Event denoising convergence method and system based on attack payload clustering

Abstract

The present invention discloses an event denoising convergence method and system based on attack load clustering, which relates to the technical field related to data processing. The method includes: collecting historical event load data, extracting a list of key feature words using a denoising convergence model; obtaining clustering output results using a clustering algorithm after denoising; generating an event baseline; collecting real-time event load data, matching it with a feature matching model in combination with the event baseline; outputting an abnormal risk tag if it does not match; performing validity analysis on the security triage results based on a normal event behavior recognition module; generating parameter adjustment instructions; and iteratively correcting through a URL baseline filtering model. The method solves the technical problem that the load data feature acquisition in the existing event denoising convergence is inaccurate, resulting in an inaccurate denoising model, and the accuracy and reliability of the event denoising convergence results are not high, and achieves the technical effect of improving the accuracy and reliability of the event denoising convergence results.

Description

Technical Field

[0001] The present application relates to data processing technology-related fields, and specifically to an event noise reduction convergence method and system based on attack payload clustering. Background Art

[0002] In modern society, with the continuous improvement of informatization, a large amount of data and information has flooded into people's vision. These data and information contain both valuable intelligence and a lot of noise and redundancy. Especially in the field of event monitoring and early warning, how to extract key information from massive data is of great significance to improving the efficiency and accuracy of event processing. Attack payload clustering is based on the intrinsic characteristics and similarity of data, and data points with similar payload characteristics are merged into the same category. In this way, important information related to the event can be effectively identified and separated, while excluding noise data that is not related to the event. However, in the traditional event denoising convergence process, due to various reasons, there are often a lot of noise and outliers in the data, and the key features of the event cannot be accurately obtained. These noise and outliers will interfere with our correct judgment and analysis of the event and affect the accuracy of the event denoising convergence results.

[0003] Therefore, in the current technologies related to time denoising convergence, there is a technical problem that the load data characteristics are not accurately acquired, resulting in an inaccurate denoising model, which makes the accuracy and reliability of the event denoising convergence results low. Summary of the invention

[0004] The present application provides an event denoising convergence method and system based on attack payload clustering, and adopts technical means such as feature extraction and matching, and construction of a denoising convergence model, to solve the technical problem of inaccurate acquisition of load data features in the existing event denoising convergence, which leads to inaccurate denoising models and low accuracy and reliability of event denoising convergence results, thereby achieving the technical effect of improving the accuracy and reliability of event denoising convergence results.

[0005] The present application provides an event denoising convergence method based on attack load clustering, the method comprising: connecting to a security management center, collecting historical event load data, using a denoising convergence model to perform denoising processing on the historical event load data and extracting a list of key feature words; based on the historical event load data, after the historical event load data is denoised, using a clustering algorithm to obtain a clustering output result; generating an event baseline through the clustering output result and the list of key feature words; collecting real-time event load data, using a denoising convergence model to perform denoising processing on the real-time event load data and extract key feature words, and matching the event baseline with a feature matching model; if there is no match, outputting an abnormal risk mark, and performing security triage through the abnormal risk mark; based on a normal event behavior recognition module, performing validity analysis on the security triage result, generating a data label through validity analysis scoring, the data label including a normal label and an abnormal label; generating a parameter adjustment instruction based on the data label; adjusting the parameters of the key feature word list and the parameters of the clustering algorithm through the parameter adjustment instruction, and iteratively correcting the event baseline through a URL baseline filtering model.

[0006] In a possible implementation, security triage is performed through the abnormal risk markers, and the following processing is performed: based on a machine learning algorithm, a vulnerability scanning detection model is established, and the vulnerability scanning detection model includes a quantitative feature identification scanning layer of event types and a trigger frequency feature identification scanning layer; based on the vulnerability scanning detection model, security triage is performed through the abnormal risk markers to determine high-confidence attack behaviors.

[0007] In a possible implementation, a noise reduction convergence model is used to perform noise reduction processing on the real-time event load data and extract key feature words, and the following processing is performed: based on the algorithm model management module, a CRUD port is configured, and the CRUD port is used to manage CRUD requests; based on the algorithm model management module, a start / stop port is configured, and the start / stop port is used to manage start / stop requests; based on the algorithm model management module, a data source interface is configured, and the data source interface is used to manage data acquisition requests.

[0008] In a possible implementation, a noise reduction convergence model is used to perform noise reduction processing on the real-time event load data and extract key feature words, and the following processing is also performed: connecting to a task management module, which is used for task registration, task allocation, and task execution; based on the task management module, providing request response management corresponding to the start and stop task registration of the add, delete, modify, and query port, the start and stop port, and the data source interface.

[0009] In a possible implementation, a noise reduction convergence model is used to perform noise reduction processing on the real-time event payload data and extract key feature words, and the following processing is also performed: the task management module is communicatively connected with the configuration management module, and in the configuration management module, calls to the add, delete, modify and query port, the start and stop port, and the data source interface are supported; in the configuration management module, the acquisition of the data source by the newly added model is supported, and it is synchronized to any one or more corresponding algorithm model modules among the noise reduction convergence model, the normal event behavior recognition module, the feature matching model, the URL baseline filtering model, and the vulnerability scanning detection model.

[0010] In a possible implementation, a denoising convergence model is used to perform denoising on the real-time event payload data and extract key feature words, and the following processing is also performed: obtaining basic management data of the vulnerability scanning detection model, the basic management data including model ID, model category, and model name; obtaining model creation time, model update time, and model status; and generating a model management process through the model creation time, model update time, model status, and the basic management data.

[0011] In a possible implementation, a noise reduction convergence model is used to perform noise reduction processing on the real-time event payload data and extract key feature words, and the following processing is also performed: on the model operation management platform, the start and stop port is called to perform start and stop operation management; on the model operation management platform, the add, delete, modify and query port is called to perform add, delete, modify and query operation management; on the model operation management platform, the data source is obtained in combination with the model management process, and the data source interface is used to import the data source into any one or more corresponding algorithm model modules among the noise reduction convergence model, normal event behavior recognition module, feature matching model, URL baseline filtering model, and vulnerability scanning detection model.

[0012] This application also provides an event noise reduction convergence system based on attack payload clustering, including:

[0013] A historical key feature word extraction module, which is used to connect to the security management center, collect historical event load data, use a noise reduction convergence model to perform noise reduction on the historical event load data and extract a key feature word list;

[0014] An event baseline generation module, wherein the event baseline generation module is used to obtain a clustering output result based on the historical event load data after performing noise reduction processing on the historical event load data, and generate an event baseline through the clustering output result and the key feature word list;

[0015] A feature matching module, which is used to collect real-time event load data, use a noise reduction convergence model to perform noise reduction processing on the real-time event load data and extract key feature words, and match the event baseline with a feature matching model;

[0016] A safety triage module, which is used to output an abnormal risk mark if there is no match, perform safety triage based on the abnormal risk mark, perform effectiveness analysis on the safety triage result based on the normal event behavior recognition module, and generate data labels through effectiveness analysis scoring, wherein the data labels include normal labels and abnormal labels;

[0017] An event baseline iteration correction module is used to adjust the parameters of the key feature word list and the parameters of the clustering algorithm through the parameter adjustment instruction, and to iteratively correct the event baseline through the URL baseline filtering model.

[0018] Through the event denoising convergence method and system based on attack load clustering proposed in this application, historical event load data is collected, and a list of key feature words is extracted using a denoising convergence model; after denoising, a clustering algorithm is used to obtain clustering output results; an event baseline is generated; real-time event load data is collected, and matched with the feature matching model in combination with the event baseline; if there is a mismatch, an abnormal risk mark is output; based on the normal event behavior recognition module, the security triage results are analyzed for effectiveness; parameter adjustment instructions are generated; and corrections are made through the URL baseline filtering model iteration. The technical problem of inaccurate acquisition of load data features in existing event denoising convergence, which leads to inaccurate denoising models and low accuracy and reliability of event denoising convergence results, is solved, and the technical effect of improving the accuracy and reliability of event denoising convergence results is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solution of the embodiment of the present disclosure, the accompanying drawings of the embodiment of the present disclosure will be briefly introduced below. A flow chart is used in the present application to illustrate the operations performed by the system according to the embodiment of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0020] Figure 1 A schematic diagram of the flow of an event denoising convergence method based on attack payload clustering provided in an embodiment of the present application;

[0021] Figure 2 A schematic diagram of the structure of an event denoising and convergence system based on attack payload clustering provided in an embodiment of the present application.

[0022] Explanation of the accompanying drawings: historical key feature word extraction module 10, event baseline generation module 20, feature matching module 30, safety triage module 40, event baseline iterative correction module 50. DETAILED DESCRIPTION

[0023] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0024] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0025] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict, and the terms "first\second" involved are merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0026] The present application embodiment provides an event noise reduction convergence method based on attack load clustering, such as Figure 1 As shown, the method includes:

[0027] Step S100, connecting to the security management center, collecting historical event load data, using a noise reduction convergence model to perform noise reduction processing on the historical event load data and extracting a key feature word list. The data processing system or platform is connected to the security management center so as to obtain the required historical event payload data from the security management center. The security management center is usually a system dedicated to organizing and managing security work. It is responsible for monitoring and managing internal and external security risks of the enterprise and saving relevant historical data. After connecting to the security management center, it is necessary to collect historical event payload data from the data storage of the center. These data may include relevant information of various security events, such as the type of event, time of occurrence, location, personnel, equipment or systems involved, detailed description of the event, etc. The collected historical event payload data is processed using a denoising convergence model to eliminate noise and outliers in the data, such as signal analysis, filtering, denoising algorithm selection, etc. Among them, the denoising convergence model is a model for processing data noise and extracting key information. It is applied to historical event payload data to eliminate noise and redundant information in the data while retaining information related to key features. After the denoising process is completed, it is necessary to extract a list of key feature words from the denoised data, which may include clustering based on word vectors, keyword extraction algorithms, etc. These key feature words can represent the main information and features of the data.

[0028] Step S200, based on the historical event load data, after the historical event load data is subjected to noise reduction processing, a clustering algorithm is used to obtain a clustering output result. According to the historical event load data, after the historical event load data is subjected to noise reduction processing, a clustering algorithm is used to perform clustering and obtain a clustering output result. Specifically, a suitable clustering algorithm is selected, such as K-means, hierarchical clustering or DBSCAN, and the selected clustering algorithm is applied to the historical event load data after noise reduction processing, and the feature words are combined into vectors. A baseline is generated by calculating the distance between the vectors and using the DBSCAN clustering method, and the distance or similarity between the data points is calculated. Then, the data points are grouped into different clusters (clusters) according to the set conditions. After the clustering algorithm is run, you will get the clustering results, which usually include the center point of each cluster, the size of the cluster (that is, the number of data points included), the shape or distribution of the cluster, and other information. Each cluster represents a class of similar or related data points in the historical event load data.

[0029] Step S300, generating an event baseline through the clustering output result and the key feature word list. The clustering result obtained by the clustering algorithm and the key feature word list extracted from the data are used to jointly construct a baseline for describing and identifying similar events, namely, the event baseline, wherein the event baseline is a standard for reference and comparison, which contains the main features and patterns of a specific type of event. Through the clustering output result, we can understand the characteristics and distribution of different categories in the historical event payload data, thereby identifying the key data clusters related to the specific event. Specifically, based on the feature extraction and statistical analysis method, the destination IP address and the request directory are extracted to describe the service characteristics, the historical baseline is read, and the service whose payload length fluctuates within a certain range of the baseline and the request volume of the service reaches a certain number is used to generate a baseline. According to the baseline matching, real-time alarms are issued, and all hits are regarded as normal services. The clustering output result is matched and associated with the key feature word list, and information that can represent the main features of the event is extracted from the matching and association results, which may include the size, shape, and distribution of the cluster, as well as the frequency and relevance of the key feature words, etc., and the event baseline is constructed based on the extracted feature information.

[0030] Step S400 , collecting real-time event load data, using a noise reduction convergence model to perform noise reduction processing on the real-time event load data and extract key feature words, and matching the event baseline with a feature matching model. Collect real-time event load data, use a noise reduction convergence model to perform noise reduction processing on the real-time event load data and extract key feature words, and then match it with the event baseline using a feature matching model. Specifically, the normal Internet communication feature library is continuously accumulated and updated through an algorithm, and a string-based feature matching method is used to form rules for automated normal Internet access behavior, thereby filtering normal Internet communications from alarms, and obtaining event load data in real time from the source of the event or related systems. These data may come from various sensors, log files, monitoring devices or other data sources. Since real-time event load data may contain a large amount of noise, redundant information and outliers, directly using these data for analysis may result in inaccurate or misleading results. Therefore, it is necessary to use a noise reduction convergence model to process these data to eliminate noise, smooth data and retain key information. In the data after noise reduction processing, it is necessary to further extract key feature words. The event baseline is a baseline for describing and identifying similar events generated by clustering output results and a list of key feature words. In the real-time data processing process, the extracted key feature words are compared and matched with the event baseline to determine whether the real-time event belongs to a known type or pattern.

[0031] In a possible implementation, step S400 further includes step S410, configuring the add, delete, modify and query port based on the algorithm model management module, and the add, delete, modify and query port is used to manage the add, delete, modify and query requests. Through a specific algorithm model management module, a series of ports for processing add, delete, modify and query operations are set and enabled. These ports are interfaces for the system or application to interact with the outside world, and are responsible for receiving and processing add, delete, modify and query requests related to the algorithm model. It also includes step S420, configuring the start and stop port based on the algorithm model management module, and the start and stop port is used to manage the start and stop requests. The start-stop port is configured based on the algorithm model management module, which is mainly used to manage related start-stop requests. Specifically, the start-stop port plays a key role in the algorithm model management module. It is responsible for receiving and processing requests related to the start and stop of the algorithm model. When a certain algorithm model needs to be started, the external system or user can send a start request through this start-stop port. After receiving the request, the algorithm model management module will perform corresponding operations, such as loading the model, initializing parameters, etc., to ensure that the model can be started correctly and is in a working state; similarly, when a certain algorithm model needs to be stopped, a stop request can also be sent through this start-stop port. The algorithm model management module will receive the request and perform a stop operation, such as releasing resources, saving model status, etc., to ensure that the model can be safely stopped and related resources are released. It also includes step S430, configuring a data source interface based on the algorithm model management module, and the data source interface is used to manage data acquisition requests. The data source interface is configured based on the algorithm model management module, mainly to manage data acquisition requests. The data source interface plays a key role in the algorithm model management module. It is responsible for interacting with external data sources to obtain data required by the algorithm model.

[0032] In a possible implementation, step S400 also includes step S440, connecting a task management module, which is used for task registration, task allocation, and task execution. The task management module is integrated into the system so that the functions of task registration, task allocation, and task execution provided by it can be utilized. The task management module is a powerful tool that helps to manage, track, and execute tasks more effectively. Specifically, the task management module allows users to register or create new tasks; the task management module supports the task allocation function; once a task is assigned, the task management module will track the execution process of the task, including recording the progress and completion of the task, as well as any possible problems or obstacles. It also includes step S450, based on the task management module, providing the request response management corresponding to the start and stop task registration of the add, delete, modify, and query port, the start and stop port, and the data source interface. Through the add, delete, modify, and query port, the start and stop port, and the data source interface, requests related to start and stop tasks, registration, add, delete, modify, and query are received, processed, and corresponding responses are returned.

[0033] In a possible implementation, step S450 further includes step S451, which connects the task management module to the configuration management module in communication, and in the configuration management module, supports calling the add, delete, modify and query port, the start and stop port, and the data source interface. The information interaction and function call between the task management module and the configuration management module are realized. Specifically, an effective data channel is established between the task management module and the configuration management module, so that they can transmit information, instructions and status updates to each other. It can be realized based on a network protocol, an API interface or other communication mechanism to ensure that the data transmission between the two modules is both reliable and efficient. The configuration management module can manage the task registration information in the task management module by calling the add, delete, modify and query port, such as adding a new task registration, deleting an existing task registration or modifying the properties of a task registration, etc. At the same time, the configuration management module can also call the start and stop port to control the start and stop operation of the task in the task management module; the configuration management module can also call the data source interface to interact with the data source in the task management module, including obtaining the data required for task management from the data source, or storing the status or results of task management in the data source. It also includes step S452, in which the configuration management module supports the acquisition of the data source by the newly added model, and synchronizes it to any one or more corresponding algorithm model modules among the noise reduction convergence model, normal event behavior recognition module, feature matching model, URL baseline filtering model, and vulnerability scanning detection model. The configuration management module has the ability to obtain new model data from the data source and synchronize it to the specified algorithm model module. Specifically, the configuration management module will first obtain the data of the newly added model from the specified data source. After obtaining the model data, the configuration management module will parse it to ensure that the format and structure of the data match the requirements of the target algorithm model module. The configuration management module will synchronize it to the specified algorithm model module. It can be one-way, that is, pushing data from the data source to the algorithm model module; it can also be two-way, allowing the algorithm model module to pull data from the data source when needed; once the model data is synchronized to the algorithm model module, the new data can be used. Perform calculations, reasoning or analysis. For example, the denoising convergence model can use the new data for denoising to improve the purity of the data; the normal event behavior recognition module can use the new data to update its behavior pattern library to more accurately identify normal behavior; the feature matching model can use the new data for feature learning and matching; the URL baseline filtering model can use the new data to update the baseline rules to improve filtering accuracy; the vulnerability scanning detection model can use the new data for vulnerability scanning and risk assessment. If the data needs to be synchronized to multiple algorithm model modules, the configuration management module will ensure the consistency and synchronization of the data so that each model can perform calculations and analyses based on the same data.

[0034] In a possible implementation, step S450 further includes step S453, obtaining basic management data of the vulnerability scanning detection model, the basic management data including model ID, model category, and model name. Extracting basic information related to the vulnerability scanning detection model from the relevant management system or database, including model ID, model category, and model name, is usually used to identify, classify, and manage different models to ensure the correct use and effective management of the model. Specifically, each vulnerability scanning detection model has a unique identifier, namely, model ID; model category refers to the type or classification to which the vulnerability scanning detection model belongs, for example, it may belong to different scanning types such as network scanning, Web application scanning, and host scanning; model name is a descriptive name for the vulnerability scanning detection model, which is used to intuitively represent the characteristics or uses of the model. The model name may be the same, but the model ID must be different. It also includes step S454, obtaining the model creation time, model update time, and model status. It also includes step S455, generating a model management process through the model creation time, model update time, model status, and the basic management data. Using timestamps and status information to build a systematic and standardized model management process helps ensure that vulnerability scanning and detection models are properly managed throughout their life cycle, including key links such as their creation, updating, and status monitoring. Specifically, when a new vulnerability scanning and detection model is created, the system automatically records the creation time of the model. Over time, the vulnerability scanning and detection model may need to be updated or optimized. Each time it is updated, the system records the update time of the model and may generate a new model version. The model status is important information in the model management process. The system will monitor the model in real time or regularly according to the operating status of the model (such as normal, abnormal, suspended, etc.) and generate corresponding status reports. Based on the above basic management data, an automated model management process can be built. For example, when the model needs to be updated, the system can automatically trigger the update operation and notify relevant personnel for verification and review; when the model status is abnormal, the system can automatically send an alarm to remind the administrator to handle it.

[0035] In a possible implementation, step S400 further includes step S460, in which the start-stop port is called on the model operation management platform to perform start-stop operation management. Through a specific interface or function point, the vulnerability scanning detection model is started and stopped. The start-stop port is a functional component in the task management module, which provides the ability to control the execution state of the model. Specifically, through the front-end interface or API interface of the model operation management platform, a start or stop request for the vulnerability scanning detection model is initiated and sent to the back-end server of the model operation management platform. The back-end server will parse the information in the request and identify the start-stop port to be called. Once it is determined that the start-stop port needs to be called, the back-end server will communicate with the start-stop port in the target task management module, including sending a data packet or message containing an operation instruction. After receiving the instruction, the start-stop port will perform the corresponding operation according to the content of the instruction. For example, if it is a start instruction, the port will trigger the start process of the vulnerability scanning detection model; if it is a stop instruction, it will trigger the stop process of the model. It also includes step S470, in which the add-delete-modify-check port is called on the model operation management platform to perform add-delete-modify-check operation management. Through specific interfaces or function points, the vulnerability scanning detection model is managed by operations such as adding, deleting, modifying and querying. It also includes step S480, in which the data source is obtained in the model operation management platform in combination with the model management process, and the data source interface is used to import the data source into any one or more corresponding algorithm model modules in the noise reduction convergence model, normal event behavior recognition module, feature matching model, URL baseline filtering model, and vulnerability scanning detection model. The model operation management platform will integrate the previously generated model management process, and the model operation management platform will obtain relevant data from the specified data source. The platform realizes data interaction with the data source by calling the data source interface, which may include functions such as data reading, data conversion, and data format verification. Once the data is obtained through the data source interface, the platform will import the data into the specified algorithm model module according to the requirements of the model management process, and the corresponding model module will use the data to update or calculate. For example, the noise reduction convergence model may use new data for noise reduction processing to improve the purity of the data; the vulnerability scanning detection model may use new data for model training or scanning detection.

[0036] Step S500: If there is no match, an abnormal risk mark is output, and security triage is performed through the abnormal risk mark. If the characteristics of the real-time event payload data do not match, an abnormal risk mark is output to identify those situations that may have security risks or do not conform to normal behavior patterns, and security triage is performed through abnormal risk marks. Specifically, security triage is usually to further classify, analyze and process the detected security events or abnormal behaviors. Through abnormal risk marks, the security team or system can more efficiently identify which events need to be prioritized, which events may require further investigation, and which events may be false alarms or can be ignored.

[0037] In one possible implementation, step S500 further includes step S510, establishing a vulnerability scanning detection model based on a machine learning algorithm, wherein the vulnerability scanning detection model includes a quantitative feature recognition scanning layer of event types and a trigger frequency feature recognition scanning layer. The vulnerability scanning process usually has the characteristics of multiple destination IPs, multiple destination ports, high request failure rate, and complex alarm types. Feature engineering is designed to identify vulnerability scanning behaviors based on the above characteristics. Based on feature engineering and machine learning algorithms (random forest model), this module has realized the detection of one-to-one and one-to-many vulnerability scanning. The overall process includes identifying scanners based on sip and dip grouping, the number of event types, and the frequency of event triggering, so as to more comprehensively detect and analyze potential vulnerabilities. Among them, the event type quantity feature identification scanning layer and the trigger frequency feature identification scanning layer are two key components of the model. Specifically, the event type quantity feature identification scanning layer collects and analyzes security events that occur in the system, and classifies and counts these events. For example, it can count the number of different types of attack attempts (such as SQL injection, cross-site scripting attacks, etc.), which is very critical for identifying potential vulnerability patterns; the trigger frequency feature identification scanning layer analyzes the frequency of security events in the system, including the average occurrence rate of events, the time interval between events, etc. For example, if a specific security event is triggered frequently in a short period of time, this may be an indication of a potential vulnerability. The method further includes step S520, in which security triage is performed based on the vulnerability scanning detection model and the abnormal risk marker is used to determine high-confidence attack behaviors. The vulnerability scanning detection model will perform a comprehensive vulnerability scan on the system or network based on its built-in algorithms and rules. When the model detects a behavior or event that matches a known vulnerability pattern, it will output an abnormal risk marker, analyze these abnormal risk markers, prioritize and classify them, and determine which abnormal risk markers are most likely to indicate real attack behaviors, i.e., high-confidence attack behaviors.

[0038] Step S600, based on the normal event behavior recognition module, the security triage result is analyzed for effectiveness, and data labels are generated through effectiveness analysis scores, and the data labels include normal labels and abnormal labels. Among them, the normal event behavior recognition module is a component based on machine learning or deep learning algorithms, which has been trained to identify normal or expected behavior patterns in the system. The normal event behavior recognition module will further analyze the security triage results, and compare each triage result with a predefined normal behavior pattern to determine whether the behavior meets the expected normal behavior characteristics. Based on this comparison result, the module will generate an effectiveness analysis score, which can be a numerical value or a grade to quantify the degree of match between the triage result and the normal behavior pattern. For example, the higher the score, the higher the match between the behavior and the normal behavior, and therefore it is more likely to be normal; conversely, the lower the score, the more likely it is abnormal. According to this effectiveness analysis score, the module will generate a data label for each triage result, including a normal label and an abnormal label.

[0039] Step S700, based on the data tags, parameter adjustment instructions are generated. According to the information reflected by the data tags, parameter adjustment instructions are generated to adjust and optimize the relevant model parameters in a targeted manner. Specifically, when it is found through the data tags that some parameters are improperly set or need to be optimized, parameter adjustment instructions can be generated based on these data tags. These instructions will clearly indicate which parameters need to be adjusted, as well as the specific values ​​or ranges of the adjustments.

[0040] Step S800, through the parameter adjustment instruction, adjust the parameters of the key feature word list and the parameters of the clustering algorithm, and iteratively correct the event baseline through the URL baseline filtering model. According to the generated parameter adjustment instruction, the parameters of the key feature word list and the parameters of the clustering algorithm are adjusted to more accurately identify related security events; change the distance metric, the number of clusters, the similarity threshold and other parameters in the clustering algorithm to optimize the effect and efficiency of clustering; the URL baseline filtering model is usually used to identify URLs that do not conform to normal network traffic or behavior patterns. When a new security event or data is detected, the URL baseline filtering model will compare it with the baseline data to determine whether it is abnormal. Through the parameter adjustment instruction, the parameters of the baseline filtering model can be optimized to more accurately identify abnormal URLs. At the same time, with the continuous input of new data, the system will iteratively correct the event baseline to adapt to the ever-changing network environment and attack methods.

[0041] In the above, refer to Figure 1 The event denoising convergence method based on attack load clustering according to an embodiment of the present invention is described in detail. Figure 2 An event denoising and convergence system based on attack payload clustering according to an embodiment of the present invention is described.

[0042] The event denoising convergence system based on attack load clustering according to the embodiment of the present invention is used to solve the technical problem that the load data feature acquisition in the existing event denoising convergence is inaccurate, resulting in an inaccurate denoising model, and the accuracy and reliability of the event denoising convergence result are not high, and the technical effect of improving the accuracy and reliability of the event denoising convergence result is achieved. The event denoising convergence system based on attack load clustering includes: a historical key feature word extraction module 10, an event baseline generation module 20, a feature matching module 30, a security triage module 40, and an event baseline iteration correction module 50.

[0043] A historical key feature word extraction module 10, which is used to connect to the security management center, collect historical event load data, use a noise reduction convergence model to perform noise reduction processing on the historical event load data and extract a key feature word list;

[0044] An event baseline generating module 20, wherein the event baseline generating module 20 is used to obtain a clustering output result by using a clustering algorithm based on the historical event load data after performing noise reduction processing on the historical event load data, and generate an event baseline through the clustering output result and the key feature word list;

[0045] A feature matching module 30, which is used to collect real-time event load data, perform noise reduction processing on the real-time event load data using a noise reduction convergence model and extract key feature words, and perform matching with the feature matching model in combination with the event baseline;

[0046] A safety triage module 40, wherein the safety triage module 40 is used to output an abnormal risk mark if there is no match, perform safety triage based on the abnormal risk mark, perform validity analysis on the safety triage result based on the normal event behavior recognition module, and generate data labels through validity analysis scoring, wherein the data labels include normal labels and abnormal labels;

[0047] The event baseline iteration correction module 50 is used to adjust the parameters of the key feature word list and the parameters of the clustering algorithm through the parameter adjustment instruction, and to iteratively correct the event baseline through the URL baseline filtering model.

[0048] The specific configuration of the feature matching module 30 will be described in detail below. The feature matching module 30 further includes: a connection task management module, the task management module is used for task registration, task allocation, and task execution; based on the task management module, it provides request response management corresponding to the start and stop task registration of the add, delete, modify, and query port, the start and stop port, and the data source interface.

[0049] The specific configuration of the feature matching module 30 will be described in detail below. The feature matching module 30 may further include: a connection task management module, the task management module is used for task registration, task allocation, and task execution; based on the task management module, a request response management corresponding to the start and stop task registration of the add, delete, modify, and query port, the start and stop port, and the data source interface is provided.

[0050] The specific configuration of the feature matching module 30 will be described in detail below. The feature matching module 30 may further include: communicating with the task management module and the configuration management module, in which the configuration management module supports calling the add, delete, modify and query port, the start and stop port, and the data source interface; in the configuration management module, the acquisition of the data source by the newly added model is supported, and it is synchronized to any one or more corresponding algorithm model modules in the noise reduction convergence model, the normal event behavior recognition module, the feature matching model, the URL baseline filtering model, and the vulnerability scanning detection model.

[0051] The specific configuration of the feature matching module 30 will be described in detail below. The feature matching module 30 further includes: obtaining basic management data of the vulnerability scanning detection model, the basic management data including model ID, model category, model name; obtaining model creation time, model update time, model status; generating a model management process through the model creation time, model update time, model status and the basic management data.

[0052] The specific configuration of the feature matching module 30 will be described in detail below. The feature matching module 30 further includes: in the model operation management platform, calling the start and stop port to perform start and stop operation management; in the model operation management platform, calling the add, delete, modify and check port to perform add, delete, modify and check operation management; in the model operation management platform, in combination with the model management process, obtaining the data source, the data source interface is used to import the data source into any one or more corresponding algorithm model modules in the noise reduction convergence model, normal event behavior recognition module, feature matching model, URL baseline filtering model, and vulnerability scanning detection model.

[0053] The specific configuration of the security triage module 40 will be described in detail below. The security triage module 40 may further include: establishing a vulnerability scanning detection model based on a machine learning algorithm, wherein the vulnerability scanning detection model includes a quantitative feature recognition scanning layer of an event type and a trigger frequency feature recognition scanning layer; and performing security triage based on the vulnerability scanning detection model through the abnormal risk marker to determine a high-confidence attack behavior.

[0054] The event denoising and convergence system based on attack load clustering provided by the embodiment of the present invention can execute the event denoising and convergence method based on attack load clustering provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0055] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules may be used and run on the user terminal and / or server, and the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0056] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. The event denoising convergence method based on attack payload clustering is characterized by: The method comprises: Connecting to the security management center, collecting historical event load data, using a noise reduction convergence model to perform noise reduction on the historical event load data and extracting a list of key feature words; Based on the historical event load data, after performing noise reduction processing on the historical event load data, a clustering algorithm is used to obtain a clustering output result; Generate an event baseline through the clustering output result and the key feature word list; Collecting real-time event load data, performing noise reduction processing on the real-time event load data using a noise reduction convergence model and extracting key feature words, and matching the event baseline using a feature matching model; If there is no match, an abnormal risk mark is output, and safety triage is performed based on the abnormal risk mark. Security triage is to further classify, analyze and process the detected security events and abnormal behaviors; based on the normal event behavior recognition module, the security triage results are analyzed for effectiveness, and data labels are generated through effectiveness analysis scores, and the data labels include normal labels and abnormal labels; Based on the data tag, a parameter adjustment instruction is generated, including: obtaining a parameter setting that needs to be optimized through the data tag, generating a parameter adjustment instruction based on the data tag, and adjusting the specific value or range of the parameter; adjusting the parameters of the key feature word list and the parameters of the clustering algorithm through the parameter adjustment instruction, and iteratively correcting the event baseline through the URL baseline filtering model, including: adjusting the parameters of the key feature word list and the parameters of the clustering algorithm according to the parameter adjustment instruction to identify security events; adjusting the distance metric, the number of clusters, and the similarity threshold in the clustering algorithm; the URL baseline filtering model identifies URLs that are inconsistent with normal network traffic and behavior patterns. When a security event is detected, the URL baseline filtering model compares the URL that is inconsistent with normal network traffic and behavior patterns with the baseline data to determine whether it is abnormal; optimizing the parameters of the baseline filtering model through the parameter adjustment instruction, and iteratively correcting the event baseline through the URL baseline filtering model according to new data input; performing security triage through the abnormal risk marker, the method includes: Based on the machine learning algorithm, a vulnerability scanning detection model is established, wherein the vulnerability scanning detection model includes a quantitative feature recognition scanning layer of event types and a trigger frequency feature recognition scanning layer; Based on the vulnerability scanning detection model, security triage is performed through the abnormal risk markers to determine high-confidence attack behaviors.

2. The event denoising convergence method based on attack load clustering according to claim 1, characterized in that: The method comprises: Based on the algorithm model management module, configure the add, delete, modify and query port, which is used to manage the add, delete, modify and query requests; Based on the algorithm model management module, configure the start and stop port, which is used to manage the start and stop request; Based on the algorithm model management module, a data source interface is configured, and the data source interface is used to manage data acquisition requests.

3. The event denoising convergence method based on attack load clustering according to claim 2, characterized in that: The method further comprises: Connecting to a task management module, the task management module is used for task registration, task allocation, and task execution; Based on the task management module, request response management corresponding to the start and stop task registration of the add, delete, modify and query port, the start and stop port and the data source interface is provided.

4. The event denoising convergence method based on attack load clustering according to claim 3, characterized in that: The method comprises: The task management module is connected to the configuration management module for communication, and the configuration management module supports calling the add, delete, modify and query port, the start and stop port, and the data source interface; In the configuration management module, the acquisition of data sources by new models is supported, and is synchronized to any one or more corresponding algorithm model modules among the noise reduction convergence model, normal event behavior recognition module, feature matching model, URL baseline filtering model, and vulnerability scanning detection model.

5. The event denoising convergence method based on attack load clustering according to claim 4, characterized in that: The method further comprises: Obtaining basic management data of the vulnerability scanning detection model, wherein the basic management data includes a model ID, a model category, and a model name; Get model creation time, model update time, and model status; A model management process is generated based on the model creation time, model update time, model status and the basic management data.

6. The event denoising convergence method based on attack load clustering according to claim 5, characterized in that: The method further comprises: On the model operation management platform, calling the start / stop port to perform start / stop operation management; On the model operation management platform, calling the add, delete, modify and check port to perform add, delete, modify and check operation management; On the model operation management platform, in combination with the model management process, the data source is obtained, and the data source interface is used to import the data source into any one or more corresponding algorithm model modules among the noise reduction convergence model, normal event behavior recognition module, feature matching model, URL baseline filtering model, and vulnerability scanning detection model.

Images