Linkage processing method and system for multi-source heterogeneous safety equipment

Abstract

The invention discloses a linkage disposal method and system for multi-source heterogeneous security equipment. The method comprises the following steps: acquiring security data of the heterogeneous security equipment, and preprocessing the security data to obtain first security data; processing the first security data through an association rule algorithm to obtain a potential threat event; judging the potential threat event, and if the potential threat event is judged to be a trigger strategy rule, retrieving a corresponding disposal strategy from a strategy knowledge base; and issuing a corresponding instruction based on the processing strategy, and linking corresponding equipment for query. According to the method, security data such as alarm logs of the multi-source heterogeneous security equipment of different equipment can be combined, the association rule is mined by using an association rule algorithm, potential threat events are obtained according to the mined association rule, a linkage disposal strategy is effectively, accurately and automatically generated in real time, finally linkage disposal of the multi-source heterogeneous security equipment is realized, and the safety of the multi-source heterogeneous security equipment is improved. And waste of manpower and material resources is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of security device data processing, and in particular to a linkage processing method and system for multi-source heterogeneous security devices. Background Art

[0002] In actual applications, power companies have adopted many network security products, including firewalls, intrusion detection systems, virus protection systems, vulnerability scanning systems, etc., to ensure the security of the power network environment. However, each security product is still in the "single-soldier combat" situation, which cannot meet the current situation of frequent network security incidents and increasingly prominent security threats in power companies.

[0003] At present, it is still impossible to achieve independent, static, and single protection of network security equipment, nor to meet the automation and dynamic requirements of network security management, to achieve the overall security of the network, to solve the security problems existing in the system from a global perspective, to provide complete security protection for the system, and to minimize security risks. Therefore, how to effectively link and deal with multi-source heterogeneous security devices in the face of network security incidents is a technical problem that needs to be solved urgently. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a linkage processing method and system for multi-source heterogeneous security devices to solve the current problems that it is difficult to achieve independent, static, and single protection of network security devices, data security is difficult to link, and security problems existing in the system cannot be solved from a global perspective.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a linkage processing method for multi-source heterogeneous security devices, comprising: obtaining security data of the heterogeneous security devices, and obtaining first security data after preprocessing;

[0008] Processing the first security data through an association rule algorithm to obtain potential threat events;

[0009] The potential threat event is judged based on the set threshold, and if it is judged to trigger the policy rule, the corresponding disposal policy is retrieved from the policy knowledge base;

[0010] Issue corresponding instructions based on the disposal strategy and link corresponding equipment queries.

[0011] As a preferred solution of the linkage processing method for multi-source heterogeneous security devices described in the present invention, the preprocessing includes filtering the data, specifically including:

[0012] Input the security data and extract data attribute information;

[0013] Filtering the attribute information based on filtering rules of priority and key fields;

[0014] If the attribute information successfully matches the filtering rule, the corresponding attribute information is deleted;

[0015] If the attribute information fails to match the filtering rule, the security data is saved for normalization to obtain the first security data.

[0016] As a preferred solution of the linkage handling method for multi-source heterogeneous security devices described in the present invention, the first security data is processed by an association rule algorithm to obtain potential threat events, including:

[0017] The first security data transaction item subset is traversed through the improved Apriori algorithm, and the security data transaction candidate item set is iteratively generated;

[0018] For each security data transaction candidate item set, the transaction candidate item set that meets the minimum support threshold is used as the security data transaction frequent item set;

[0019] For each security data transaction frequent itemset, generate all possible non-empty subsets as the antecedents of the association rule;

[0020] For each association rule's antecedent, select and output the association rules that meet the requirements based on the minimum threshold of the rule parameters;

[0021] Identify potential threat events based on correlation rules.

[0022] As a preferred solution of the linkage handling method for multi-source heterogeneous security devices described in the present invention, the potential threat event is judged, specifically including:

[0023] Classify potential threat events into different levels, and events of different levels correspond to different threshold ranges of association rule parameters;

[0024] If the corresponding association rule parameter value exceeds the set threshold, the corresponding level event triggers the corresponding policy rule.

[0025] As a preferred solution of the linkage handling method for multi-source heterogeneous security devices described in the present invention, if the corresponding association rule parameter does not exceed the set threshold, the corresponding level event is transferred to the manual judgment project.

[0026] As a preferred solution of the linkage disposal method for multi-source heterogeneous security devices described in the present invention, wherein: the security data of the heterogeneous security devices is obtained through a preset data access interface, and the data access interface includes: data fields, data transmission encryption method and authentication method between the security device and the linkage disposal system during data reporting.

[0027] In a second aspect, the present invention provides a linkage handling system for multi-source heterogeneous security devices, including: an acquisition module for acquiring security data of heterogeneous security devices, and first security data obtained after preprocessing;

[0028] A processing module, used to process the first security data through an association rule algorithm to obtain potential threat events;

[0029] A judgment module is used to judge the potential threat event based on a set threshold, and if it is judged to trigger a policy rule, retrieve a corresponding disposal policy from a policy knowledge base;

[0030] The linkage module is used to issue corresponding instructions based on the disposal strategy and to link the corresponding equipment query.

[0031] As a preferred solution of the linkage handling system for multi-source heterogeneous security devices described in the present invention, the judgment module includes:

[0032] A classification module is used to classify potential threat events into different levels, and different levels of events correspond to different threshold intervals of association rule parameters;

[0033] The first judgment module is used to trigger the corresponding policy rule when the corresponding level event exceeds the set threshold value;

[0034] The second judgment module is used to transfer the corresponding level event to the manual judgment project if the corresponding association rule parameter does not exceed the set threshold.

[0035] In a third aspect, the present invention provides a computing device, comprising:

[0036] Memory and processor;

[0037] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the linkage disposal method for multi-source heterogeneous security devices are implemented.

[0038] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the linkage disposal method for multi-source heterogeneous security devices.

[0039] Compared with the prior art, the present invention has the following beneficial effects: the present invention proposes a linkage disposal method for multi-source heterogeneous security devices, which can combine security data such as alarm logs of multi-source heterogeneous security devices of different devices such as firewalls and intrusion detection systems, and use association rule algorithms to mine association rules, obtain potential threat events based on the mined association rules, and automatically generate linkage disposal strategies effectively, accurately and in real time, ultimately achieving linkage disposal of multi-source heterogeneous security devices and reducing waste of manpower and material resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0041] Figure 1 A schematic diagram of the overall process logic of a linkage processing method for multi-source heterogeneous security devices according to an embodiment of the present invention;

[0042] Figure 2 A schematic diagram of a process of filtering data according to filtering rules in a linkage processing method for multi-source heterogeneous security devices according to an embodiment of the present invention;

[0043] Figure 3 A schematic diagram of a process of using an improved Apriori algorithm to perform data mining to obtain association rules in a linkage disposal method for multi-source heterogeneous security devices according to an embodiment of the present invention;

[0044] Figure 4 The present invention is a flowchart of triggering policy rules and retrieving disposal policies from a policy knowledge base in a linkage disposal method for multi-source heterogeneous security devices according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0046] Example 1

[0047] Reference Figure 1-Figure 4 Tables 1 and 2 are an embodiment of the present invention, which provides a linkage processing method for multi-source heterogeneous security devices, including:

[0048] S100: Acquire security data of heterogeneous security devices, and obtain first security data after preprocessing;

[0049] S200: Processing the first security data by using an association rule algorithm to obtain a potential threat event;

[0050] S300: judging a potential threat event based on a set threshold, and if it is judged to trigger a policy rule, retrieving a corresponding handling policy from a policy knowledge base;

[0051] S400: issuing corresponding instructions based on the disposal strategy and linking corresponding equipment to query.

[0052] It should be noted that the security architectures of the Internet region and management information region in the power industry are currently converging, and the attack threats they face and the methods of dealing with them are also highly similar. At this stage, the security threat handling of the two major regions is carried out independently, and the threats between regions and domains cannot be handled in parallel. It is necessary to manually log in to the device / system one by one to execute instructions and verify the execution results, which takes up a lot of human resources.

[0053] Therefore, a linkage disposal method for multi-source heterogeneous security devices is proposed. The security data such as the alarm logs of multi-source heterogeneous security devices from different devices are combined to mine association rules using the association rule algorithm. Potential threat events are obtained based on the mined association rules, and linkage disposal strategies are automatically generated effectively, accurately and in real time.

[0054] In the embodiment of the present application, the implementation step of acquiring the security data of the heterogeneous security device in the above step S100 is A1:

[0055] In A1, security data is accessed through a preset data access interface, which includes: data fields, data transmission encryption method and authentication method between security equipment and linkage disposal system during data reporting.

[0056] Optionally, the data field may include one or more basic fields (system name, log type, alarm type, alarm time, victim IP) and extended fields (alarm level, compromise status, attacking IP, attack chain stage, certainty, terminal unique device number, terminal MAC address, source IP, source port, target IP, target port, application layer protocol, deduplication string, first alarm time, last alarm time, merged alarm number, merge period, IOC, domain name, domain name MD5, file name, file MD5, attacking organization, whether it is a WEB attack).

[0057] It should be understood that data can be sent via Syslog, Kafka, APT, etc.

[0058] In the embodiments of the present application, Figure 2 As shown, the preprocessing in the above step S100 includes the following steps B1-B5:

[0059] B1: Input security data;

[0060] B2: Extract data attribute information;

[0061] B3: Filter attribute information based on priority and key field filtering rules;

[0062] B4: If the attribute information successfully matches the filtering rule, the corresponding attribute information is deleted;

[0063] B5: If the attribute information fails to match the filtering rule, the security data is saved for normalization to obtain the first security data.

[0064] It should be noted that data sources are multi-source, heterogeneous, heterogeneous, and redundant. Direct data feature extraction will bring more negative impacts. Therefore, it is very necessary to pre-process the original data by filtering and normalizing the data.

[0065] Data filtering refers to filtering data according to filtering rules. The above filtering rules mainly include two aspects:

[0066] (1) Priority-based filtering in step B3:

[0067] The PRI (priority) value shows the importance of the event. Some urgent events need to be handled with priority.

[0068] Exemplarily, the PRI value of the event is read and compared with a preset threshold value k. If PRI>k, it means that the data needs to be processed immediately and is retained, otherwise it is deleted.

[0069] (2) Filtering based on key fields in step B3:

[0070] In an practicable manner, the preprocessing in the above step S100 can be implemented by ignoring. Some security events have incomplete key fields, which are useless for our subsequent processing and analysis, and are directly deleted. For example, security event information with an empty log type has no research value and should be deleted. In addition, events with obvious error information are deleted.

[0071] For example, the number of each part of the IP address is an integer between 0 and 255. If the value of this attribute of a security event is not in this range, it is obviously erroneous data and is filtered out.

[0072] In another feasible way, it is realized by filling in. When the missing attributes of an event record are few and not very important, the field value of this attribute can be filled by using linear prediction, global constant, and average value of local attributes.

[0073] In an implementable manner, data normalization can normalize the collected multi-source heterogeneous data into a prescribed format through a defined heterogeneous security device standard integration specification.

[0074] In the embodiments of the present application, Figure 3 As shown, in the above step S200, the first security data is processed by an association rule algorithm to obtain a potential threat event, including the following steps C1-C5:

[0075] C1: Traverse the first security data transaction item subset through the improved Apriori algorithm and iteratively generate the security data transaction candidate item set, i.e., k-item set;

[0076] Exemplarily, the first security data transaction items may be as shown in Table 1-Table 2:

[0077] Table 1: First security data transaction items

[0078]

[0079] Table 2: Specific transaction records of A, B, C, and D

[0080]

[0081]

[0082] C2: For each security data transaction candidate item set, the transaction candidate item set that meets the minimum support threshold is taken as the security data transaction frequent item set, denoted as L k ;

[0083] C3: For each security data transaction frequent itemset L k , generate all possible non-empty subsets of it as the antecedents of the association rules;

[0084] C4: For each antecedent of the association rule, select the association rules that meet the requirements according to the minimum threshold setting of the rule parameters and output them;

[0085] Specifically, the rule parameters may be interest level, improvement level, or confidence level, etc.

[0086] The formula for interest is:

[0087]

[0088] It should be noted that the interest degree determines whether there is a non-random association between the premise and the result of the rule in the data sample. Interest(X->Y)≥1 indicates that there is a positive association between the premise and the result of the rule, that is, X in the rule has a positive impact on Y.

[0089] For example, if transaction X is the discovery of multiple devices accessing sensitive data at night, and transaction Y is a potential data leak, then if the interest calculation result is > 1, it means that there is a positive correlation between the two.

[0090] The formula for lift is:

[0091]

[0092] Among them, X and Y are disjoint non-empty sets, Support(X→Y) is the support, Support(X→Y)=P(X∩Y)=P(XY), Confidence(X→Y) is the confidence, Confidence(X→Y)=P(Y|X).

[0093] It should also be noted that the measure of the probability of the result Y in the rule under the condition of the presence of premise X is the degree of improvement compared to the probability of Y appearing independently in the data set. A lift greater than 1 means that the appearance of the association rule increases the probability of the result, and a lift equal to 1 means that the two are unrelated.

[0094] C5: Identify potential threat events based on association rules.

[0095] It should be noted that the data is stored in the form of transaction databases or tables, and the data is mined for association rules using algorithms (data mining process, from data to knowledge) to obtain a series of rules, such as:

[0096] ① A certain IP frequently accesses in a specific time period, and a certain IP frequently fails to log in but frequently attempts --> abnormal login;

[0097] ② Frequent access to sensitive data during abnormal periods of time -> potential data leakage;

[0098] ③A large number of abnormal data packets flow to unknown IPs → potential DDoS attacks. These association rules indicate that the system is under threat.

[0099] By way of example, by combining the above Table 1 and Table 2 and mining through steps C1-C5, the following association rules can be found:

[0100] {B}→{C} (support: 4 / 5, confidence: 4 / 4=1.0, interest: 1 / 5, lift: 1)

[0101] {A,D}→{C}(Support: 3 / 5, Confidence: 3 / 3=1.0, Interest: 2 / 5, Lift: 1)

[0102] It should be noted that, if we only look at the support and confidence, the association rule {B}→{C} meets the requirements better, but combined with the interest and lift, {A,D}→{C} also meets the requirements. The algorithm in this paper can ensure that infrequently occurring rules are not ignored, and the obtained association rules are more comprehensive.

[0103] In another practicable manner, the association rule algorithm in the above step S300 may also be performed by a conventional Apriori algorithm.

[0104] It should be understood that the conventional Apriori algorithm is based on the confidence and support framework, and focuses on the frequency and accuracy of rules, but may ignore the distribution of rules in the data set. This may cause some rules that frequently appear in a specific subset to be ignored, so interest and lift are introduced to overcome this defect.

[0105] In the embodiments of the present application, Figure 4 As shown, the potential threat event is judged based on the set threshold in the above step S300, which specifically includes the following steps D1-D2:

[0106] D1: Classify potential threat events into different levels, and different levels of events correspond to different threshold ranges of association rule parameters;

[0107] Exemplarily, threat events are divided into low threat level, medium threat level and high threat level. The confidence, support, interest and promotion values ​​of the association rules corresponding to low threat events are lower, while the values ​​corresponding to medium threat level and high threat level are higher.

[0108] D2: If the corresponding association rule parameter value exceeds the set threshold, the corresponding level event triggers the corresponding policy rule.

[0109] In the embodiment of the present application, the potential threat event is judged in the above step S300, and step D3 may also be included:

[0110] D3: If the corresponding association rule parameter does not exceed the set threshold, the corresponding level event will be transferred to the manual judgment project.

[0111] For example, if the confidence, support, interest and promotion values ​​of the association rules corresponding to the low threat level are between 0 and 0.2, the value is considered low, and the policy rule is not triggered first, and it is left to manual judgment to avoid missing threat events. If the value of the medium threat level and the high threat level is greater than 0.2, the policy rule is directly triggered.

[0112] Different threat events trigger different policy rules, and relevant disposal policies are retrieved from the policy knowledge base according to the policy rules;

[0113] For example, if a threat event occurs in which an email contains illegal information, the corresponding policy rule is illegal email information injection, and the retrieved disposal policy is to prohibit email reception and open the antivirus port;

[0114] For example, when a DDoS attack threat event occurs, the corresponding policy rule is DDoS attack, and the retrieved disposal policy is to enable the anti-DDoS attack module.

[0115] In the embodiment of the present application, in the above step S400, corresponding instructions are issued based on the disposal strategy, and the corresponding device query is linked. Specifically:

[0116] According to the strategy, the standard event handling interface is used to issue instructions and query linkage devices. Instruction issuance refers to the issuance of security protection disposal instructions based on the results of data integration and correlation analysis through the API interface that adapts to the corresponding security device type. Linkage device query refers to querying the task status of the handled security device or checking the dynamic information of the relevant security device through the API interface that adapts to the corresponding security device type, so as to verify whether the security device has completed the issued instruction action.

[0117] In one practicable manner, the instruction may be called via RESTful, HTTP or HTTPS.

[0118] In an implementable manner, the security device implements access authentication, task execution, and result status query according to the issued instructions, and the specific implementation methods of access authentication, task execution, and result status query are different for different types of security devices.

[0119] Optionally, if the security device is a terminal management device, access authentication should support obtaining an authentication token through an interface based on a username / password; task execution should at least support blacklist settings, whitelist settings, terminal isolation, cancellation of terminal isolation, process isolation, etc.; result status query should at least support querying terminal information, querying process information, and querying policy information.

[0120] Optionally, if the security device is a network management and control security device, access authentication should support obtaining an authentication token through an interface based on a username / password; task execution should at least support network blocking instructions based on IP, port, domain name, URL, terminal ID, MAC address, etc., support issuing network access policy instructions based on IP, port, domain name, URL, terminal ID, MAC address, etc., and support reclaiming network access policy instructions based on IP, port, domain name, URL, terminal ID, MAC address, etc.

[0121] Optionally, if the security device is a status scanning device, access authentication should support obtaining the authentication token through the interface based on the username / password; task execution should at least support terminal full disk scanning, terminal vulnerability scanning, and terminal configuration baseline scanning; result status query should at least support full disk scanning result query, vulnerability scanning result query, and configuration baseline scanning result query.

[0122] The above is a schematic scheme of a linkage disposal method for multi-source heterogeneous security devices in this embodiment. It should be noted that the technical solution of the linkage disposal system for multi-source heterogeneous security devices and the technical solution of the linkage disposal method for multi-source heterogeneous security devices described above belong to the same concept. For details not described in detail in the technical solution of the linkage disposal system for multi-source heterogeneous security devices in this embodiment, please refer to the description of the technical solution of the linkage disposal method for multi-source heterogeneous security devices described above.

[0123] The linkage handling system for multi-source heterogeneous security devices in this embodiment includes:

[0124] An acquisition module, used for acquiring security data of heterogeneous security devices, and obtaining first security data after preprocessing;

[0125] A processing module, used to process the first security data through an association rule algorithm to obtain potential threat events;

[0126] A judgment module is used to judge potential threat events based on a set threshold. If it is judged to trigger a policy rule, the corresponding disposal policy is retrieved from the policy knowledge base;

[0127] The linkage module is used to issue corresponding instructions based on the disposal strategy and to link the corresponding equipment query.

[0128] The judgment module includes:

[0129] A classification module is used to classify potential threat events into different levels, and different levels of events correspond to different threshold intervals of association rule parameters;

[0130] The first judgment module is used to trigger the corresponding policy rule when the corresponding level event exceeds the set threshold value;

[0131] The second judgment module is used to transfer the corresponding level event to the manual judgment project if the corresponding association rule parameter does not exceed the set threshold.

[0132] This embodiment further provides a computing device, which is applicable to the case of linkage processing for multi-source heterogeneous security devices, including:

[0133] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the linkage disposal method for multi-source heterogeneous security devices proposed in the above embodiment.

[0134] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the linkage processing method for multi-source heterogeneous security devices proposed in the above embodiment is implemented.

[0135] The storage medium proposed in this embodiment and the linkage disposal method for multi-source heterogeneous security devices proposed in the above embodiment belong to the same inventive concept. The technical details not described in detail in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0136] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ReadOnly, Memory, ROM), random access memory (Random Access Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform the methods of various embodiments of the present invention.

[0137] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A linkage processing method for multi-source heterogeneous security devices, characterized in that: include: Acquire security data of heterogeneous security devices and obtain first security data after preprocessing; Processing the first security data through an association rule algorithm to obtain potential threat events; The potential threat event is judged based on the set threshold, and if it is judged to trigger the policy rule, the corresponding disposal policy is retrieved from the policy knowledge base; Issue corresponding instructions based on the disposal strategy and link corresponding equipment queries.

2. The linkage processing method for multi-source heterogeneous security devices according to claim 1, characterized in that: The preprocessing includes filtering the data, specifically including: Input the security data and extract data attribute information; Filtering the attribute information based on the filtering rules of the priority and key fields, wherein the filtering includes deleting the corresponding attribute information if the attribute information successfully matches the filtering rules; If the attribute information fails to match the filtering rule, the security data is saved for normalization to obtain the first security data.

3. The linkage processing method for multi-source heterogeneous security devices according to claim 2, characterized in that: The first security data is processed through the association rule algorithm to obtain potential threat events, including: The first security data transaction item subset is traversed through the improved Apriori algorithm, and the security data transaction candidate item set is iteratively generated; For each security data transaction candidate item set, the transaction candidate item set that meets the minimum support threshold is used as the security data transaction frequent item set; For each security data transaction frequent itemset, generate all possible non-empty subsets as the antecedents of the association rule; For each association rule's antecedent, select and output the association rules that meet the requirements based on the minimum threshold of the rule parameters; Identify potential threat events based on correlation rules.

4. The linkage processing method for multi-source heterogeneous security devices according to claim 3, characterized in that: The potential threat event is judged, specifically including: Classify potential threat events into different levels, and events of different levels correspond to different threshold ranges of association rule parameters; If the corresponding association rule parameter value exceeds the set threshold, the corresponding level event triggers the corresponding policy rule.

5. The linkage processing method for multi-source heterogeneous security devices according to claim 4, characterized in that: If the corresponding association rule parameter does not exceed the set threshold, the corresponding level event will be transferred to the manual judgment project.

6. The linkage processing method for multi-source heterogeneous security devices according to claim 1 or 5, characterized in that: The acquisition of security data of heterogeneous security devices is performed through a preset data access interface, and the data access interface includes: a data field, a data transmission encryption method and an authentication method between the security device and the linkage disposal system during data reporting.

7. A system using the linkage processing method for multi-source heterogeneous security devices as described in any one of claims 1 to 6, characterized in that: include: An acquisition module, used for acquiring security data of heterogeneous security devices, and obtaining first security data after preprocessing; A processing module, used to process the first security data through an association rule algorithm to obtain potential threat events; A judgment module is used to judge the potential threat event based on a set threshold, and if it is judged to trigger a policy rule, retrieve a corresponding disposal policy from a policy knowledge base; The linkage module is used to issue corresponding instructions based on the disposal strategy and to link the corresponding equipment query.

8. The linkage handling system for multi-source heterogeneous security devices according to claim 7, characterized in that: The judging module comprises: A classification module is used to classify potential threat events into different levels, and different levels of events correspond to different threshold intervals of association rule parameters; The first judgment module is used to trigger the corresponding policy rule when the corresponding level event exceeds the set threshold value; The second judgment module is used to transfer the corresponding level event to the manual judgment project if the corresponding association rule parameter does not exceed the set threshold.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the linkage disposal method for multi-source heterogeneous security devices described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the linkage handling method for multi-source heterogeneous security devices as described in any one of claims 1 to 6.

Images