Network alarm confirmation method, apparatus and device

Abstract

A network alarm confirmation method, device and equipment are disclosed to improve the accuracy of network alarms. The method comprises: obtaining a rule identifier in a plurality of to-be-verified alarms of a target IP to obtain a first rule set; determining that a target rule set exists in at least one verification rule set of a rule cluster library according to the first rule set; and determining that the plurality of to-be-verified alarms are accurate alarms or false alarms. Each to-be-verified alarm is generated by a data stream from the target IP hitting a rule corresponding to the rule identifier in the to-be-verified alarm. At least part of the rule identifiers in the target rule set belong to the first rule set. The rule identifiers in each verification rule set are rule identifiers with correlation obtained by statistics from a plurality of historical alarms.

Description

Technical Field

[0001] This application relates to the field of computer network technology, and in particular to a method, apparatus and device for network alarm confirmation. Background Technology

[0002] To ensure network security, computer network security devices such as firewalls, intrusion detection systems (IDS), or intrusion prevention systems (IPS) are typically used to detect, interrupt, adjust, or isolate abnormal or harmful network data transmission behaviors in a timely manner.

[0003] Network security devices such as IPS and IDS are based on signature-based network intrusion detection, using rule definitions to examine problematic data packets in the network. Rules in IPS are also called IPS signatures. By matching network traffic characteristics against rules, a rule being matched or triggered generates an alert, which the network security device then interprets as a malicious attack. Because network security devices use rules to match traffic, their detection capabilities primarily depend on the richness and accuracy of these rules.

[0004] Over the long term, the rules have gradually evolved into two parts: high-quality rules (few false alarms) and low-quality rules (many false alarms). Low-quality rules cannot be improved in a short time, resulting in too many uncertain alarms. Alarms generated by high-quality rules cannot be guaranteed to be accurate. Uncertain alarms cannot determine whether the IP address is engaging in attack behavior, and in practical applications, further manual verification is required, which is time-consuming, labor-intensive, and costly. Summary of the Invention

[0005] This application provides a network alarm confirmation method, apparatus, and device to improve the accuracy of network alarms.

[0006] A first aspect provides a network alarm confirmation method. This method is applied to network devices. The method includes obtaining rule identifiers from multiple unverified alarms of a target IP to obtain a first rule set; determining, based on the first rule set, that a target rule set exists in at least one verification rule set of a rule cluster library; and determining that the multiple unverified alarms are accurate alarms or false alarms. Each unverified alarm is generated by a rule corresponding to a rule identifier in the unverified alarm, originating from a data stream from the target IP. At least some rule identifiers in the target rule set belong to the first rule set. The rule identifiers in each verification rule set are relevance rule identifiers statistically obtained from multiple historical alarms. This application compares the rule cluster library with the first rule set corresponding to the multiple unverified alarms of the target IP to perform secondary screening of the unverified alarms. When a target rule set that meets preset conditions exists in the rule cluster library, it indicates that the multiple unverified alarms of the target IP are accurate alarms or false alarms, thereby improving the accuracy of alarms.

[0007] In one possible implementation, the rule cluster library includes a first rule cluster library for verifying at least one alarm to be verified as an accurate alarm, and the target rule set belongs to the first rule cluster library. Determining at least one alarm to be verified as an accurate alarm or a false alarm includes: determining multiple alarms to be verified as accurate alarms.

[0008] In one possible implementation, after determining that multiple alarms to be verified are accurate alarms, the process also includes: intercepting data streams from the target IP address. This helps prevent losses caused by network attacks.

[0009] In one possible implementation, the rule cluster library includes a second rule cluster library for verifying at least one alarm to be verified as a false alarm, and the target rule set belongs to the second rule cluster library. Determining multiple alarms to be verified as accurate alarms or false alarms includes: determining that multiple alarms to be verified are false alarms.

[0010] In one possible implementation, before determining that the target rule set exists in at least one verification rule set of the rule cluster library according to the first rule set, the process includes: receiving the rule cluster library sent by the analysis device. The rule cluster library may be generated by the analysis device and distributed to the network device, thereby reducing the computing power requirements of the network device and reducing the consumption of network device computing resources.

[0011] In one possible implementation, before determining that at least one verification rule set of the rule cluster library contains the target rule set based on the first rule set, the process includes: acquiring multiple historical alarms; acquiring multiple alarm groups based on the multiple historical alarms; acquiring rule identifiers from the multiple alarm groups to obtain multiple second rule sets; and determining the rule cluster library based on the multiple second rule sets. Each historical alarm includes a source IP, destination IP, rule identifier, and alarm generation time; all historical alarms are either accurate alarms or false alarms. Each alarm group includes at least one historical alarm, and the source IP, destination IP, and alarm generation time of the historical alarms in each alarm group belong to the same time period. Grouping historical alarms according to the same time period, source IP, and destination IP allows alarms belonging to the same network activity process to be grouped into the same alarm group. Extracting the rule cluster library based on the alarm groups can more accurately represent the behavioral patterns during network activities.

[0012] In one possible implementation, each set of verification rules is a subset of at least a portion of a plurality of second rule sets.

[0013] In one possible implementation, the target rule set includes at least two rule identifiers, and the target rule set is a subset of the first rule set; or the overlap between the rule identifiers in the target rule set and the rule identifiers in the first rule set is greater than or equal to a threshold, where the rule overlap is the ratio of the number of rule identifiers that overlap between the target rule set and the first rule set to the total number of rule identifiers in the target rule set.

[0014] The second aspect provides a network alarm confirmation method. This method includes: acquiring multiple historical alarms, analyzing the multiple historical alarms, and obtaining a rule cluster library. The multiple historical alarms are either accurate alarms or false alarms, and each historical alarm includes a rule identifier corresponding to the rule that triggered the generation of the historical alarm. The rule cluster library includes at least one verification rule set, and the rule identifiers in each verification rule set are relevance rule identifiers statistically obtained from the multiple historical alarms. The rule cluster library is used to determine whether multiple alarms to be verified corresponding to the first rule set are accurate alarms or false alarms when the network device determines that a target rule set exists in the rule cluster library based on a first rule set of the target IP. At least some rule identifiers in the target rule set belong to the first rule set, and each alarm to be verified is generated by a data stream from the target IP hitting the rule corresponding to the rule identifier in the alarm to be verified.

[0015] In one possible implementation, each historical alarm includes a source IP, a destination IP, and an alarm generation time. Analyzing multiple historical alarms to obtain a rule cluster library includes: obtaining multiple alarm groups based on multiple historical alarms, each alarm group including at least one historical alarm, and the source IP, destination IP, and alarm generation time of the historical alarms in each alarm group belonging to the same time period; obtaining rule identifiers from multiple alarm groups to obtain multiple second rule sets; and determining the rule cluster library based on the multiple second rule sets.

[0016] In one possible implementation, the rule cluster library includes at least one set of validation rules, each set of validation rules being a subset of a plurality of second rule sets.

[0017] The third aspect provides a network alarm confirmation device. The device includes: an acquisition module, used to acquire rule identifiers from multiple alarms to be verified from a target IP to obtain a first rule set, wherein each alarm to be verified is generated by a rule corresponding to the rule identifier in the alarm to be verified when a data stream from the target IP hits the rule; a determination module, used to determine, based on the first rule set, that at least one verification rule set in the rule cluster library contains a target rule set, wherein at least some rule identifiers in the target rule set belong to the first rule set, and the rule identifiers in each verification rule set are relevance rule identifiers statistically obtained from multiple historical alarms; the determination module is also used to confirm whether the multiple alarms to be verified are accurate alarms or false alarms.

[0018] In one possible implementation, the rule cluster library includes a first rule cluster library for verifying at least one alarm to be verified as an accurate alarm, the target rule set belonging to the first rule cluster library; and a determination module for determining multiple alarms to be verified as accurate alarms.

[0019] In one possible implementation, the device further includes an interception module for intercepting data streams from the target IP.

[0020] In one possible implementation, the rule cluster library includes a second rule cluster library for verifying at least one alarm to be verified as a false alarm, and the target rule set belongs to the second rule cluster library; and a determination module for determining multiple alarms to be verified as accurate alarms.

[0021] In one possible implementation, the acquisition module is further configured to acquire multiple historical alarms and acquire multiple alarm groups based on the multiple historical alarms. Each historical alarm includes a source IP, a destination IP, a rule identifier, and an alarm generation time. All the multiple historical alarms are either accurate alarms or false alarms. Each alarm group includes at least one historical alarm. The source IP, destination IP, and alarm generation time of the historical alarms in each alarm group belong to the same time period. The acquisition module is further configured to acquire the rule identifiers in the multiple alarm groups to obtain multiple second rule sets. The determination module is further configured to determine a rule cluster library based on the multiple second rule sets.

[0022] In one possible implementation, the target rule set includes at least one rule identifier, and the target rule set is a subset of the first rule set; or the overlap between the rule identifiers in the target rule set and the rule identifiers in the first rule set is greater than or equal to a threshold, where the rule overlap is the ratio of the number of rule identifiers in the target rule set that overlap with the first rule set to the total number of rule identifiers in the target rule set.

[0023] The fourth aspect provides a network alarm confirmation device. The device includes: an acquisition module for acquiring multiple historical alarms, where the multiple historical alarms are accurate alarms or false alarms, and each historical alarm includes a rule identifier corresponding to the rule that triggered the generation of the historical alarm; and an analysis module for analyzing the multiple historical alarms to obtain a rule cluster library, the rule cluster library including at least one verification rule set, where the rule identifier in each verification rule set is a relevance rule identifier statistically obtained from the multiple historical alarms. The rule cluster library is used to determine whether multiple alarms to be verified corresponding to the first rule set are accurate alarms or false alarms when the network device determines that a target rule set exists in the rule cluster library based on a first rule set of the target IP. At least some rule identifiers in the target rule set belong to the first rule set, and each alarm to be verified is generated by a data stream from the target IP hitting the rule corresponding to the rule identifier in the alarm to be verified.

[0024] In one possible implementation, the apparatus further includes a determining module. The acquiring module is further configured to acquire multiple historical alarms and, based on these historical alarms, acquire multiple alarm groups. Each historical alarm includes a source IP, a destination IP, a rule identifier, and an alarm generation time. All historical alarms are either accurate alarms or false alarms. Each alarm group includes at least one historical alarm, and the source IP, destination IP, and alarm generation time of the historical alarms in each alarm group belong to the same time period. The acquiring module is also configured to acquire the rule identifiers from the multiple alarm groups to obtain multiple second rule sets. The determining module is configured to determine a rule cluster library based on the multiple second rule sets.

[0025] In one possible implementation, the rule cluster library includes at least one set of validation rules, each set of validation rules being a subset of a plurality of second rule sets.

[0026] A fifth aspect provides a network alarm confirmation device. The device includes a processor and a memory. The processor is coupled to the memory and is configured to execute, based on instructions stored in the memory, the network alarm confirmation method of the first aspect or any possible implementation thereof, or the second aspect or any possible implementation thereof.

[0027] A sixth aspect provides a computer-readable storage medium. The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the network alarm confirmation method of the first aspect or any possible implementation thereof, or the second aspect or any possible implementation thereof. Attached Figure Description

[0028] Figure 1 A schematic diagram of the structure of an embodiment of the network alarm confirmation system provided in this application;

[0029] Figure 2 A flowchart illustrating the first embodiment of the network alarm confirmation method provided in this application;

[0030] Figure 3 A flowchart illustrating the second embodiment of the network alarm confirmation method provided in this application;

[0031] Figure 4 A schematic diagram of the structure of the first embodiment of the network alarm confirmation device provided in this application;

[0032] Figure 5 A schematic diagram of the structure of the second embodiment of the network alarm confirmation device provided in this application;

[0033] Figure 6 A schematic diagram of the structure of an embodiment of the network alarm confirmation device provided in this application. Detailed Implementation

[0034] This application provides a network alarm confirmation method, apparatus, and device to improve the accuracy of network alarms.

[0035] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items. The character “ / ” in this document generally indicates that the preceding and following objects are in an “or” relationship.

[0036] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various messages / frames, requests, and terminal devices, these messages / frames, requests, and terminal devices should not be limited to these terms. These terms are only used to distinguish messages / frames, requests, and terminal devices from one another. For example, without departing from the scope of this application, a first terminal device may also be referred to as a second terminal device, and similarly, a second terminal device may also be referred to as a first terminal device.

[0037] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrase “if determination” or “if detection (of the condition or event of the statement)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the condition or event of the statement)” or “in response to detection (of the condition or event of the statement).”

[0038] Network security devices such as IPS and IDS primarily work by identifying the characteristics of network attacks. Rules corresponding to these characteristics are manually written, and IPS or IDS devices then identify these characteristics in the data stream based on these rules. If a rule is matched, an alert is generated. Therefore, the detection capabilities of network security devices like IPS and IDS largely depend on the richness and accuracy of these rules. If the rules are too vague, they are prone to generating false alarms. However, even with high-quality (precise) rules, if the number of alerts generated is very large, false alarms may still occur, and it cannot be guaranteed that all alerts are accurate.

[0039] Therefore, this application provides the following embodiments: by analyzing and integrating historical alarms, a rule cluster library is output. The rule cluster library is used to perform secondary filtering on alarms generated by high and low quality rules, selecting accurate or false alarms, thereby improving the accuracy of alarms and reducing the human and time costs caused by manual filtering.

[0040] Specifically, such as Figure 1 As shown, Figure 1 This is a schematic diagram of an embodiment of the network alarm confirmation system provided in this application. In this embodiment, the network alarm confirmation system 100 includes an analysis device and a network device. Figure 1 The number of analysis devices and network devices described herein is for illustrative purposes only; the actual number should be used in real-world applications, and this application does not impose any limitations on this. Analysis devices can be computing devices such as servers, computers, tablets, and smart terminals. Network devices can be network security devices such as IPS, IDS, or firewalls.

[0041] In this embodiment, the analysis device analyzes multiple historical alarms to obtain a rule cluster library including at least one set of verification rules, and then distributes this rule cluster library to the network device. The network device then uses this rule cluster library to verify and filter the generated alarms to be verified, selecting accurate alarms or false alarms. In this embodiment, "multiple" refers to two or more alarms.

[0042] Historical alarms are alarms that have been generated previously and confirmed as either accurate or false alarms. Analysis devices can obtain historical data in various ways, such as retrieving it from a database or receiving alarms from multiple network devices.

[0043] Network devices are configured with multiple rules. These rules are used to detect the characteristics of passing data flows. If a data flow matches a rule (i.e., its characteristics match the rule), a corresponding alarm is generated and uploaded to the analysis device. There are several ways for network devices to upload alarms to the analysis device. For example, alarms generated within a certain time period can be uploaded periodically, or alarms can be uploaded in real-time after they are generated. This application does not impose any restrictions on this. Alarms from network devices are manually verified and labeled as accurate or false alarms before being used as historical alarms for analysis. An accurate alarm is one whose corresponding data flow is confirmed to be a malicious attack flow; the alarm is accurate. A false alarm is one whose corresponding data flow is confirmed to be not a malicious attack flow; the alarm is a false alarm.

[0044] The analysis device classifies, statistically analyzes, and filters multiple historical alarms to obtain a rule cluster library. The rule cluster library includes at least one verification rule set, and each verification rule set includes at least two rule identifiers. Specifically, a historical alarm includes a source IP, a destination IP, a rule identifier, and an alarm generation time. The source IP indicates the sender of the data stream that triggered the historical alarm, the destination IP indicates the receiver of the data stream that triggered the historical alarm, and the rule identifier in the historical alarm is the rule identifier of the rule that triggered the historical alarm. The analysis device classifies multiple historical alarms according to the source IP, destination IP, and alarm generation time to obtain multiple alarm groups, such that the source IP, destination IP, and alarm generation time of historical alarms in the same alarm group belong to the same time period. The time period used to divide the alarm group can be the time period of historical alarms belonging to the same source IP and destination IP. The duration of the time period can be 1 minute, 2 minutes, 10 minutes, or 30 minutes, etc., and can also be determined according to the duration of the historical alarm set; this application does not impose any restrictions on this. For example, taking historical alarms as accurate alarms, a certain alarm group is shown in Table 1.

[0045] Table 1. Alarm Groups

[0046] Web Backdoor 1 - PHP One-Line Backdoor 11:01 IP001 IP002 1 Accurate alarm Web backdoor - Upload a one-line backdoor via URI parameters 11:01 IP001 IP002 2 Accurate alarm PHPUnit CVE-2017-9841 Remote Code Execution Vulnerability 11:01 IP001 IP002 3 Accurate alarm

[0047] A data stream represents a network behavior / event. Multiple network behaviors during the network activity process of a source IP have intermittent and diverse characteristics. Therefore, classifying multiple historical alarms according to the source IP, destination IP, and time period can group alarms that occur during the same network activity process into the same alarm group. Thus, analysis based on multiple alarm groups can more quickly and accurately obtain prior knowledge of the network activity process, i.e., the rule cluster library. The verification rule set in the rule cluster library can represent the general pattern of network behavior during the network activity process.

[0048] Specifically, after obtaining multiple alarm groups, the analysis device extracts the rule identifiers of historical alarms from each alarm group to obtain a second rule set corresponding to each alarm group. For example, the second rule set corresponding to the alarm groups in Table 1 is (1, 2, 3). Optionally, if there are duplicate rule identifiers in the second rule set, the duplicate rule identifiers are deduplicated.

[0049] Furthermore, a verification rule set is obtained based on multiple second rule sets, where each verification rule set is a subset of at least some of the multiple second rule sets. For example, given five second rule sets (1, 2, 3), (2, 3, 4), (1, 2, 3, 5), (1, 4, 5), and (1, 5, 6), the verification rule sets (2, 3) and (1, 5) can be extracted.

[0050] There are several methods to obtain a validation rule set based on multiple second rule sets. For example, one can first obtain all possible intersections between each pair of second rule sets. Then, one can count and deduplicate all possible intersections, selecting the intersections whose frequency exceeds a threshold or ranks in the top N (in descending order) and whose number of elements is greater than or equal to 2 as the validation rule set. Here, N is a non-zero natural number. Counting and deduplicating intersections means counting the number of a given intersection. When intersection A is a subset of another intersection B, only intersection A is retained, and intersection B is removed. The number of elements in intersection B is included in the number of elements in intersection A. For example, the possible intersections between any two pairs of the five second rule sets (1, 2, 3), (2, 3, 4), (1, 2, 3, 5), (1, 4, 5), and (1, 5, 6) are (2, 3), (1, 2, 3), (1), (2, 3), (4), (1, 5), (1, 5), and (1, 5). Among them, the intersection (2, 3) is a subset of the intersection (1, 2, 3), so the intersection (1, 2, 3) is included in the number of intersections (2, 3). The number of intersections (2, 3) is 3, and the number of intersections (1, 5) is 3. Since the number of elements in intersections (1) and (5) is less than 2, it can be determined that the intersections (2, 3) and (1, 5) are the verification rule sets.

[0051] For example, the correlation between rule identifiers in the second rule set can be calculated to determine that rule identifiers with a correlation greater than a threshold belong to the same validation rule set. The correlation between two rule identifiers a and b can be calculated, for example, by dividing the number of second rule sets containing both rule identifiers a and b by the number of second rules containing rule identifier a; the ratio obtained is the correlation between rule identifier a and rule identifier b. Similarly, the correlation between rule identifier b and rule identifier a can be calculated. The degree of association between rule identifier a and rule identifier b can be taken as... and The larger, smaller, or average of the two rule identifiers. Optionally, to improve the reliability of the validation rule set, it can also be determined by combining the number of second rule sets that simultaneously contain both rule identifiers. For example, if the correlation between two rule identifiers is greater than a first threshold, and the number of second rule sets that simultaneously contain both rule identifiers is greater than a second threshold, then the two rule identifiers are determined to constitute a validation rule set. Similarly, it is also possible to determine whether multiple rule identifiers can constitute a validation rule set by calculating the correlation between multiple rule identifiers, which will not be elaborated here. Optionally, the multiple validation rule sets determined by the correlation between rule identifiers can be further deduplicated, that is, when one validation rule set is a subset of another validation rule set, only the subset is retained.

[0052] In this embodiment, depending on the purpose of the rule cluster library, it can be a first rule cluster library for verifying alarms as accurate alarms, or a second rule cluster library for verifying alarms as false alarms. Of course, the rule cluster library can also include both the first and second rule cluster libraries. It can be understood that multiple historical alarms used to analyze and obtain the first rule cluster library are all accurate alarms, meaning the first rule cluster library is obtained based on the analysis of multiple attack behaviors during multiple attack activities. Similarly, multiple historical alarms used to analyze and obtain the second rule cluster library are all false alarms, meaning the second rule cluster library is obtained based on the analysis of normal behaviors during multiple normal network activities that were mistakenly reported as attack behaviors. Optionally, if a verification rule set exists in both the first and second rule cluster libraries, then that verification rule set is removed from both the first and second rule cluster libraries, thereby improving the reliability and accuracy of the rule cluster library.

[0053] After the analysis equipment obtains the rule cluster library, it distributes the rule cluster library to the network devices. After configuring the rule cluster library, the network devices use the rule cluster library to verify subsequent alarms, thereby determining whether the subsequent alarms are accurate alarms or false alarms.

[0054] Specifically, network devices use rules to inspect data flows, generating corresponding alarms when a rule is matched by the data flow. The alarm includes information such as the source IP, destination IP, rule identifier, and alarm generation time. The network device retrieves multiple unverified alarms corresponding to the target IP based on the source IP, destination IP, and alarm generation time. The target IP is the source IP, and the source and destination IPs of multiple unverified alarms are the same. To ensure that the network behaviors corresponding to multiple unverified alarms belong to the same network activity process, the alarm generation times of the multiple unverified alarms belong to the same time period. For example, among the multiple alarms corresponding to the target IP and destination IP, alarms within the time period where they are concentrated are identified as unverified alarms. Another example is that the multiple alarms for the target IP and destination IP are sorted by alarm generation time from smallest to largest, and alarms within the time period from the earliest alarm generation time to the earliest alarm generation time plus a preset duration are identified as unverified alarms. The preset duration is, for example, 1 minute, 2 minutes, 5 minutes, 10 minutes, or 30 minutes. For example, among the multiple alarms corresponding to the target IP and destination IP, alarms generated within a preset time period before the current time are selected as alarms to be verified.

[0055] Extract rule identifiers from multiple alarms to be verified to obtain a first rule set. Compare the first rule set with the verification rule sets in the rule cluster library to determine whether a target rule set exists in the rule cluster library. At least some rule identifiers in the target rule set belong to the first rule set. For example, the target rule set is a subset of the first rule set. For instance, if the first rule set is (1, 2, 3, 4), and the rule cluster library includes two verification rule sets (1, 5) and (2, 3), then there exists a verification rule set (2, 3) that is a subset of the first rule set (1, 2, 3, 4), meaning the target rule set exists in the rule cluster library. Alternatively, the overlap between the rule identifiers in the target rule set and the rule identifiers in the first rule set is greater than or equal to a threshold. The rule overlap is the ratio of the number of rule identifiers that overlap between the target rule set and the first rule set to the total number of rule identifiers in the target rule set. For example, the first rule set is (1, 2, 3, 4), and the rule cluster library includes two verification rule sets (1, 5) and (2, 3, 5). The overlap threshold is 60%. The number of overlapping rule identifiers between the verification rule set (2, 3, 5) and the first rule set (1, 2, 3, 4) in the rule cluster library is 2, and the number of rule identifiers in the verification rule set (2, 3, 5) is 3. Then, the overlap between the verification rule set (2, 3, 5) and the first rule set (1, 2, 3, 4) can be calculated to be 66.67%, which is greater than the overlap threshold, that is, the target rule set exists in the rule cluster library.

[0056] If the target rule set exists in the rule cluster library, then multiple alarms awaiting verification can be determined to be accurate alarms or false alarms. Since the rule identifiers within the same verification rule set are correlated in this embodiment, analysis of multiple historical network activity processes indicates that if, during a certain network activity of a particular IP, a first network behavior triggers a rule corresponding to a first rule identifier in the verification rule set to generate a corresponding alarm, there is a high probability that a second network behavior will also trigger a rule corresponding to a second rule identifier in the same verification rule set to generate a corresponding alarm. In other words, the first and second network behaviors often coexist in multiple network activity processes, resulting in the first and second rule identifiers often belonging to multiple different second rule sets simultaneously. Therefore, in a network activity process awaiting verification, when at least two network behaviors corresponding to a verification rule set are proven to exist simultaneously, it can be determined whether it is an attack or a normal behavior.

[0057] Specifically, if the rule cluster library includes a first rule cluster library, and the target rule set belongs to the first rule cluster library, since the first rule cluster library is obtained from the analysis of accurate alerts generated by multiple attack behaviors during multiple historical attack activities, the verification rule set in the first rule cluster library represents at least two attack behaviors that will occur simultaneously during the attack activity. The existence of the target rule set in the first rule cluster library means that during the network activity to be verified corresponding to multiple unverified alerts, at least two network behaviors are attack behaviors that frequently occur simultaneously during historical attack activities. Therefore, it can be confirmed that the network activity to be verified is a network attack activity, the target IP is the attacking IP, the data stream sent by the target IP is the attack data stream, and the multiple unverified alerts are accurate alerts.

[0058] If the rule cluster library includes a second rule cluster library, and the target rule set belongs to the second rule cluster library, since the second rule cluster library is derived from the analysis of false alarms generated by multiple network behaviors during multiple normal network activities, the verification rule set in the second rule cluster library represents normal network behaviors that are likely to simultaneously trigger false alarms during normal network activities. The existence of the target rule set in the second rule cluster library, meaning that in the network activities corresponding to multiple unverified alarms, at least two network behaviors are normal network behaviors that frequently trigger false alarms simultaneously during historical normal network activities, can confirm that the network activity process to be verified is a normal network activity, the target IP is not an attacking IP, the data stream sent by the target IP is not an attack data stream, and the multiple unverified alarms are false alarms.

[0059] In this embodiment, by analyzing historical alarms, a rule cluster library consisting of at least one set of associated rule identifiers is obtained. The alarm to be verified is then verified according to the rule cluster library to determine whether the alarm to be verified is an accurate alarm or a false alarm, thereby improving the accuracy of alarms. Furthermore, there is no need for manual screening to distinguish between false alarms and accurate alarms, which can reduce manpower and time costs.

[0060] Optionally, after confirming that multiple unverified alarms are accurate alarms, the network device can further confirm all alarms corresponding to the target IP as accurate alarms. For devices such as firewalls or IPS, all data streams from the target IP can be blocked, or the target IP can be added to a blacklist, thereby preventing losses caused by network attacks.

[0061] In some other implementations, the network device itself can obtain the rule cluster library based on the analysis of multiple historical alarms, without needing an analysis device to obtain the rule cluster library and then distribute it to the network device. In this case, the method by which the network device obtains the rule cluster library is similar to the method by which the analysis device obtains the rule cluster library based on the analysis of multiple historical alarms, and therefore will not be described in detail here. Optionally, to ensure the security of the process of obtaining the rule cluster library and to prevent malicious attacks or tampering during the generation of the rule cluster library, which could lead to inaccurate rule cluster libraries, the network device can operate independently of the private network or complete the closed loop within the network device.

[0062] In some other implementations, after detecting multiple unverified alarms for a target IP, the network device can also send these alarms to an analysis device. The analysis device then verifies these alarms based on a rule cluster library. After obtaining the verification results for the multiple unverified alarms for the target IP, the analysis device sends the results back to the network device, which then performs subsequent operations based on the verification results. For example, if the verification results indicate that the multiple unverified alarms for the target IP are accurate alarms, the network device can further intercept data streams from the target IP.

[0063] like Figure 2 As shown, Figure 2 This is a flowchart illustrating the first embodiment of the network alarm confirmation method provided in this application. The executing entity in this embodiment is a network device. The network device may be, for example, a firewall, IPS, or IDS. This embodiment includes the following steps:

[0064] S201: Obtain the rule identifiers from multiple pending alarms of the target IP to obtain the first rule set. Each pending alarm is generated by the rule corresponding to the rule identifier in the pending alarm when the data stream from the target IP hits it.

[0065] S202: Based on the first rule set, at least one verification rule set of the rule cluster library contains a target rule set, at least some rule identifiers in the target rule set belong to the first rule set, and the rule identifiers in each verification rule set are relevance rule identifiers obtained from multiple historical alarms.

[0066] S203: Determine whether multiple alarms to be verified are accurate alarms or false alarms.

[0067] For detailed procedures of S201-S203 in this embodiment, please refer to the operation of the network device in the embodiment of the network alarm confirmation system, and therefore will not be repeated here.

[0068] Optionally, in some implementations, after S203, the network device may also intercept data streams from the target IP.

[0069] like Figure 3 As shown, Figure 3 This is a flowchart illustrating a second embodiment of the network alarm confirmation method provided in this application. The executing entity in this embodiment can be a network device or an analysis device. Network devices include, for example, firewalls, IPS, or IDS. Analysis devices include, for example, servers, computers, tablets, smart terminals, and other devices with computing power. This embodiment includes the following steps:

[0070] S301: Obtain multiple historical alarms, which may be accurate alarms or false alarms. Each historical alarm includes the rule identifier corresponding to the rule that triggered the generation of the historical alarm.

[0071] S302: Analyze multiple historical alarms to obtain a rule cluster library. The rule cluster library includes at least one verification rule set. The rule identifier in each verification rule set is a relevance rule identifier obtained statistically from multiple historical alarms. The rule cluster library is used to determine whether multiple alarms to be verified corresponding to the first rule set are accurate alarms or false alarms when the network device determines that the target rule set exists in the rule cluster library based on the first rule set of the target IP. At least some rule identifiers in the target rule set belong to the first rule set. Each alarm to be verified is generated by the rule corresponding to the rule identifier in the alarm to be verified when the data stream from the target IP hits the rule in the alarm to be verified.

[0072] The detailed process of S301-S302 in this embodiment is similar to the operation of the analysis device in the network alarm confirmation system embodiment, so it will not be described again here.

[0073] like Figure 4 As shown, Figure 4 This is a schematic diagram of the structure of a first embodiment of the network alarm confirmation device provided in this application. In this embodiment, the network alarm confirmation device 400 includes an acquisition module 401 and a determination module 402.

[0074] The acquisition module 401 is used to acquire rule identifiers from multiple unverified alarms of the target IP to obtain a first rule set. Each unverified alarm is generated by the rule corresponding to the rule identifier in the unverified alarm when the data stream from the target IP hits it.

[0075] The determination module 402 is used to determine, based on the first rule set, that at least one verification rule set in the rule cluster library contains a target rule set. At least some rule identifiers in the target rule set belong to the first rule set, and the rule identifiers in each verification rule set are relevance rule identifiers obtained statistically from multiple historical alarms.

[0076] The determination module 402 is also used to confirm whether multiple alarms to be verified are accurate alarms or false alarms.

[0077] In one possible implementation, the rule cluster library includes a first rule cluster library for verifying at least one alarm to be verified as an accurate alarm, and the target rule set belongs to the first rule cluster library. The determination module 402 is used to determine that multiple alarms to be verified are accurate alarms.

[0078] In one possible implementation, the device 400 further includes an interception module 403 for intercepting data streams from the target IP.

[0079] In one possible implementation, the rule cluster library includes a second rule cluster library for verifying at least one alarm to be verified as a false alarm, and the target rule set belongs to the second rule cluster library. The determination module 402 is used to determine that multiple alarms to be verified are accurate alarms.

[0080] In one possible implementation, the acquisition module 401 is further configured to acquire multiple historical alarms and, based on these historical alarms, acquire multiple alarm groups. Each historical alarm includes a source IP, a destination IP, a rule identifier, and an alarm generation time. All historical alarms are either accurate alarms or false alarms. Each alarm group includes at least one historical alarm, and the source IP, destination IP, and alarm generation time of the historical alarms in each alarm group belong to the same time period. The acquisition module 401 is also configured to acquire the rule identifiers from the multiple alarm groups to obtain multiple second rule sets. The determination module 402 is further configured to determine a rule cluster library based on the multiple second rule sets.

[0081] In one possible implementation, the target rule set includes at least one rule identifier, and the target rule set is a subset of the first rule set. Alternatively, the overlap between the rule identifiers in the target rule set and the rule identifiers in the first rule set is greater than or equal to a threshold, where the rule overlap is the ratio of the number of rule identifiers in the target rule set that overlap with the first rule set to the total number of rule identifiers in the target rule set.

[0082] like Figure 5 As shown, Figure 5This is a schematic diagram of the structure of a second embodiment of the network alarm confirmation device provided in this application. In this embodiment, the network alarm confirmation device 500 includes an acquisition module 501 and an analysis module 502.

[0083] The acquisition module 501 is used to acquire multiple historical alarms. These historical alarms can be accurate alarms or false alarms, and each historical alarm includes a rule identifier corresponding to the rule that triggered the generation of the historical alarm.

[0084] Analysis module 502 is used to analyze multiple historical alarms to obtain a rule cluster library. The rule cluster library includes at least one verification rule set. The rule identifiers in each verification rule set are relevance rule identifiers statistically obtained from multiple historical alarms. The rule cluster library is used to determine whether multiple alarms to be verified corresponding to the first rule set are accurate alarms or false alarms when the network device determines that the target rule set exists in the rule cluster library based on the first rule set of the target IP. At least some rule identifiers in the target rule set belong to the first rule set. Each alarm to be verified is generated by the data stream from the target IP hitting the rule corresponding to the rule identifier in the alarm to be verified.

[0085] In one possible implementation, the device 500 further includes a determining module 503. The acquiring module 501 is further configured to acquire multiple historical alarms and acquire multiple alarm groups based on the multiple historical alarms. Each historical alarm includes a source IP, destination IP, rule identifier, and alarm generation time. All historical alarms are either accurate alarms or false alarms. Each alarm group includes at least one historical alarm, and the source IP, destination IP, and alarm generation time of the historical alarms in each alarm group belong to the same time period. The acquiring module 501 is further configured to acquire rule identifiers from the multiple alarm groups to obtain multiple second rule sets. The determining module 503 is configured to determine a rule cluster library based on the multiple second rule sets.

[0086] In one possible implementation, the rule cluster library includes at least one set of validation rules, each set of validation rules being a subset of a plurality of second rule sets.

[0087] In one possible implementation, the target rule set includes at least one rule identifier, and the target rule set is a subset of the first rule set. Alternatively, the overlap between the rule identifiers in the target rule set and the rule identifiers in the first rule set is greater than or equal to a threshold, where the rule overlap is the ratio of the number of rule identifiers in the target rule set that overlap with the first rule set to the total number of rule identifiers in the target rule set.

[0088] like Figure 6 As shown, Figure 6This is a schematic diagram of an embodiment of the network alarm confirmation device provided in this application. The network alarm confirmation device 600 includes a processor 601 and a memory 602. The processor 601 is coupled to the memory 602, and the processor 601 is configured to execute the above-described instructions based on instructions stored in the memory 602. Figure 2 Alternatively, use the network alarm confirmation method described in section 3.

[0089] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a computer, implements the channel configuration method flow of any of the above method embodiments.

[0090] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0091] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical or other forms.

[0092] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0093] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0094] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the technical solution of this application can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, analysis device, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for confirming network alarms, characterized in that, Applied to network devices, the method includes: A first rule set is obtained by obtaining the rule identifiers from multiple pending alarms of the target IP. Each pending alarm is generated by the rule corresponding to the rule identifier in the pending alarm when the data stream from the target IP hits the target alarm. According to the first rule set, at least one verification rule set of the rule cluster library contains a target rule set, and at least some rule identifiers in the target rule set belong to the first rule set. The rule identifiers in each verification rule set are relevance rule identifiers obtained from multiple historical alarms. The multiple alarms to be verified are determined to be accurate alarms or false alarms.

2. The method according to claim 1, characterized in that, The rule cluster library includes a first rule cluster library for verifying at least one alarm to be verified as an accurate alarm, the target rule set belongs to the first rule cluster library, and determining whether the plurality of alarms to be verified are accurate alarms or false alarms includes: The multiple alarms to be verified were determined to be accurate alarms.

3. The method according to claim 2, characterized in that, After determining that the plurality of alarms to be verified are accurate alarms, the process further includes: Intercept data streams originating from the target IP.

4. The method according to claim 1, characterized in that, The rule cluster library includes a second rule cluster library for verifying at least one alarm to be verified as a false alarm, the target rule set belongs to the second rule cluster library, and determining whether the plurality of alarms to be verified are accurate alarms or false alarms includes: The multiple alarms to be verified were determined to be false alarms.

5. The method according to any one of claims 1 to 4, characterized in that, Before determining that at least one verification rule set in the rule cluster library exists based on the first rule set, the process includes: The rule cluster library sent by the analysis device is received.

6. The method according to any one of claims 1 to 4, characterized in that, Before determining that at least one verification rule set in the rule cluster library exists based on the first rule set, the process includes: The plurality of historical alarms are obtained, each of which includes source IP, destination IP, rule identifier and alarm generation time. All of the plurality of historical alarms are either accurate alarms or false alarms. Multiple alarm groups are obtained based on the multiple historical alarms. Each alarm group includes at least one of the historical alarms. The source IP, destination IP, and alarm generation time of the historical alarms in each alarm group belong to the same time period. Multiple second rule sets are obtained by retrieving the rule identifiers from the multiple alarm groups; The rule cluster library is determined based on the multiple second rule sets.

7. The method according to claim 6, characterized in that, Each of the verification rule sets is at least a subset of a portion of the plurality of second rule sets.

8. The method according to any one of claims 1 to 4, characterized in that, The target rule set includes at least two rule identifiers, and the target rule set is a subset of the first rule set; or, The overlap between the rule identifiers in the target rule set and the rule identifiers in the first rule set is greater than or equal to a threshold. The overlap is the ratio of the number of rule identifiers in the target rule set that overlap with the first rule set to the total number of rule identifiers in the target rule set.

9. A method for confirming network alarms, characterized in that, The method includes: Multiple historical alarms are acquired, which are either accurate alarms or false alarms. Each historical alarm includes a rule identifier corresponding to the rule that triggered the generation of the historical alarm. Analyzing the multiple historical alarms yields a rule cluster library, which includes at least one verification rule set. Each rule identifier in the verification rule set is a relevance-based rule identifier statistically obtained from the multiple historical alarms. The rule cluster library is used to determine whether multiple alarms to be verified corresponding to the first rule set are accurate alarms or false alarms when the network device determines that a target rule set exists in the rule cluster library based on the first rule set of the target IP. At least some rule identifiers in the target rule set belong to the first rule set. Each alarm to be verified is generated by a data stream from the target IP hitting a rule corresponding to a rule identifier in the alarm to be verified.

10. The method according to claim 9, characterized in that, Each historical alarm includes a source IP, a destination IP, and the alarm generation time. Analyzing these historical alarms yields a rule cluster library including: Multiple alarm groups are obtained based on the multiple historical alarms. Each alarm group includes at least one of the historical alarms. The source IP, destination IP, and alarm generation time of the historical alarms in each alarm group belong to the same time period. Multiple second rule sets are obtained by retrieving the rule identifiers from the multiple alarm groups; The rule cluster library is determined based on the multiple second rule sets.

11. The method according to claim 10, characterized in that, The rule cluster library includes at least one verification rule set, and each verification rule set is a subset of a portion of the second rule sets in the plurality of second rule sets.

12. A network alarm confirmation device, characterized in that, The device includes: The acquisition module is used to acquire rule identifiers from multiple unverified alarms of the target IP to obtain a first rule set. Each unverified alarm is generated by the data stream from the target IP hitting the rule identifier corresponding to the rule in the unverified alarm. The determination module is configured to determine, based on the first rule set, that at least one verification rule set in the rule cluster library contains a target rule set, wherein at least some rule identifiers in the target rule set belong to the first rule set, and each rule identifier in the verification rule set is a relevance rule identifier obtained statistically from multiple historical alarms. The determining module is also used to confirm whether the plurality of alarms to be verified are accurate alarms or false alarms.

13. The apparatus according to claim 12, characterized in that, The rule cluster library includes a first rule cluster library for verifying at least one alarm to be verified as an accurate alarm, and the target rule set belongs to the first rule cluster library; The determining module is used to determine that the plurality of alarms to be verified are accurate alarms.

14. The apparatus according to claim 13, characterized in that, The device further includes: The interception module is used to intercept data streams from the target IP.

15. The apparatus according to claim 12, characterized in that, The rule cluster library includes a second rule cluster library for verifying that at least one alarm to be verified is a false alarm, and the target rule set belongs to the second rule cluster library; The determining module is used to determine that the plurality of alarms to be verified are accurate alarms.

16. The apparatus according to any one of claims 12 to 15, characterized in that, The acquisition module is further configured to acquire the plurality of historical alarms and acquire a plurality of alarm groups based on the plurality of historical alarms. Each historical alarm includes a source IP, a destination IP, a rule identifier, and an alarm generation time. The plurality of historical alarms are either accurate alarms or false alarms. Each alarm group includes at least one of the historical alarms. The source IP, the destination IP, and the alarm generation time of the historical alarms in each alarm group belong to the same time period. The acquisition module is also used to acquire rule identifiers in the multiple alarm groups to obtain multiple second rule sets; The determining module is further configured to determine the rule cluster library based on the plurality of second rule sets.

17. The apparatus according to any one of claims 12 to 15, characterized in that, The target rule set includes at least one rule identifier, and the target rule set is a subset of the first rule set; or, The overlap between the rule identifiers in the target rule set and the rule identifiers in the first rule set is greater than or equal to a threshold. The overlap is the ratio of the number of rule identifiers in the target rule set that overlap with the first rule set to the total number of rule identifiers in the target rule set.

18. A network alarm confirmation device, characterized in that, The device includes: The acquisition module is used to acquire multiple historical alarms, which are accurate alarms or false alarms. Each historical alarm includes a rule identifier corresponding to the rule that triggered the generation of the historical alarm. An analysis module is used to analyze the multiple historical alarms to obtain a rule cluster library. The rule cluster library includes at least one verification rule set. The rule identifier in each verification rule set is a relevance rule identifier obtained statistically from the multiple historical alarms. The rule cluster library is used to determine whether multiple alarms to be verified corresponding to the first rule set are accurate alarms or false alarms when the network device determines that a target rule set exists in the rule cluster library based on the first rule set of the target IP. At least some rule identifiers in the target rule set belong to the first rule set. Each alarm to be verified is generated by the data stream from the target IP hitting the rule corresponding to the rule identifier in the alarm to be verified.

19. The apparatus according to claim 18, characterized in that, The device also includes a determining module; The acquisition module is further configured to acquire the plurality of historical alarms and acquire a plurality of alarm groups based on the plurality of historical alarms. Each historical alarm includes a source IP, a destination IP, a rule identifier, and an alarm generation time. The plurality of historical alarms are either accurate alarms or false alarms. Each alarm group includes at least one of the historical alarms. The source IP, the destination IP, and the alarm generation time of the historical alarms in each alarm group belong to the same time period. The acquisition module is also used to acquire rule identifiers in the multiple alarm groups to obtain multiple second rule sets; The determining module is used to determine the rule cluster library based on the plurality of second rule sets.

20. The apparatus according to claim 19, characterized in that, The rule cluster library includes at least one verification rule set, and each verification rule set is a subset of a portion of the second rule sets in the plurality of second rule sets.

21. A network alarm confirmation device, characterized in that, The device includes a processor and a memory, the processor being coupled to the memory, and the processor being configured to execute the network alarm confirmation method as described in any one of claims 1-11 based on instructions stored in the memory.

22. A computer-readable storage medium, characterized in that, The instructions include, when the computer-readable storage medium is run on a computer, causing the computer to perform the network alarm confirmation method as described in any one of claims 1-11.

Images