Alarm information processing method, alarm information processing device and storage medium

Abstract

The embodiment of the present application discloses an alarm information processing method, an alarm information processing device, and a storage medium for use in the field of alarm processing technology. The method includes: obtaining traffic alarm information and terminal alarm information, wherein the traffic alarm information includes identification information of an alarm data packet that triggers an alarm, and the terminal alarm information includes process information created by a first data object that triggers an alarm; determining the result of uploading or downloading a second data object in the alarm data packet based on the identification information; and determining whether the traffic alarm information is associated with the terminal alarm information based on the result of uploading or downloading the second data object in the alarm data packet and the process information created by the first data object that triggers an alarm. By determining whether the traffic alarm information and the terminal alarm information are associated through the result of uploading or downloading the second data object in the alarm data packet and the process information created by the first data object that triggers an alarm, it is effectively avoided that the alarm information cannot be associated when the association is performed through the file name, thereby effectively improving the accuracy of the alarm association.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of alarm processing, and in particular to an alarm information processing method, an alarm information processing device, and a storage medium. Background Art

[0002] In existing network operations, maintenance personnel set numerous different monitoring indicators and alarm rules for different services, generating alerts for abnormal information. Daily network operations generate a large number of alarm messages, making it difficult to analyze and process them individually. However, a failure or abnormality in a network module can trigger alarms in multiple network modules. These alarms often share many related alarm rules or the same monitoring indicators. Linking these alarms allows maintenance personnel to identify the cause of the alarm and more quickly resolve similar issues.

[0003] The existing method for correlating traffic-side and terminal-side alarms involves obtaining the traffic alarm type triggered by downloading and uploading alarm data on the traffic side, as well as the terminal alarm type triggered by alarm data on the terminal side. This alarm type can be a virus alarm or a Trojan horse alarm. If the traffic alarm type and the terminal alarm type are the same, the alarms are confirmed to be correlated. However, different alarm data may trigger the same alarm type on the traffic side and the terminal side. Correlating alarms based on alarm type can easily link alarm information corresponding to different alarm data, making alarm correlation less accurate. Summary of the Invention

[0004] The embodiments of the present application provide an alarm information processing method, an alarm information processing device, and a storage medium, which can effectively improve the accuracy of alarm association when performing alarm association on traffic alarm information and terminal alarm information.

[0005] The present invention provides a method for processing alarm information, including:

[0006] Acquire traffic alarm information and terminal alarm information, wherein the traffic alarm information includes identification information of an alarm data packet that triggers the alarm, and the terminal alarm information includes process information of a first data object that triggers the alarm;

[0007] determining, based on the identification information, a result of uploading or downloading the second data object in the alarm data packet;

[0008] Based on the upload or download result and the process information, it is determined whether the traffic alarm information is associated with the terminal alarm information.

[0009] Furthermore, the traffic alarm information further includes: identification information of the second data object, and the terminal alarm information further includes: identification information of the first data object;

[0010] Before determining the result of uploading or downloading the second data object in the alarm data packet based on the identification information, the method further includes:

[0011] Determining whether the identification information of the second data object is the same as the identification information of the first data object;

[0012] If they are not the same, the step of determining the result of uploading or downloading the second data object in the alarm data packet based on the identification information and all subsequent steps are triggered to execute.

[0013] Furthermore, before determining whether the identification information of the second data object is the same as the identification information of the first data object, the method further includes:

[0014] performing a restoration operation on the identification information of the second data object based on a preset restoration operation to obtain restoration information;

[0015] Correspondingly, determining whether the identification information of the second data object is the same as the identification information of the first data object includes:

[0016] Determine whether the restoration information is the same as the identification information of the first data object.

[0017] Furthermore, the preset restoration operation includes decoding the identification information of the second data object, and / or decrypting the identification information of the second data object; and / or deserializing the identification information of the second data object.

[0018] Furthermore, the alarm data packet includes a data request packet and / or a data response packet.

[0019] Furthermore, the determining, based on the upload or download result and the process information, whether the traffic alarm information is associated with the terminal alarm information includes:

[0020] If the upload or download result indicates that the second data object meets a preset upload success or download success condition, and the process information is preset process information, it is determined that the traffic alarm information is associated with the terminal alarm information.

[0021] Furthermore, the traffic alarm information also includes the traffic alarm time, and the terminal alarm information also includes the terminal alarm time;

[0022] The determining, based on the upload or download result and the process information, whether the traffic alarm information is associated with the terminal alarm information includes:

[0023] If the result of the upload or download indicates that the second data object meets the preset upload success or download success condition, and the process information is the preset process information, and the time interval between the traffic alarm time and the terminal alarm time is less than the preset duration, then it is determined that the traffic alarm information is associated with the terminal alarm information.

[0024] The present application also provides an alarm information processing device, including:

[0025] an acquiring unit, configured to acquire flow alarm information and terminal alarm information, wherein the flow alarm information includes identification information of an alarm data packet that triggers the alarm, and the terminal alarm information includes process information of creation of a first data object that triggers the alarm;

[0026] a first determining unit, configured to determine a result of uploading or downloading the second data object in the alarm data packet based on the identification information;

[0027] The second determining unit is configured to determine whether the traffic alarm information is associated with the terminal alarm information based on the upload or download result and the process information.

[0028] The present application also provides an alarm information processing device, including:

[0029] CPU, memory, input and output interfaces, wired or wireless network interfaces, power supply;

[0030] The memory is a transient storage memory or a persistent storage memory;

[0031] The central processing unit is configured to communicate with the memory and execute instruction operations in the memory on the control plane function entity to perform the above-mentioned alarm information processing method.

[0032] An embodiment of the present application further provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the alarm information processing method as described above.

[0033] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0034] The alarm information processing method in the embodiment of the present application includes: obtaining traffic alarm information and terminal alarm information, the traffic alarm information including identification information of the alarm data packet that triggers the alarm, and the terminal alarm information including process information created by the first data object that triggers the alarm; determining the result of uploading or downloading the second data object in the alarm data packet based on the identification information; and determining whether there is an association between the traffic alarm information and the terminal alarm information based on the result of uploading or downloading the second data object in the alarm data packet and the process information created by the first data object that triggers the alarm. By determining whether there is an association between the traffic alarm information and the terminal alarm information through the result of uploading or downloading the second data object in the alarm data packet and the process information created by the first data object that triggers the alarm, it is effectively avoided that the alarm information corresponding to different alarm data is associated when the alarm is associated by the alarm type, thereby effectively improving the accuracy of the alarm association. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0036] Figure 1 A schematic diagram of a communication network architecture provided in an embodiment of the present application;

[0037] Figure 2 A flowchart of an alarm information processing provided in an embodiment of the present application;

[0038] Figure 3 A flowchart of an alarm process based on identification information provided in an embodiment of the present application;

[0039] Figure 4 Another flowchart of alarm processing based on identification information provided in an embodiment of the present application;

[0040] Figure 5 A flowchart of another alarm information processing provided in an embodiment of the present application;

[0041] Figure 6 A flowchart of an alarm processing based on alarm time provided in an embodiment of the present application;

[0042] Figure 7 A diagram of an alarm information device provided in an embodiment of the present application;

[0043] Figure 8 This is another diagram of an alarm information device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0045] In the description of the embodiments of the present application, it should be noted that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings. They are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, they cannot be understood as limiting the embodiments of the present application.

[0046] In the description of the embodiments of the present application, it should be noted that, unless otherwise expressly specified or limited, the terms "installed," "connected," and "connected" should be understood in a broad sense. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to internal connections between two components. Those skilled in the art will understand the specific meanings of the above terms in the embodiments of the present application based on the specific circumstances.

[0047] Existing alarm information processing is as follows Figure 1As shown, the alarm processing device 101 is connected to the flow side device 102 and the terminal side device 103, and can obtain the alarm information of the flow side device 102 and the terminal side device 103, and associate the alarm information with the associated relationship. Among them, the flow side device 102 can be understood as the network side that communicates with the server, such as the wide area network port (WAN port) side of a broadband router or switch, which is not specifically limited here. The terminal side device 103 can be understood as a terminal device that is connected to the flow side device 102 through the network, and communicates with the server through the flow side device 102. The terminal side device 103 can be a mobile phone or computer connected to the router, etc., which is not specifically limited here. When the alarm processing device 101 associates the alarms of the traffic side device 102 (traffic side) and the terminal side device 103 (terminal side), it associates the file name in the alarm data packet when the traffic side device 102 downloads and uploads with the file name of the alarm file when the terminal side device 103 performs virus detection. Generally, the file name of the alarm file on the terminal side is extracted and the alarm data packet on the traffic side is searched to see whether it contains the file name of the alarm file. If it does, the alarm association is performed. However, some files often modify their file names after landing on the terminal side, and the file names in the data packets uploaded on the traffic side may also be encoded, encrypted, and serialized, resulting in the inability to search for the file name of the alarm file in the data packet, thereby causing the alarm information to be unable to be associated. Therefore, an embodiment of the present application provides an alarm information processing method that can effectively improve the accuracy of alarm association when alarm association is performed on traffic alarm information and terminal alarm information, such as Figure 2 As shown, it specifically includes step 201 and step 204.

[0048] 201. Obtain traffic alarm information and terminal alarm information.

[0049] The alarm information processing device in the embodiments of the present application can obtain flow alarm information and terminal alarm information. The flow alarm information is generated when an anomaly is detected based on alarm rules during data transmission on the flow side. The transmitted data includes data uploaded or downloaded from the flow side to the network server, such as uploaded attack traffic. The flow alarm information includes identification information of the alarm data packet that triggered the alarm. The alarm data packet is a data packet uploaded or downloaded from the flow side. The alarm data packet may include one or more data files or commands, the specific details of which are not limited here. It is understood that when an alarm data packet triggers an alarm on the flow side, the identification information of the alarm data packet will be recorded in the flow alarm information on the flow side. The identification information of the alarm data packet may be the data packet name or data packet ID of the alarm data packet, the specific details of which are not limited here. It is understood that the alarm information processing device may collect the flow alarm information on the flow side after an alarm occurs on the flow side, or receive the flow alarm information transmitted by the flow side, or pre-store the flow alarm information in the alarm information processing device, the specific details of which are not limited here.

[0050] The terminal alarm information on the terminal side is the terminal alarm information generated when an anomaly is detected in the data on the terminal side based on the alarm rules. For example, data that has been virus-checked on the terminal side will generate corresponding virus alarm information. The terminal alarm information includes the process information created by the first data object that triggers the alarm on the terminal side, wherein the first data object can be a file or a command, which is not limited here. It can be understood that when the first data object is landed on the terminal side, a corresponding process will be created to process the landed first data object. When the first data object triggers an alarm on the terminal side, the process information of the first data object will be saved in the terminal alarm information; the process information of the first data object includes the process name of the alarm file or the process status of the alarm file, which is not limited here. The first data object that is landed on the terminal side can be the first data object downloaded by the terminal side through a network connection. Generally, after the first data object is landed on the terminal side, the terminal side will automatically detect whether there is an anomaly in the first data object. If there is an anomaly, an alarm will be triggered and the corresponding terminal alarm information will be generated. It is understandable that the alarm information processing device may collect terminal alarm information on the terminal side after an alarm occurs on the terminal side, or store the terminal alarm information in the alarm information processing device in advance, which is not specifically limited here.

[0051] 202. Determine an upload or download result of a second data object in the alarm data packet based on identification information of the alarm data packet in the traffic alarm information.

[0052] After obtaining the identification information of the alarm data packet in the traffic side, the result of uploading or downloading the second data object in the alarm data packet can be determined based on the identification information of the alarm data packet in the traffic alarm information. It can be understood that the second data object in the alarm data packet can be a file or command in the alarm data packet, which is not limited here. When the second data object in the alarm data packet is uploaded or downloaded on the traffic side, corresponding upload feedback information or download feedback information can be obtained, and the upload feedback information indicates that the upload result of the second data object uploaded to the network server on the traffic side is upload failure or upload success. The upload feedback information includes an upload status code or an upload response packet, which is not limited here; the download feedback information indicates that the download result of the second data object downloaded from the network server on the traffic side is download failure or download success. The upload feedback information or download feedback information contains the identification information of the uploaded or downloaded data packet, and the identification information can be used to determine the upload or download result of the second data object from the upload feedback information or download feedback information.

[0053] 203. Determine whether the traffic alarm information is associated with the terminal alarm information based on the upload or download result and the process information of the first data object created in the terminal alarm information.

[0054] In an embodiment of the present application, it is possible to determine whether there is an association between the flow alarm information and the terminal alarm information based on the result of the upload or download and the process information of the first data object created in the terminal alarm information. Specifically, if the result of uploading or downloading the second data object is upload success or download success, it can be determined that the second data object is uploaded to the server via the flow side or downloaded from the server via the flow side. At this time, the terminal side can download the second data object through the server or download the second data object through the flow side, that is, the data object obtained by the terminal side is the same as the data object transmitted on the flow side; if the second data object is a virus or Trojan horse that triggers an alarm, the second data object may also trigger an alarm on the terminal side after triggering an alarm on the flow side. If the result of uploading or downloading the second data object is upload failure or download failure, the terminal side cannot download the second data object through the server or download the second data object through the flow side, that is, the terminal side cannot obtain the same data object as the flow side, then it can be determined that the flow alarm information and the terminal alarm information are not alarms triggered based on the same data object, that is, the flow alarm information and the terminal alarm information are not associated.

[0055] It is understandable that if the data object in the data packet triggers an alarm when it is transmitted (uploaded or downloaded) on the traffic side, then when the terminal side downloads the data object in the data packet from the server or traffic side, the process information created by the data object generally contains a suspicious network process name. The suspicious network process name can be a Java process name. That is, the process information created by the first data object that triggered the alarm can be extracted through the terminal alarm information, and the process information is used to determine whether the first data object is a data object transmitted through the traffic side. Therefore, based on the upload or download result and process information, it can be determined whether the traffic alarm information and the terminal alarm information are associated. If the upload or download result of the second data object in the alarm data packet is a successful upload or download, and the process information created by the first data object is the suspicious network process name, then it can be determined that the traffic alarm information and the terminal alarm information are associated.

[0056] In one practicable manner, upon determining that traffic alarm information and terminal alarm information are associated, the associated traffic alarm information and terminal alarm information may be associated with each other to facilitate subsequent processing of the associated alarm information. The alarm association may include assigning the same identifier to the traffic alarm information and the terminal alarm information, or storing the traffic alarm information and the terminal alarm information in the same storage space, the specifics of which are not limited herein.

[0057] It can be seen that the embodiments of the present application include: obtaining traffic alarm information and terminal alarm information, the traffic alarm information includes the identification information of the alarm data packet that triggers the alarm, and the terminal alarm information includes the process information created by the first data object that triggers the alarm; determining the result of uploading or downloading the second data object in the alarm data packet based on the identification information; and determining whether the traffic alarm information and the terminal alarm information are associated based on the result of uploading or downloading the second data object in the alarm data packet and the process information created by the first data object that triggers the alarm. By determining whether the traffic alarm information and the terminal alarm information are associated through the result of uploading or downloading the second data object in the alarm data packet and the process information created by the first data object that triggers the alarm, it is effectively avoided that the alarm information corresponding to different alarm data is associated when the alarm is associated by the alarm type, thereby effectively improving the accuracy of the alarm association.

[0058] Furthermore, in the embodiment of the present application, it is possible to first determine whether the alarm information is associated through the identification information of the data object in the alarm information, specifically as follows: Figure 3 As shown, it includes steps 301 to 305.

[0059] 301. Obtain traffic alarm information and terminal alarm information.

[0060] It is understandable that step 301 is similar to the above step 201 and will not be described in detail here.

[0061] 302. Determine whether the identification information of the second data object is the same as the identification information of the first data object. If not, execute step 303; if so, execute step 304.

[0062] It is understood that the traffic alarm information also includes: identification information of the second data object, and the terminal alarm information also includes: identification information of the first data object. Specifically, when the data object is a file, the identification information of the data object can be the file name; when the data object is a command, the identification information of the data object can be the command identifier. The alarm information processing device can directly extract the file name of the terminal landing file or the command identifier of the command from the terminal alarm information. The file name or command identifier can include numbers, letters, or Chinese characters.

[0063] When determining whether the traffic alarm information and the terminal alarm information are associated, you can first determine whether the identification information of the second data object is the same as the identification information of the first data object. Specifically, you can extract the identification information of the second data object in the alarm data packet from the traffic alarm information, and extract the identification information of the first data object from the terminal alarm information. It is determined whether the identification information of the second data object is the same as the identification information of the first data object. If they are not the same, that is, it cannot be determined that the alarm information is associated through the identification information of the data object (it cannot be determined that the alarm information is associated through the file name). Then, based on the identification information, the result of uploading or downloading the second data object in the alarm data packet is determined. The result of uploading or downloading and the process information are used to determine whether the traffic alarm information and the terminal alarm information are associated.

[0064] Specifically, if the identification information of the second data object in the alarm data packet is the same as the identification information of the first data object, then it can be determined that the second data object is the first data object, that is, the alarm data packet that triggers the alarm on the traffic side contains the data object that triggers the alarm on the terminal side, and the traffic alarm and the terminal alarm are caused by the same data object, that is, it is determined that the traffic alarm information and the terminal alarm information are associated. If they are not the same, it is preliminarily determined that the alarm data packet does not contain the data object that triggers the alarm on the terminal side, and the upload or download results and process information are further used to determine whether the traffic alarm information and the terminal alarm information are associated.

[0065] It is understandable that the alarm data packet that triggers the alarm during transmission on the traffic side includes a data request packet and a data response packet. When determining whether the identification information of the second data object is the same as the identification information of the first data object, it is necessary to determine not only the identification information of the data object in the data request packet, but also the identification information of the data object in the data response packet. This is because the data request packet on the traffic side may modify the identification information of the data object in the data packet during upload, such as modifying the file name, and the identification information of the modified data object can be returned to the traffic side via the data response packet. By determining the identification information of the data object in the data response packet, it is possible to more accurately determine whether the alarm data packet contains the first data object that triggered the alarm on the terminal side.

[0066] 303. Determine an upload or download result of the second data object in the alarm data packet based on identification information of the alarm data packet in the traffic alarm information.

[0067] 304. Determine whether the traffic alarm information is associated with the terminal alarm information based on the upload or download result and the process information of the first data object created in the terminal alarm information.

[0068] It is understandable that step 303 and step 304 are similar to the above-mentioned step 202 and step 203, and the details are not repeated here.

[0069] Furthermore, when determining whether the alarm information is associated through the identification information of the data object in the alarm information, the identification information of the data object may be modified when uploading the data packet on the traffic side, such as being encoded, encrypted, or serialized, resulting in the inability to directly search for the identification information of the data object that triggered the alarm on the terminal side in the data packet, thereby causing the alarm information to be unable to be associated. At this time, you can try to restore the identification information of the second data object in the alarm data packet, and then determine whether the alarm data packet contains the data object that triggered the alarm on the terminal side, which can improve the accuracy of the alarm association. Figure 4 As shown, it specifically includes steps 401 to 406.

[0070] 401. Obtain traffic alarm information and terminal alarm information.

[0071] It is understandable that step 301 is similar to the above step 201 and will not be described in detail here.

[0072] 402. Perform a restoration operation on the identification information of the second data object based on a preset restoration operation to obtain restoration information.

[0073] In an embodiment of the present application, a restoration operation can be performed on the identification information of the second data object based on a preset restoration operation to obtain restoration information, that is, the identification information of the data object that may have been modified can be restored through the preset restoration operation. It can be understood that the identification information of the second data object in the alarm data packet can be the file name in the alarm data packet, that is, the file name in the alarm data packet can be restored based on the preset restoration operation. Among them, the preset restoration operation includes decoding the identification information of the second data object in the alarm data packet, and / or decrypting the identification information of the second data object; and / or deserializing the identification information of the second data object. That is, attempting to restore the identification information of the second data object based on the preset restoration operation can be attempting to decode, decrypt and deserialize the identification information of the second data object, and one or more operations of decoding, decryption and deserialization can be selected to attempt to restore the identification information of the second data object. The specific restoration operation is shown in steps 4021 to 4023:

[0074] 4021. Decode identification information of the second data object.

[0075] Data packets uploaded from the traffic side may be encoded. For example, the file name of the attack payload in the data packet may be URL-encoded or Base64-encoded, converting the binary data in the file name into text format. Base64 encoding is characterized by a string containing only AZ, az, 0-9, +, / , = characters, and a string length that is a multiple of 4. If the data packet is encoded, the identification information of the second data object in the alarm data packet can be decoded, for example, by decoding the identification information of the second data object into the corresponding binary data and restoring the identification information.

[0076] 4022. Decrypt the identification information of the second data object.

[0077] Data packets uploaded on the traffic side may also be encrypted. For example, the file name of the attack payload file in the data packet may be encrypted using Shiro encryption, which uses a hash algorithm to encrypt the file name, making it impossible to successfully match the file name. The NDPI framework can be used to unpack and analyze the alarm data packet. Encrypted data packets will have obvious handshake protocol traffic characteristics, generally starting with 0x160303. If the alarm data packet is encrypted, the identification information of the second data object can be decrypted and compared with the encrypted identification information in the Shiro database to restore the identification information.

[0078] 4023. Deserialize the identification information of the second data object.

[0079] Data packets uploaded from the traffic side may also be serialized. For example, if the file name of the attack payload in the data packet is converted from Java serialization to a byte sequence, this will also prevent the file name from being matched successfully. In this case, it is possible to determine whether the alarm data packet is a byte sequence and whether it is serialized. If the alarm data packet is serialized, the string of the byte sequence can be deserialized, and the identification information of the second data object can be deserialized. Based on the identification information status and description information stored in the byte sequence, the identification information can be reconstructed through deserialization to restore the identification information.

[0080] It is understandable that the execution order of step 402 and step 403 is not limited here.

[0081] 403. Determine whether the restored information is the same as the identification information of the first data object. If not, execute step 404; if so, execute step 405.

[0082] After performing a restore operation on the identification information of the second data object based on the preset restore operation to obtain the restored information, it can be determined whether the restored information is the same as the identification information of the first data object. The specific judgment process is similar to the above-mentioned step 302 and will not be repeated here. It is understood that the restored information can be determined to be the same as the identification information of the first data object. If the restored information is the same as the identification information of the first data object, it is determined that the traffic alarm information and the terminal alarm information are associated. If they are not the same, it is further determined whether the traffic alarm information and the terminal alarm information are associated based on the upload or download results and process information.

[0083] 404. Determine the upload or download result of the second data object in the alarm data packet based on the identification information of the alarm data packet in the traffic alarm information.

[0084] 405. Determine whether the traffic alarm information is associated with the terminal alarm information based on the upload or download result and the process information of the first data object created in the terminal alarm information.

[0085] It is understandable that step 404 and step 405 are similar to the above-mentioned step 202 and step 203, and the details are not repeated here.

[0086] In one feasible method, when the existence of an association cannot be confirmed through the identification information of the data object, the identification information of the second data object in the alarm data packet can be further attempted to be restored, and then the association can be performed through the restored information. If the association cannot be performed, it can be further determined based on the upload or download results and process information whether there is an association between the traffic alarm information and the terminal alarm information.

[0087] Furthermore, for remote loading scenarios or web attack scenarios, such as webshell (script Trojan) files, the file name is often modified after landing on the terminal, and the modified file name may not be returned to the traffic side in the data response packet, that is, it is difficult to associate an alarm with the identification information of the data object. Therefore, in the implementation of this application, you can also preset the upload success or download success conditions and preset process information to determine whether there is an alarm association, such as Figure 5 As shown, it specifically includes step 501 and step 504.

[0088] 501. Obtain traffic alarm information and terminal alarm information.

[0089] 502. Determine an upload or download result of a second data object in the alarm data packet based on identification information of the alarm data packet in the traffic alarm information.

[0090] It is understandable that step 501 and step 502 are similar to the above-mentioned step 201 and step 202, and the details are not repeated here.

[0091] 503. Based on a preset upload success or download success condition and preset process information, determine whether the traffic alarm information is associated with the terminal alarm information.

[0092] In an embodiment of the present application, it is possible to determine whether the traffic alarm information and the terminal alarm information are associated based on a preset upload success or download success condition and preset process information. If the result of the upload or download indicates that the second data object meets the preset upload success or download success condition, and the process information is the preset process information, then it is determined that the traffic alarm information and the terminal alarm information are associated; if the result of the upload or download indicates that the second data object does not meet the preset upload success or download success condition, or the process information is non-preset process information, then it is determined that the traffic alarm information and the terminal alarm information are not associated.

[0093] It is understandable that the second data object satisfies the preset upload success or download success condition if the status code fed back when the second data object is uploaded or downloaded on the traffic side does not belong to the status code of the transmission error, or the data response packet returned when the second data object is uploaded or downloaded on the traffic side does not contain the associated words of the upload or download failure, then the second data object can meet the preset upload success or download success condition. Among them, the status code of the transmission error can be a "404" identification status code or a "400" identification status code, which is not specifically limited here. The associated words of the upload or download failure can be Fail or Loss, which is not specifically limited here.

[0094] Among them, if the first data object that triggers an alarm on the terminal side also triggers an alarm on the traffic side, the first data object generally creates suspicious files such as dynamic scripts and PE files on the terminal side, and the corresponding created process is a suspicious web process (suspicious network process) such as java, phpcgi, IIS, etc. Determining whether the process information of the first data object is the preset process information can be to determine whether the process of the first data object is the suspicious network process. If so, the process information of the first data object is determined to be the preset process information. If not, the process information of the first data object is determined to be non-preset process information. Specifically, it can be determined whether the process name created by the first data object contains java, phpcgi or IIS. If it does, the process information of the first data object is determined to be the preset process information.

[0095] Furthermore, when determining whether the alarm information is associated, in order to further improve the accuracy of the alarm association, the alarm time can also be used to determine whether there is an association, such as Figure 6 As shown, it specifically includes steps 601 to 604

[0096] 601. Obtain traffic alarm information and terminal alarm information.

[0097] 602. Determine the upload or download result of the second data object in the alarm data packet based on the identification information of the alarm data packet in the traffic alarm information.

[0098] It is understandable that step 601 and step 602 are similar to the above-mentioned step 201 and step 202, and the details are not repeated here.

[0099] 603. Based on the preset upload success or download success condition, the preset process information, and the traffic alarm time, determine whether the traffic alarm information is associated with the terminal alarm information.

[0100] It is understandable that the flow alarm information also includes the flow alarm time, and the terminal alarm information also includes the terminal alarm time; when an alarm occurs on the flow side or the terminal side, the corresponding alarm information is recorded with the alarm time, and the alarm information processing device can extract the flow alarm time and the terminal alarm time from the flow alarm information on the flow side and the terminal alarm information on the terminal side, respectively, or record the alarm time on the flow side or the terminal side through a network connection. The specific details are not limited here. When determining whether the alarm information is associated, if the result of uploading or downloading indicates that the second data object meets the preset upload success or download success condition, and the process information is the preset process information, and the time interval between the flow alarm time and the terminal alarm time is less than the preset time length, then it is determined that the flow alarm information and the terminal alarm information are associated; if the result of uploading or downloading indicates that the second data object does not meet the preset upload success or download success condition, or the process information is non-preset process information, or the time interval between the flow alarm time and the terminal alarm time is greater than or equal to the preset time length, then it is determined that the flow alarm information and the terminal alarm information are not associated. Among them, the preset time length can be 2 minutes or 3 minutes, which is not limited here, and the preset time length is generally short. That is, if an alarm occurs on the traffic side and an alarm occurs on the terminal side within a short time, the two alarm information can be associated.

[0101] The embodiment of the present application provides an alarm information processing device, such as Figure 7 Shown, including:

[0102] An acquiring unit 701 is configured to acquire traffic alarm information and terminal alarm information, wherein the traffic alarm information includes identification information of an alarm data packet that triggers an alarm, and the terminal alarm information includes process information of a first data object that triggers an alarm.

[0103] A first determining unit 702 is configured to determine a result of uploading or downloading the second data object in the alarm data packet based on the identification information;

[0104] The second determining unit 703 is configured to determine whether the traffic alarm information is associated with the terminal alarm information based on the upload or download result and the process information.

[0105] The present application also provides an alarm information processing device, see Figure 8 The alarm information processing device 800 of the embodiment of the present application may include one or more central processing units (CPUs) 801 and a memory 802 , in which one or more applications or data are stored.

[0106] Memory 802 can be volatile or persistent storage. The program stored in memory 802 may include one or more modules, each of which may include a series of instruction operations on the electronic device. Furthermore, the central processing unit 801 may be configured to communicate with memory 802, and execute the series of instruction operations in memory 802 on the alarm information processing device 800.

[0107] The alarm information processing device 800 may also include one or more power supplies 805, one or more wired or wireless network interfaces 804, one or more input and output interfaces 803, and / or one or more operating systems, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0108] The central processing unit 801 can execute the operations performed by the aforementioned first aspect or any specific method embodiment of the first aspect, and the details will not be repeated here.

[0109] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0110] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0111] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0112] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0113] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A method for processing alarm information, characterized in that: include: Acquire traffic alarm information and terminal alarm information, wherein the traffic alarm information includes identification information of an alarm data packet that triggers the alarm, and the terminal alarm information includes process information of a first data object that triggers the alarm; determining, based on the identification information, a result of uploading or downloading the second data object in the alarm data packet; Based on the upload or download result and the process information, it is determined whether the traffic alarm information is associated with the terminal alarm information.

2. The alarm information processing method according to claim 1, characterized in that: The traffic alarm information further includes: identification information of the second data object; the terminal alarm information further includes: identification information of the first data object; Before determining the result of uploading or downloading the second data object in the alarm data packet based on the identification information, the method further includes: Determining whether the identification information of the second data object is the same as the identification information of the first data object; If they are not the same, the step of determining the result of uploading or downloading the second data object in the alarm data packet based on the identification information and all subsequent steps are triggered to execute.

3. The alarm information processing method according to claim 2, characterized in that: Before determining whether the identification information of the second data object is the same as the identification information of the first data object, the method further includes: performing a restoration operation on the identification information of the second data object based on a preset restoration operation to obtain restoration information; Correspondingly, determining whether the identification information of the second data object is the same as the identification information of the first data object includes: Determine whether the restoration information is identical to the identification information of the first data object.

4. The alarm information processing method according to claim 3, characterized in that: The preset restoration operation includes decoding the identification information of the second data object, and / or decrypting the identification information of the second data object; and / or deserializing the identification information of the second data object.

5. The alarm information processing method according to claim 1, characterized in that: The alarm data packet includes a data request packet and / or a data response packet.

6. The alarm information processing method according to any one of claims 1 to 5, characterized in that: The determining, based on the upload or download result and the process information, whether the traffic alarm information is associated with the terminal alarm information includes: If the upload or download result indicates that the second data object meets a preset upload success or download success condition, and the process information is preset process information, it is determined that the traffic alarm information is associated with the terminal alarm information.

7. The alarm information processing method according to any one of claims 1 to 5, characterized in that: The traffic alarm information also includes the traffic alarm time, and the terminal alarm information also includes the terminal alarm time; The determining, based on the upload or download result and the process information, whether the traffic alarm information is associated with the terminal alarm information includes: If the result of the upload or download indicates that the second data object meets the preset upload success or download success condition, and the process information is the preset process information, and the time interval between the traffic alarm time and the terminal alarm time is less than the preset duration, then it is determined that the traffic alarm information is associated with the terminal alarm information.

8. An alarm information processing device, characterized in that: include: an acquiring unit, configured to acquire flow alarm information and terminal alarm information, wherein the flow alarm information includes identification information of an alarm data packet that triggers the alarm, and the terminal alarm information includes process information of creation of a first data object that triggers the alarm; a first determining unit, configured to determine a result of uploading or downloading the second data object in the alarm data packet based on the identification information; The second determining unit is configured to determine whether the traffic alarm information is associated with the terminal alarm information based on the upload or download result and the process information.

9. An alarm information processing device, characterized in that: include: CPU, memory, input and output interfaces, wired or wireless network interfaces, power supply; The memory is a transient storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instruction operations in the memory on a control plane function entity to perform the alarm information processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium includes instructions, and when the instructions are executed on a computer, the computer executes the alarm information processing method according to any one of claims 1 to 7.

Images