Periodic false alarm filtering method and device, equipment and storage medium

Abstract

The invention discloses a periodic false alarm filtering method, apparatus and device, and a storage medium. The method comprises the steps of calculating frequency data of a time sequence of occurrence times per second corresponding to each alarm tetrad combination and signal-to-noise ratio data corresponding to the frequency data; taking the signal-to-noise ratio data greater than the segmented peak value as target signal-to-noise ratio data, then converting the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a period, and taking the period as a candidate period of a corresponding target time sequence; calculating an autocorrelation coefficient corresponding to the candidate period of each target time sequence, and when the autocorrelation coefficient is greater than the preset threshold value, determining that the target time sequence corresponding to the autocorrelation coefficient has periodicity, and the alarm tetrad combination corresponding to the target time sequence with periodicity is eliminated from the security alarm data. According to the invention, periodic false alarms can be eliminated, and the data volume of alarm data is reduced.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet information security technology, and in particular to a filtering method, device, equipment and storage medium for periodic false alarms. Background Art

[0002] With the advent of the era of big data and cloud computing, the network security situation has become more complex, and the detection, penetration and malicious attacks of hackers and hostile forces against the power industry have also increased. The transformation of the new power system has blurred the network security boundary of the power system, and security issues have gradually become prominent. Various loopholes and vulnerabilities in the information network continue to threaten the safe operation of the power system. Network security situation analysis is a key link in network security protection.

[0003] There is a phenomenon in the industrial control network environment: the regular periodic alarms generated by machines are mostly periodic, and most of these alarms are false alarms. However, due to the rapid development of the Internet, big data and cloud computing, alarms are growing exponentially, and real alarms are drowned in a large number of false alarms, making it difficult for staff to identify real alarms. Summary of the invention

[0004] The present invention provides a filtering method, device, equipment and storage medium for periodic false alarms, so as to solve the technical problem that real alarms are submerged in a large number of false alarms, making it difficult for staff to identify real alarms.

[0005] In order to solve the above technical problem, an embodiment of the present invention provides a method for filtering periodic false alarms, including:

[0006] Obtain all security alarm data, and extract alarm data with the same alarm source IP, destination IP, destination port and alarm type, and generate the corresponding alarm quadruple combination;

[0007] According to the number of occurrences of each alarm quadruple combination per second, a time series of the number of occurrences per second corresponding to each alarm quadruple combination is generated, and a time series with a length greater than a preset length is used as a target time series;

[0008] Calculate the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series;

[0009] Perform segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series to obtain the corresponding segmented peak value, and use the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and then convert the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a period, and use the period as the candidate period of the corresponding target time series;

[0010] The autocorrelation coefficient corresponding to the candidate period of each target time series is calculated, and the autocorrelation coefficient is compared with a preset threshold. When the autocorrelation coefficient is greater than the preset threshold, it is determined that the target time series corresponding to the autocorrelation coefficient is periodic, and then the alarm quadruple combination corresponding to the target time series with periodicity is eliminated from the security alarm data.

[0011] As a preferred solution, before calculating the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series, the method further includes:

[0012] It is determined whether there are abnormal values ​​in each target time series. When it is determined that there are corresponding abnormal values ​​in the target time series, the abnormal values ​​are replaced with preset values.

[0013] As a preferred solution, the step of judging whether there are abnormal values ​​in each target time series and replacing the abnormal values ​​with preset values ​​when it is determined that there are corresponding abnormal values ​​in the target time series includes:

[0014] According to the preset domain radius and the minimum number of points within the domain radius, each target time series is clustered, and then it is determined whether there are abnormal values ​​in each target time series according to the clustering results, and the abnormal values ​​are replaced with preset values.

[0015] As a preferred solution, the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data are calculated according to the preset minimum period and maximum period of the time series, including:

[0016] Perform FFA transformation on each target time series, reshape each target time series into a corresponding two-dimensional array, and generate the experimental folding frequency of the FFA transformation;

[0017] The signal-to-noise ratio of each target time series is calculated according to the two-dimensional array and the test folding frequency, and the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data are generated according to the signal-to-noise ratio and the maximum period and minimum period of the preset time series.

[0018] As a preferred solution, the frequency data and signal-to-noise ratio data of each target time series are subjected to segmented peak detection to obtain the corresponding segmented peak, and the signal-to-noise ratio data greater than the segmented peak is used as the target signal-to-noise ratio data, and then the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data is converted into a period, and the period is used as a candidate period of the corresponding target time series, including:

[0019] Perform segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series, divide the frequency data of each target time series into several segments of segmented frequency data, calculate the median and standard deviation of the signal-to-noise ratio data corresponding to each segment of segmented frequency data, and then calculate the segmented peak value corresponding to each target time series according to the median and standard deviation;

[0020] The signal-to-noise ratio data greater than the segment peak is taken as the target signal-to-noise ratio data, and the frequency data corresponding to the target signal-to-noise ratio data is taken as the target frequency data. The target signal-to-noise ratio data are sorted in ascending order, and then the target frequency data corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data is converted into a period, and the period is taken as a candidate period of the corresponding target time series.

[0021] Based on the above embodiment, another embodiment of the present invention provides a filtering device for periodic false alarms, comprising: an alarm quadruple combination generation module, a target time series generation module, a frequency signal-to-noise ratio data calculation module, a candidate period calculation module, and a periodic alarm data filtering module;

[0022] The alarm four-tuple combination generation module is used to obtain all security alarm data, and extract alarm data with the same alarm source IP, destination IP, destination port and alarm type, and generate corresponding alarm four-tuple combinations;

[0023] The target time series generation module is used to generate a time series of the number of occurrences per second corresponding to each alarm four-tuple combination according to the number of occurrences per second of each alarm four-tuple combination, and use a time series with a length greater than a preset length as a target time series;

[0024] The frequency signal-to-noise ratio data calculation module is used to calculate the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series;

[0025] The candidate cycle calculation module is used to perform segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series to obtain the corresponding segmented peak value, and use the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and then convert the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a cycle, and use the cycle as the candidate cycle of the corresponding target time series;

[0026] The periodic alarm data filtering module is used to calculate the autocorrelation coefficient corresponding to the candidate period of each target time series, compare the autocorrelation coefficient with a preset threshold, and when the autocorrelation coefficient is greater than the preset threshold, it is determined that the target time series corresponding to the autocorrelation coefficient is periodic, and then the alarm quadruple combination corresponding to the periodic target time series is eliminated from the security alarm data.

[0027] As a preferred solution, it also includes: an abnormal value replacement module;

[0028] The abnormal value replacement module is used to determine whether there are abnormal values ​​in each target time series, and when it is determined that there are corresponding abnormal values ​​in the target time series, the abnormal values ​​are replaced with preset values.

[0029] As a preferred solution, the step of judging whether there are abnormal values ​​in each target time series and replacing the abnormal values ​​with preset values ​​when it is determined that there are corresponding abnormal values ​​in the target time series includes:

[0030] According to the preset domain radius and the minimum number of points within the domain radius, each target time series is clustered, and then it is determined whether there are abnormal values ​​in each target time series according to the clustering results, and the abnormal values ​​are replaced with preset values.

[0031] Based on the above embodiments, another embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, the method for filtering periodic false alarms described in the above embodiments of the invention is implemented.

[0032] Based on the above embodiments, another embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the periodic false alarm filtering method described in the above invention embodiment.

[0033] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0034] The present invention provides a filtering method for periodic false alarms, which obtains all security alarm data, extracts alarm data with the same alarm source IP, destination IP, destination port and alarm type, and generates corresponding alarm four-tuple combinations; generates a time series of the number of occurrences per second corresponding to each alarm four-tuple combination according to the number of occurrences per second of each alarm four-tuple combination, and uses a time series with a length greater than a preset length as a target time series; calculates frequency data of each target time series and signal-to-noise ratio data corresponding to the frequency data according to a preset minimum period and maximum period of the time series; analyzes the frequency data and signal-to-noise ratio data of each target time series, and analyzes the frequency data and signal-to-noise ratio data of each target time series. The segment peak value is detected to obtain the corresponding segment peak value, and the signal-to-noise ratio data greater than the segment peak value is used as the target signal-to-noise ratio data, and then the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data is converted into a period, and the period is used as the candidate period of the corresponding target time series; the autocorrelation coefficient corresponding to the candidate period of each target time series is calculated, and the autocorrelation coefficient is compared with a preset threshold value. When the autocorrelation coefficient is greater than the preset threshold value, it is determined that the target time series corresponding to the autocorrelation coefficient has periodicity, and then the alarm quadruple combination corresponding to the target time series with periodicity is eliminated from the security alarm data.

[0035] The present invention detects the periodicity of the time series of the number of occurrences per second corresponding to the alarm four-tuple combination. When the target time series is periodic, it indicates that the corresponding alarm four-tuple combination is a periodic false alarm, which is removed from the security alarm data. This can greatly reduce the amount of alarm data, avoid real alarms being submerged in a large number of false alarms, and assist security analysts in filtering out low-risk false alarms and identifying real alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a flowchart of a method for filtering periodic false alarms provided by an embodiment of the present invention;

[0037] Figure 2 This is a flow chart of the signal-to-noise ratio peak detection method;

[0038] Figure 3 It is a structural schematic diagram of a periodic false alarm filtering device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0041] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0042] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0043] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0044] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0045] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0046] Embodiment 1

[0047] Please refer to Figure 1 , is a flow chart of a method for filtering periodic false alarms provided by an embodiment of the present invention, comprising the following specific steps:

[0048] S1. Obtain all security alarm data, and extract alarm data with the same alarm source IP, destination IP, destination port and alarm type, and generate corresponding alarm quadruple combination;

[0049] Specifically, the method for filtering periodic false alarms of the present invention comprises the following steps:

[0050] Step S1: input a large amount of network security alarm data, extract the alarm data with the same alarm source IP, destination IP, destination port and alarm type, and generate the corresponding alarm four-tuple combination;

[0051] S2. Generate a time series of the number of occurrences per second of each alarm quadruple combination according to the number of occurrences per second of each alarm quadruple combination, and use a time series with a length greater than a preset length as a target time series;

[0052] Step S2: according to the number of occurrences of each alarm quadruple combination per second, generate a time series of the number of occurrences per second corresponding to each alarm quadruple combination, and extract the time series with a longer length.

[0053] Specifically, first, count all the (Sip, Dip, Dport, Category) combinations in the alarm. Among them, Sip is the alarm source IP, Dip is the alarm destination IP, Dport is the destination port, and Category is the alarm type. Then query the (ID, Timestamp) of the corresponding alarm for each (Sip, Dip, Dport, Category) combination. And count the number of times it occurs per second. The starting time is the time when the alarm combination first appears and the time when it last appears. Generate the corresponding alarm combination time sequence, Ci = {num1, num2, ..., num n}. Where ID is the alarm number, Timestamp is the alarm timestamp, and num is the number of occurrences of the corresponding alarm combination per second. Finally, set the alarm combination sequence length threshold τ. If the alarm combination sequence length l>τ, filter to select the longer alarm combination sequence.

[0054] For example, there is an alarm sample as shown in Table 1 below. All (Sip, Dip, Dport, Category) combinations in the alarm are (1.1.1.1, 2.2.2.2, 123, information leakage) and (1.1.1.1, 4.4.4.4, 123, password cracking). The number of times the alarm combination appears per second is counted, thereby generating an alarm combination sequence C1 = {1, 1, 1, 1, 1, 30, ...}, with a length of 10000. C2 = {0, 1, 0, 1, 0, 1, ...}, with a length of 200.

[0055] Set the alarm combination time sequence length threshold to 1000, and C2 is filtered.

[0056] Sip Dip Dport Category C 1.1.1.1 2.2.2.2 123 Information Leakage 1,1,1,1,1,1,30… 1.1.1.1 2.2.2.2 123 Information Leakage 0,1,0,1,0,1…

[0057] Table 1 Alarm data sample

[0058] S3. Calculate the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series;

[0059] Preferably, before calculating the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series, it also includes: judging whether there are abnormal values ​​in each target time series, and when it is determined that there are corresponding abnormal values ​​in the target time series, replacing the abnormal values ​​with preset values.

[0060] Preferably, the judging whether there are outliers in each target time series and replacing the outliers with preset values ​​when it is determined that there are corresponding outliers in the target time series include: clustering each target time series according to a preset domain radius and a minimum number of points parameter within the domain radius, and then judging whether there are outliers in each target time series according to the clustering results, and replacing the outliers with preset values.

[0061] Step S3: Perform extreme outlier processing on each alarm combination time series, input the time series and the selected appropriate domain radius and the minimum number of points within the domain radius into the DBSCAN algorithm to obtain the extreme outlier of each time series, and then replace each outlier to finally obtain the time series after outlier processing.

[0062] Specifically, DBSCAN is used to cluster the alarm combination time series by selecting appropriate eps (domain radius) and min_samples (minimum number of points within the domain radius) parameters, and extreme outliers are obtained. Outliers are points far away from the clusters formed by the DBSCAN algorithm. Considering that the number of alarm combinations per second is generally 0 or 1, all extreme outliers are replaced with 1 to reduce the impact of extreme outliers and obtain new alarm combination time series.

[0063] For example, the above C1={1,1,1,1,1,1,30,…} sequence is detected by DBSCAN and it is found that 30 is an extreme outlier, and 30 is replaced by 1, so a new alarm combination sequence is obtained, C1={1,1,1,1,1,1,1,…}.

[0064] Preferably, the method of calculating the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series includes: performing FFA transformation on each target time series, reshaping each target time series into a corresponding two-dimensional array, and generating a test folding frequency of the FFA transformation; calculating the signal-to-noise ratio of each target time series according to the two-dimensional array and the test folding frequency, and generating the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the signal-to-noise ratio and the preset maximum period and minimum period of the time series.

[0065] Step S4: For the alarm combination time series, set the range thresholds of the minimum period and maximum period of the alarm combination time series according to the actual situation. Then input the alarm combination time series and the set minimum period and maximum period into the FFA-riptide periodogram algorithm, perform FFA transformation on the one-dimensional input representing the time series according to different frequencies (periods), reshape it into a two-dimensional array, and record the experimental folding frequency of the FFA transformation at the same time. Then the algorithm performs circular convolution with a set of pulse templates simply selected by the algorithm itself through the folded contour to calculate the signal-to-noise ratio. And perform multiple foldings according to the input maximum period and minimum period range to obtain a signal-to-noise ratio sequence corresponding to the frequency, and the frequency range is the inverse of the set minimum and maximum period values. Obtain frequency-signal-to-noise ratio two-dimensional data.

[0066] Specifically, the range thresholds of the minimum period and the maximum period are set. In actual situations, the alarm combination time series is counted in seconds as the minimum unit, so under normal circumstances, the theoretical minimum period value is 1 second. At the same time, the maximum period value is adjusted according to actual needs, which can be set to 1 hour (3600 seconds) or 24 hours, etc., indicating that the timing period is meaningless when it exceeds the maximum period. The alarm combination timing after S3 processing and the minimum period and maximum period set according to actual conditions are input into the FFA-ript ide periodogram algorithm to obtain frequency-signal-to-noise ratio two-dimensional data, and the frequency (time) range is the inverse of the set minimum and maximum period values. The frequency data frei={f1,f2,…,f m}, the signal-to-noise ratio data of the alarm combination time series SNi={sn1,sn2,…,sn m}. Where m is the length, f is the frequency, and sn is the signal-to-noise ratio corresponding to the frequency.

[0067] For example, the above alarm combination sequence sets the minimum period to 1 second and the maximum period to 24 hours, i.e., 86400 seconds. Then, the time series and the minimum and maximum period values ​​are input into the FFA-riptide periodogram algorithm to obtain the frequency-signal-to-noise ratio information.

[0068] S4, performing segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series to obtain the corresponding segmented peak value, and using the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and then converting the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a period, and using the period as the candidate period of the corresponding target time series;

[0069] Preferably, the step of performing segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series to obtain the corresponding segmented peak value, and taking the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and then converting the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a period, and taking the period as the candidate period of the corresponding target time series, includes: performing segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series, dividing the frequency data of each target time series into a plurality of segments of segmented frequency data, calculating the median and standard deviation of the signal-to-noise ratio data corresponding to each segment of segmented frequency data, and then calculating the segmented peak value corresponding to each target time series according to the median and standard deviation; taking the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and taking the frequency data corresponding to the target signal-to-noise ratio data as the target frequency data, sorting the target signal-to-noise ratio data in ascending order, and then converting the target frequency data corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a period, and taking the period as the candidate period of the corresponding target time series.

[0070] Step S5: For each alarm combination time series, perform peak detection on the two-dimensional frequency-signal-to-noise ratio data obtained in Step S4. To obtain significant peaks, segmented peak detection is required to determine how much higher a maximum value point is than the neighboring data to be considered significant. In the case of segmented detection, the maximum value of the sequence does not necessarily have obvious significance. Each segment filters out the signal-to-noise ratio greater than the threshold and the corresponding frequency according to the corresponding segment threshold, and the data of all segments are integrated together to find the maximum signal-to-noise ratio and period as the candidate period of the alarm combination. That is, the candidate frequency (i.e., candidate period) and the corresponding signal-to-noise ratio of each time series are obtained. Please refer to Figure 2 , which is the flowchart of the signal-to-noise ratio peak detection method.

[0071] Specifically, the steps of the peak detection method in Step S5 are as follows:

[0072] Step S501: Divide the frequency data corresponding to the alarm combination time series into p segments equally, and obtain the median M of all signal-to-noise ratios corresponding to each segment of frequency i and the standard deviation s i , where 0 < i ≤ p,

[0073] Step S502: Set the segmented peak threshold σ i = M i + αs i . Where 0 < i ≤ p, and α is a variable dimensionless parameter.

[0074] Step S503: Obtain the frequency of each segment where the signal-to-noise ratio is greater than the corresponding threshold σ i , and also retain the signal-to-noise ratio. Integrate the signal-to-noise ratios and corresponding frequencies exceeding the threshold obtained from all segments together, and sort them according to the signal-to-noise ratio. The frequency (i.e., period) corresponding to the maximum signal-to-noise ratio is used as the candidate period of the time series.

[0075] For example, assume that the above frequency data is divided into 5 segments, and the medians of each segment are {1, 1, 3, 2, 1}, and the standard deviations are {0.05, 0.005, 0.06, 0.005, 0.006}, and α is selected as 6. So the segmented peak thresholds are {1.3, 1.03, 3.36, 2.025, 1.036}. Each segment filters out the signal-to-noise ratio greater than the threshold and the corresponding frequency according to the corresponding threshold, and the data of all segments are integrated together to find the maximum signal-to-noise ratio and period as the candidate period of this alarm combination time series.

[0076] S5. Calculate the autocorrelation coefficient corresponding to the candidate period of each target time series, compare the autocorrelation coefficient with a preset threshold, and when the autocorrelation coefficient is greater than the preset threshold, determine that the target time series corresponding to the autocorrelation coefficient is periodic, and then remove the alarm quadruple combination corresponding to the target time series with periodicity from the security alarm data.

[0077] Step S6: Perform significance judgment on the candidate period value obtained in step S5. Since the above algorithm will obtain candidate periods of the alarm combination time series whose periodicity is not significant enough, it is necessary to perform significance judgment on the candidate period value. The significance of the candidate period value is judged by using the autocorrelation coefficient. If the candidate period value on the autocorrelation coefficient of the candidate period corresponding to the alarm combination time series is greater than a certain threshold, it is considered to have periodicity; otherwise, it has no periodicity.

[0078] Specifically, the autocorrelation coefficient is used to test the candidate period of each alarm combination time series.

[0079] The formula for calculating the autocorrelation coefficient is: Where k is the lag number and x is the time series. The candidate cycle value is used as the lag number, and then the alarm combination time series and the candidate cycle are input into the autocorrelation coefficient formula to obtain the autocorrelation of the candidate cycle of the alarm combination time series. If the autocorrelation coefficient is greater than the set threshold, it is considered to be periodic, and the candidate cycle is the cycle value of this sequence. Otherwise, it is non-periodic. In the industrial control network environment, the alarm combination sequence with a long period is generally a false alarm generated by a long-term cyclical business. This false alarm can be filtered out to further mine the real alarm.

[0080] For example, the candidate period of the alarm combination time series C1={1,1,1,1,1,1,1,…} obtained in step S2 is 1 second. This candidate period of 1 second and the C1 sequence value are put into the autocorrelation coefficient calculation formula, and the autocorrelation coefficient is 0.99. Here, the autocorrelation coefficient threshold is set to 0.5. The autocorrelation coefficient 0.99 is greater than 0.5, so it is considered that this sequence has periodicity, and the candidate period is the period value of this sequence.

[0081] Embodiment 2

[0082] Please refer to Figure 3 , is a schematic diagram of the structure of a periodic false alarm filtering device provided by an embodiment of the present invention, the device comprising: an alarm quadruple combination generation module, a target time series generation module, a frequency signal-to-noise ratio data calculation module, a candidate period calculation module and a periodic alarm data filtering module;

[0083] The alarm four-tuple combination generation module is used to obtain all security alarm data, and extract alarm data with the same alarm source IP, destination IP, destination port and alarm type, and generate corresponding alarm four-tuple combinations;

[0084] The target time series generation module is used to generate a time series of the number of occurrences per second corresponding to each alarm four-tuple combination according to the number of occurrences per second of each alarm four-tuple combination, and use a time series with a length greater than a preset length as a target time series;

[0085] The frequency signal-to-noise ratio data calculation module is used to calculate the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series;

[0086] The candidate cycle calculation module is used to perform segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series to obtain the corresponding segmented peak value, and use the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and then convert the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a cycle, and use the cycle as the candidate cycle of the corresponding target time series;

[0087] The periodic alarm data filtering module is used to calculate the autocorrelation coefficient corresponding to the candidate period of each target time series, compare the autocorrelation coefficient with a preset threshold, and when the autocorrelation coefficient is greater than the preset threshold, it is determined that the target time series corresponding to the autocorrelation coefficient is periodic, and then the alarm quadruple combination corresponding to the periodic target time series is eliminated from the security alarm data.

[0088] Preferably, it also includes: an outlier replacement module; the outlier replacement module is used to determine whether there are outliers in each target time series, and when it is determined that there are corresponding outliers in the target time series, replace the outliers with preset values.

[0089] Preferably, the judging whether there are outliers in each target time series and replacing the outliers with preset values ​​when it is determined that there are corresponding outliers in the target time series include: clustering each target time series according to a preset domain radius and a minimum number of points parameter within the domain radius, and then judging whether there are outliers in each target time series according to the clustering results, and replacing the outliers with preset values.

[0090] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0091] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0092] Embodiment 3

[0093] Accordingly, an embodiment of the present invention provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the method for filtering periodic false alarms described in the above-mentioned embodiment of the invention when executing the computer program.

[0094] The electronic device may be a computing device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The device may include, but is not limited to, a processor and a memory.

[0095] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the device, and various interfaces and lines are used to connect various parts of the entire device.

[0096] Embodiment 4

[0097] Accordingly, an embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the method for filtering periodic false alarms described in the above embodiment of the invention.

[0098] The memory can be used to store the computer program, and the processor realizes various functions of the device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Med ia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0099] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each method embodiment described above can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-On l yMemory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0100] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for filtering periodic false alarms, characterized in that: include: Obtain all security alarm data, and extract alarm data with the same alarm source IP, destination IP, destination port and alarm type, and generate corresponding alarm quadruple combination; According to the number of occurrences of each alarm quadruple combination per second, a time series of the number of occurrences per second corresponding to each alarm quadruple combination is generated, and a time series with a length greater than a preset length is used as a target time series; Calculate the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series; Perform segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series to obtain the corresponding segmented peak value, and use the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and then convert the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a period, and use the period as the candidate period of the corresponding target time series; The autocorrelation coefficient corresponding to the candidate period of each target time series is calculated, and the autocorrelation coefficient is compared with a preset threshold. When the autocorrelation coefficient is greater than the preset threshold, it is determined that the target time series corresponding to the autocorrelation coefficient is periodic, and then the alarm quadruple combination corresponding to the target time series with periodicity is eliminated from the security alarm data.

2. The method for filtering periodic false alarms according to claim 1, characterized in that: Before calculating the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series, the method further includes: It is determined whether there are abnormal values ​​in each target time series, and when it is determined that there are corresponding abnormal values ​​in the target time series, the abnormal values ​​are replaced with preset values.

3. The method for filtering periodic false alarms according to claim 2, characterized in that: The determining whether there is an abnormal value in each target time series, and when it is determined that there is a corresponding abnormal value in the target time series, replacing the abnormal value with a preset value, includes: According to the preset domain radius and the minimum number of points within the domain radius, each target time series is clustered, and then it is determined whether there are abnormal values ​​in each target time series according to the clustering results, and the abnormal values ​​are replaced with preset values.

4. The method for filtering periodic false alarms according to claim 1, characterized in that: The step of calculating the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series includes: Perform FFA transformation on each target time series, reshape each target time series into a corresponding two-dimensional array, and generate the experimental folding frequency of the FFA transformation; The signal-to-noise ratio of each target time series is calculated according to the two-dimensional array and the test folding frequency, and the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data are generated according to the signal-to-noise ratio and the maximum period and minimum period of the preset time series.

5. The method for filtering periodic false alarms according to claim 1, characterized in that: The step of performing segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series to obtain a corresponding segmented peak value, and using the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and then converting the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a period, and using the period as a candidate period of the corresponding target time series, includes: Perform segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series, divide the frequency data of each target time series into several segments of segmented frequency data, calculate the median and standard deviation of the signal-to-noise ratio data corresponding to each segment of segmented frequency data, and then calculate the segmented peak value corresponding to each target time series according to the median and standard deviation; The signal-to-noise ratio data greater than the segment peak is taken as the target signal-to-noise ratio data, and the frequency data corresponding to the target signal-to-noise ratio data is taken as the target frequency data. The target signal-to-noise ratio data are sorted in ascending order, and then the target frequency data corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data is converted into a period, and the period is taken as a candidate period of the corresponding target time series.

6. A filtering device for periodic false alarms, characterized in that: include: Alarm quadruple combination generation module, target time series generation module, frequency signal-to-noise ratio data calculation module, candidate period calculation module and periodic alarm data filtering module; The alarm four-tuple combination generation module is used to obtain all security alarm data, and extract alarm data with the same alarm source IP, destination IP, destination port and alarm type, and generate corresponding alarm four-tuple combinations; The target time series generation module is used to generate a time series of the number of occurrences per second corresponding to each alarm four-tuple combination according to the number of occurrences per second of each alarm four-tuple combination, and use a time series with a length greater than a preset length as a target time series; The frequency signal-to-noise ratio data calculation module is used to calculate the frequency data of each target time series and the signal-to-noise ratio data corresponding to the frequency data according to the preset minimum period and maximum period of the time series; The candidate cycle calculation module is used to perform segmented peak detection on the frequency data and signal-to-noise ratio data of each target time series to obtain the corresponding segmented peak value, and use the signal-to-noise ratio data greater than the segmented peak value as the target signal-to-noise ratio data, and then convert the frequency corresponding to the maximum signal-to-noise ratio in the target signal-to-noise ratio data into a cycle, and use the cycle as the candidate cycle of the corresponding target time series; The periodic alarm data filtering module is used to calculate the autocorrelation coefficient corresponding to the candidate period of each target time series, compare the autocorrelation coefficient with a preset threshold, and when the autocorrelation coefficient is greater than the preset threshold, it is determined that the target time series corresponding to the autocorrelation coefficient is periodic, and then the alarm quadruple combination corresponding to the periodic target time series is eliminated from the security alarm data.

7. The filtering device for periodic false alarms according to claim 6, characterized in that: Also includes: Outlier replacement module; The abnormal value replacement module is used to determine whether there are abnormal values ​​in each target time series, and when it is determined that there are corresponding abnormal values ​​in the target time series, the abnormal values ​​are replaced with preset values.

8. The filtering device for periodic false alarms according to claim 7, characterized in that: The determining whether there is an abnormal value in each target time series, and when it is determined that there is a corresponding abnormal value in the target time series, replacing the abnormal value with a preset value, includes: According to the preset domain radius and the minimum number of points within the domain radius, each target time series is clustered, and then it is determined whether there are abnormal values ​​in each target time series according to the clustering results, and the abnormal values ​​are replaced with preset values.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for filtering periodic false alarms as claimed in any one of claims 1 to 5 is implemented.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is executed, the device where the storage medium is located is controlled to execute the method for filtering periodic false alarms as described in any one of claims 1 to 5.

Images