Alarm data processing method, device, medium and electronic equipment

Abstract

The present disclosure relates to an alarm data processing method, device, medium and electronic device. The method includes: obtaining multiple alarm data to be processed; for each of at least part of the alarm data in the multiple alarm data, extracting the threat indicator in the alarm data; for each of at least part of the extracted threat indicators, performing data association analysis on the threat indicator to associate historical data related to the threat indicator. In this way, threat indicators can be automatically extracted from the alarm data, and data association analysis of threat indicators can be automatically performed, avoiding problems such as low operational efficiency and low alarm accuracy caused by repetitive data tracing and manual search, thereby greatly improving security operation efficiency and alarm accuracy, saving operational manpower, and allowing security operation personnel to focus on real risk events on the basis of ensuring operational coverage, and improve the discovery rate of real risks under the same number of alarm conditions.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to an alarm data processing method, device, medium and electronic device. Background Art

[0002] Network traffic products occupy a key position as the first line of defense in the enterprise security protection architecture. They are facing a large number of security attacks all the time, and inevitably generate massive alarm logs. The traditional network traffic security alarm operation method is that security operators analyze alarms one by one after merging and deduplicating alarms, and combine various data dimensions such as hosts and businesses to trace and collect evidence to determine whether the alarms are real security risks. When there are massive alarms on the equipment, if full operation is to be achieved, there will be a significant gap between the manpower required for enterprise security operations and the number of alarms, and similar repetitive data tracing and manual search will result in low operational efficiency. In addition, the above-mentioned operation method cannot really solve the problem of full operation of related high-risk scenarios in a real and complex network and business environment, and it is very easy to cause underreporting and false alarms. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] In a first aspect, the present disclosure provides an alarm data processing method, comprising:

[0005] Get multiple alarm data to be processed;

[0006] For each of at least a portion of the plurality of alarm data, extracting a threat indicator in the alarm data;

[0007] For each of at least a portion of the extracted threat indicators, data association analysis is performed on the threat indicator to associate historical data related to the threat indicator.

[0008] In a second aspect, the present disclosure provides an alarm data processing device, comprising:

[0009] An acquisition module, used to acquire multiple alarm data to be processed;

[0010] An extraction module, configured to extract a threat indicator in each of at least a portion of the plurality of alarm data;

[0011] The association analysis module is used to perform data association analysis on each of at least a portion of the extracted threat indicators to associate historical data related to the threat indicator.

[0012] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the alarm data processing method provided in the first aspect of the present disclosure.

[0013] In a fourth aspect, the present disclosure provides an electronic device, including:

[0014] a storage device having a computer program stored thereon;

[0015] A processing device is used to execute the computer program in the storage device to implement the steps of the alarm data processing method provided in the first aspect of the present disclosure.

[0016] Through the above technical solution, threat indicators can be automatically extracted from the alarm data, and data correlation analysis of threat indicators can be automatically performed, avoiding problems such as low operational efficiency and low alarm accuracy caused by repetitive data tracing and manual search. This can greatly improve security operation efficiency and alarm accuracy, save operational manpower, and allow security operations personnel to focus on real risk events while ensuring operational coverage, thereby improving the discovery rate of real risks under the same number of alarms.

[0017] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0019] Figure 1 The diagram is a schematic diagram of an alarm data processing system according to an exemplary embodiment.

[0020] Figure 2 The figure is a flowchart of a method for processing alarm data according to an exemplary embodiment.

[0021] Figure 3 The diagram is a schematic diagram of a threat indicator extraction method according to an exemplary embodiment.

[0022] Figure 4 The figure is a schematic diagram of a process of data association analysis according to an exemplary embodiment.

[0023] Figure 5 The diagram is a schematic diagram showing a process of associating session data according to an exemplary embodiment.

[0024] Figure 6 The diagram is a schematic diagram showing a process of associating host data according to an exemplary embodiment.

[0025] Figure 7 The present invention is a schematic diagram of a process of associating intelligence data according to an exemplary embodiment.

[0026] Figure 8 The present invention is a schematic diagram showing a process of DNS data association according to an exemplary embodiment.

[0027] Fig. 9 The figure is a schematic diagram of a warning prediction process according to an exemplary embodiment.

[0028] Fig.10 The figure is a block diagram of an alarm data processing device according to an exemplary embodiment.

[0029] Fig.11 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0030] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0031] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0032] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0033] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0034] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0035] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0036] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0037] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0038] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0039] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0040] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0041] The present disclosure provides an alarm data processing system, such as Figure 1As shown, the system includes a traffic automatic analysis module and a data association analysis module, wherein the traffic automatic analysis module includes a data preprocessing module and a network traffic data intelligent analysis module. The data preprocessing module is used to filter out some common false alarm data or alarm data of irrelevant business scenarios from the alarm data to be processed. The network traffic data intelligent analysis module mainly distinguishes the alarm data based on knowledge scenarios and natural language technology, automatically identifies the threat indicators (Indicators of Compromise, IOC) information in common high-risk scenarios and provides a unified interface service for structured processing of the extracted threat indicators to obtain structured threat indicators (i.e. Figure 1 The intelligent analysis module of network traffic data is the most important and basic link to improve the accuracy of alarm analysis and operational efficiency. After the IOC is identified, the IOC can be matched with the IOC whitelist, and the IOCs outside the IOC whitelist can be identified as threat intelligence. In the field of network security, IOCs are key data points for identifying and detecting malicious activities. These indicators can be file hash values, malicious IP addresses, registry entries, etc.

[0042] like Figure 1 As shown, the network traffic data intelligent analysis module mainly covers attack scenarios such as rebound Shell (Reverse Shell, also known as reverse Shell), file download, vulnerability verification, domain name query, encoding scenario, host command execution, sandbox escape, etc.

[0043] The data association analysis module is used to associate the Domain Name System (DNS) data, session data, intelligence data and Host-based IDS (HIDS) data (hereinafter referred to as host data) of each structured threat indicator to associate related historical data, thereby obtaining multiple suspected risk information, and conducting alarm analysis based on multiple suspected risk information to identify real risk information, which is then provided to the Security Information and Event Management (SIEM) / Security Orchestration Automation and Response (SOAR) operation platform to generate security work orders based on the real risk information.

[0044] Figure 2 FIG. 1 is a flow chart of a method for processing alarm data according to an exemplary embodiment. Figure 2As shown, the alarm data processing method may include the following S101 to S103.

[0045] In S101, a plurality of alarm data to be processed is obtained.

[0046] like Figure 1 As shown, multiple alarm data to be processed can be obtained from the Transmit Load Balancing (TLB) alarm log message queue and the Network Traffic Analysis (NTA) alarm log message queue. By connecting the TLB alarm log to the alarm data processing system, its related capabilities can be used to solve the problem of partial encrypted traffic detection coverage, so that the encrypted log can also be incorporated into the security operation scope, achieving the effect of expanding the traffic security operation scope.

[0047] In S102, for each of at least a portion of the multiple alarm data, a threat indicator in the alarm data is extracted.

[0048] In the present disclosure, the threat indicator in each of the multiple alarm data may be extracted, or the threat indicator in part of the multiple alarm data may be extracted.

[0049] In S103, for each of at least a portion of the extracted threat indicators, data association analysis is performed on the threat indicator to associate historical data related to the threat indicator.

[0050] In the present disclosure, data association analysis may be performed on each of the extracted threat indicators, or data association analysis may be performed on some of the extracted threat indicators.

[0051] Through the above technical solution, threat indicators can be automatically extracted from the alarm data, and data correlation analysis of threat indicators can be automatically performed, avoiding problems such as low operational efficiency and low alarm accuracy caused by repetitive data tracing and manual search. This can greatly improve security operation efficiency and alarm accuracy, save operational manpower, and allow security operations personnel to focus on real risk events while ensuring operational coverage, thereby improving the discovery rate of real risks under the same number of alarms.

[0052] The following is a detailed description of the specific implementation of extracting the threat indicator from the alarm data in S102. Specifically, it can be implemented through steps (11) and (12).

[0053] Step (11): Utilize a classification model based on machine learning and multiple extraction models based on regular expressions to respectively extract threat indicators from the alarm data.

[0054] Step (12): Generate a threat indicator extraction result in the alarm data based on the first extraction result of the classification model and the second extraction result of each extraction model.

[0055] In the present disclosure, the above-mentioned classification model based on machine learning can be a language model such as Bidirectional Encoder Representation from Transformers (BERT), or a deep learning model such as a convolutional neural network and a recurrent neural network.

[0056] The above-mentioned multiple extraction models based on regular expressions may include an expert model based on regular expressions of attack types and at least one general model based on general regular expressions. The number of general models may be one or more. The regular expression uses a single string to describe and match a series of strings that conform to a certain IOC rule. If the regular expression successfully matches the data to be matched, it means that the data to be matched contains IOC.

[0057] Regular expressions based on attack types are regular expressions summarized by security experts based on known attack types, that is, regular expressions summarized based on attack-related IOC rules. The expert model extracts attack threat indicators in the alarm data based on these regular expressions. Attack types may include one or more of the following: Structured Query Language (SQL) injection attacks, cross-site scripting attacks (XSS), information leakage attacks, code injection attacks, file upload attacks, file inclusion attacks, weak password attacks, etc. Here, the attack types are only exemplarily explained without specific limitations.

[0058] like Figure 3 As shown in the figure, the expert model can use the summary of known attack scenarios to cover the detection of various threat indicator types such as network address (IP), port (Port), domain name (Domain), link (URL), command (Command, i.e. binary program, such as python, curl, wget, git, etc.), attack type identification, etc., and provide the attack type identification function to give additional attack scenario semantics to the alarm data, which is conducive to understanding the attack data and supporting other upstream businesses.

[0059] The general regular expression is an expression defined based on the general IOC rule, wherein the general IOC rule is determined based on the data characteristics of the corresponding IOC, and the general model is used to extract the general threat indicator.

[0060] Among them, multiple extraction models may include an expert model based on regular expressions of attack types and a general model based on general regular expressions; or, multiple extraction models may include an expert model based on regular expressions of attack types and multiple general models based on general regular expressions. When there are multiple general models, the regular expressions used by the multiple general models are different. Different general models focus on different types of threat indicators, and are irrelevant to the fixed pattern or attack scenario of the alarm data, and can actively extract all IOCs of the corresponding threat indicator type from the alarm data of unknown threats.

[0061] Different general models may use different regular expressions to process the same threat indicator type, representing extraction strategies of different strictness or standards, which may result in differences in the extraction results of different general models, that is, different general models provide detection capabilities for different threat indicator types.

[0062] For example, Figure 3 As shown, multiple extraction models include an expert model and three general models, namely general model A, general model B and general model C, wherein general model A and general model B can be used for detecting three types of threat indicators, namely IP, Domain and URL, and general model C is used for detecting two types of threat indicators, namely IP and URL.

[0063] In the above implementation, the expert model relies on the experience and knowledge of the expert, focusing on the extraction of threat indicators for known or fixed-pattern attack scenarios, achieving rapid detection efficiency and ensuring basic detection results. At the same time, in order to address the problem that regular expressions can usually only match specific text patterns, an additional extractor for general threat indicators (i.e., a general model) is provided to provide a certain degree of flexibility in detection capabilities, and to provide basic detection results for specific threat indicator types (e.g., IP, domain name, URL, etc.) when expert experience has not been accumulated.

[0064] In addition, if Figure 3 As shown in the figure, the expert model also supports adding new regular expressions to the regular expression whitelist, or adding the configuration of the new regular expression to the regular expression pattern configuration set for checking suspicious data, thereby improving the scalability of the expert model to adapt to the dynamic changes and increasing complexity of network threats.

[0065] In order to facilitate the analysis and extraction of IOC, such as Figure 3As shown, after obtaining multiple alarm data to be processed, data preprocessing can be performed on the multiple alarm data respectively to obtain multiple text data. After that, the classification model and each extraction model can extract IOC from the multiple text data.

[0066] The preprocessing process of alarm data can include the following three steps:

[0067] ① Data cleaning: mainly removes invalid, redundant and irrelevant data in the alarm data to improve data quality. For example, remove redundant data packets in the alarm data, fill in missing values, and process abnormal values.

[0068] ②Data conversion: mainly converting the data obtained after data cleaning into a format suitable for analysis. This includes converting binary and hexadecimal data into text data, or converting unstructured data into structured data. In addition, it may also include data standardization, such as converting all data to the same scale, converting numerical data into text type, etc., to facilitate subsequent analysis and comparison.

[0069] ③ Data decoding: It mainly decodes the encoded data into its original format through a decoder for subsequent analysis. For example, data encoded by base64 or URL encoding can be decoded into regular text data that can be processed by the classification model.

[0070] like Figure 3 As shown, after a threat indicator set (i.e., a first extraction result) is extracted from the alarm data through a classification model, and threat indicator results (i.e., a second extraction result) are extracted respectively through each extraction module, these threat indicator sets are aggregated to remove duplicate threat indicators; then, based on the threat indicator type, each IOC in the extraction result obtained after the aggregation process is verified for entity legitimacy and filtered to filter out IOCs with non-compliant formats, and then, the threat indicator extraction results in the alarm data are assembled and returned.

[0071] The following is a detailed description of the specific implementation method of performing data association analysis on the threat indicator in S103 to associate historical data related to the threat indicator. Specifically, it can be achieved through the following steps (21) to (23):

[0072] Step (21): Structuring the threat indicator to obtain a structured threat indicator.

[0073] In the present disclosure, in order to facilitate data association analysis, the threat indicators can be structured to standardize the threat indicators, thereby obtaining structured threat indicators. The structured threat indicators can include at least one of the following field information: IP field, Port field, Domain field, and Command field.

[0074] Step (22): According to the field information of the structured threat indicator, historical data related to the threat indicator is obtained.

[0075] In the present disclosure, the historical data related to the threat indicator may include session data, DNS data, intelligence data, host data, etc.

[0076] Step (23): For each of at least a portion of the historical data related to the threat indicator, associate the related historical data with the structured threat indicator to form a piece of suspected risk information.

[0077] In the present disclosure, each piece of historical data related to the threat indicator may be associated with the structured threat indicator, or part of the historical data related to the threat indicator may be associated with the structured threat indicator.

[0078] There are usually multiple pieces of historical data related to the threat indicator, wherein the structured threat indicator obtained after the threat indicator is structured and any piece of historical data associated with it constitutes a piece of suspected risk information.

[0079] For example, the historical data related to the threat indicator includes five session data. If each of the historical data related to the threat indicator is associated with the structured threat indicator, then the structured threat indicator obtained after structuring the threat indicator is associated with each of the five session data, and five suspected risk information can be obtained.

[0080] The following describes in detail the specific implementation method of obtaining historical data related to the threat indicator based on the field information of the structured threat indicator in the above step (22).

[0081] Specifically, the above structured threat indicators may include an IP field, a Port field, a Domain field, and a Command field. Figure 4As shown, if the IP field and the Port field of the structured threat indicator are both non-blank values, then the session data related to the threat indicator is obtained according to the field value of the network address field and the field value of the port field of the structured threat indicator, and then the session data is associated; if the domain name field of the structured threat indicator is a non-blank value, the DNS data matching the field value of the domain name field is obtained from the historical DNS data, and then the DNS data is associated; if the command field (specifically the Remote Command Execute (RCE) command) of the structured threat indicator is a non-blank value, then the host data related to the threat indicator is obtained according to the field value of the command field, and specifically, the host data matching the field value of the above-mentioned command field can be obtained from the historical host data as the host data related to the threat indicator.

[0082] After associating the session data and DNS data, it can be determined whether there are corresponding access records. At the same time, after associating the host data, it can be determined whether there are command execution records on the host. If there are corresponding access records or command execution records, the number of alarm data (i.e. suspected risk information), alarm time distribution (i.e. time distribution information of suspected risk information) and threat intelligence data are recorded, that is, according to the field value of the network address field and the field value of the domain name field of the structured threat indicator, the threat intelligence data related to the threat indicator is obtained. If there are no corresponding access records or command execution records, the corresponding recording operation is not performed.

[0083] If there are blank values ​​in the IP field and Port field of the structured threat indicator, no session data association is performed; if the domain name field of the structured threat indicator is a blank value, no DNS data association is performed; if the command field of the structured threat indicator is a blank value, no host data association is performed.

[0084] The relevant historical data may include session data related to the threat indicator, DNS data matching the field value of the domain name field, host data related to the threat indicator, and threat intelligence data related to the threat indicator. The historical DNS data may be DNS data within a first preset period (e.g., seven days) before the alarm time corresponding to the corresponding alarm data. The historical host data may be host data within a first preset period before the alarm time corresponding to the corresponding alarm data.

[0085] The following describes in detail a specific implementation method of obtaining session data related to the threat indicator based on the field value of the network address field and the field value of the port field of the structured threat indicator.

[0086] In one embodiment, session data that matches both the field value of the network address field and the field value of the port field of the structured threat indicator can be obtained from the historical session data as session data related to the threat indicator. The historical session data can be session data within a first preset period before the alarm time corresponding to the corresponding alarm data.

[0087] like Figure 5 As shown, there are multiple types of session data, such as proxy egress sessions, Network Address Translation (NAT) egress sessions, office network egress sessions (i.e., Internet egress sessions), and east-west sessions (i.e., east-west traffic sessions). Matching session data can be obtained from different types of historical session data and associated with structured IOCs.

[0088] In another embodiment, session data that matches both the field value of the network address field and the field value of the port field of the structured threat indicator can be obtained from the historical session data as session data related to the threat indicator; at the same time, according to the correspondence between the network address and the domain name, the target domain name corresponding to the field value of the network address field of the structured threat indicator is determined; then, session data that matches the target domain name is obtained from the historical session data as session data related to the threat indicator. If a certain IP has been resolved by a domain name, a correspondence between the IP and the domain name is established.

[0089] In the above implementation, not only can the session data be associated with the field value of the IP field and the field value of the Port field in the structured threat indicator, but the session data can also be associated with the target domain name corresponding to the field value of the IP field in the structured threat indicator. In this way, by reverse-checking the domain name information through the IP, the session data matching the reverse-checked domain name information can be obtained, thereby improving the comprehensiveness of the associated session data to discover potential security risks and thus improve the accuracy of the alarm.

[0090] like Figure 6As shown, after associating the host data, the command represented by the field value of the command field of the structured threat indicator (i.e., the current command) can be judged whether it is executed successfully (i.e., there is a command execution record) from three dimensions: the RCE command, the initiation time of the command, and the IP or PSM of the asset that executes the command (i.e., the operator of the service or the user of the machine). If an associated host data has data from all three dimensions at the same time, it is determined that the current command is executed successfully, otherwise, it is determined that the current command fails to execute. Among them, PSM is the unique identifier of the company's service. Before developing a service, the name of the service must be determined first. The service name is uniformly named using PSM. PSM is Product Subsystem Module, and the naming needs to follow the corresponding naming specifications.

[0091] Among them, the structured threat indicator may also include a command execution mark field. When the current command is executed successfully, the field value of the command execution mark field of the corresponding structured threat indicator is success. When the current command fails to execute, the field value of the command execution mark field of the corresponding structured threat indicator is failure.

[0092] The following describes in detail a specific implementation method for obtaining threat intelligence data related to the threat indicator based on the field value of the network address field and the field value of the port field.

[0093] Specifically, if Figure 7 As shown, if the network address field of the structured threat indicator is a non-blank value, the first threat intelligence data (i.e., IOC IP intelligence) that matches the field value of the network address field is obtained from the historical threat intelligence data; if the domain name field of the structured threat indicator is a non-blank value, the second threat intelligence data (i.e., IOC domain name intelligence) that matches the field value of the domain name field is obtained from the historical threat intelligence data; finally, the first threat intelligence data, the second threat intelligence data, and the historical alarm data of the threat indicator are aggregated to obtain threat intelligence data related to the threat indicator.

[0094] The historical threat intelligence data may be threat intelligence data within a first preset period before the alarm time corresponding to the corresponding alarm data. The historical alarm data of the threat indicator may be alarm data within a second preset period before the alarm time corresponding to the alarm data where the threat indicator is located.

[0095] In order to further improve the comprehensiveness of the associated session data, to discover potential security risks, and thus improve the accuracy of the alarm, in addition to associating the relevant DNS data, the session data can also be further associated based on the associated DNS data. Specifically, the above step (22) can also include the following steps:

[0096] The session data that matches both the network address and the port in the matching domain name system data are obtained from the historical session data as the session data related to the threat indicator.

[0097] like Figure 8 As shown, after associating the domain name field in the structured threat indicator with the DNS data according to the field value, the network address and port in the matching DNS data can be obtained. If the network address and port are obtained, the session data matching the network address and port can be obtained from the historical session data as the session data related to the threat indicator. Specifically, the NAT record matching the network address and port can be obtained from the NAT export session data, and the NAT record can be associated; at the same time, the information technology (internation technology, it) login log and authentication log matching the network address and port can be obtained from the office network export session data, and the indicator it login log and authentication log can be associated; at the same time, the virtual private network (virtual private network, vpn) and other logs matching the target domain name can be obtained from the east-west session data, and the vpn and other logs can be associated.

[0098] Considering the performance of the alarm data processing system, some common false alarm data or alarm data of irrelevant business scenarios can be filtered out from the alarm data to be processed. Specifically, before the above S102, the above method can also include the following steps:

[0099] Filter out false alarm data and / or alarm data of irrelevant business scenarios from multiple alarm data.

[0100] At this time, the above S102 can extract the threat indicator in the alarm data for each of at least part of the alarm data obtained after filtering. In the present disclosure, the threat indicator in each of the alarm data obtained after filtering can be extracted, and the threat indicator in part of the alarm data obtained after filtering can also be extracted.

[0101] In one implementation, alarm data of non-related business scenarios may be filtered out from a plurality of alarm data.

[0102] like Figure 1 As shown, multiple alarm data can be whitelist filtered. Specifically, filtering can be based on any field in the alarm data (i.e., filtering out alarm data containing this field from multiple alarm data), which is strongly related to the business, such as IP, domain name, PSM, etc. It can also be specific content in the traffic load. The filtering field can be flexibly set as needed.

[0103] In another implementation, false alarm data may be filtered out from a plurality of alarm data.

[0104] like Figure 1 As shown, multiple alarm data can be filtered by web pages and logs. Specifically, due to the unpredictability of scenarios such as user browsing, searching, and web crawling, a large number of false alarms are often generated in the network traffic due to the content in the web pages, causing interference to operations. The HTML filtering technology for Chinese and English tutorials combines HTML entity parsing, character set analysis, and pattern matching technology. By identifying and parsing HTML entities to accurately restore special characters and structures in web pages, and then analyzing the ratio of Chinese and English characters in the text, using language features to determine the language type of the main content of the page, and finally detecting specific grammatical patterns and tags to achieve recognition and classification of code blocks, tutorial web pages can be accurately identified, and then such web page alarm data can be filtered out.

[0105] In a real business environment, mechanisms such as log storage and data synchronization may cause false alarms due to the transmission of log content in the network. Based on operational feedback, accurate filtering of business logs can be achieved through business log format, keywords, and specific word statistics.

[0106] In yet another embodiment, in order to maximize the performance of the alarm data processing system, false alarm data and alarm data of irrelevant business scenarios may be filtered out from multiple alarm data at the same time.

[0107] In order to further improve the efficiency of security operations and the accuracy of alarms, after obtaining multiple pieces of suspected risk information, such as Figure 4 As shown in the figure, alarm analysis can be automatically performed to further save operational manpower. Fig. 9 As shown, the above alarm data processing method may further include the following two steps:

[0108] From all suspected risk information (i.e. Fig. 9 Filter out suspected risk information whose alarm times per unit time reach a preset number from the aggregated alarm data in the data;

[0109] For each piece of at least part of the suspected risk information obtained after filtering, determine whether the suspected risk information is real risk information based on relevant historical data in the suspected risk information.

[0110] In the present disclosure, it is possible to determine whether each piece of suspected risk information obtained after filtering is real risk information, and it is also possible to determine whether part of the suspected risk information obtained after filtering is real risk information.

[0111] Normally, a large number of threat attacks will not be carried out in a short period of time. Therefore, suspected risk information that frequently alarms within a unit time (for example, within an hour) is likely to be a false alarm. Therefore, alarm threshold deduplication filtering can be performed, that is, suspected risk information with an alarm number of times reaching a preset number within a unit time is filtered out from all suspected risk information to improve security operation efficiency and alarm accuracy.

[0112] In one implementation, whether the suspected risk information is real risk information can be determined based on relevant historical data in the suspected risk information through a pre-trained alarm prediction model.

[0113] After alarm analysis, the real risk information from the filtered suspected risk information can be provided to the SIEM / SOAR operation platform, allowing security operations personnel to focus on real risk events while ensuring operational coverage, thereby improving the detection rate of real risks under the same number of alarms.

[0114] In addition, before the above S103, the above alarm data processing method may further include the following steps:

[0115] Threat indicators included in the threat indicator whitelist are filtered out from the extracted threat indicators.

[0116] At this time, the above S103 can perform data association analysis on each of at least some of the threat indicators obtained after filtering. In the present disclosure, data association analysis can be performed on each of the threat indicators obtained after filtering, and data association analysis can also be performed on some of the threat indicators obtained after filtering.

[0117] In the above implementation, before performing data association analysis, IOC filtering is performed according to the IOC whitelist, which can reduce the workload of subsequent data association analysis and further improve security operation efficiency. Fig. 9 As shown, the IOC filtering operation can also be performed in the alarm analysis stage.

[0118] like Figure 5 , Figure 6 as well as Figure 8As shown, when the session data is associated, the DNS data is associated, and the host data is associated, the service information, the person in charge information, the process file information, etc. of the asset will also be associated at the same time to enrich the data dimension of the alarm, so as to facilitate the traceability of the asset, process and other information when handling the subsequent security risk events. Among them, after matching and associating with the corresponding type of session data from the proxy export session data, the proxy registration information in the session data can be further associated; after matching and associating with the corresponding type of session data from the NAT export session data, the production network asset information in the session data can be further associated; after matching and associating with the corresponding type of session data from the office network export session data, the office asset information in the session data can be further associated; after matching and associating with the corresponding type of session data from the east-west export session data, the user information in the session data can be further associated; so as to generate the asset's service information, person in charge information, process file information and other information based on these further associated information. Among them, the asset's service information and person in charge information can include the service owner, asset owner, login user information, etc.

[0119] Fig.10 FIG. 1 is a block diagram of an alarm data processing device according to an exemplary embodiment. Fig.10 As shown, the alarm data processing device 200 may include:

[0120] An acquisition module 201 is used to acquire a plurality of alarm data to be processed;

[0121] An extraction module 202, configured to extract a threat indicator in each of at least a portion of the plurality of alarm data;

[0122] The association analysis module 203 is configured to perform data association analysis on each of at least a portion of the extracted threat indicators to associate historical data related to the threat indicator.

[0123] Through the above technical solution, threat indicators can be automatically extracted from the alarm data, and data correlation analysis of threat indicators can be automatically performed, avoiding problems such as low operational efficiency and low alarm accuracy caused by repetitive data tracing and manual search. This can greatly improve security operation efficiency and alarm accuracy, save operational manpower, and allow security operations personnel to focus on real risk events while ensuring operational coverage, thereby improving the discovery rate of real risks under the same number of alarms.

[0124] Optionally, the association analysis module 203 includes:

[0125] A structured processing submodule, configured to perform structured processing on the threat indicator to obtain a structured threat indicator, wherein the structured threat indicator includes at least one of the following field information: a network address field, a port field, a domain name field, and a command field;

[0126] A related historical data acquisition submodule, used to acquire historical data related to the threat indicator according to the field information of the structured threat indicator;

[0127] The associating submodule is used to associate each of at least a portion of the historical data related to the threat indicator with the structured threat indicator to form a piece of suspected risk information.

[0128] Optionally, the structured threat indicator includes the network address field, the port field, the domain name field and the command field;

[0129] The relevant historical data acquisition submodule includes one or more of the following:

[0130] A session data acquisition submodule, configured to acquire session data related to the threat indicator according to the field value of the network address field and the field value of the port field if both the network address field and the port field are non-blank values;

[0131] A domain name system data acquisition submodule, for acquiring domain name system data matching the field value of the domain name field from historical domain name system data if the domain name field is a non-blank value;

[0132] A host data acquisition submodule, configured to acquire host data related to the threat indicator according to a field value of the command field if the command field is a non-blank value;

[0133] An intelligence data acquisition submodule is used to acquire threat intelligence data related to the threat indicator based on the field value of the network address field and the field value of the domain name field, wherein the related historical data includes the matching session data, the matching domain name system data, the related host data and the related threat intelligence data.

[0134] Optionally, the session data acquisition submodule includes:

[0135] The first acquisition submodule is used to acquire session data that matches both the field value of the network address field and the field value of the port field from historical session data as session data related to the threat indicator.

[0136] Optionally, the first session data acquisition submodule further includes:

[0137] A determination submodule, used to determine a target domain name corresponding to the field value of the network address field according to the correspondence between the network address and the domain name;

[0138] The second acquisition submodule is used to acquire session data matching the target domain name from the historical session data as session data related to the threat indicator.

[0139] Optionally, the intelligence data acquisition submodule includes:

[0140] A third acquisition submodule is used to acquire first threat intelligence data matching the field value of the network address field from historical threat intelligence data if the network address field is a non-blank value;

[0141] a fourth acquisition submodule, configured to acquire, if the domain name field is a non-blank value, second threat intelligence data matching the field value of the domain name field from the historical threat intelligence data;

[0142] The aggregation processing submodule is used to aggregate the first threat intelligence data, the second threat intelligence data and the historical alarm data of the threat indicator to obtain threat intelligence data related to the threat indicator.

[0143] Optionally, the relevant historical data acquisition submodule further includes:

[0144] The fifth acquisition submodule is used to acquire, from the historical session data, session data that matches both the network address and the port in the matching domain name system data as the relevant session data.

[0145] Optionally, the device 200 further includes:

[0146] A first filtering module is used to filter out suspected risk information whose alarm times per unit time reach a preset number from all the suspected risk information;

[0147] The determination module is used to determine whether each piece of at least part of the suspected risk information obtained after filtering is real risk information based on the relevant historical data in the suspected risk information.

[0148] Optionally, the determination module is used to determine whether the suspected risk information is real risk information based on the relevant historical data in the suspected risk information through a pre-trained alarm prediction model.

[0149] Optionally, the device 200 further includes:

[0150] A second filtering module, configured to filter out false alarm data and / or alarm data of irrelevant business scenarios from the plurality of alarm data before the extraction module 202 extracts the threat indicator in the alarm data for each of at least part of the plurality of alarm data;

[0151] The extraction module 202 is used to extract the threat indicator in each of at least a part of the alarm data obtained after filtering.

[0152] Optionally, the device 200 further includes:

[0153] A third filtering module, configured to filter out threat indicators included in a threat indicator whitelist from the extracted threat indicators before the association analysis module 203 performs data association analysis on each of at least part of the extracted threat indicators;

[0154] The association analysis module 203 is used to perform data association analysis on each of at least a portion of the threat indicators obtained after filtering.

[0155] Optionally, the extraction module 202 includes:

[0156] An extraction submodule, used to extract threat indicators in the alarm data respectively by using a classification model based on machine learning and a plurality of extraction models based on regular expressions, wherein the plurality of extraction models based on regular expressions include an expert model based on regular expressions of attack types and at least one general model based on general regular expressions;

[0157] The generating submodule is used to generate a threat indicator extraction result in the alarm data according to the first extraction result of the classification model and the second extraction result of each of the extraction models.

[0158] The present disclosure also provides a computer-readable medium on which a computer program is stored. When the program is executed by a processing device, the steps of the above-mentioned alarm data processing method provided by the present disclosure are implemented.

[0159] Reference below Fig.11 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.11The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0160] like Fig.11 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0161] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.11 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0162] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0163] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0164] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0165] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0166] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains multiple alarm data to be processed; for each of at least part of the multiple alarm data, extracts threat indicators in the alarm data; for each of at least part of the extracted threat indicators, performs data association analysis on the threat indicator to associate historical data related to the threat indicator.

[0167] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0168] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0169] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, an acquisition module may also be described as a "module for acquiring multiple alarm data to be processed".

[0170] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0171] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0172] According to one or more embodiments of the present disclosure, Example 1 provides an alarm data processing method, including:

[0173] Get multiple alarm data to be processed;

[0174] For each of at least a portion of the plurality of alarm data, extracting a threat indicator in the alarm data;

[0175] For each of at least a portion of the extracted threat indicators, data association analysis is performed on the threat indicator to associate historical data related to the threat indicator.

[0176] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein performing data association analysis on the threat indicator to associate historical data related to the threat indicator includes:

[0177] Structuring the threat indicator to obtain a structured threat indicator, wherein the structured threat indicator includes at least one of the following field information: a network address field, a port field, a domain name field, and a command field;

[0178] Acquiring historical data related to the threat indicator according to the field information of the structured threat indicator;

[0179] For each of at least a portion of the historical data related to the threat indicator, the related historical data is associated with the structured threat indicator to form a piece of suspected risk information.

[0180] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, wherein the structured threat indicator includes the network address field, the port field, the domain name field, and the command field;

[0181] The acquiring of historical data related to the threat indicator according to the field information of the structured threat indicator includes one or more of the following:

[0182] If both the network address field and the port field are non-blank values, acquiring session data related to the threat indicator according to the field value of the network address field and the field value of the port field;

[0183] If the domain name field is a non-blank value, obtaining domain name system data that matches the field value of the domain name field from historical domain name system data;

[0184] If the command field is a non-blank value, obtaining host data related to the threat indicator according to the field value of the command field;

[0185] According to the field value of the network address field and the field value of the domain name field, threat intelligence data related to the threat indicator is obtained, wherein the related historical data includes the matching session data, the matching domain name system data, the related host data and the related threat intelligence data.

[0186] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 3, wherein acquiring session data related to the threat indicator according to the field value of the network address field and the field value of the port field includes:

[0187] The session data that matches both the field value of the network address field and the field value of the port field is obtained from the historical session data as the session data related to the threat indicator.

[0188] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 4, wherein acquiring session data related to the threat indicator according to the field value of the network address field and the field value of the port field further includes:

[0189] Determine the target domain name corresponding to the field value of the network address field according to the correspondence between the network address and the domain name;

[0190] The session data matching the target domain name is obtained from the historical session data as the session data related to the threat indicator.

[0191] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 3, wherein acquiring threat intelligence data related to the threat indicator according to the field value of the network address field and the field value of the domain name field includes:

[0192] If the network address field is a non-blank value, obtaining first threat intelligence data that matches the field value of the network address field from historical threat intelligence data;

[0193] If the domain name field is a non-blank value, obtaining second threat intelligence data that matches the field value of the domain name field from the historical threat intelligence data;

[0194] The first threat intelligence data, the second threat intelligence data, and the historical alarm data of the threat indicator are aggregated to obtain threat intelligence data related to the threat indicator.

[0195] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 3, wherein acquiring historical data related to the threat indicator according to the field information of the structured threat indicator further includes:

[0196] The session data that matches both the network address and the port in the matching domain name system data are obtained from the historical session data as the relevant session data.

[0197] According to one or more embodiments of the present disclosure, Example 8 provides the method of any one of Examples 2-7, wherein the method further includes:

[0198] Filter out suspected risk information whose alarm times per unit time reach a preset number from all the suspected risk information;

[0199] For each piece of at least part of the suspected risk information obtained after filtering, determine whether the suspected risk information is real risk information based on the relevant historical data in the suspected risk information.

[0200] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 8, wherein determining whether the suspected risk information is real risk information according to the relevant historical data in the suspected risk information includes:

[0201] According to the relevant historical data in the suspected risk information, whether the suspected risk information is real risk information is determined by a pre-trained alarm prediction model.

[0202] According to one or more embodiments of the present disclosure, Example 10 provides the method of any one of Examples 1-7, wherein before the step of extracting the threat indicator in the alarm data for each of at least part of the plurality of alarm data, the method further includes:

[0203] Filtering out false alarm data and / or alarm data of irrelevant business scenarios from the plurality of alarm data;

[0204] For each of at least part of the plurality of alarm data, extracting a threat indicator in the alarm data includes:

[0205] For each of at least a portion of the alarm data obtained after filtering, a threat indicator in the alarm data is extracted.

[0206] According to one or more embodiments of the present disclosure, Example 11 provides the method of any one of Examples 1-7, and before the step of performing data association analysis on each of at least part of the extracted threat indicators, the method further includes:

[0207] Filtering out threat indicators included in a threat indicator whitelist from the extracted threat indicators;

[0208] The step of performing data association analysis on each of at least a portion of the extracted threat indicators comprises:

[0209] For each of at least a portion of the threat indicators obtained after filtering, data association analysis is performed on the threat indicator.

[0210] According to one or more embodiments of the present disclosure, Example 12 provides the method of any one of Examples 1-7, wherein extracting the threat indicator in the alarm data includes:

[0211] Using a classification model based on machine learning and a plurality of extraction models based on regular expressions, respectively extracting threat indicators in the alarm data, wherein the plurality of extraction models based on regular expressions include an expert model based on regular expressions of attack types and at least one general model based on general regular expressions;

[0212] A threat indicator extraction result in the alarm data is generated according to the first extraction result of the classification model and the second extraction result of each of the extraction models.

[0213] According to one or more embodiments of the present disclosure, Example 13 provides an alarm data processing device, including:

[0214] An acquisition module, used to acquire multiple alarm data to be processed;

[0215] An extraction module, configured to extract a threat indicator in each of at least a portion of the plurality of alarm data;

[0216] The association analysis module is used to perform data association analysis on each of at least a portion of the extracted threat indicators to associate historical data related to the threat indicator.

[0217] According to one or more embodiments of the present disclosure, Example 14 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-12 when executed by a processing device.

[0218] According to one or more embodiments of the present disclosure, Example 15 provides an electronic device, including:

[0219] a storage device having a computer program stored thereon;

[0220] A processing device is used to execute the computer program in the storage device to implement the steps of the method described in any one of Examples 1-12.

[0221] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0222] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0223] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A method for processing alarm data, characterized in that: include: Get multiple alarm data to be processed; For each of at least a portion of the plurality of alarm data, extracting a threat indicator in the alarm data; For each of at least part of the extracted threat indicators, perform structured processing on the threat indicator to obtain a structured threat indicator, wherein the structured threat indicator includes at least one of the following field information: a network address field, a port field, a domain name field, and a command field; according to the field information of the structured threat indicator, obtain historical data related to the threat indicator; for each of at least part of the historical data related to the threat indicator, associate the related historical data with the structured threat indicator to form a piece of suspected risk information; Wherein, in the case where the structured threat indicator includes the network address field, the port field, the domain name field, and the command field, the historical data related to the threat indicator includes at least one of session data, domain name system data, intelligence data, and host data; The extracting of threat indicators from the alarm data includes: Utilizing a classification model based on machine learning and a plurality of extraction models based on regular expressions to respectively extract threat indicators from the alarm data, wherein the plurality of extraction models based on regular expressions include an expert model based on regular expressions of attack types and at least one general model based on general regular expressions, and when there are a plurality of general models, the regular expressions adopted by the plurality of general models are different; A threat indicator extraction result in the alarm data is generated according to the first extraction result of the classification model and the second extraction result of each of the extraction models.

2. The method according to claim 1, characterized in that The structured threat indicator includes the network address field, the port field, the domain name field and the command field; The acquiring of historical data related to the threat indicator according to the field information of the structured threat indicator includes one or more of the following: If both the network address field and the port field are non-blank values, acquiring session data related to the threat indicator according to the field value of the network address field and the field value of the port field; If the domain name field is a non-blank value, obtaining domain name system data that matches the field value of the domain name field from historical domain name system data; If the command field is a non-blank value, obtaining host data related to the threat indicator according to the field value of the command field; According to the field value of the network address field and the field value of the domain name field, threat intelligence data related to the threat indicator is obtained, wherein the relevant historical data includes the relevant session data, the matching domain name system data, the relevant host data and the relevant threat intelligence data.

3. The method according to claim 2, characterized in that The acquiring, according to the field value of the network address field and the field value of the port field, session data related to the threat indicator includes: The session data that matches both the field value of the network address field and the field value of the port field is obtained from the historical session data as the session data related to the threat indicator.

4. The method according to claim 3, characterized in that The acquiring, according to the field value of the network address field and the field value of the port field, session data related to the threat indicator further includes: Determine the target domain name corresponding to the field value of the network address field according to the correspondence between the network address and the domain name; The session data matching the target domain name is obtained from the historical session data as the session data related to the threat indicator.

5. The method according to claim 2, characterized in that: The acquiring threat intelligence data related to the threat indicator according to the field value of the network address field and the field value of the domain name field includes: If the network address field is a non-blank value, obtaining first threat intelligence data that matches the field value of the network address field from historical threat intelligence data; If the domain name field is a non-blank value, obtaining second threat intelligence data that matches the field value of the domain name field from the historical threat intelligence data; The first threat intelligence data, the second threat intelligence data, and the historical alarm data of the threat indicator are aggregated to obtain threat intelligence data related to the threat indicator.

6. The method according to claim 2, characterized in that The step of acquiring historical data related to the threat indicator according to the field information of the structured threat indicator further includes: The session data that matches both the network address and the port in the matching domain name system data are obtained from the historical session data as the relevant session data.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Filter out suspected risk information whose alarm times per unit time reach a preset number from all the suspected risk information; For each piece of at least part of the suspected risk information obtained after filtering, determine whether the suspected risk information is real risk information based on the relevant historical data in the suspected risk information.

8. The method according to claim 7, characterized in that The determining, based on the relevant historical data in the suspected risk information, whether the suspected risk information is real risk information includes: According to the relevant historical data in the suspected risk information, whether the suspected risk information is real risk information is determined by a pre-trained alarm prediction model.

9. The method according to any one of claims 1 to 6, characterized in that: Before the step of extracting the threat indicator in each of at least part of the plurality of alarm data, the method further comprises: Filtering out false alarm data and / or alarm data of irrelevant business scenarios from the plurality of alarm data; For each of at least part of the plurality of alarm data, extracting a threat indicator in the alarm data includes: For each of at least a portion of the alarm data obtained after filtering, a threat indicator in the alarm data is extracted.

10. The method according to any one of claims 1 to 6, characterized in that: Before the step of performing structured processing on each of at least a portion of the extracted threat indicators, the method further includes: Filtering out threat indicators included in a threat indicator whitelist from the extracted threat indicators; The step of performing structured processing on each of at least a portion of the extracted threat indicators comprises: For each of at least a portion of the threat indicators obtained after filtering, structural processing is performed on the threat indicator.

11. An alarm data processing device, characterized in that: include: An acquisition module, used to acquire multiple alarm data to be processed; An extraction module, configured to extract a threat indicator in each of at least a portion of the plurality of alarm data; A correlation analysis module, configured to perform data correlation analysis on each of at least a portion of the extracted threat indicators to correlate historical data related to the threat indicator; Wherein, the association analysis module includes: A structured processing submodule, configured to perform structured processing on the threat indicator to obtain a structured threat indicator, wherein the structured threat indicator includes at least one of the following field information: a network address field, a port field, a domain name field, and a command field; A related historical data acquisition submodule, used to acquire historical data related to the threat indicator according to the field information of the structured threat indicator; an associating submodule, configured to associate, for each of at least a portion of the historical data related to the threat indicator, the related historical data with the structured threat indicator to form a piece of suspected risk information; Wherein, in the case where the structured threat indicator includes the network address field, the port field, the domain name field, and the command field, the historical data related to the threat indicator includes at least one of session data, domain name system data, intelligence data, and host data; The extraction module comprises: An extraction submodule, used to respectively extract threat indicators in the alarm data using a classification model based on machine learning and a plurality of extraction models based on regular expressions, wherein the plurality of extraction models based on regular expressions include an expert model based on regular expressions of attack types and at least one general model based on general regular expressions, and when there are a plurality of general models, the regular expressions adopted by the plurality of general models are different; The generating submodule is used to generate a threat indicator extraction result in the alarm data according to the first extraction result of the classification model and the second extraction result of each of the extraction models.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processing device, the steps of the method described in any one of claims 1 to 10 are implemented.

13. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 10.

Images