Security event early warning method and system based on alarm data analysis

Abstract

The invention belongs to the field of system safety monitoring, and provides a safety event early warning method and system based on alarm data analysis, and the method comprises the steps: building an alarm coordinate system for a first type of unimportant alarms by taking an alarm triggering user as a first coordinate axis and an alarm triggering asset as a second coordinate axis; obtaining a first type of unimportant alarm data in real time; obtaining an alarm number corresponding to each user and each asset in the first time window; converting the alarm number into a gray value; the gray value is marked in the alarm coordinate system; converting the alarm coordinate system into an alarm image, and performing linear detection on the alarm image by using Hough transform; and when the linear confidence coefficient is greater than a preset value, judging that the first type of unimportant alarms may be abnormal, and displaying the alarm coordinate system on a first user interface. According to the scheme, alarm data analysis is performed efficiently.

Description

Technical Field

[0001] The present invention belongs to the field of system security monitoring, and in particular relates to a security event early warning method and system based on alarm data analysis. Background Art

[0002] In the prior art, alarm levels are usually divided into emergency alarms, important alarms, minor alarms, and prompt alarms. Emergency alarms and important alarms can attract the attention of maintenance personnel in a timely manner, while non-important alarms, such as minor alarms and prompt alarms, are usually ignored by maintenance personnel. However, continuous low-priority alarms may pose a serious threat under certain conditions.

[0003] For example, if an IP address continues to try to log in to different users' passwords multiple times, each failed attempt will trigger a low-priority login failure alarm. If the attacker uses a slow, scattered brute force cracking method with a long interval between each attempt, it may not trigger a high-priority alarm. However, the accumulation of such continuous low-priority alarms may mean that the attacker is conducting a planned brute force cracking attack.

[0004] After infiltrating the system, attackers may try to move laterally in the internal network, looking for higher-privileged accounts or more sensitive data. In this process, some low-priority alerts may be triggered, such as unauthorized attempts to access shared folders, low-priority attempts to escalate user privileges, abnormal service requests, etc. These alerts may not pose a serious threat individually, but when attackers move laterally between multiple nodes or multiple services, the frequent occurrence of low-priority alerts may indicate that the attacker has broken through the initial defense line and is trying to expand its control range.

[0005] Although individual non-critical alerts may seem harmless, when they appear in a continuous, concentrated, or patterned manner, they may indicate that the attacker is preparing for a larger, more covert attack.

[0006] However, the number of non-critical alarms is usually large, and as the environment changes, the number of alarms fluctuates greatly. It is usually difficult to filter out potentially abnormal data from a large amount of alarm data by setting a fixed threshold, making it difficult to identify hidden attacks. Summary of the invention

[0007] In order to solve the problems in the prior art, the present invention provides a security incident early warning method based on alarm data analysis, the method comprising the following steps:

[0008] For the first type of non-important alarm, an alarm coordinate system is constructed with the alarm triggering user as the first coordinate axis and the alarm triggering asset as the second coordinate axis;

[0009] Obtain the first type of non-critical alarm data in real time;

[0010] Get the number of alarms corresponding to each user and each asset in the first time window;

[0011] Converting the alarm quantity into a grayscale value;

[0012] Marking the grayscale value in the warning coordinate system;

[0013] The warning coordinate system is transformed into a warning image, and the warning image is subjected to straight line detection using Hough transform; when the straight line confidence is greater than a preset value, it is determined that the first type of non-important warning may be abnormal, and the warning coordinate system is displayed on a first user interface.

[0014] Another aspect of the present invention further provides a security incident early warning system based on alarm data analysis, the system comprising the following modules:

[0015] A setting module is used to construct an alarm coordinate system for the first type of non-important alarm with the alarm triggering user as the first coordinate axis and the alarm triggering asset as the second coordinate axis;

[0016] An acquisition module is used to acquire the first type of non-important alarm data in real time;

[0017] A calculation module, used to obtain the number of alarms corresponding to each user and each asset in the first time window;

[0018] A conversion module, used for converting the alarm quantity into a grayscale value;

[0019] A marking module, used for marking the grayscale value in the warning coordinate system;

[0020] A judgment module is used to transform the warning coordinate system into a warning image, and use Hough transform to perform straight line detection on the warning image; when the straight line confidence is greater than a preset value, it is judged that the first type of non-important warning may be abnormal, and the warning coordinate system is displayed on a first user interface.

[0021] The present invention can produce the following beneficial effects through the above technical solution:

[0022] Unlike traditional alarm systems based on fixed thresholds, the present invention uses a graphical alarm data analysis method and does not require pre-setting thresholds based on the number of alarms. In traditional methods, fluctuations in the number of alarms and environmental changes often result in the set thresholds being unable to effectively capture abnormal situations. However, the present invention uses image processing techniques such as Hough transform to directly identify potential abnormal behaviors from alarm images. Even if the number of alarms changes significantly, the system can still accurately identify potential threats.

[0023] In the present invention, when an abnormal situation occurs in the system, an obvious linear image will automatically appear in the alarm image. This linear pattern is usually caused by multiple related alarm events, representing highly related activities or attack behaviors between users and assets. Since the method is based on image pattern recognition, no matter how the amount of alarm data fluctuates or changes, the system can effectively detect abnormal behavior and ensure early warning of security events.

[0024] The present invention does not rely on a fixed alarm quantity threshold, and can therefore adapt to a variety of dynamically changing environments. Whether in a high-load network environment or in a scenario where the alarm data fluctuates greatly, the system can reliably identify abnormal situations through image processing. This feature enables the system to have greater adaptability and stability when dealing with complex and changing security threats.

[0025] Since it no longer relies on fixed thresholds, the present invention effectively reduces the problem of false positives and false negatives caused by improper threshold settings. Through the significant linear features in the image, the system can more accurately identify actual abnormal behavior without missing potential threats due to insufficient alarms or short-term fluctuations.

[0026] The present invention can be applied to various alarm types and system environments, whether it is a financial system, an industrial control system, or an enterprise network management platform. Through graphical alarm analysis and linear feature detection, the system can effectively play a role in different application scenarios, ensuring timely warning of security threats in different environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0029] Below, the invention is preferably described in conjunction with the accompanying drawings and specific implementation methods.

[0030] This embodiment solves the above problem through the following steps:

[0031] In one embodiment, reference Figure 1 The present invention provides a security incident early warning method based on alarm data analysis.

[0032] A security incident early warning method based on alarm data analysis detects regular or repetitive abnormal behaviors hidden in non-critical alarms that are usually ignored by maintenance personnel.

[0033] The classification of alarms may vary in different systems. Non-important alarms refer to those warning messages that appear frequently in the system but usually do not attract immediate attention, such as minor alarms and prompt alarms. These alarms may be triggered by minor system errors, temporary network fluctuations, or improper user operations. Since they seem harmless and usually do not have a significant impact on the normal operation of the system, maintenance personnel often ignore these alarms.

[0034] First, for the first type of non-important alarms, an alarm coordinate system is constructed with the alarm triggering user as the first coordinate axis and the alarm triggering asset as the second coordinate axis.

[0035] There may be many types of non-important alarms, such as network alarms, account alarms, file alarms, etc. The first type of non-important alarms is one of the multiple types of non-important alarms. In the present invention, an alarm coordinate system is established for each type of alarm.

[0036] Alarm triggering users refer to users or accounts that cause alarm events to be generated. Whenever a user performs certain operations in the system (such as logging in, accessing files, modifying configurations, etc.), the system may generate alarms based on preset security policies. These alarms record user activities and help security teams identify and track possible abnormal behaviors. Alarm triggering users are usually related to the source of the alarm and are an important basis for analyzing user behavior and detecting potential threats.

[0037] Alarm triggering assets refer to system resources or devices that are affected or related to an alarm event. Assets can be servers, databases, network devices, applications, etc. Whenever an asset detects an abnormal operation or state, a corresponding alarm is triggered. Alarm triggering assets are crucial in security analysis because they represent possible attack targets or failure points.

[0038] The alarm coordinate system is a two-dimensional spatial representation method used to express alarm events in a graphical manner. In this coordinate system, the two coordinate axes represent different variables (alarm triggering users and alarm triggering assets). Through this representation method, security analysts can intuitively observe and analyze the distribution of alarm events between users and assets, making it easier to identify abnormal behavior patterns or attack paths. The present invention subsequently performs analysis by means of image recognition to improve the efficiency of recognition.

[0039] Obtain the first type of non-critical alarm data in real time.

[0040] At each important node of the network, including servers, network devices, security devices, etc. These nodes use technical means such as security agents, log collectors or monitoring probes to capture all alarm events occurring in the system in real time.

[0041] On the centralized management platform, the real-time alarm data will be immediately stored in an efficient database. NoSQL databases (such as MongoDB, Cassandra) or distributed databases (such as HBase) can be used to support fast reading and writing of large-scale data. At the same time, the data processing module will perform real-time analysis on the newly acquired alarm data, including data cleaning, formatting, feature extraction, etc., to prepare for subsequent alarm pattern recognition and anomaly detection.

[0042] In order to achieve real-time analysis, the system can also introduce a stream processing framework (such as Apache Kafka, Apache Flink) to process the alarm data stream. Through this real-time processing mechanism, the system can capture any possible security threats within millisecond response time.

[0043] Get the number of alarms corresponding to each user and each asset in the first time window.

[0044] In the security incident warning system, analyzing the alarm behavior between users and assets is a key step in identifying potential security threats. By counting the number of alarms triggered by each user on each asset within a specific time period, the system can reveal the pattern of alarm distribution and identify abnormal user behavior or abnormal asset usage. The definition of the first time window determines the system's time sensitivity to data. This time window can be minutes, hours, days, etc., depending on the monitoring requirements and the accuracy of alarm analysis.

[0045] Suitable for environments that require high-frequency monitoring, such as financial trading systems or network traffic monitoring. The time window may be set to a few minutes to a few hours to capture rapidly changing attack behaviors.

[0046] Suitable for analyzing alarm trends over a long period of time, such as user behavior analysis or long-term network health status monitoring. The time window may be set to one day or one week.

[0047] This embodiment does not specifically limit the first time window, and those skilled in the art may select it according to the above rules and system requirements.

[0048] In the time window, the system traverses all alarm events one by one and counts them in the counter of the corresponding user-asset pair. Read the user ID and asset ID of each alarm event and find the corresponding row and column in the user-asset matrix.

[0049] Once the corresponding user-asset pair is found, the system will increase the alarm counter of the pair by 1, indicating that the user triggered an alarm for the asset within the time window.

[0050] This process will continue until the time window ends. The statistical results will show how many alerts each user has generated for which assets in a specific time period.

[0051] The alarm quantity is converted into a grayscale value.

[0052] In the security incident early warning system, the visualization of alarm data can more intuitively analyze and identify potential security threats. In order to achieve this visualization effect, the number of alarms needs to be converted into grayscale values ​​and displayed in the form of images. The application of grayscale values ​​can simplify complex digital information into visual information, allowing security analysts to identify alarm patterns and abnormal behaviors more quickly and intuitively. At the same time, image processing methods can also be used to identify obvious patterns in images.

[0053] Grayscale is a numerical value between 0 and 255, where 0 usually represents black, 255 represents white, and values ​​in between represent different shades of gray. In image processing, grayscale is used to represent the brightness of each pixel in an image. In the visualization of alarm data, the grayscale value can be used to represent the number of alarms:

[0054] Low grayscale values ​​(dark colors): indicate a smaller number of alerts, which may mean less or more normal interactions between users and assets.

[0055] High grayscale values ​​(light colors): indicate a large number of alerts, which may indicate frequent interactions between users and assets, or potential abnormal behavior.

[0056] Before converting the alarm quantity into grayscale values, the original alarm quantity data needs to be standardized. This is because the alarm quantity between different users and assets may vary greatly, and directly using these raw data may result in unclear contrast in the grayscale image.

[0057] You can use minimum-maximum normalization: normalize the alarm quantity data to a specific range (usually 0 to 1) to ensure that all data can be compared on a uniform scale. The formula is as follows:

[0058]

[0059] Where x represents the original alarm number, x′ represents the normalized value, and x min and x max Respectively represent the minimum and maximum value of the alarm quantity.

[0060] Logarithmic transformation can also be used. For situations where the difference in the number of alarms is particularly large, logarithmic transformation can be used to compress the range of the data so that a large number of alarms will not excessively affect the conversion of grayscale values. The formula is as follows:

[0061] x′=log(1+x)

[0062] Logarithmic transformation can effectively reduce the gap between extreme values ​​and enhance the visualization effect of the image.

[0063] After completing the data standardization process, the system needs to convert the standardized alarm quantity into a grayscale value. The grayscale value is usually between 0 and 255, and is mapped through the following steps:

[0064] Linear mapping: Map the normalized alarm quantity directly to the grayscale value range. Assuming the normalized value is between 0 and 1, the corresponding grayscale value calculation formula is:

[0065] GrayValue = x′×255

[0066] Non-linear mapping: In some cases, non-linear mapping (such as exponential mapping or gamma correction) can be used to adjust the distribution of grayscale values ​​to enhance the contrast within a specific range. For example:

[0067] GrayValue=(x′) γ ×255

[0068] Among them, γ is an adjustable parameter used to control the nonlinearity of the mapping. A larger γ value will make the grayscale value more concentrated on the darker or brighter end, thereby highlighting the difference in the number of alarms.

[0069] The grayscale value is marked in the warning coordinate system.

[0070] In the previous steps, we have built an alarm coordinate system, the horizontal axis (X axis) of which represents the user who triggered the alarm, and the vertical axis (Y axis) represents the asset related to the alarm. This two-dimensional representation can intuitively show the alarm relationship between different users and different assets. Each user-asset pair corresponds to a position in the coordinate system, that is, a point.

[0071] The system converts the previously calculated alarm counts for each user-asset pair into grayscale values. These grayscale values ​​need to be accurately mapped to the corresponding positions in the alarm coordinate system:

[0072] Mapping of users and assets: For each user-asset pair, the system finds the corresponding coordinate point in the alarm coordinate system. For example, suppose the X-axis position of a user A in the coordinate system is X A , an asset B is at position Y on the Y axis B, then the grayscale value converted by the number of alarms between user A and asset B should be marked on the coordinate (X A ,Y B )superior.

[0073] Grayscale value annotation: The system will annotate the corresponding grayscale value on each coordinate point found. This grayscale value represents the alarm frequency of the user for the asset, and in the subsequent image generation process, this grayscale value will be used to define the brightness of the point on the image.

[0074] In the alarm coordinate system, each intersection point between a user and an asset can be regarded as a pixel on an image. The brightness of each pixel in the image is determined by its corresponding grayscale value. The following is the specific implementation process:

[0075] Image pixel definition: Assume that the resolution of the alarm image to be generated by the system is

[0076] M×N, where M is the number of users and N is the number of assets. Then, each pixel point (i, j) in the image corresponds to a user-asset pair (Xi, Yj) in the alarm coordinate system.

[0077] Gray value filling: For each user-asset pair, find its corresponding coordinate point in the alarm coordinate system, and then fill its gray value into the corresponding pixel of the image. Specifically, assuming that the gray value converted from the number of alarms between user Ui and asset Aj is Gij, then the brightness of the pixel at (i, j) in the image will be set to Cij.

[0078] After the grayscale value is labeled, the system generates an alarm image in which the brightness of each pixel represents the alarm frequency of the corresponding user-asset pair.

[0079] Furthermore, users with the same permissions are moved to adjacent positions in the coordinate system, and assets with the same asset type are moved to adjacent positions in the coordinate system.

[0080] In order to more effectively analyze and identify patterns and abnormal behaviors in alarm data, clustering users with the same permissions and assets of the same asset type and moving them to adjacent positions in the alarm coordinate system helps reveal potential correlations and abnormal behaviors. This operation not only improves data visualization, but also makes it easier for the system to discover and analyze alarm trends and abnormal distributions between similar users or assets.

[0081] In a typical enterprise or organization, user permissions are usually defined based on their positions, responsibilities, and roles. Permissions may involve the ability to access certain key resources, perform certain operations, or manage specific assets. For example:

[0082] Administrator user: has the highest permissions and can access and modify almost all system resources.

[0083] Ordinary users: have lower permissions and can only access some resources related to their work.

[0084] Guest user: has the least permissions and can usually only view some public information or perform limited operations.

[0085] Users can be divided into different categories based on their permissions. For users with the same permissions, the operations they perform in the system and the resources they access are often similar, so they may show similar behavior patterns in alarm analysis.

[0086] In order to better analyze the alarm data between users with the same permissions, you can move these users to adjacent positions in the alarm coordinate system. The specific steps are as follows:

[0087] User sorting: First, sort all users by their permission levels. You can sort them from the user with the highest permission to the user with the lowest permission, or adjust other sorting methods based on specific business needs.

[0088] User rearrangement: Arrange the sorted users in sequence on the X-axis of the alarm coordinate system so that users with the same permissions are adjacent to each other. This arrangement ensures that the alarm data between users with the same or similar permissions are easier to identify and compare in the alarm image.

[0089] User clustering display: In the generated alarm image, users with the same permissions will be displayed in one area, allowing analysts to quickly identify the alarm correlation and potential abnormal behavior between these users.

[0090] By moving users with the same permissions to adjacent positions, the system can more intuitively display the alarm patterns between users with similar permissions. This approach has the following advantages:

[0091] Correlation analysis: It is easier to analyze whether there are common behavior patterns or anomalies between users in the same permission group, for example, whether multiple administrator accounts triggered similar alarms in the same time period.

[0092] Enhanced visualization: Makes similar user alarms in the alarm image more structured and regular, facilitating quick identification of anomalies.

[0093] Asset types are usually classified based on the nature and purpose of the resource in the system. Common asset types include:

[0094] Servers: These are used to run applications and services and are often the primary target of attackers.

[0095] Database: Stores important data, is highly sensitive, and requires strict access control.

[0096] Network equipment: such as routers and switches, responsible for data transmission and network management.

[0097] Applications: include internal applications, SaaS services, etc., through which users perform daily operations.

[0098] The types of these assets determine their functions and importance in the system, and different types of assets often face different security threats. Therefore, in alarm analysis, placing assets of the same type together helps to better understand the security status of specific types of assets.

[0099] In order to analyze asset alarm data more effectively, you can move assets of the same type to adjacent locations in the alarm coordinate system. The specific steps are as follows:

[0100] Classification of asset types: First, classify all assets and group them according to their types (such as servers, databases, network devices, etc.).

[0101] Asset sorting and rearrangement: Arrange the classified assets in sequence on the Y axis of the alarm coordinate system so that assets of the same type are adjacent. This arrangement ensures that the correlation between assets can be more clearly displayed in the alarm image.

[0102] Asset clustering display: In the generated alarm image, assets of the same type will be displayed in one area, making it easier to observe the alarm frequency and distribution of these assets within a specific time window.

[0103] Moving assets of the same asset type to adjacent locations has significant advantages in alarm analysis:

[0104] Comparison between asset types: This arrangement allows you to quickly compare the alarm conditions of assets of the same type and identify which assets face greater security risks.

[0105] Centralized management: For the management and protection of specific types of assets, more targeted security strategies can be formulated by analyzing alarm data from adjacent locations.

[0106] The warning coordinate system is transformed into a warning image, and the warning image is subjected to straight line detection using Hough transform; when the straight line confidence is greater than a preset value, it is determined that the first type of non-important warning may be abnormal, and the warning coordinate system is displayed on a first user interface.

[0107] In the previous step, the system has constructed an alarm coordinate system based on the information of users and assets, and converted the grayscale values ​​of the alarm data. The system needs to convert this alarm coordinate system into a two-dimensional image for subsequent image processing and analysis.

[0108] Pixel matrix generation: The system maps each user-asset pair in the alarm coordinate system to a pixel in the image. Specifically, the grayscale value of each pixel represents the number of alarms triggered between the user and the asset within the specified time window. In this way, a pixel matrix containing grayscale values ​​is generated.

[0109] Image construction: Using the generated pixel matrix, the system constructs a two-dimensional grayscale image. The X-axis of this image represents the user, the Y-axis represents the asset, and the brightness of each pixel reflects the frequency of the user triggering an alarm for the asset.

[0110] The main advantage of converting the alarm coordinate system into an image is that it can present a large amount of complex data in an intuitive way, allowing the system to use mature image processing techniques to identify hidden patterns and anomalies in the data. This approach also makes it easier for human analysts to quickly understand the distribution and potential risks of the data.

[0111] Hough transform is a classic image processing algorithm that is widely used to detect straight lines or other geometric shapes in images. In this system, the role of Hough transform is to identify possible straight line patterns in the alarm image. The presence of straight lines usually indicates an alarm event with a high correlation between the user and the asset, and this correlation may indicate potential abnormal behavior or attack.

[0112] The system applies the Hough transform algorithm to the generated warning image, analyzes the brightness distribution in the image pixel by pixel, and converts the regular changes in the number of warnings into the Hough space. In the Hough space, a straight line is represented as a series of points with the highest votes, and possible straight line parameters (such as the slope and intercept of the straight line) are recorded through an accumulator.

[0113] Through the Hough transform, the system can detect which areas in the image may form straight lines. These straight lines may represent concentrated alarms from multiple users on the same or similar assets, or frequent alarms from the same user on a series of related assets. The system will record the parameters of the detected straight lines for further analysis.

[0114] Straight lines detected in the alert image may represent potential abnormal patterns in the alert data. For example, if multiple different users issue a large number of alerts on the same asset in a short period of time, this phenomenon may indicate a coordinated attack against the asset or a system configuration error. By identifying these straight lines, the system can detect and warn of possible security issues early.

[0115] The result of the Hough transform can be used to determine the significance of the line through confidence assessment. Confidence refers to the system's confidence in whether the detected line actually exists, usually calculated based on the number of votes in the accumulator.

[0116] In Hough space, the confidence of a line is determined by the maximum number of votes in the accumulator. The more votes there are, the higher the probability that the corresponding pixel in the image is on the line, and therefore the greater the possibility that the line exists.

[0117] The system sets a confidence threshold. When the confidence of a detected straight line is higher than this threshold, the system considers that the straight line may represent an abnormal pattern in the alarm data.

[0118] Once straight lines with a high confidence level are detected, the system will further analyze the alarm data patterns represented by these straight lines and determine whether there is potential abnormal behavior.

[0119] If a straight line represents concentrated alarms from multiple users on the same asset or concentrated alarms from one user on multiple assets, and these alarm behaviors are inconsistent with the normal operating mode, the system will mark these alarms as possible abnormal behaviors.

[0120] When potential abnormal behavior is confirmed, the system will trigger an early warning mechanism to notify relevant security personnel to take further investigation and response measures.

[0121] In order to facilitate security analysts to quickly understand and respond, the system displays the generated alarm images and detection results on the user interface. This process involves visually presenting graphical information of alarm data to users, enabling them to quickly identify abnormal areas and take action.

[0122] The system will display the warning image after Hough transform processing directly in the user interface, where straight lines mark possible abnormal behavior areas. Users can zoom in, zoom out or move the view to view these areas in detail.

[0123] The system will highlight the lines with high confidence in the image and attach relevant alarm information, such as the users, assets and alarm types involved. This annotation helps users quickly locate the root cause of the problem.

[0124] Furthermore, the user can click on a straight line or other marked area in the image, and the system will pop up detailed alarm information, including the time, users and assets involved, and the specific content of the alarm.

[0125] Furthermore, based on the displayed alarm information, users can quickly determine the severity of the problem and take corresponding security measures, such as blocking accounts, isolating assets, or adjusting firewall rules.

[0126] On the other hand, the present invention also provides a security incident early warning system based on alarm data analysis, comprising:

[0127] A setting module is used to construct an alarm coordinate system for the first type of non-important alarm with the alarm triggering user as the first coordinate axis and the alarm triggering asset as the second coordinate axis;

[0128] An acquisition module is used to acquire the first type of non-important alarm data in real time;

[0129] A calculation module, used to obtain the number of alarms corresponding to each user and each asset in the first time window; a conversion module, used to convert the number of alarms into a gray value;

[0130] A marking module, used for marking the grayscale value in the warning coordinate system;

[0131] A judgment module is used to transform the warning coordinate system into a warning image, and use Hough transform to perform straight line detection on the warning image; when the straight line confidence is greater than a preset value, it is judged that the first type of non-important warning may be abnormal, and the warning coordinate system is displayed on a first user interface.

[0132] Furthermore, the specific implementation methods of the above-mentioned security incident warning system based on alarm data analysis are the same as a security incident warning method based on alarm data analysis, and all further technical solutions in a security incident warning method based on alarm data analysis are fully introduced into a security incident warning system based on alarm data analysis.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

[0134] The present invention does not particularly specify the structure of some modules, which shall be subject to the contents recorded in the prior art. The prior art mentioned in the above background technology section and the specific embodiment section of the present invention can be used as part of the present invention to understand the meaning of some technical features or parameters. The scope of protection of the present invention shall be subject to the contents actually recorded in the claims.

Claims

1. A security incident early warning method based on alarm data analysis, characterized in that The method comprises the following steps: For the first type of non-important alarm, an alarm coordinate system is constructed with the alarm triggering user as the first coordinate axis and the alarm triggering asset as the second coordinate axis; Obtain the first type of non-critical alarm data in real time; Get the number of alarms corresponding to each user and each asset in the first time window; Converting the alarm quantity into a grayscale value; Marking the grayscale value in the warning coordinate system; The warning coordinate system is transformed into a warning image, and the warning image is subjected to straight line detection using Hough transform; when the straight line confidence is greater than a preset value, it is determined that the first type of non-important warning may be abnormal, and the warning coordinate system is displayed on a first user interface.

2. A security incident early warning method based on alarm data analysis according to claim 1, characterized in that: When obtaining the first type of non-important alarm data in real time, a stream processing framework is introduced to process the alarm data stream.

3. The security incident early warning method based on alarm data analysis according to claim 1 is characterized by: Converting the alarm quantity into a grayscale value will normalize the alarm quantity.

4. The security incident early warning method based on alarm data analysis according to claim 1 is characterized in that: Move users with the same permissions to adjacent positions in the coordinate system, and move assets of the same asset type to adjacent positions in the coordinate system.

5. The security incident early warning method based on alarm data analysis according to claim 1 is characterized by: When the straight line confidence is greater than the preset value, it is judged that the first type of non-important alarm may be abnormal. After the user clicks the straight line or marked area in the image, the system will pop up detailed alarm information, including time, users and assets involved, and specific content of the alarm.

6. A security incident early warning system based on alarm data analysis, characterized in that The system includes the following modules: A setting module is used to construct an alarm coordinate system for the first type of non-important alarm with the alarm triggering user as the first coordinate axis and the alarm triggering asset as the second coordinate axis; An acquisition module is used to acquire the first type of non-important alarm data in real time; A calculation module, used to obtain the number of alarms corresponding to each user and each asset in the first time window; A conversion module, used for converting the alarm quantity into a grayscale value; A marking module, used for marking the grayscale value in the warning coordinate system; A judgment module is used to transform the warning coordinate system into a warning image, and use Hough transform to perform straight line detection on the warning image; when the straight line confidence is greater than a preset value, it is judged that the first type of non-important warning may be abnormal, and the warning coordinate system is displayed on a first user interface.

7. A security incident early warning system based on alarm data analysis according to claim 6, characterized in that: When obtaining the first type of non-important alarm data in real time, a stream processing framework is introduced to process the alarm data stream.

8. The security incident early warning system based on alarm data analysis according to claim 6 is characterized in that: Converting the alarm quantity into a grayscale value will normalize the alarm quantity.

9. The security incident early warning system based on alarm data analysis according to claim 6 is characterized in that: Move users with the same permissions to adjacent positions in the coordinate system, and move assets of the same asset type to adjacent positions in the coordinate system.

10. The security incident early warning system based on alarm data analysis according to claim 6, characterized in that: When the straight line confidence is greater than the preset value, it is judged that the first type of non-important alarm may be abnormal. After the user clicks the straight line or marked area in the image, the system will pop up detailed alarm information, including time, users and assets involved, and specific content of the alarm.

Images