data by means of keyword extraction;

[0026] A similarity comparison module, configured to perform similarity comparison based on the text abstract of the to-be-processed alarm data and the text abstract of the historical alarm data, and use the historical alarm data that meets the first preset condition as quasi-target historical alarm data;

[0027] A frequency comparison module, configured to perform grid division and frequency comparison on the quasi-target historical alarm data and the to-be-processed alarm data based on the time distribution characteristic, use the to-be-processed alarm data that meets the second preset condition as the to-be-analyzed alarm data, and use the quasi-target historical alarm data corresponding to the to-be-analyzed alarm data as the target historical alarm data;

[0028] A data association module, configured to determine the alarm type of the to-be-analyzed alarm data according to the alarm type of the target historical alarm data, and send the alarm type to the corresponding network device for an association mining operation on the current to-be-analyzed alarm data.

[0029] The mining system for alarm data relevance provided by the embodiments of the present invention first obtains the alarm data and text summary of historical alarm data, and obtains the text summary of the current to-be-processed alarm data through keyword extraction, and compares the similarity of the two text summaries. Secondly, based on the time distribution characteristic, grid division and frequency comparison are performed on the historical alarm data and the to-be-processed alarm data after successful similarity comparison. Finally, the alarm type of the to-be-processed alarm data is determined according to the alarm type of the historical alarm data after successful frequency comparison, and is sent to the corresponding network device for an association mining operation. The present invention mines the data relevance of a large number of current alarm data based on historical alarm data, and mines the relevance of the to-be-processed alarm data through a secondary comparison method, which can improve the mining accuracy and mining accuracy of alarm data relevance, quickly discover major vulnerabilities and risks in industrial control security, and provide comprehensive early warning notification information for subsequent emergency responses.

[0030] In a third aspect, an embodiment of the present invention provides a computer device, including: a memory and a processor, which are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to execute the method described in the first aspect or any optional implementation manner of the first aspect.

[0031] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores computer instructions for causing the computer to execute the method described in the first aspect or any optional implementation manner of the first aspect. Description of the Drawings

[0032] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0033] Figure 1 A flowchart showing a method for mining the correlation of alarm data provided by an embodiment of the present invention;

[0034] Figure 2 A structural diagram showing a system for mining the correlation of alarm data provided by an embodiment of the present invention;

[0035] Figure 3 A structural diagram showing a computer device provided by an embodiment of the present invention. Detailed implementation manners

[0036] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0037] In addition, the technical features involved in different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0038] An embodiment of the present invention provides a method for mining the correlation of alarm data. As Figure 1 shown, the method specifically includes the following steps:

[0039] Step S1: Obtain a preset number of historical alarm data of a network device, and obtain the alarm type and text summary of each piece of historical alarm data through preprocessing. Obtain the alarm data to be processed in a preset time period, and obtain the text summary of the alarm data to be processed by means of keyword extraction.

[0040] Specifically, in the embodiment of the present invention, first, obtain the historical alarm data of the network device. The network device includes at least one of an industrial computer with a built-in gateway, a switch, and a routing device. The historical alarm data is the log content of the built-in gateway. Preprocess the historical alarm data to obtain the corresponding alarm type and text summary. The text summary includes the size of the alarm data, the packet content of the alarm data, the packet source address, the packet destination address, and the alarm code. Secondly, obtain the alarm data to be processed within a preset time period, and obtain the text summary of the alarm data to be processed by extracting keywords from the log content of the alarm data to be processed.

[0041] Step S2: Compare the similarity between the text summary of the alarm data to be processed and the text summary of the historical alarm data, and use the historical alarm data that meets the first preset condition as the quasi-target historical alarm data.

[0042] Specifically, in the embodiments of the present invention, the similarity between the text abstract of historical alarm data and the text abstract of the alarm data to be processed is calculated for comparison. The historical alarm data with the similarity between the text abstract of the alarm data to be processed and the text abstract of the historical alarm data greater than the preset similarity threshold is used as the quasi-target historical alarm data. All the historical alarm data that passes the similarity comparison is used as the quasi-target historical alarm data.

[0043] Step S3: Based on the time distribution characteristics, grid division and frequency comparison are performed on the quasi-target historical alarm data and the alarm data to be processed. The alarm data to be processed that meets the second preset condition is used as the alarm data to be analyzed, and the quasi-target historical alarm data corresponding to the alarm data to be analyzed is used as the target historical alarm data.

[0044] Specifically, in the embodiments of the present invention, a suitable preset time interval is selected. Generally, it is timed in minutes. For example, 1 minute, 5 minutes, 10 minutes are used as the preset time intervals, but it is not limited thereto. Based on the preset time interval, the time distribution characteristics of the quasi-target historical alarm data are divided into time grids, divided into multiple historical sub-time grids. At the same time, based on the same preset time interval, the time distribution characteristics of the alarm data to be processed in the preset time period are divided into time grids at equal time intervals, divided into multiple sub-time grids. The occurrence frequencies of the alarm data in the sub-time grid of the currently to-be-processed alarm data and the historical sub-time grid are obtained and compared and analyzed. The sub-time grids with the difference in occurrence frequencies between the two less than the standard frequency threshold and the similarity threshold of the time distribution characteristics of the adjacent alarm data occurrence intervals in the time grid greater than the standard time interval distribution state threshold and multiple consecutive sub-time grids in time sequence are screened out. The alarm data to be processed corresponding to the multiple sub-time grids screened out is used as the initial analysis alarm data. The multiple historical sub-time grids corresponding to the multiple sub-time grids are screened out as the target historical sub-time grids, and the historical alarm data corresponding to the target historical sub-time grids is determined as the target historical alarm data.

[0045] Step S4: Determine the alarm type of the alarm data to be analyzed according to the alarm type of the target historical alarm data, and send the alarm type to the corresponding network device for the association mining operation of the currently to-be-analyzed alarm data.

[0046] Specifically, in the embodiments of the present invention, the alarm type of the to-be-processed alarm data is analyzed according to the alarm types of multiple target historical alarm data. If the alarm types of the current multiple target historical alarms are the same, it is determined that the corresponding alarm type is the alarm type of the current to-be-analyzed alarm data. If the alarm types of at least one target historical alarm are different, the sub-time grids with different alarm types are screened out, the proportion of the screened sub-time grids with different alarm types in all sub-time grids is calculated, and when the proportion is greater than the preset proportion threshold, the preset time interval is adjusted and grid division and frequency comparison are performed on the sub-time grids with different alarm types; when the proportion is less than the preset proportion threshold, the sub-time grids with different alarm types are directly discarded. The data corresponding to the sub-time grids after the discard process in the embodiments of the present invention will be more accurate.

[0047] In the embodiments of the present invention, after determining the alarm type of the to-be-analyzed alarm data, it further includes tracing the transmission link of the current to-be-analyzed alarm data: sending a mining search instruction of the alarm data to all network devices on the transmission link; performing an associated mining operation on all network devices on the transmission link for the current initial analyzed alarm data. In the embodiments of the present invention, tracing the transmission link of the current to-be-analyzed alarm data is an important tracing method. While tracing, a mining search instruction of the alarm data is sent to all network devices on the transmission link to facilitate the associated mining operation of the current to-be-analyzed alarm data on all network devices on the transmission link.

[0048] The mining method for alarm data relevance provided by the embodiments of the present invention first obtains the alarm data and text summary of historical alarm data, and obtains the text summary of the current to-be-processed alarm data by keyword extraction, and compares the text summaries of the two. Secondly, based on the time distribution characteristics, grid division and frequency comparison are performed on the historical alarm data and the to-be-processed alarm data after the similarity comparison is successful. Finally, the alarm type of the to-be-processed alarm data is determined according to the alarm type of the historical alarm data after the frequency comparison is successful, and is sent to the corresponding network device for associated mining operation. The present invention mines the data relevance of a large amount of current alarm data based on historical alarm data, and mines the relevance of the to-be-processed alarm data through a secondary comparison method, which can improve the mining accuracy and mining accuracy of alarm data relevance, quickly discover major vulnerabilities and risks in industrial control security, and provide comprehensive early warning information for subsequent emergency responses.

[0049] The embodiments of the present invention provide a mining system for alarm data relevance, as Figure 2 shown, the system includes:

[0050] The data acquisition module 1 is used to acquire a preset number of historical alarm data of network devices, and obtain the alarm types and text summaries of each piece of historical alarm data through preprocessing. It acquires the to-be-processed alarm data within a preset time period, and obtains the text summary of the to-be-processed alarm data through keyword extraction. For detailed content, refer to the relevant description of step S1 in the above method embodiment, which will not be elaborated here.

[0051] The similarity comparison module 2 is used to perform similarity comparison based on the text summaries of the to-be-processed alarm data and the historical alarm data, and use the historical alarm data that meets the first preset condition as the quasi-target historical alarm data. For detailed content, refer to the relevant description of step S2 in the above method embodiment, which will not be elaborated here.

[0052] The frequency comparison module 3 is used to perform grid division and frequency comparison on the quasi-target historical alarm data and the to-be-processed alarm data based on the time distribution characteristics, and use the to-be-processed alarm data that meets the second preset condition as the to-be-analyzed alarm data, and use the quasi-target historical alarm data corresponding to the to-be-analyzed alarm data as the target historical alarm data. For detailed content, refer to the relevant description of step S3 in the above method embodiment, which will not be elaborated here.

[0053] The data association module 4 is used to determine the alarm type of the to-be-analyzed alarm data according to the alarm type of the target historical alarm data, and send the alarm type to the corresponding network device for association mining operation of the current to-be-analyzed alarm data. For detailed content, refer to the relevant description of step S4 in the above method embodiment, which will not be elaborated here.

[0054] The mining system for alarm data relevance provided by the embodiment of the present invention first acquires the alarm data and text summaries of historical alarm data, and obtains the text summary of the current to-be-processed alarm data through keyword extraction, and performs similarity comparison on the two text summaries. Secondly, based on the time distribution characteristics, grid division and frequency comparison are performed on the historical alarm data and the to-be-processed alarm data after successful similarity comparison. Finally, the alarm type of the to-be-processed alarm data is determined according to the alarm type of the historical alarm data after successful frequency comparison, and is sent to the corresponding network device for association mining operation. The present invention mines the data relevance of a large number of current alarm data based on historical alarm data, and mines the relevance of the to-be-processed alarm data through a secondary comparison method, which can improve the mining accuracy and mining accuracy of alarm data relevance, quickly discover major vulnerabilities and risks in industrial control security, and provide comprehensive early warning notification information for subsequent emergency response.

[0055] Figure 3The structural schematic diagram of the computer device in the embodiment of the present invention is shown, including: a processor 901 and a memory 902. Among them, the processor 901 and the memory 902 can be connected through a bus or other means. Figure 3 Taking the connection through the bus as an example.

[0056] The processor 901 can be a central processing unit (CPU). The processor 901 can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. chips, or combinations of the above types of chips.

[0057] As a non-transitory computer-readable storage medium, the memory 902 can be used to store non-transitory server programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the methods in the above method embodiments. The processor 901 executes various functional applications and data processing of the processor by running the non-transitory server programs, instructions, and modules stored in the memory 902, that is, implementing the methods in the above method embodiments.

[0058] The memory 902 can include a program storage area and a data storage area. Among them, the program storage area can store an operating system and application programs required for at least one function; the data storage area can store data created by the processor 901, etc. In addition, the memory 902 can include high-speed random access memory, and can also include non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory 902 may optionally include a memory remotely set relative to the processor 901, and these remote memories can be connected to the processor 901 through a network. Examples of the above networks include but are not limited to the Internet, enterprise intranets, local area networks, mobile communication networks, and combinations thereof.

[0059] One or more modules are stored in the memory 902 and, when executed by the processor 901, execute the methods in the above method embodiments.

[0060] The specific details of the above computer device can be understood by referring to the corresponding related descriptions and effects in the above method embodiments, and will not be elaborated here.

[0061] Those skilled in the art can understand that to implement all or part of the processes in the above method embodiments, it can be completed by instructing relevant hardware through a computer program. The implemented program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above method embodiments. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memories.

[0062] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for mining the relevance of alarm data, characterized in that It includes the following steps: Obtain a preset number of historical alarm data of a network device, and obtain the alarm type and text summary of each piece of historical alarm data through preprocessing. Obtain the alarm data to be processed in a preset time period, and obtain the text summary of the alarm data to be processed by means of keyword extraction; Based on the similarity comparison between the text summary of the alarm data to be processed and the text summary of the historical alarm data, and use the historical alarm data that meets the first preset condition as the quasi-target historical alarm data; Based on the time distribution characteristics, perform grid division and frequency comparison on the quasi-target historical alarm data and the alarm data to be processed, and use the alarm data to be processed that meets the second preset condition as the alarm data to be analyzed, and use the quasi-target historical alarm data corresponding to the alarm data to be analyzed as the target historical alarm data; Determine the alarm type of the alarm data to be analyzed according to the alarm type of the target historical alarm data, and send the alarm type to the corresponding network device for the associated mining operation of the current alarm data to be analyzed.

2. The mining method for the relevance of alarm data according to claim 1, wherein The network device includes at least one of an industrial control computer with a built-in gateway, a switch, and a routing device; The text summary includes the alarm data size, the packet content of the alarm data, the packet source address, the packet target address, and the alarm code.

3. The method for mining the relevance of alarm data according to claim 1, wherein The first preset condition includes that the similarity between the text summary of the alarm data to be processed and the text summary of the historical alarm data is greater than a preset similarity threshold.

4. The method for mining the relevance of alarm data according to claim 1, wherein The process of the grid division and frequency comparison includes: Perform time grid division on the quasi-target historical alarm data at a preset time interval to generate a first sub-time grid; Perform time grid division on the alarm data to be processed at the preset time interval to generate a second sub-time grid; Obtain the occurrence frequency of the alarm data in the first sub-time grid and the occurrence frequency of the alarm data in the second sub-time grid and compare them.

5. The method for mining the relevance of alarm data according to claim 4, wherein The second preset condition includes simultaneously meeting the first sub-condition, the second sub-condition, and the third sub-condition; The first sub-condition indicates that the difference between the occurrence frequency of the alarm data in the first sub-time grid and the occurrence frequency of the alarm data in the second sub-time grid is less than a second preset threshold; The second sub-condition indicates that the similarity between the adjacent alarm data occurrence interval distribution time characteristics in the first sub-time grid and the adjacent alarm data occurrence interval distribution time characteristics in the second sub-time grid is greater than a third preset threshold; The third sub-condition indicates that the first sub-time grid is continuous in time sequence.

6. The method for mining the relevance of alarm data according to claim 1, wherein The process of determining the alarm type of the alarm data to be analyzed according to the alarm type of the target historical alarm data includes: Obtain the alarm type of each piece of the target historical alarm data; When the alarm types of each piece of the target historical alarm data are the same, the alarm type is the alarm type of the alarm data to be analyzed; When the alarm types of at least one piece of the target historical alarm data are different, filter out the first sub-time grids with different alarm types for grid division or discard them.

7. The method for mining the relevance of alarm data according to claim 6, wherein The process of filtering out the first sub-time grids with different alarm types for grid division or discard them includes: Calculate the proportion of the first sub-time grids with different alarm types filtered out in all the first sub-time grids; When the proportion is greater than the preset proportion threshold, adjust the preset time interval and conduct grid division and frequency comparison for the first sub-time grids with different alarm types; When the proportion is less than the preset proportion threshold, discard the first sub-time grids with different alarm types.

8. A mining system for alarm data relevance, characterized in that It includes: A data acquisition module, configured to acquire a preset number of historical alarm data of a network device, obtain the alarm type and text summary of each piece of historical alarm data through preprocessing, acquire the to-be-processed alarm data within a preset time period, and obtain the text summary of the to-be-processed alarm data by means of keyword extraction; A similarity comparison module, configured to conduct similarity comparison based on the text summary of the to-be-processed alarm data and the text summary of the historical alarm data, and use the historical alarm data that meets the first preset condition as the quasi-target historical alarm data; A frequency comparison module, configured to conduct grid division and frequency comparison for the quasi-target historical alarm data and the to-be-processed alarm data based on the time distribution characteristics, use the to-be-processed alarm data that meets the second preset condition as the to-be-analyzed alarm data, and use the quasi-target historical alarm data corresponding to the to-be-analyzed alarm data as the target historical alarm data; A data association module, configured to determine the alarm type of the to-be-analyzed alarm data according to the alarm type of the target historical alarm data, and send the alarm type to the corresponding network device for associated mining operation of the current to-be-analyzed alarm data.

9. An electronic device, characterized in that, It includes: A memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to execute the mining method for the relevance of alarm data according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions, and the computer instructions are used to make the computer execute the mining method for the relevance of alarm data according to any one of claims 1-7.

Images