Security event stream big data analysis engine

Abstract

The invention discloses a security event stream big data analysis engine, and relates to the technical field of network attack and defense, comprising: acquiring security event stream data of a device; based on the security event stream data of the device, performing data division according to the type of the security event stream under the time node to obtain a plurality of security event stream classification sets of the device; determining the initialization performance of equipment hardware; according to a plurality of security event flow classification sets of the equipment and hardware initialization performance, analyzing a performance resource consumption trend of the equipment influenced by each security event flow classification set, and obtaining security event flow performance redundancy overhead time sequence data of the equipment; and based on the security event flow performance redundancy overhead time sequence data of the equipment, analyzing according to the equipment hardware performance preference of each security event flow, and generating a security event flow dynamic confidence threshold value under the time node. The method has the advantages that abnormal alarms can be effectively reduced, and the accuracy of security event flow detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of network attack and defense technology, and in particular to a security event stream big data analysis engine. Background Art

[0002] The security event stream big data analysis engine refers to a system that integrates big data processing and analysis capabilities. It is specifically used to collect, integrate, analyze and mine security event stream data from multiple sources in real time to provide in-depth security insights, threat detection and situational awareness, thereby supporting the organization's security management and decision-making.

[0003] The existing security event stream big data analysis engine overreacts to non-security events due to inaccurate data analysis algorithms or unreasonable threshold settings, resulting in frequent abnormal alarms and false positives. In addition, due to the lack of targeted training and the low quality of training data, it is unable to effectively identify and distinguish real security threats. Summary of the invention

[0004] In order to solve the above technical problems, a security event stream big data analysis engine is provided. This technical solution solves the problem that the existing security event stream big data analysis engine mentioned above, due to the inaccurate data analysis algorithm or unreasonable threshold setting, leads to the engine's overreaction to non-security events, frequent abnormal alarms and false alarms, and due to the inability to conduct targeted training and the low quality of training data, it is impossible to effectively identify and distinguish real security threats.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0006] A security event stream big data analysis engine, comprising:

[0007] Obtain the multi-source security event stream in the operation and maintenance log of the device to obtain the security event stream data of the device;

[0008] Based on the security event flow data of the device, data is divided according to the type of security event flow at the time node to obtain several security event flow classification sets of the device;

[0009] Determine the device hardware initialization performance based on the device hardware parameters;

[0010] According to several security event flow classification sets and hardware initialization performance of the device, analyze the performance resource consumption trend of each security event flow classification set affecting the device, and obtain the device's security event flow performance redundant overhead time series data;

[0011] Based on the device's security event flow performance redundancy overhead time series data, the device hardware performance preference of each security event flow is analyzed to generate a dynamic confidence threshold for the security event flow at the time node.

[0012] Preferably, based on the security event flow data of the device, data is divided according to the type of the security event flow at the time node, and several security event flow classification sets of the device are obtained, which specifically include:

[0013] Perform data cleaning preprocessing based on the device's security event stream data, and convert the device's security event stream data into a binary security event stream data set through one-hot encoding;

[0014] According to the binary value security event stream data, the security event stream data is marked and divided according to the security event stream type and time node, and the security event stream feature array under the time node is obtained;

[0015] Based on the security event stream feature array at the time node, calculate the information gain of each sample in the security event stream feature array at each time node;

[0016] Based on the information gain of each sample in the security event stream feature array at the time node, samples with information gain greater than the corresponding security event stream feature at the time node are selected and combined into a security event stream feature sample set at the time node;

[0017] Based on the sample set of security event flow characteristics at the time node, a decision tree corresponding to each security event flow type is established, and the sample set of security event flow characteristics at the time node is used as the segmentation leaf node of the corresponding decision tree to construct a security event flow classification decision forest model;

[0018] Based on the security event flow classification decision forest model, the security event flow data of the device is taken as input, and several security event flow classification sets of the device are taken as output;

[0019] The information gain of each sample in the security event stream feature array at each time node is calculated as follows:

[0020]

[0021] In the formula, E v is the information gain of the vth sample in the security event stream feature array, D t is the security event stream feature array at t time nodes, is the vth sample in the security event stream feature array at t time nodes, is the information entropy of the vth sample in the security event stream feature array at t time nodes.

[0022] Preferably, according to several security event flow classification sets and hardware initialization performance of the device, analyzing the performance resource consumption trend of each security event flow classification set affecting the device, and obtaining the security event flow performance redundant overhead time series data of the device specifically includes:

[0023] Based on the device's task manager, determine the device hardware performance usage value at the time node;

[0024] Based on the difference calculation between the device hardware initialization performance and the device hardware performance occupancy value at the time node, the device hardware performance redundancy value at the time node is obtained; the device hardware performance redundancy value includes: CPU performance redundancy value, memory performance redundancy value, and network bandwidth performance redundancy value;

[0025] Mark the redundant cost of each hardware performance in the device hardware performance redundancy value at the time node, and record it as the redundant cost of the hardware performance at the time node;

[0026] Based on the redundant overhead of the hardware performance at the time node and the set of several security event flow classifications at the time node, calculate the correlation coefficient between the redundant overhead of the hardware performance at the time node and the several security event flow classifications at the time node;

[0027] Screen out the security event flows whose correlation coefficients are positively correlated between the redundant overhead of hardware performance at the time node and the classification of several security event flows at the time node, and record them as the hardware performance overhead at the time node affecting the security event flow;

[0028] Establish a VAR extended autoregressive performance overhead trend analysis model;

[0029] The hardware performance overhead affecting the security event flow at a time node is taken as an exogenous variable, and several security event flow classification sets and the hardware performance redundancy value at a time node are taken as dependent variable inputs. The redundant overhead of hardware performance associated with the security event flow at the predicted time node is taken as output to generate the performance redundancy overhead time series data of the device.

[0030] The correlation coefficient between the security event flow performance overhead at the calculation time node and the classification of several security event flows at the time node is specifically:

[0031]

[0032] In the formula, r ij is the correlation coefficient between the redundant overhead of the i-th hardware performance and the j-th security event flow, The redundant overhead of the i-th hardware performance at the t-th time node, is the j-th security event flow at the t-th time node, t is the time node, and T is the total duration of the time node;

[0033] The VAR extended autoregressive performance overhead trend analysis model is specifically:

[0034]

[0035] In the formula, To predict the performance redundancy overhead of the i-th hardware performance at the t-th time node under the influence of the j-th security event flow association, a 1 、a 2 、a p are all lagged autoregressive coefficients, β is the exogenous variable coefficient, ∈ is the constant term, ε(t) is the error term at the tth time node, and p is the order of lagged learning.

[0036] Preferably, based on the security event flow performance redundancy overhead time series data of the device, the device hardware performance preference of each security event flow is analyzed to generate the dynamic confidence threshold of the security event flow at the time node, specifically including:

[0037] Standardize the performance redundancy overhead time series data of the device's security event stream;

[0038] Based on the device's security event flow performance redundant overhead time series data, principal component analysis (PCA) is used to reduce the dimension of the device's security event flow performance redundant overhead time series data to obtain the device's security event flow performance redundant overhead time series dimension reduction data;

[0039] Cluster the hardware performance redundancy overhead preference of each security event flow for the device in the security event flow performance redundancy overhead time series dimensionality reduction data to obtain the security event flow hardware performance redundancy overhead preference cluster at the time node;

[0040] The mean and standard deviation of the hardware performance redundancy overhead preference of the security event flows in the hardware performance redundancy overhead preference cluster of the security event flows at the statistical time node;

[0041] Based on the mean and standard deviation of the security event flow's preference for hardware performance redundancy overhead, the dynamic confidence threshold of the security event flow at the time node is calculated;

[0042] The hardware performance redundancy overhead preference cluster of the security event flow at the time node is specifically:

[0043]

[0044] Where f is the objective function (the preference of security event flow for the hardware performance redundancy overhead of the device), n is the total number of clusters, and a i′ is the i′th data point in the security event stream performance redundancy overhead time series dimension reduction data, b k′is a set of data points that are assigned to the kth cluster, c k′ is the centroid of the kth cluster;

[0045] The dynamic confidence threshold of the security event flow at the calculation time node is specifically:

[0046]

[0047] In the formula, Q - is the lower limit of the dynamic confidence threshold of the security event flow at the time node, Q + is the upper limit of the dynamic confidence threshold of the security event flow at the time node, μ is the mean preference of the security event flow for hardware performance redundant overhead, σ is the standard deviation of the preference of the security event flow for hardware performance redundant overhead, and Z is the confidence level value (Z≈1.96).

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] The present invention proposes a security event stream big data analysis engine. By collecting multi-source security event stream data in the operation and maintenance log of the device, the data is first divided and classified by time node and event type to understand the impact of different security event streams on device performance. Combined with the hardware parameters and initialization performance of the device, the consumption trend of each security event stream classification set on device performance resources is analyzed, thereby obtaining the time series data of the security event stream performance redundancy overhead. Furthermore, based on these data, cluster analysis is performed on the preference of each security event stream for device hardware performance, and finally a dynamic confidence threshold under the time node is generated, which can effectively reduce abnormal alarms and improve the accuracy of security event stream detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A flowchart of a security event stream big data analysis engine method;

[0051] Figure 2 A flow chart of a method for obtaining a classification set of several security event flows of a device;

[0052] Figure 3 A flow chart of a method for obtaining redundant overhead timing data of security event stream performance of a device;

[0053] Figure 4 A flow chart of a method for generating a dynamic confidence threshold of a security event flow at a time node;

[0054] Figure 5 It is a schematic diagram of the structure of the electronic device of the present invention;

[0055] Figure 6 It is a schematic diagram of the computer-readable storage medium structure of the present invention. DETAILED DESCRIPTION

[0056] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0057] Reference Figure 1 As shown, a security event stream big data analysis engine includes:

[0058] Obtain the multi-source security event stream in the operation and maintenance log of the device to obtain the security event stream data of the device;

[0059] Based on the security event flow data of the device, data is divided according to the type of security event flow at the time node to obtain several security event flow classification sets of the device;

[0060] Determine the device hardware initialization performance based on the device hardware parameters;

[0061] According to several security event flow classification sets and hardware initialization performance of the device, analyze the performance resource consumption trend of each security event flow classification set affecting the device, and obtain the device's security event flow performance redundant overhead time series data;

[0062] Based on the device's security event flow performance redundancy overhead time series data, the device hardware performance preference of each security event flow is analyzed to generate a dynamic confidence threshold for the security event flow at the time node.

[0063] This solution collects multi-source security event flow data from the operation and maintenance log of the device, first divides and classifies the data by time node and event type to understand the impact of different security event flows on device performance, and analyzes the consumption trend of device performance resources by each security event flow classification set in combination with the device's hardware parameters and initialization performance, thereby obtaining the time series data of the security event flow performance redundancy overhead. Furthermore, based on these data, cluster analysis is performed on the preference of each security event flow for device hardware performance, and finally a dynamic confidence threshold at the time node is generated, which can effectively reduce abnormal alarms and improve the accuracy of security event flow detection.

[0064] Reference Figure 2 As shown, based on the security event flow data of the device, data is divided according to the type of security event flow at the time node, and several security event flow classification sets of the device are obtained, which specifically include:

[0065] Perform data cleaning preprocessing based on the device's security event stream data, and convert the device's security event stream data into a binary security event stream data set through one-hot encoding;

[0066] According to the binary value security event stream data, the security event stream data is marked and divided according to the security event stream type and time node, and the security event stream feature array under the time node is obtained;

[0067] Based on the security event stream feature array at the time node, calculate the information gain of each sample in the security event stream feature array at each time node;

[0068] Based on the information gain of each sample in the security event stream feature array at the time node, samples with information gain greater than the corresponding security event stream feature at the time node are selected and combined into a security event stream feature sample set at the time node;

[0069] Based on the sample set of security event flow characteristics at the time node, a decision tree corresponding to each security event flow type is established, and the sample set of security event flow characteristics at the time node is used as the segmentation leaf node of the corresponding decision tree to construct a security event flow classification decision forest model;

[0070] Based on the security event flow classification decision forest model, the security event flow data of the device is taken as input, and several security event flow classification sets of the device are taken as output;

[0071] The information gain of each sample in the security event stream feature array at each time node is calculated as follows:

[0072]

[0073] In the formula, E v is the information gain of the vth sample in the security event stream feature array, D t is the security event stream feature array at t time nodes, is the vth sample in the security event stream feature array at t time nodes, is the information entropy of the vth sample in the security event stream feature array at t time nodes.

[0074] It is understandable that due to the concentration of security event flows when devices are attacked from the outside, and the attack distribution of security event flows does not conform to the normal distribution, conventional means of classification and analysis in the overall dimension are easily affected by automatic attack security event flows. Therefore, the security event flows within the time node are classified to improve the accuracy of subsequent abnormal security event flow detection.

[0075] Reference Figure 3 As shown, according to several security event flow classification sets and hardware initialization performance of the device, the performance resource consumption trend of each security event flow classification set affecting the device is analyzed, and the security event flow performance redundant overhead time series data of the device is obtained, which specifically includes:

[0076] Based on the device's task manager, determine the device hardware performance usage value at the time node;

[0077] Based on the difference calculation between the device hardware initialization performance and the device hardware performance occupancy value at the time node, the device hardware performance redundancy value at the time node is obtained; the device hardware performance redundancy value includes: CPU performance redundancy value, memory performance redundancy value, and network bandwidth performance redundancy value;

[0078] Mark the redundant cost of each hardware performance in the device hardware performance redundancy value at the time node, and record it as the redundant cost of the hardware performance at the time node;

[0079] Based on the redundant overhead of the hardware performance at the time node and the set of several security event flow classifications at the time node, calculate the correlation coefficient between the redundant overhead of the hardware performance at the time node and the several security event flow classifications at the time node;

[0080] Screen out the security event flows whose correlation coefficients are positively correlated between the redundant overhead of hardware performance at the time node and the classification of several security event flows at the time node, and record them as the hardware performance overhead at the time node affecting the security event flow;

[0081] Establish a VAR extended autoregressive performance overhead trend analysis model;

[0082] The hardware performance overhead affecting the security event flow at a time node is taken as an exogenous variable, and several security event flow classification sets and the hardware performance redundancy value at a time node are taken as dependent variable inputs. The redundant overhead of hardware performance associated with the security event flow at the predicted time node is taken as output to generate the performance redundancy overhead time series data of the device.

[0083] The correlation coefficient between the security event flow performance overhead at the calculation time node and the classification of several security event flows at the time node is specifically:

[0084]

[0085] In the formula, r ij is the correlation coefficient between the redundant overhead of the i-th hardware performance and the j-th security event flow, The redundant overhead of the i-th hardware performance at the t-th time node, is the j-th security event flow at the t-th time node, t is the time node, and T is the total duration of the time node;

[0086] The VAR extended autoregressive performance overhead trend analysis model is specifically:

[0087]

[0088] In the formula, To predict the performance redundancy overhead of the i-th hardware performance at the t-th time node under the influence of the j-th security event flow association, a 1 、a 2 、a p are all lagged autoregressive coefficients, β is the exogenous variable coefficient, ∈ is the constant term, ε(t) is the error term at the tth time node, and p is the order of lagged learning.

[0089] This solution analyzes the impact of the security event flow classification set of the device at different time nodes on the device performance resource consumption, determines the hardware performance redundancy value and marks its overhead, calculates the correlation coefficient between these redundant overheads and the security event flow, and screens out the positively correlated security event flow as an influencing factor. By establishing a VAR model, the hardware performance overhead at the time node affecting the security event flow is taken as an exogenous variable, and the redundant value of the device is used as the dependent variable for prediction, thereby generating accurate device performance redundant overhead time series data, and realizing accurate analysis of the impact trend of the security event flow on the device performance overhead.

[0090] Reference Figure 4 As shown in the figure, based on the device's security event flow performance redundancy overhead time series data, the device hardware performance preference of each security event flow is analyzed to generate the dynamic confidence threshold of the security event flow at the time node, which specifically includes:

[0091] Standardize the performance redundancy overhead time series data of the device's security event stream;

[0092] Based on the device's security event flow performance redundant overhead time series data, principal component analysis (PCA) is used to reduce the dimension of the device's security event flow performance redundant overhead time series data to obtain the device's security event flow performance redundant overhead time series dimension reduction data;

[0093] Cluster the hardware performance redundancy overhead preference of each security event flow for the device in the security event flow performance redundancy overhead time series dimensionality reduction data to obtain the security event flow hardware performance redundancy overhead preference cluster at the time node;

[0094] The mean and standard deviation of the hardware performance redundancy overhead preference of the security event flows in the hardware performance redundancy overhead preference cluster of the security event flows at the statistical time node;

[0095] Based on the mean and standard deviation of the security event flow's preference for hardware performance redundancy overhead, the dynamic confidence threshold of the security event flow at the time node is calculated;

[0096] The hardware performance redundancy overhead preference cluster of the security event flow at the time node is specifically:

[0097]

[0098] Where f is the objective function (the preference of security event flow for the hardware performance redundancy overhead of the device), n is the total number of clusters, and a i′ is the i′th data point in the security event stream performance redundancy overhead time series dimension reduction data, b k′ is a set of data points that are assigned to the kth cluster, c k′ is the centroid of the kth cluster;

[0099] The dynamic confidence threshold of the security event flow at the calculation time node is specifically:

[0100]

[0101] In the formula, Q - is the lower limit of the dynamic confidence threshold of the security event flow at the time node, Q + is the upper limit of the dynamic confidence threshold of the security event flow at the time node, μ is the mean preference of the security event flow for hardware performance redundant overhead, σ is the standard deviation of the preference of the security event flow for hardware performance redundant overhead, and Z is the confidence level value (Z≈1.96).

[0102] It should be noted that the hardware performance redundancy overhead preference of security event flows refers to the target direction of security event intrusion, such as side channel attacks (such as Spectre and Meltdown), which use the redundant processing power of the CPU to steal sensitive data. Distributed denial of service (DDoS) attacks exhaust network bandwidth resources and affect the normal operation of the system by overloading the target network interface; therefore, by clustering the hardware performance preferences corresponding to different security event flows, it is possible to identify attack patterns and formulate targeted defense strategies.

[0103] Figure 5 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Figure 5 As shown, according to another aspect of the present application, an electronic device 500 is also provided. The electronic device 500 may include one or more processors and one or more memories. The memory stores a computer readable code, and when the computer readable code is run by one or more processors, it can execute a security event big data analysis engine as described above.

[0104] Figure 6 Schematic diagram of a computer-readable storage medium structure provided by an embodiment of the present application. Figure 6As shown, a computer-readable storage medium 600 according to an embodiment of the present application is shown. Computer-readable instructions are stored on the computer-readable storage medium 600. When the computer-readable instructions are executed by the processor, a security event big data analysis engine according to an embodiment of the present application described with reference to the above figures can be executed.

[0105] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A security event stream big data analysis engine, characterized in that: include: Obtain the multi-source security event stream in the operation and maintenance log of the device to obtain the security event stream data of the device; Based on the security event flow data of the device, data is divided according to the type of security event flow at the time node to obtain several security event flow classification sets of the device; Determine the device hardware initialization performance based on the device hardware parameters; According to several security event flow classification sets and hardware initialization performance of the device, analyze the performance resource consumption trend of each security event flow classification set affecting the device, and obtain the device's security event flow performance redundant overhead time series data; Based on the device's security event flow performance redundancy overhead time series data, the device hardware performance preference of each security event flow is analyzed to generate a dynamic confidence threshold for the security event flow at the time node.

2. A security event stream big data analysis engine according to claim 1, characterized in that: Based on the security event flow data of the device, data is divided according to the type of security event flow at the time node, and several security event flow classification sets of the device are obtained, including: Perform data cleaning preprocessing based on the device's security event stream data, and convert the device's security event stream data into a binary security event stream data set through one-hot encoding; According to the binary value security event stream data, the security event stream data is marked and divided according to the security event stream type and time node, and the security event stream feature array under the time node is obtained; Based on the security event stream feature array at the time node, calculate the information gain of each sample in the security event stream feature array at each time node; Based on the information gain of each sample in the security event stream feature array at the time node, samples with information gain greater than the corresponding security event stream feature at the time node are selected and combined into a security event stream feature sample set at the time node; Based on the sample set of security event flow characteristics at the time node, a decision tree corresponding to each security event flow type is established, and the sample set of security event flow characteristics at the time node is used as the segmentation leaf node of the corresponding decision tree to construct a security event flow classification decision forest model; Based on the security event flow classification decision forest model, the security event flow data of the device is taken as input, and several security event flow classification sets of the device are taken as output; The information gain of each sample in the security event stream feature array at each time node is calculated as follows: In the formula, E v is the information gain of the vth sample in the security event stream feature array, D t is the security event stream feature array at t time nodes, is the vth sample in the security event stream feature array at t time nodes, is the information entropy of the vth sample in the security event stream feature array at t time nodes.

3. A security event stream big data analysis engine according to claim 2, characterized in that: According to several security event flow classification sets and hardware initialization performance of the device, the performance resource consumption trend of each security event flow classification set affecting the device is analyzed, and the device's security event flow performance redundant overhead time series data is obtained, including: Based on the device's task manager, determine the device hardware performance usage value at the time node; Based on the difference calculation between the device hardware initialization performance and the device hardware performance occupancy value at the time node, the device hardware performance redundancy value at the time node is obtained; the device hardware performance redundancy value includes: CPU performance redundancy value, memory performance redundancy value, and network bandwidth performance redundancy value; Mark the redundant cost of each hardware performance in the device hardware performance redundancy value at the time node, and record it as the redundant cost of the hardware performance at the time node; Based on the redundant overhead of the hardware performance at the time node and the set of several security event flow classifications at the time node, calculate the correlation coefficient between the redundant overhead of the hardware performance at the time node and the several security event flow classifications at the time node; Screen out the security event flows whose correlation coefficients are positively correlated between the redundant overhead of hardware performance at the time node and the classification of several security event flows at the time node, and record them as the hardware performance overhead at the time node affecting the security event flow; Establish a VAR extended autoregressive performance overhead trend analysis model; The hardware performance overhead affecting the security event flow at a time node is taken as an exogenous variable, several security event flow classification sets and the hardware performance redundancy value at a time node are taken as dependent variable inputs, and the redundant overhead of the hardware performance associated with the security event flow at the predicted time node is taken as output to generate the performance redundancy overhead time series data of the device.

4. A security event stream big data analysis engine according to claim 3, characterized in that: The correlation coefficient between the security event flow performance overhead at the calculation time node and the classification of several security event flows at the time node is specifically: In the formula, r ij is the correlation coefficient between the redundant overhead of the i-th hardware performance and the j-th security event flow, The redundant overhead of the i-th hardware performance at the t-th time node, is the j-th security event flow at the t-th time node, t is the time node, and T is the total duration of the time node.

5. A security event stream big data analysis engine according to claim 4, characterized in that: The VAR extended autoregressive performance overhead trend analysis model is specifically: In the formula, To predict the performance redundancy overhead of the i-th hardware performance at the t-th time node under the influence of the j-th security event flow association, a1, a2, a p are all lagged autoregressive coefficients, β is the exogenous variable coefficient, ∈ is the constant term, ε(t) is the error term at the tth time node, and p is the order of lagged learning.

6. A security event stream big data analysis engine according to claim 5, characterized in that: Based on the device's security event flow performance redundancy overhead time series data, the device hardware performance preference of each security event flow is analyzed to generate the dynamic confidence threshold of the security event flow at the time node, including: Standardize the performance redundancy overhead time series data of the device's security event stream; Based on the device's security event flow performance redundant overhead time series data, principal component analysis (PCA) is used to reduce the dimension of the device's security event flow performance redundant overhead time series data to obtain the device's security event flow performance redundant overhead time series dimension reduction data; Cluster the hardware performance redundancy overhead preference of each security event flow for the device in the security event flow performance redundancy overhead time series dimensionality reduction data to obtain the security event flow hardware performance redundancy overhead preference cluster at the time node; The mean and standard deviation of the hardware performance redundancy overhead preference of the security event flows in the hardware performance redundancy overhead preference cluster of the security event flows at the statistical time node; Based on the mean and standard deviation of the security event flow's preference for hardware performance redundancy overhead, the dynamic confidence threshold of the security event flow at the time node is calculated; The hardware performance redundancy overhead preference cluster of the security event flow at the time node is specifically: Where f is the objective function (the preference of security event flow for the hardware performance redundancy overhead of the device), n is the total number of clusters, and a i′ is the i′th data point in the security event stream performance redundancy overhead time series dimension reduction data, b k′ is a set of data points that are assigned to the kth cluster, c k′ is the centroid of the kth cluster; The dynamic confidence threshold of the security event flow at the calculation time node is specifically: In the formula, Q - is the lower limit of the dynamic confidence threshold of the security event flow at the time node, Q + is the upper limit of the dynamic confidence threshold of the security event flow at the time node, μ is the mean preference of the security event flow for hardware performance redundant overhead, σ is the standard deviation of the preference of the security event flow for hardware performance redundant overhead, and Z is the confidence level value (Z≈1.96).

7. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a security event stream big data analysis engine as described in any one of claims 1-6.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, a security event stream big data analysis engine according to any one of claims 1 to 6 is implemented.

Images