Alarm processing method and device, equipment and storage medium

Abstract

The embodiment of the invention provides an alarm processing method and device, equipment and a storage medium. The method comprises the steps of determining a first entity involved in a target alarm based on description information of the target alarm occurring in a target system; obtaining first log information related to the first entity in the target system and first auxiliary information corresponding to the first log information, wherein the auxiliary information is used for describing an exception in a log of the target system; and generating an analysis result for the target alarm based on the first log information and the first auxiliary information. In this way, manual checking of the log system by operation and maintenance personnel can be reduced, the management cost for alarms can be reduced, and the alarm processing efficiency can be improved.

Description

Technical Field

[0001] The exemplary embodiments of the present disclosure generally relate to the field of computers, and more particularly to methods, devices, apparatuses, and computer-readable storage media for alarm processing. Background Art

[0002] In the operation and maintenance management of information systems such as business networks and business platforms, alarms are the most important part of determining whether the information system has security risks or intrusion behaviors. In particular, in some scenarios, various assets in the information system (e.g., physical devices, software systems, applications), etc. may come from different providers. One such example scenario is the multi-cloud security management scenario. In these scenarios, operation and maintenance personnel need to promptly discover and solve problems through alarms to ensure the availability and stability of services. However, due to the large number of assets in the information system, the number of alarms has also increased dramatically. On the other hand, assets from different providers are not unified in terms of the format and content of alarm logs. These factors pose huge challenges to operation and maintenance personnel. For example, decentralized alarms for indicators, links, and logs are prone to alarm storms if there is no good monitoring and management. Therefore, effective management methods are expected for a large number of alarms. Summary of the invention

[0003] In a first aspect of the present disclosure, a method for alarm processing is provided. The method includes: determining a first entity involved in a target alarm based on description information of a target alarm occurring in a target system; obtaining first log information related to the first entity in the target system and first auxiliary information corresponding to the first log information, the auxiliary information being used to describe an anomaly in a log of the target system; and generating an analysis result for the target alarm based on the first log information and the first auxiliary information.

[0004] In a second aspect of the present disclosure, a device for alarm processing is provided. The device includes: an entity determination module, configured to determine a first entity involved in a target alarm based on description information of a target alarm occurring in a target system; an information acquisition module, configured to acquire first log information related to the first entity in the target system and first auxiliary information corresponding to the first log information, the auxiliary information being used to describe an anomaly in a log of the target system; and an analysis result generation module, configured to generate an analysis result for the target alarm based on the first log information and the first auxiliary information.

[0005] In a third aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. When the instructions are executed by the at least one processing unit, the device executes the method of the first aspect.

[0006] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and the computer program can be executed by a processor to implement the method of the first aspect.

[0007] It should be understood that the contents described in this content section are not intended to limit the key features or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0009] Figure 1 A schematic diagram showing an example environment in which embodiments of the present disclosure can be implemented;

[0010] Figure 2 A schematic diagram showing an example architecture for alarm processing according to some embodiments of the present disclosure;

[0011] Figure 3 A schematic diagram showing an example architecture of a mapping relationship between entities and data sources according to some embodiments of the present disclosure;

[0012] Figure 4 A schematic diagram showing an example interface for parameter configuration according to some embodiments of the present disclosure is shown;

[0013] Figure 5 A schematic diagram showing an example architecture for tracing the source of an alarm according to some embodiments of the present disclosure is shown;

[0014] Figure 6 A flowchart showing a process of alarm processing according to some embodiments of the present disclosure;

[0015] Figure 7 A block diagram showing an apparatus for alarm processing according to some embodiments of the present disclosure; and

[0016] Figure 8 A block diagram of a device capable of implementing various embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0017] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0018] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0019] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0020] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0021] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0022] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0023] It should be noted that the titles of any sections / subsections provided herein are not restrictive. Various embodiments are described throughout this article, and any type of embodiment may be included under any section / subsection. In addition, the embodiments described in any section / subsection may be combined in any manner with any other embodiments described in the same section / subsection and / or different sections / subsections.

[0024] Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

[0025] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may be included below. The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may be included below.

[0026] As used herein, the term "model" can learn the association between the corresponding input and output from the training data, so that after the training is completed, the corresponding output can be generated for a given input. The generation of the model can be based on machine learning technology. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs by using multiple layers of processing units. In this article, "model" may also be referred to as "machine learning model", "machine learning network" or "network", which are used interchangeably in this article. A model may also include different types of processing units or networks.

[0027] As used herein, judging an alarm refers to determining whether the alarm actually has a risk or has the possibility of a risk. Tracing the source of an alarm refers to determining the source of the event corresponding to the alarm and / or the attack link, etc.

[0028] As briefly mentioned above, with the continuous expansion of business and continuous upgrading of systems, the number of alarms has also increased dramatically. Conventionally, it is mainly through providing original log search to manage alarms. However, this method has weak ability to judge and trace the source of alarm events, and the original logs need to be manually understood, which increases costs.

[0029] Furthermore, by adding a large amount of expert experience and a large amount of contextual data mining, the ability to judge and trace events can be improved. However, the construction investment to improve the ability to judge and trace events is large. Accordingly, it requires the investment of multiple technologies and a large amount of expert experience, such as extracting entity relationships, a large amount of expert recommendation experience (for example, log search), survey maps, etc.

[0030] In view of this, an embodiment of the present disclosure proposes a scheme for alarm processing. According to various embodiments of the present disclosure, based on the description information of the target alarm occurring in the target system, the first entity involved in the target alarm is determined. Subsequently, the first log information related to the first entity in the target system and the first auxiliary information corresponding to the first log information are obtained. The first auxiliary information is used to describe the anomaly in the log of the target system. Then, based on the first log information and the first auxiliary information, an analysis result for the target alarm is generated.

[0031] In an embodiment of the present disclosure, for a generated alarm, the entity involved in the alarm is first extracted, that is, the entity with potential problems is first focused on. Then, the log information and auxiliary information related to the entity are further focused on. In this way, information related to the current alarm event can be extracted from a large amount of data in the target system, and the alarm can be analyzed using such information. In this way, the manual review of the log system by operation and maintenance personnel can be reduced, the management cost for alarms can be reduced, and the efficiency of processing alarms can be improved.

[0032] Example Environment

[0033] Figure 1 1 is a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. Figure 1 As shown, the environment 100 may include a system management platform 110. In the example environment 100, the system management platform 110 may be used to manage a large number of alarms generated by hosts, networks, security devices, etc. included in an organization (enterprise, government unit, other group, etc.). The system management platform 110 may present a large number of alarms in the form of a list in an interface 142 corresponding to the system management platform 110. A user 140 may manage a large number of alarms in the organization based on the system management platform 110.

[0034] Based on the description information of the alarm occurring in the organization, the system management platform 110 determines the log information of the entity corresponding to the alarm and the auxiliary information used to describe the abnormality in the log. Then, the system management platform 110 generates the analysis result of the alarm based on the log information and the auxiliary information. In some embodiments, at least part of the functions of the system management platform 110 can be implemented based on the target model 155.

[0035] In the process of the system management platform 110 generating analysis results for alarms occurring in the organization, one or more target models 155, such as the capabilities of the target model 155, can be called. As used herein, the term "model" can learn the association between the corresponding input and output from the training data, so that after the training is completed, the corresponding output can be generated for the given input. The generation of the model can be based on machine learning technology. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs by using multiple layers of processing units. A neural network model is an example of a model based on deep learning. In this article, "model" may also be referred to as "machine learning model", "learning model", "machine learning network" or "learning network", and these terms are used interchangeably in this article.

[0036] The system management platform 110 may be deployed locally on the terminal device of the user 140, and / or may be supported by a server device. For example, the terminal device of the user 140 may run a client of the system management platform, and the client may support the interaction between the user and the system management platform provided by the server. In the case where the system management platform runs locally on the user's terminal device, the user 140 may directly interact with the local system management platform using the terminal device. In the case where the system management platform runs on the server device, the server device may provide services to the client running in the terminal device based on the communication connection with the terminal device. The system management platform 110 may present a corresponding interface 142 to the user 140 based on the operation of the user 140, so as to output information related to system management to the user 140 and / or receive information from the user 140.

[0037] The system management platform 110 can run on appropriate electronic devices. The electronic devices here can be any type of device with computing capabilities, including terminal devices or server devices. The terminal device can be any type of mobile terminal, fixed terminal or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication systems (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, gaming devices or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. The server device can include, for example, a computing system / server, such as a mainframe, an edge computing node, a computing device in a cloud environment, and the like. In some embodiments, the data management platform 110 can be implemented based on cloud services.

[0038] It should be understood that the structure and functionality of environment 100 are described for exemplary purposes only and do not imply any limitation on the scope of the present disclosure.

[0039] Some example embodiments of the present disclosure will be described below with reference to the accompanying drawings. Hereinafter, the example embodiments will be described mainly with respect to the system management platform 110. It should be understood that the actions described with respect to the system management platform 110 may be performed by a plug-in included in the system management platform 110, or may be performed by the plug-in in collaboration with its service end (e.g., server) and / or machine learning model.

[0040] The following first refers to Figure 2 To describe the process of the present disclosure for alarm processing. Figure 2 A schematic diagram of an example architecture 200 for alarm processing according to some embodiments of the present disclosure is shown.

[0041] In some embodiments, the system management platform 110 determines the first entity involved in the target alarm according to the description information of the target alarm sent in the target system. In some examples, the description information of the target alarm (e.g., the detailed information of the target alarm) may include one or more of the following: the name of the target alarm, the occurrence time of the target alarm, the context field related to the target alarm, the original log corresponding to the target alarm, the device corresponding to the target alarm, the login information, etc. The specific content of the description information of the target alarm is related to the type of the target alarm.

[0042] In some examples, the system management platform 110 may generate a first entity related to the target alarm based on the description information of the target alarm. In the description herein, an entity may refer to various types of components that can be distinguished and identified in an information system, such as physical components and abstract components. In some embodiments, the first entity includes at least one of a host, a file, an object, an account, an address, and a process. In some examples, the first entity may be an entity determined from multiple predetermined types of entities. For example, an IP address, a host, a process, an account, an object, a file, and the like entities involved in the target alarm. Figure 2 In the example process 200 shown, at block 210, the system management platform 110 obtains the description information of the target alarm. At block 211, the system management platform 110 may input the description information of the target alarm into the machine learning model 211. At block 212, the system management platform 110 determines whether there is an alarm matching the target alarm in the alarm information library based on the description information of the target alarm via the machine learning model 211. In some embodiments, the alarm information library is obtained based on the judgment of historical alarms, and includes the description information and analysis results corresponding to each historical alarm.

[0043] In the case that there is no alarm matching the alarm in the alarm information library, the system management platform 110 determines the first entity involved in the target alarm based on the description information of the target alarm. Figure 2 Describe how the system management platform 110 determines the first entity involved in the target alarm when there is an alarm matching the alarm in the alarm information library. In box 213, when there is no alarm matching the alarm in the alarm information library, the system management platform 110 can input the description information of the target alarm into the machine learning model. In box 214, the system management platform 110 obtains multiple entities (e.g., addresses, domain names, files, resources, accounts, users, alarms, etc.) related to the target alarm output by the machine learning model, and the multiple entities include the first entity.

[0044] In some examples, the system management platform 110 extracts entities related to the target alarm based on the description information of the target alarm. For example, when there is an asset externally connected to an external IP or an external IP accessing an asset in the log details, the system management platform 110 extracts the IP entity. If the alarm entity is extracted, the name of the alarm, the earliest alarm sending time, and the most recent alarm update time are extracted, all represented by timestamps. If the asset in the log details belongs to a cloud account, the user entity is extracted. If the user entity is extracted, the cloud account to which the current asset belongs, the name of the cloud account to which the current asset belongs, and so on are extracted. If the asset in the alarm details is a host, the host entity is extracted, including the ID of the host asset, the name of the host asset, the private IP of the host asset, and the public IP of the host asset.

[0045] If the domain name asset of the Web Application Firewall (WAF) alarm or the domain name matched from the command line parsing library (cmdline), extract the domain name entity. If there is a file in the alarm details (for example, a malicious file or a downloaded file), extract the file entity, including the file path, the hash value of the file, or the message digest algorithm (md5) value. If there is process-related information in the alarm details, extract the process entity, including the process ID, process name, the file that starts the process, the process start time, the host ID that starts the process, the user ID that executes the process, the command that starts the process, the process call chain, the ID of the parent process, the name of the parent process, and the command to start the parent process. If accessing the cloud resource interface, abstract the interface into a service entity, including the service name, service ID, service method or operation.

[0046] In some embodiments, the system management platform 110 obtains first log information related to the first entity in the target system and first auxiliary information corresponding to the first log information. In some embodiments, the first auxiliary information is used to describe anomalies in the log of the target system. The auxiliary information corresponding to the log information can be, for example, a predetermined rule, an expert description, etc.

[0047] In some examples, after determining the first entity involved in the target alarm, the system management platform 110 obtains multiple data sets associated with the first entity. Each of the multiple data sets includes first log information related to the first entity (e.g., login log, network log, etc.) and first auxiliary information corresponding to the first log information (also referred to as a judgment rule, or a prompt word provided to the machine learning model). For example, for an IP entity, the login log corresponding to the IP address and the first auxiliary information corresponding to the login log for indicating anomalies (e.g., brute force cracking, access to sensitive interfaces, and other abnormal behaviors) can be obtained. For a host entity, the network log of the host and the first auxiliary information corresponding to the network log for indicating anomalies can be obtained, and so on. The acquisition of the first log information related to the first entity and the first auxiliary information corresponding to the first log information by the system management platform 110 will be described in detail below.

[0048] In some embodiments, the system management platform 110 generates an analysis result for the target alarm based on the first log information and the first auxiliary information. In some examples, the system management platform 110 generates a context of the target alarm based on the first log information and the first auxiliary information, and summarizes multiple contexts into an analysis report for the target alarm. In some examples, the system management platform 110 can obtain the analysis result output by the machine learning model in a predetermined format (e.g., JSON format).

[0049] For example, the analysis result for the target alarm generated by the system management platform 110 may include the attack rate corresponding to the target alarm, the attack rate corresponding to the first entity, the logic for analyzing the target alarm, detailed information of the anomaly in each entity involved in the target alarm, etc. In some examples, the system management platform 110 may generate the context of the target alarm using a machine learning model based on the first log information and the first auxiliary information.

[0050] Continuing with process 200, since the original log 217 includes log fragments in various storage systems, the system management platform 110 can obtain these log fragments based on the plug-in. In some examples, the system management platform 110 can obtain prompt words 218 (also called expert experience or rules) configured by the user based on the scenario query requirement 219 for each log fragment.

[0051] In box 230, the system management platform 110 obtains analysis results for the first entity by calling a machine learning model based on the log fragment of the first entity (e.g., domain name entity) and the prompt word 218 corresponding to the log fragment. For example, the first entity may correspond to multiple data sets, and each data set may correspond to multiple rules. In some examples, the system management platform 110 may call a machine learning model to obtain the corresponding attack probability of each data set. Accordingly, the attack probability of the first entity can be calculated using the following expression: 1-(attack rate of 1-a data set)*(attack rate of 1-b data set)*…*(attack rate of 1-n data set). In some examples, if the attack probability of an entity is greater than a predetermined probability threshold (e.g., XX%), the entity is at risk of attack.

[0052] In block 231, the system management platform 110 determines the analysis result of the target alarm (i.e., a report formed by the context information of the target alarm) based on the analysis results corresponding to the multiple entities respectively obtained by calling the machine learning model. Subsequently, the system management platform 110 can store the description information and analysis results of the target alarm in the alarm information library 234.

[0053] Thus, processing alarms based on log information and auxiliary information can lower the threshold for judging and tracing alarms, thereby improving the efficiency of processing alarms. The following further describes the system management platform 110 acquiring first log information related to the first entity and first auxiliary information corresponding to the first log information.

[0054] In some embodiments, the system management platform 110 determines at least one scenario according to the entity type of the first entity. In some embodiments, the scenario in the at least one scenario is configured with a corresponding log range and an abnormal state description within the log range. In some embodiments, the system management platform 110 first determines a plurality of candidate scenarios corresponding to the first entity type. Then, the system management platform 110 uses a machine learning model to select at least one scenario from the plurality of candidate scenarios according to the description information of the target alarm.

[0055] Continuing with process 200, in box 215, the system management platform 110 inputs the first entity of the plurality of entities 214 into the machine learning model. In box 216, the system management platform 110 calls a plug-in (e.g., a search plug-in) 221, a plug-in (e.g., a log service language plug-in) 222, a plug-in (e.g., a visualization plug-in) 223, a plug-in (e.g., a transport layer plug-in) 224, a plug-in (e.g., other log query plug-ins) 225, and so on to obtain a plurality of candidate scenarios (also referred to as entity built-in scenarios) 220 for the first entity. It can be understood that the system management platform 110 uses the plug-in to convert the data set corresponding to the first entity into a natural language that can be understood by the machine learning model. Then, the system management platform 110 uses the machine learning model to determine at least one scenario from the plurality of candidate scenarios for investigating whether the target alarm is abnormal.

[0056] In some embodiments, at least one scenario is configured with a corresponding log range and a description of abnormal status within the log range. It is understandable that at least one scenario indicates multiple rules corresponding to a data set related to the first entity associated with the target alarm (for example, prompt words provided to the machine learning model). The data set and the scenario are a one-to-many relationship, that is, a data set can be configured with multiple rules (for example, prompt words provided to the machine learning model). As shown in Table 1, users can customize extended prompt words based on the data set, and Table 1 is an example of at least one scenario.

[0057] Table 1

[0058]

[0059]

[0060]

[0061] In some embodiments, the management system platform 110 determines the first log information based on the log range configured for at least one scenario. As shown in Table 1, each row is a scenario. The second row in Table 1 shows the log range configured for the scenario, such as the login log N days before the alarm. Subsequently, the management system platform 110 can determine the first log information that needs to be extracted based on the login log N days before the alarm and the occurrence time of the alarm.

[0062] In some embodiments, the system management platform 110 extracts target log fragments from the target system as at least a part of the first log information based on the log range configured for the first scenario for a first scenario in at least one scenario. In some examples, the system management platform 110 can extract target log fragments from the target system using log query statements of the data set corresponding to the first entity based on the log range configured for the first scenario. In some examples, each data set corresponds to a query statement (e.g., a structured query statement SQL). Due to the differences in log formats of different users, SQL statements are different, so the mapping of SQL template fields and original log fields can be automatically completed through prompt words used to generate SQL statements. As shown in Table 2, the data set is extensible, and Table 2 shows multiple examples of data sets.

[0063] Table 2

[0064]

[0065]

[0066]

[0067] In some embodiments, the log range configured for the first scenario indicates the log name and time range. In some embodiments, the system management platform 110 determines the target log in the target system based on the log name. Accordingly, the system management platform 110 determines the extraction range of the target log based on the occurrence time and time range of the alarm. Then, the system management platform 110 extracts the part within the extraction range from the target log as the target log fragment.

[0068] As shown in Table 1, the second row in Table 1 shows the log range configured for the scenario. For example, the log name is login log, and the time range is the previous N days. The management system platform 110 can determine the extraction range of the target log to be extracted based on the log with the log name of login log and the occurrence time of the alarm. Then, the system management platform 110 extracts the risky part from the target log as the target log fragment. It can be understood that for the entity type of the first entity, a data set related to it is determined, and the data set indicates a fragment of the log of the core field of the first entity.

[0069] In some embodiments, the system management platform 110 determines the first auxiliary information based on the abnormal state descriptions configured for the first scenario. In some embodiments, the system management platform 110 determines the first auxiliary information item corresponding to the target log segment based on the abnormal state descriptions configured for the first scenario, so as to describe the abnormality in the target log segment. In some examples, an entity may correspond to multiple scenarios, and each scenario has corresponding prompt words, i.e., auxiliary information items, for providing to the machine learning model. Therefore, the auxiliary information is a collection of multiple auxiliary information items. That is, the system management platform 110 determines the first auxiliary information item corresponding to the target log segment based on the prompt words configured for the first scenario.

[0070] Continuing with process 200 , the system management platform 110 determines first log information from the original log 217 based on the mapping relationship between the plug-in, the entity and the data source, the data source configuration, and the mapping relationship between the SQL and the scenario.

[0071] The following is for reference Figure 3 To describe the mapping relationship 226 between data sources and entities. Figure 3 A schematic diagram showing an example architecture of mapping relationships between entities and data sources according to some embodiments of the present disclosure.

[0072] like Figure 3 As shown, for the mapping relationship between the host entity 320 related to the target alarm and the data source, for example, it can include alarms and risks. Alarms include intrusion backtracking and lateral analysis, and risks include high exploitable risks. For the mapping relationship between the file entity 320 related to the target alarm and the data source, for example, it can include file download, file change, host fingerprint, and alarm. For the mapping relationship between the object entity 340 related to the target alarm and the data source, for example, it can include audit logs and grade certificates. For the mapping relationship between the account entity 350 related to the target alarm and the data source, for example, it can include login logs, file change logs, host network logs, host process logs, and alarms. For the mapping relationship between the address entity 360 related to the target alarm and the data source, for example, it can include alarms, host networks, network address translation, process outbound, download analysis, login logs, audit logs, and domain name systems. For the mapping relationship between the process entity 370 related to the target alarm and the data source, for example, it can include host process startup, host network connection, and alarms.

[0073] In some embodiments, the system management platform 110 performs an associated entity detection for the first entity based on the first log information and the first auxiliary information. If the system management platform 110 detects a second entity associated with the first entity, it obtains second log information related to the second entity in the target system and second auxiliary information corresponding to the second log information, and the second auxiliary information is used to describe the anomaly in the log of the target system. Accordingly, the system management platform 110 performs an associated entity detection for the second entity based on the second log information and the second auxiliary information. Then, the system management platform 110 determines the occurrence path of the target alarm based on the first entity and the results of the associated entity detection of the second entity.

[0074] Figure 5 FIG. 5 is a schematic diagram showing an example process 500 for tracing the source of an alarm according to some embodiments of the present disclosure. Figure 5 As shown, the system management platform 110 can trace the first entity 510 according to the first log information and the first auxiliary information. That is, in box 512, if the system management platform 110 detects the address entity 511 related to the first entity 510, it can determine at least one scenario based on the entity type of the address entity 511. In box 513, based on at least one scenario corresponding to the address entity 511, the system management platform 110 can extract the relationship between the host entity 541 and the address entity 511 according to the log information corresponding to the address entity 511 (for example, the host network connection log). In box 514, the system management platform 110 can trace back to the host entity 541 based on the relationship between the host entity 541 and the address entity 511.

[0075] In block 542, the system management platform 110 may determine at least one scenario based on the entity type of the host entity 541. In block 543, the system management platform 110 may extract the relationship between the account entity 521 and the host entity 541 according to the log information (e.g., host login log) corresponding to the host entity 541 based on the at least one scenario corresponding to the host entity 541. In some examples, the system management platform 110 may trace back to the account entity 521 based on the relationship between the host entity 541 and the account entity 521.

[0076] Accordingly, in block 532, if the system management platform 110 detects a process entity 531 related to the first entity 510, it may determine at least one scenario based on the entity type of the process entity 531. In block 533, based on the at least one scenario corresponding to the process entity 531, the system management platform 110 may extract the relationship between the account entity 521 and the process entity 533 according to the log information (e.g., the host process log) corresponding to the process entity 531. In block 534, the system management platform 110 may trace back to the account entity 521 based on the relationship between the account entity 521 and the process entity 533.

[0077] In box 522, the system management platform 110 may determine at least one scenario based on the entity type of the account entity 521. In box 523, the system management platform 110 may extract the relationship between the account entity 521 and the address entity 511 according to the log information (e.g., host login log) corresponding to the account entity 521 based on the at least one scenario corresponding to the account entity 521. In box 524, the system management platform 110 may trace back to the address entity 511 based on the relationship between the account entity 521 and the address entity 511. In box 525, the system management platform 110 determines whether the account entity 521 and the address entity 511 are the same. In box 526, if the system management platform 110 determines that the account entity 521 and the address entity 511 are the same, the tracing of the address entity 511 ends.

[0078] Therefore, by tracing the source of the risky entity, the source of the risk can be determined. Figure 2 It is described how the system management platform 110 determines the first entity involved in the target alarm when there is an alarm matching the target alarm in the alarm information library.

[0079] In some embodiments, the system management platform 110 obtains an alarm information library including corresponding description information and corresponding analysis results of multiple historical alarms occurring in the target system. In some examples, the system management platform 110 may obtain an alarm information library including analysis results of historical alarms generated by the system management platform 110 based on log information and auxiliary information corresponding to the historical alarms.

[0080] In some embodiments, the system management platform 110 updates the alarm information base according to the description information of the target alarm and the analysis result of the target alarm. Figure 2 In the illustrated example process 200 , the system management platform 110 may store the description information of the current alarm and the corresponding analysis result generated for the current alarm in the alarm information repository 234 .

[0081] Further, if the system management platform 110 receives the target alarm, based on the description information of the target alarm, it retrieves the historical alarm matching the target alarm from the alarm information library. Then, if the system management platform 110 fails to retrieve the historical alarm matching the target alarm, it uses the machine learning model to determine the first entity based on the description information.

[0082] Continue reviewing Figure 2In the example process 200 shown, at box 212, the system management platform 110 calls the machine learning model based on the target alarm to determine whether the target alarm is successfully judged. At box 232, the system management platform 110 determines the historical alarm matching the target alarm from the alarm information library 234 based on the description information of the target alarm. If the system management platform 110 determines from the alarm information library 234 that there is a historical alarm matching the target alarm, it returns the analysis result for the target alarm. Correspondingly, if the system management platform 110 determines from the alarm information library 234 that there is no historical alarm matching the target alarm, it uses the machine learning model to judge the target alarm.

[0083] Therefore, the analysis result and description information of the alarm are stored in the alarm information library, which can provide a basis for judgment of subsequent similar alarms. The following further describes the deployment of the machine learning model by the system management platform 110 before obtaining the first log information.

[0084] In some embodiments, the system management platform 110 determines the target log field in the target log of the target system corresponding to the variable in the log query instruction before obtaining the first log information. In some embodiments, the system management platform 110 extracts multiple log records from the target log. Accordingly, the system management platform 110 provides prompt word information to the machine learning model based on the variable description and multiple log records for the variable to obtain the output of the machine learning model. Then, the system management platform 110 determines the target log field based on one or more target fields indicated by the output of the machine learning model.

[0085] It is understandable that the system management platform 110 needs to deploy the machine learning model before obtaining the first log information. In some examples, the system management platform 110 provides an application program interface (API) to call the machine learning model. The system management platform 110 can also provide a global wide area network (web) service to provide plug-in capabilities for the machine learning model. The machine learning model is pre-configured with built-in metadata, for example, the machine learning model is pre-configured with prompt words, data sets, plug-in usage, judgment expert experience, and traceability expert experience.

[0086] In some examples, the machine learning model is pre-configured with prompt words for multiple different functions, for example, prompt words for extracting entities, general prompt words for executing data sets and expert experience. The machine learning model can be pre-configured with commonly used data sets, which can be saved in csv files or in db files. In some examples, the data sets pre-configured with the machine learning model can be expanded as needed, as shown in Table 2, and the user can expand the data set. The table names and fields corresponding to the data sets do not depend on the user's logs, and all available data sets can be built into the machine learning model in advance. For the log table configured in the machine learning model, the system management platform 110 can filter out the log table on the client side corresponding to the user. Table 3 shows an example of the configuration information required for the data set built into the machine learning model.

[0087] Table 3

[0088] entity Log table Dataset name Description Start time IP ssh login-from-ip XXXXX XX IP ti_for_ip ti_for_ip XXXXXX XX Host alert alert-context XXXXXXXX XXX Account process process-context XXXXXXXX XXX user audit audit-context XXXXXXXXXX XX Host risk risk-context XXXXXXXX XXXX

[0089] In some examples, the system management platform 110 may configure parameters corresponding to the plug-ins that the machine learning model needs to call in the machine learning model. Figure 4 FIG. 4 is a schematic diagram showing an example interface 400 for parameter configuration according to some embodiments of the present disclosure. Figure 4 As shown, the user (also referred to as the administrator) can present a configuration interface 400 for parameter configuration in the interface 142 based on the system management platform 110. The user can configure the parameter name 411, parameter description information 412, parameter type 413, parameter corresponding input method 414, etc. corresponding to the plug-in in the interface 400.

[0090] In some examples, the system management platform 110 can integrate different expert experiences based on the data set, and these expert experiences can be stored in a csv file or a db file. Accordingly, the expert experience pre-configured in the machine learning model can also be expanded as needed. Table 4 shows an example of the configuration information required for expert experience.

[0091] Table 4

[0092]

[0093] For tracing expert experience, the system management platform 110 can integrate different expert experiences according to the data set. These expert experiences can be stored in csv files or db files, for example. Accordingly, the expert experience pre-configured in the machine learning model can also be expanded as needed. Table 5 shows an example of the configuration information required for tracing expert experience.

[0094] Table 5

[0095]

[0096] In some embodiments, based on the alarm, it is possible to determine the multiple entities to which it corresponds, and each of the multiple entities corresponds to multiple data sets. Each of the multiple data sets can be pre-configured. In some examples, the type of log corresponding to the data set can be pre-configured, and the large model needs to learn the necessary field mapping. In some examples, when the log type is in the form of a table, the name of the table corresponding to the log may be different from the user's table name, but needs to be consistent with the configuration of the data set. In some examples, the log can be stored in file and tls formats. If the log type is in the form of a logical table, it is necessary to add query conditions in the configuration information. If the log type is in the form of a file, the file needs to be placed in a predetermined directory.

[0097] In some examples, the machine learning model needs to learn the necessary field mappings, for example, the machine learning model learns the field mappings configured in the dataset. Based on the necessary field mappings, the machine learning model can convert standard fields into their corresponding original fields in the scenario of calling the plug-in capability. Table 6 shows an example of a field mapping table.

[0098] Table 6

[0099]

[0100]

[0101] In some embodiments, the system management platform 110 can enable the machine learning model to learn field mapping in the following manner. The system management platform 110 extracts the configuration in the data set configuration and generates a prompt word for each table. Further, the system management platform 110 loops all data source configurations and extracts a predetermined number of logs and prompt words from each log source. Subsequently, the system management platform 110 inputs the predetermined number of logs and prompt words into the machine learning model to obtain preliminary learning results output by the machine learning model. Then, the system management platform 110 can also provide the preliminary learning results to the user, and the user confirms whether there is a deviation. Furthermore, the system management platform 110 stores the mapping document output by the machine learning model in a predetermined folder. For example, the mapping document may be named field_mapping.

[0102] In summary, the embodiments of the present disclosure can lower the threshold for judging and tracing alarms, thereby improving the efficiency of handling alarms. The following is a description of the method for managing alarms disclosed in the present disclosure with reference to some case studies for ease of understanding. In some embodiments, the system management platform 110 can use the following steps to judge the abnormal IP login for the abnormal IP login.

[0103] As an example, the system management platform 110 first receives an alarm for abnormal IP login. By calling the webshell to perform intrusion link analysis, the alarm time can be obtained as "xxxx year xx month xx day". Subsequently, the system management platform 110 analyzes the alarm and can obtain an analysis report on the alarm. In some examples, the analysis report may include an overall summary of the alarm. The overall summary may include a judgment result, a risk score, and a judgment basis.

[0104] In some embodiments, the analysis report may also include a step-by-step summary. For example, the step-by-step summary may include the step name, analysis result, judgment result, risk score, judgment basis, analysis details, and call timeline corresponding to each step.

[0105] In some embodiments, the analysis report may list the data sets used, for example, the name and description of the data sets may be shown.

[0106] In some embodiments, the analysis report may also include a next step processing strategy for the investigation alert. For example, the analysis report may include the ID, reason, next step suggestion, entity, etc. of the next step corresponding to each recommended step.

[0107] In some embodiments, the analysis report may also include further investigation of the alert. For example, the further investigation includes: judgment result, risk score, score calculation logic, judgment basis, attack timeline (for example, including start time, end time, alert name, alert level, number of alerts), lateral movement analysis, intrusion process analysis, summary of the alert, and enumeration of used data sets.

[0108] In some embodiments, the analysis report may also include query conditions for the data set.

[0109] In some embodiments, the system management platform 110 obtains a final tracing analysis report based on the automatic judgment of the alarm and the tracing of the judgment result. The tracing analysis report includes the judgment result, risk score, and judgment basis.

[0110] In some embodiments, the source tracing analysis report includes a step-by-step summary. The step-by-step summary may include a judgment step for each entity related to the alarm, for example, the judgment step includes a judgment result, the importance of the alarm (or the probability of attack), and a judgment basis.

[0111] In some embodiments, the source tracing analysis report may also include evidence for tracing the source of the target alarm, for example, the log name, judgment result, attack probability, and judgment basis for each log information.

[0112] In some embodiments, the traceability analysis report may also include a summary of the traceability alarm.

[0113] By providing information of various dimensions in the analysis report, users such as operation and maintenance personnel can understand the process and logic of using machine learning models to analyze alarms. This can help users judge the accuracy of the analysis results.

[0114] In summary, the embodiments of the present disclosure can enable users to quickly obtain the analysis results of alarms by calling machine learning models to obtain the analysis results of alarms, and assist users in making quick decisions. Furthermore, the analysis results and description information of the alarms can be stored in the alarm information library to provide a basis for judgment for subsequent similar alarms, thereby improving the efficiency of handling alarms.

[0115] Example Process

[0116] Figure 6 FIG. 6 is a flowchart of a process 600 for alarm processing according to some embodiments of the present disclosure. The process 600 may be implemented at the system management platform 110. Figure 1 Process 600 is described.

[0117] In block 610 , the system management platform 110 determines a first entity involved in the target alarm based on description information of the target alarm occurring in the target system.

[0118] In block 620 , the system management platform 110 obtains first log information related to the first entity in the target system and first auxiliary information corresponding to the first log information, where the first auxiliary information is used to describe anomalies in the log of the target system.

[0119] In block 630 , the system management platform 110 generates an analysis result for the target alarm based on the first log information and the first auxiliary information.

[0120] In some embodiments, obtaining the first log information and the first auxiliary information includes: determining at least one scenario based on the entity type of the first entity, the scenario in the at least one scenario being configured with a corresponding log range and an abnormal status description within the log range; determining the first log information based on the log range configured for the at least one scenario; and determining the first auxiliary information based on the abnormal status description configured for the at least one scenario.

[0121] In some embodiments, determining at least one scenario based on the entity type of the first entity includes: determining multiple candidate scenarios corresponding to the entity type of the first entity; and selecting at least one scenario from the multiple candidate scenarios based on the description information of the target alarm using a machine learning model.

[0122] In some embodiments, determining the first log information includes: for a first scenario in at least one scenario, based on a log range configured for the first scenario, extracting a target log segment from a target system as at least a part of the first log information.

[0123] In some embodiments, the first scenario is configured with a log range indicating a log name and a time range, and extracting a target log fragment includes: determining a target log in a target system based on the log name; determining an extraction range of the target log based on an occurrence time and a time range of a target alarm; and extracting a portion within the extraction range from the target log as a target log fragment.

[0124] In some embodiments, determining the first auxiliary information includes: determining an auxiliary information item corresponding to the target log segment based on the abnormal state description configured for the first scenario, so as to describe the abnormality in the target log segment.

[0125] In some embodiments, process 600 also includes: performing an associated entity detection for the first entity based on the first log information and the first auxiliary information; in response to detecting a second entity associated with the first entity, obtaining second log information related to the second entity in the target system and second auxiliary information corresponding to the second log information, the second auxiliary information being used to describe anomalies in the log of the target system; performing an associated entity detection for the second entity based on the second log information and the second auxiliary information; and determining the occurrence path of the target alarm based on the results of the first entity and the associated entity detection of the second entity.

[0126] In some embodiments, determining the first entity involved in the target alarm includes: obtaining an alarm information library, the alarm information library including corresponding descriptive information and corresponding analysis results of multiple historical alarms occurring in the target system; in response to receiving the target alarm, based on the descriptive information of the target alarm, retrieving historical alarms matching the target alarm from the alarm information library; and in response to not retrieving historical alarms matching the target alarm, determining the first entity using a machine learning model based on the descriptive information.

[0127] In some embodiments, process 600 further includes: updating an alarm information library based on description information of the target alarm and analysis results of the target alarm.

[0128] In some embodiments, the first log information is obtained using a predetermined log query statement, and the method further includes: before obtaining the first log information, determining a target log field in a target log of the target system corresponding to a variable in the log query instruction.

[0129] In some embodiments, determining the target log field includes: extracting multiple log records from the target log; providing prompt word information to the machine learning model based on the variable description and the multiple log records for the variable to obtain the output of the machine learning model; and determining the target log field based on one or more target fields indicated by the output of the machine learning model.

[0130] In some embodiments, the first entity includes at least one of a subject, a file, an object, an account, an address, and a process.

[0131] Example devices and equipment

[0132] Figure 7 A schematic structural block diagram of an apparatus 700 for alarm processing according to some embodiments of the present disclosure is shown. The apparatus 700 may be implemented as or included in the system management platform 110. Each module / component in the apparatus 700 may be implemented by hardware, software, firmware or any combination thereof.

[0133] As shown in the figure, the device 700 includes an entity determination module 710, which is configured to determine the first entity involved in the target alarm based on the description information of the target alarm occurring in the target system. The device 700 also includes an information acquisition module 720, which is configured to obtain first log information related to the first entity in the target system and first auxiliary information corresponding to the first log information, and the first auxiliary information is used to describe the abnormality in the log of the target system. The device 700 also includes an analysis result generation module 730, which is configured to generate an analysis result for the target alarm based on the first log information and the first auxiliary information.

[0134] In some embodiments, the information acquisition module 720 is further configured to determine at least one scenario based on the entity type of the first entity, wherein the scenario in the at least one scenario is configured with a corresponding log range and an abnormal status description within the log range; determine the first log information based on the log range configured for the at least one scenario; and determine the first auxiliary information based on the abnormal status description configured for the at least one scenario.

[0135] In some embodiments, the device 700 also includes a scene determination module configured to determine multiple candidate scenes corresponding to the entity type of the first entity; and use a machine learning model to select at least one scene from the multiple candidate scenes based on the description information of the target alarm.

[0136] In some embodiments, the information acquisition module 720 is further configured to extract a target log segment from the target system as at least a part of the first log information based on the log range configured for the first scenario in the at least one scenario.

[0137] In some embodiments, the first scenario is configured with a log range indicating a log name and a time range, and the information acquisition module 720 is further configured to determine a target log in the target system based on the log name; determine an extraction range of the target log based on the occurrence time and time range of the target alarm; and extract a portion within the extraction range from the target log as a target log fragment.

[0138] In some embodiments, the information acquisition module 720 is further configured to determine an auxiliary information item corresponding to the target log segment based on the abnormal state description configured for the first scenario, so as to describe the abnormality in the target log segment.

[0139] In some embodiments, the device 700 also includes an occurrence path determination module, which is configured to perform an associated entity detection for the first entity based on the first log information and the first auxiliary information; in response to detecting a second entity associated with the first entity, obtain second log information related to the second entity in the target system and second auxiliary information corresponding to the second log information, the second auxiliary information being used to describe anomalies in the log of the target system; based on the second log information and the second auxiliary information, perform an associated entity detection for the second entity; and determine the occurrence path of the target alarm based on the results of the first entity and the associated entity detection of the second entity.

[0140] In some embodiments, the entity determination module 710 is further configured to obtain an alarm information library, which includes corresponding descriptive information and corresponding analysis results of multiple historical alarms occurring in the target system; in response to receiving a target alarm, based on the descriptive information of the target alarm, retrieve historical alarms that match the target alarm from the alarm information library; and in response to not retrieving a historical alarm that matches the target alarm, determine the first entity using a machine learning model based on the descriptive information.

[0141] In some embodiments, the apparatus 700 further includes an alarm information base determination module configured to update the alarm information base based on the description information of the target alarm and the analysis result of the target alarm.

[0142] In some embodiments, the first log information is obtained using a predetermined log query statement, and the device 700 also includes a log field determination module, which is configured to determine the target log field in the target log of the target system corresponding to the variable in the log query instruction before obtaining the first log information.

[0143] In some embodiments, the log field determination module is also configured to extract multiple log records from the target log; provide prompt word information to the machine learning model based on the variable description and multiple log records for the variable to obtain the output of the machine learning model; and determine the target log field based on one or more target fields indicated by the output of the machine learning model.

[0144] In some embodiments, the first entity includes at least one of a subject, a file, an object, an account, an address, and a process.

[0145] Figure 8 A block diagram of an electronic device 800 is shown in which one or more embodiments of the present disclosure may be implemented. It should be understood that Figure 8 The electronic device 800 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. Figure 8 The electronic device 800 shown can be used to implement Figure 1 An electronic device 110.

[0146] like Figure 8 As shown, the electronic device 800 is in the form of a general electronic device. The components of the electronic device 800 may include, but are not limited to, one or more processors or processing units 810, a memory 820, a storage device 830, one or more communication units 840, one or more input devices 850, and one or more output devices 860. The processing unit 810 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 820. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 800.

[0147] The electronic device 800 typically includes a plurality of computer storage media. Such media can be any accessible media that can be obtained by the electronic device 800, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 820 can be a volatile memory (e.g., a register, a cache, a random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 830 can be a removable or non-removable medium, and can include a machine-readable medium, such as a flash drive, a disk, or any other medium, which can be used to store information and / or data and can be accessed within the electronic device 800.

[0148] The electronic device 800 may further include additional removable / non-removable, volatile / non-volatile storage media. Figure 8As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. The memory 820 may include a computer program product 825 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0149] The communication unit 840 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 800 can be implemented with a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 800 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0150] The input device 850 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 860 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 800 may also communicate with one or more external devices (not shown) through the communication unit 840 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 800, or communicate with any device that allows the electronic device 800 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0151] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0152] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0153] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0154] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0155] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0156] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims

1. An alarm processing method, comprising: Determine, based on description information of a target alarm occurring in a target system, a first entity involved in the target alarm; Acquire first log information related to the first entity and first auxiliary information corresponding to the first log information in the target system, where the first auxiliary information is used to describe an anomaly in the log of the target system; as well as Based on the first log information and the first auxiliary information, an analysis result for the target alarm is generated.

2. The method according to claim 1, wherein obtaining the first log information and the first auxiliary information comprises: determining at least one scenario based on the entity type of the first entity, wherein a scenario in the at least one scenario is configured with a corresponding log range and an abnormal state description within the log range; Determining the first log information based on the log range configured for the at least one scenario respectively; as well as The first auxiliary information is determined based on the abnormal state description configured for the at least one scenario respectively.

3. The method of claim 2, wherein determining at least one scenario based on the entity type of the first entity comprises: determining a plurality of candidate scenarios corresponding to an entity type of the first entity; as well as Using a machine learning model, based on the description information of the target alarm, at least one scenario is selected from the multiple candidate scenarios.

4. The method according to claim 2, wherein determining the first log information comprises: For a first scenario in the at least one scenario, based on the log range configured for the first scenario, a target log segment is extracted from the target system as at least a part of the first log information.

5. The method according to claim 4, wherein the log range configured in the first scenario indicates a log name and a time range, and extracting a target log segment comprises: Based on the log name, determining a target log in the target system; Determining an extraction range of the target log based on the occurrence time of the target alarm and the time range; as well as A portion within the extraction range is extracted from the target log as the target log segment.

6. The method of claim 4, wherein determining the first auxiliary information comprises: Based on the abnormal state description configured for the first scenario, an auxiliary information item corresponding to the target log segment is determined to describe the abnormality in the target log segment.

7. The method according to claim 1, further comprising: Based on the first log information and the first auxiliary information, performing associated entity detection for the first entity; In response to detecting a second entity associated with the first entity, obtaining second log information related to the second entity and second auxiliary information corresponding to the second log information in the target system, wherein the second auxiliary information is used to describe an anomaly in the log of the target system; Based on the second log information and the second auxiliary information, performing associated entity detection for the second entity; as well as Based on the first entity and the result of the associated entity detection of the second entity, an occurrence path of the target alarm is determined.

8. The method according to claim 1, wherein determining the first entity involved in the target alarm comprises: Acquire an alarm information database, wherein the alarm information database includes corresponding description information and corresponding analysis results of multiple historical alarms occurring in the target system; In response to receiving the target alarm, based on the description information of the target alarm, retrieving a historical alarm matching the target alarm from the alarm information database; as well as In response to not retrieving a historical alarm that matches the target alarm, the first entity is determined using a machine learning model based on the description information.

9. The method according to claim 8, further comprising: The alarm information library is updated based on the description information of the target alarm and the analysis result of the target alarm.

10. The method according to claim 1, wherein the first log information is obtained using a predetermined log query statement, and the method further comprises: Before acquiring the first log information, a target log field in the target log of the target system corresponding to the variable in the log query instruction is determined.

11. The method of claim 10, wherein determining the target log field comprises: extracting a plurality of log records from the target log; Based on the variable description for the variable and the plurality of log records, providing prompt word information to a machine learning model to obtain an output of the machine learning model; as well as The target log field is determined based on one or more target fields indicated by the output of the machine learning model.

12. The method according to claim 1, wherein the first entity comprises at least one of a subject, a file, an object, an account, an address, and a process.

13. An alarm processing device, comprising: An entity determination module, configured to determine a first entity involved in a target alarm based on description information of a target alarm occurring in a target system; an information acquisition module, configured to acquire first log information related to the first entity in the target system and first auxiliary information corresponding to the first log information, wherein the first auxiliary information is used to describe an anomaly in the log of the target system; as well as The analysis result generating module is configured to generate an analysis result for the target alarm based on the first log information and the first auxiliary information.

14. An electronic device comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 12 when executed by the at least one processing unit.

15. A computer-readable storage medium having a computer program stored thereon, wherein the computer program can be executed by a processor to implement the method according to any one of claims 1 to 12.

Images